CN113391981A - Early warning method for monitoring index and related equipment - Google Patents
Early warning method for monitoring index and related equipment Download PDFInfo
- Publication number
- CN113391981A CN113391981A CN202110744874.8A CN202110744874A CN113391981A CN 113391981 A CN113391981 A CN 113391981A CN 202110744874 A CN202110744874 A CN 202110744874A CN 113391981 A CN113391981 A CN 113391981A
- Authority
- CN
- China
- Prior art keywords
- alarm
- monitoring index
- monitoring
- target
- unit
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 219
- 238000000034 method Methods 0.000 title claims abstract description 32
- 238000004364 calculation method Methods 0.000 claims description 10
- 238000012545 processing Methods 0.000 claims description 7
- 230000008859 change Effects 0.000 claims description 5
- 230000002159 abnormal effect Effects 0.000 abstract description 20
- 238000010586 diagram Methods 0.000 description 13
- 230000006870 function Effects 0.000 description 8
- 238000004590 computer program Methods 0.000 description 7
- 238000004458 analytical method Methods 0.000 description 6
- 238000004422 calculation algorithm Methods 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 6
- 238000013461 design Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 3
- 230000004044 response Effects 0.000 description 3
- 238000011161 development Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 239000013307 optical fiber Substances 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 230000001052 transient effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3024—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a central processing unit [CPU]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3051—Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
Abstract
The application provides an early warning method for monitoring indexes and related equipment, which can find unknown abnormal conditions of an application server in time and send out warning prompt information. The method comprises the following steps: acquiring summary performance messages corresponding to K monitoring indexes in current unit time, wherein K is an integer greater than or equal to 1; determining a baseline range corresponding to the K monitoring indexes; comparing data corresponding to a target monitoring index in the summarized performance message with a baseline range corresponding to the target monitoring index to obtain a target comparison result; obtaining historical comparison results corresponding to the target monitoring indexes in N unit time before the current unit time; and if the target comparison result and the historical comparison result accord with the preset alarm condition, outputting alarm prompt information corresponding to the target monitoring index.
Description
Technical Field
The application relates to the technical field of alarm monitoring, in particular to an early warning method for monitoring indexes and related equipment.
Background
The alarm function in the current civil aviation service monitoring refers to that when an application server in the civil aviation service monitoring is abnormal, an alarm prompt is given. The alarm function is mainly that event information of an application server is collected and then processed, an alarm rule is set according to an abnormal scene known by the application server, and when the event information meets the setting of a preset rule and generates an alarm, the alarm rule is sent to an alarm contact person which is set in advance.
With the improvement of civil aviation safety requirements and the development of big data technologies in recent years, the situation that the original rule is abnormal but not alarmed frequently occurs due to incomplete consideration of abnormal scenes, and the requirements of monitoring and analysis at present cannot be met.
Disclosure of Invention
The application provides an early warning method for monitoring indexes and related equipment, which can find the unknown abnormal condition of an application server in time and send out an alarm, and can effectively avoid the abnormal report missing condition caused by insufficient rule setting or incomplete consideration to an abnormal scene.
A first aspect of an embodiment of the present application provides an early warning method for monitoring an index, including:
acquiring summary performance messages corresponding to K monitoring indexes in current unit time, wherein K is an integer greater than or equal to 1;
determining baseline ranges corresponding to the K monitoring indexes, wherein the baseline ranges corresponding to the K monitoring indexes correspond to historical data corresponding to the K monitoring indexes;
comparing data corresponding to a target monitoring index in the summarized performance message with a baseline range corresponding to the target monitoring index to obtain a target comparison result, wherein the target monitoring index is any one of the K monitoring indexes;
obtaining historical comparison results corresponding to the target monitoring index in N unit times before the current unit time, wherein N is an integer greater than or equal to 1, and the N unit times are adjacent to the current time;
if the target comparison result and the historical comparison result accord with the preset alarm condition, alarm prompt information corresponding to the target monitoring index is output, and the preset alarm condition has an association relation with the current unit time and the N unit times.
A second aspect of the embodiments of the present application provides a monitoring index early warning device, including:
the device comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring summary performance messages corresponding to K monitoring indexes in the current unit time, and K is an integer greater than or equal to 1;
the determining unit is used for determining baseline ranges corresponding to the K monitoring indexes, and the baseline ranges corresponding to the K monitoring indexes correspond to historical data corresponding to the K monitoring indexes;
a comparison unit, configured to compare data corresponding to a target monitoring index in the summarized performance packet with a baseline range corresponding to the target monitoring index to obtain a target comparison result, where the target monitoring index is any one of the K monitoring indexes;
the obtaining unit is further configured to obtain historical comparison results corresponding to the target monitoring indicator in N unit times before the current unit time, where N is an integer greater than or equal to 1, and the N unit times are adjacent to the current time;
and the output unit is used for outputting alarm prompt information corresponding to the target monitoring index if the target comparison result and the historical comparison result accord with the preset alarm condition, wherein the preset alarm condition has an association relation with the current unit time and the N unit times.
A third aspect of the application provides a computer device comprising a memory, a processor and a bus system; wherein the memory is used for storing programs, and the bus system is used for connecting the memory and the processor so as to enable the memory and the processor to communicate; the processor is configured to execute the program in the memory, and the processor is configured to execute the steps of the method for monitoring an early warning of an indicator according to the first aspect according to instructions in the program code.
A fourth aspect of the embodiments of the present application provides a machine-readable medium, which includes instructions that, when executed on a machine, cause the machine to perform the steps of the method for monitoring an indicator in an early warning according to the first aspect.
In summary, it can be seen that, in the embodiment provided by the application, the historical data of the application server is analyzed to determine the prediction baseline range corresponding to the monitoring index, and by comparing the real-time data with the prediction baseline range, the unknown abnormal condition of the application server can be found in time, and an alarm is given, so that the abnormal report missing condition caused by insufficient rule setting or incomplete consideration of abnormal scenes can be effectively avoided.
Drawings
The above and other features, advantages and aspects of various embodiments of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numbers refer to the same or similar elements. It should be understood that the drawings are schematic and that elements and features are not necessarily drawn to scale.
Fig. 1 is an architecture diagram of a monitoring index early warning system provided in an embodiment of the present application;
fig. 2 is a schematic flow chart of an early warning method for monitoring an index according to an embodiment of the present disclosure;
fig. 3 is a schematic structural diagram of a monitoring index early warning device provided in an embodiment of the present application;
FIG. 4 is a schematic structural diagram of a machine-readable medium provided by an embodiment of the present application;
fig. 5 is a schematic hardware structure diagram of a server according to an embodiment of the present application.
Detailed Description
Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present application are shown in the drawings, it should be understood that the present application may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but rather are provided for a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are for illustration purposes only and are not intended to limit the scope of the present application.
The terms "include" and variations thereof as used herein are inclusive and open-ended, i.e., "including but not limited to. The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions for other terms will be given in the following description.
It should be noted that the terms "first", "second", and the like in the present application are only used for distinguishing different devices, modules or units, and are not used for limiting the order or interdependence relationship of the functions performed by the devices, modules or units.
It is noted that references to "a", "an", and "the" modifications in this application are intended to be illustrative rather than limiting, and that those skilled in the art will recognize that reference to "one or more" unless the context clearly dictates otherwise.
Referring to fig. 1, fig. 1 is an architecture diagram of a monitoring index early warning system according to an embodiment of the present application, including:
a log collection component 100, a log analysis component 200, a monitoring alarm component 300, and a baseline prediction component 400;
the log collection component 100 is configured to obtain information such as a running log and machine performance (the machine performance includes data such as central processor data, memory data, and file space utilization rate) in a standard format through a collection program deployed on an application server, and the log collection component 100 monitors log changes of the application server for a single process deployed on each service application server, reads current log and machine performance information from a specified location of the application server according to a preconfigured service rule, and stores the current log and machine performance information in an active Message Queue (active Message Queue).
The log analysis component 200 is configured to analyze the running log collected by the log collection component 100, and includes processing units such as a message management unit, a storage unit, and a service logic unit, and the log analysis component is based on AMQ, JBOSS (an application server based on an open source code of J2EE, where J2EE is an abbreviation of Java 2Platform Enterprise Edition, and is an Enterprise-level distributed application development specification), redis (a key-value database with high performance), and DM (DM refers to a database with high performance, and is a high-performance database management system) environment. The message management unit is used for managing reading of data in the AMQ message queue and temporarily storing the AMQ message queue to redis, the service logic unit is used for setting and managing alarm rules and storing the data in the redis to a DM database at regular time, and the storage unit is a DM database and is used for storing a large amount of historical data, alarm rules and other information.
The monitoring alarm component 300 is configured to set an alarm rule according to the business rule, continuously monitor the real-time data of the application server, compare the real-time data with the baseline to obtain a comparison result, determine the variation range of the real-time data of the application server compared with the historical data, perform summary calculation on the result, and determine whether the calculation result meets the alarm rule. And if the preset alarm rule is met, calling an external alarm interface to alarm.
The baseline prediction component 400 is used for generating a prediction baseline according to the historical data of the application server and storing the prediction baseline in the redis, extracting the historical data through the log analysis component 200, performing analysis prediction, generating a baseline, and storing the baseline in the redis and DM database.
In the embodiment provided by the application, the historical data of the application server is analyzed to determine the prediction baseline range corresponding to the monitoring index, and by comparing the real-time data with the prediction baseline range, the unknown abnormal condition of the application server can be discovered earlier, an alarm is given, and the abnormal report missing condition caused by insufficient rule setting or incomplete consideration of abnormal scenes can be effectively avoided.
Referring to fig. 2, the method for warning a monitoring index provided in the present application is described from the perspective of a monitoring index warning device, where fig. 2 is a schematic flow diagram of the method for warning a monitoring index provided in an embodiment of the present application, and includes:
201. and acquiring the summary performance messages corresponding to the K monitoring indexes in the current unit time.
In this embodiment, the monitoring index early warning device may obtain summary performance messages corresponding to K monitoring indexes in the current unit time. Specifically, the method comprises the following steps:
the monitoring index early warning device can acquire information such as an application running log and machine performance in a standard format corresponding to K monitoring indexes through a collection program deployed on an application server, wherein the format of the application log is as follows:
[#％&*^]20201211000000:173.tr730c27-sih！SIH:bbfc.137544，140080448263968#NA％NA&NA*NA^:RUNNING>AppName＝BRIDGE_1，10.5.72.214；RecvTps＝0.00；SendTps＝127.48；RecvAvMsgLen＝0；SendAvMsgLen＝1；
[#％&*^]20201211000000:173.tr730c27-sih！SIH:bbfc.137544，140080448263968#NA％NA&NA*NA^:RUNNING>AppName＝BRIDGE_1，10.5.72.220；RecvTps＝512.47；SendTps＝0.00；RecvAvMsgLen＝1；SendAvMsgLen＝0；
[#％&*^]20201211000000:173.tr730c27-sih！SIH:bbfc.137544，140080448263968#NA％NA&NA*NA^:RUNNING>AppName＝BRIDGE_1，10.6.99.47；RecvTps＝0.00；SendTps＝0.00；RecvAvMsgLen＝0；SendAvMsgLen＝0；
after obtaining the running log and the machine performance and other information, the monitoring index early warning device may convert the running log into an Extensible Markup Language (XML) format message, and send the XML format message to the AMQ, where the XML format of the running log is as follows:
<response><head><transactionid>0000000000</transactionid><version>3.0</version><type>performance</type><app>TAM</app><source>TAM</source><target>TAM</target><time>2020-12-111224:12:540</time></head><body><ip>10.225.9.88</ip><hostname>localhost</hostname><performances><performance><services><service><name>DoTask</name><art>1</art></service></services><type>request</type><tps_total>0</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>Event2AlarmTask</name><art>1</art></service></services><type>request</type><tps_total>0</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>TlhMonitorTimeTask</name><art>1</art></service></services><type>request</type><tps_total>0</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>CheckAgentStatusTask</name><art>1</art></service></services><type>request</type><tps_total>0</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>manageMsg</name><art>1</art></service></services><type>request</type><tps_total>0</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>statisticMsg</name><art>1</art></service></services><type>request</type><tps_total>0</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>pseudoMsg</name><art>1</art></service></services><type>request</type><tps_total>0</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>defaultMsg</name><art>2</art></service></services><type>request</type><tps_total>1</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance><performance><services><service><name>MQTimerTask</name><art>1</art></service></services><type>request</type><tps_total>1</tps_total><tps_fail>0</tps_fail><tps_timeout>0</tps_timeout></performance></performances></body></response>
the monitoring index early warning device can collect messages in an XML format, collect performance messages under the same application, IP address and service in the current unit time (for example, the current 1 minute), and obtain collected performance messages corresponding to K monitoring indexes. It is understood that the K monitoring metrics include, but are not limited to, number of query Transactions Per Second (TPS), Average transaction response time (ART), memory, and file space usage.
It should be noted that, after acquiring the summary performance packets corresponding to the K monitoring indexes, the monitoring index early warning device may store the summary performance packets corresponding to the K monitoring indexes into the redis for subsequent use. In addition, when K monitoring indexes are determined, the K monitoring indexes can be further processed.
202. And determining the baseline range corresponding to the K monitoring indexes.
In this embodiment, the monitoring index early warning device may determine baseline ranges corresponding to the K monitoring indexes, where the baseline ranges corresponding to the K monitoring indexes correspond to historical data corresponding to the K monitoring indexes. The following describes a determination manner for determining a baseline range corresponding to each of the K monitoring indexes:
the monitoring index early warning device can firstly determine a baseline calculation rule corresponding to each monitoring index in the K monitoring indexes, acquire historical summarized data corresponding to each monitoring index in the K monitoring indexes from a database according to the baseline calculation rule, and determine the corresponding monitoring index in the K monitoring indexes according to the historical summarized data.
That is, the monitoring index early warning device may obtain corresponding historical summarized data from the database according to the indexes such as the application, the IP, and the service name in the baseline rule, and each index may take out data of a month (for example, if K monitoring indexes to be monitored are monitoring indexes corresponding to a certain application, historical summarized data of the application in a month in the past are obtained from the database, and of course, the historical summarized data may also be monitoring indexes corresponding to a certain IP, monitoring indexes corresponding to a certain service, or a certain service under a certain IP, or historical data within 2 months and 15 days, which is not specifically limited).
The monitoring index early warning device can select a baseline learning algorithm, processes historical summarized data based on the baseline learning algorithm to obtain a baseline range corresponding to each monitoring index in the K monitoring indexes, and stores the baseline range into the redis for subsequent warning.
The baseline learning algorithm may be, for example, a prophet baseline algorithm or a triple mean algorithm, or may be another baseline learning algorithm, and is not particularly limited. In addition, the use duration of the baseline range in the redis can be set, and the use duration is automatically deleted after expiration, so that the data burden of the redis is relieved.
It should be noted that, the summarized performance packet corresponding to the K monitoring indexes may be obtained through step 201, and the baseline range corresponding to the K monitoring indexes may be determined through step 202, however, there is no sequential execution order limitation between the two steps, and step 201 may be executed first, or step 202 may be executed first, or executed simultaneously, which is not limited specifically.
203. And comparing the data corresponding to the target monitoring index in the summarized performance message with the baseline range corresponding to the target monitoring index to obtain a target comparison result.
In this embodiment, after obtaining the summary performance packet and the baseline range corresponding to the K monitoring indicators, the monitoring indicator early warning device may compare data corresponding to a target monitoring indicator in the summary performance packet with the baseline range corresponding to the target monitoring indicator to obtain a target comparison result, where the target monitoring indicator is any one of the K monitoring indicators, for example, the target monitoring indicator may be ART, compare data of ART in the current unit time with the baseline range of ART, and determine the number of times that ART exceeds the baseline range of ART in the unit time, where the number of times is the target comparison result.
204. And acquiring historical comparison results corresponding to the target monitoring indexes in N unit time before the current unit time.
In this embodiment, the monitoring index early warning device may obtain historical comparison results corresponding to N unit times before the current unit time, where N is an integer greater than or equal to 1, that is, the monitoring index early warning device may obtain parameters of the target monitoring index within the past N minutes and compare the parameters with a baseline range corresponding to the target monitoring index, determine the number of times that the target monitoring index exceeds the baseline range within the N minutes, and determine the number of times that the target monitoring index exceeds the baseline range within the N minutes as the historical comparison results.
It should be noted that the execution order of step 204 is not specifically limited, as long as it is executed before step 205.
205. And if the target comparison result and the historical comparison result accord with preset alarm conditions, outputting alarm prompt information corresponding to the target monitoring index.
In this embodiment, the monitoring index early warning device may determine whether the target comparison result and the historical comparison result meet a preset alarm condition, that is, determine the number of times that the target monitoring index exceeds the baseline range in the past several minutes and the current minute, that is, determine the number of times that the target monitoring index exceeds the baseline range in the past several minutes and the number of times that the target monitoring index exceeds the baseline range in the current minute are added, so as to obtain the total number of times, and then compare the total number of times with the preset alarm condition, where the preset alarm condition is a situation that the target monitoring index exceeds the baseline range several times in several minutes, where the value of N may be set according to the preset alarm condition, for example, if the preset alarm condition is a situation that 20 times of exceeding the baseline range occurs in 5 minutes, N is set to 4. And if the target comparison result and the historical comparison result accord with preset alarm conditions, outputting alarm prompt information corresponding to the target monitoring index. For example, the alarm prompt message is sent to the administrator to prompt the administrator to perform the treatment in time.
It should be noted that, when determining that the target comparison result and the historical comparison result meet the preset alarm condition, the monitoring index early warning device may output only a first alarm message within a period of time in order to avoid multiple alarms for the same monitoring index, specifically, may determine whether the alarm corresponding to the target monitoring index is a first alarm, if the alarm corresponding to the target monitoring index is a first alarm, output an alarm prompt message corresponding to the target monitoring index, if the alarm corresponding to the target monitoring index is not a first alarm, indicate that the alarm prompt message corresponding to the target monitoring index has been previously prompted, and after waiting for a period of time, if the alarm prompt message corresponding to the target monitoring index is still unprocessed, output the alarm prompt message corresponding to the target monitoring index again.
In an embodiment, after obtaining the historical comparison results corresponding to N unit times before the current unit time, the monitoring index early warning apparatus further performs the following operations:
determining the current unit time and the variation trend of data corresponding to the target monitoring index in P unit times, wherein P is an integer larger than or equal to 1, P unit times are unit times before the current unit time, and P unit times are adjacent to the current unit time;
and if the variation trend of the data corresponding to the target monitoring index meets a preset trend alarm rule, outputting alarm prompt information corresponding to the target monitoring index, wherein the preset trend alarm rule has an association relation with the current unit time and P unit times.
In this embodiment, the monitoring index early warning device may further determine a variation trend of a parameter corresponding to the target monitoring index within a period of time (current unit time and P unit times), where the variation trend refers to a change in which the parameter corresponding to the target monitoring index is in an increasing manner, for example, in a plurality of unit times, a value of the target monitoring index exceeding the baseline range each time is 5% more than a last time (of course, other values may be used, and are not limited specifically), then determine whether the variation trend meets a preset trend warning rule, if so, send a warning prompt message, where the preset trend warning rule is associated with the variation trend within P +1 unit times, for example, in P +1 unit times, a value of the target monitoring index exceeding the baseline range each time is 5% -20% more than the last time, and the number of continuous exceeding times reaches 20 times, an alarm prompt message is sent.
It should be noted that, when the alarm prompt information is output, the alarm prompt information is output when the target comparison result and the historical comparison result meet the preset alarm condition, or when the change trend of the data corresponding to the target monitoring index meets the preset trend alarm rule, the alarm prompt information may also be output when the target comparison result and the historical comparison result meet the preset alarm condition, and the change trend of the data corresponding to the target monitoring index meets the preset trend alarm rule, which is not limited specifically.
In addition, the monitoring index early warning device may further generate an alarm time message corresponding to a target monitoring index according to the alarm prompt information, and determine whether the alarm event message of the application server meets a preset associated alarm rule, where the preset associated alarm rule is that multiple different monitoring indexes of the same device alarm simultaneously, for example, multiple different monitoring indexes of the application server alarm simultaneously (when the memory usage rate alarms, ART and TPS also alarm), and then determine that the alarm time message of the application server meets the preset associated alarm rule, and then output the alarm prompt information corresponding to the application server.
In summary, it can be seen that, in the embodiment provided by the application, the historical data of the application server is analyzed to determine the prediction baseline range corresponding to the monitoring index, and by comparing the real-time data with the prediction baseline range, the unknown abnormal condition of the application server can be found early, and an alarm is given, so that the abnormal report missing condition caused by insufficient rule setting or incomplete consideration of abnormal scenes can be effectively avoided.
It is to be understood that the flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The names of messages or information exchanged between a plurality of devices in the embodiments of the present application are for illustrative purposes only, and are not intended to limit the scope of the messages or information.
Although the operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous.
It should be understood that the various steps recited in the method embodiments of the present application may be performed in a different order and/or in parallel. Moreover, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present application is not limited in this respect.
Additionally, the present application may also be written with computer program code for performing the operations of the present application in one or more programming languages, including, but not limited to, an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).
The embodiment of the present application is described above from the perspective of a method for warning a monitoring index, and the embodiment of the present application is described below from the perspective of a device for warning a monitoring index.
Referring to fig. 3, fig. 3 is a virtual structure of a monitoring index early warning apparatus according to an embodiment of the present disclosure, where the monitoring index early warning apparatus 300 includes:
an obtaining unit 301, configured to obtain summarized performance packets corresponding to K monitoring indexes in a current unit time, where K is an integer greater than or equal to 1;
a determining unit 302, configured to determine baseline ranges corresponding to the K monitoring indexes, where the baseline ranges corresponding to the K monitoring indexes correspond to historical data corresponding to the K monitoring indexes;
a comparing unit 303, configured to compare data corresponding to a target monitoring index in the summarized performance packet with a baseline range corresponding to the target monitoring index, to obtain a target comparison result, where the target monitoring index is any one monitoring index of the K monitoring indexes;
the obtaining unit 301 is further configured to obtain historical comparison results corresponding to the target monitoring indicator in N unit times before the current unit time, where N is an integer greater than or equal to 1, and the N unit times are adjacent to the current time;
an output unit 304, configured to output an alarm prompt message corresponding to the target monitoring indicator if the target comparison result and the historical comparison result meet the preset alarm condition, where the preset alarm condition has an association relationship with the current unit time and the N unit times.
In a possible design, the determining unit 302 is further configured to determine a trend of change of data corresponding to the target monitoring indicator in the current unit time and P unit times, where P is an integer greater than or equal to 1, P unit times are unit times before the current unit time, and P unit times are adjacent to the current time;
the output unit 304 is further configured to output alarm prompt information corresponding to the target monitoring index if a variation trend of the data corresponding to the target monitoring index meets a preset trend alarm rule, where the preset trend alarm rule has an association relationship with the current unit time and the P unit times.
In one possible design, the determining unit 302 is specifically configured to:
determining a baseline calculation rule corresponding to each monitoring index in the K monitoring indexes;
acquiring historical summarized data corresponding to each monitoring index in the K monitoring indexes from a database according to the baseline calculation rule;
and determining a baseline range corresponding to each monitoring index in the K monitoring indexes according to the historical summarized data.
In one possible design, the output unit 304 is specifically configured to:
judging whether the alarm corresponding to the target monitoring index is a first alarm or not;
if the alarm corresponding to the target monitoring index is the first alarm, outputting alarm prompt information corresponding to the target monitoring index;
and if the alarm corresponding to the target monitoring index is not the first alarm, outputting alarm prompt information corresponding to the target monitoring index after a preset alarm interval.
In one possible design, the output unit 304 is further configured to:
generating an alarm event message corresponding to the target monitoring index according to the alarm prompt information;
judging whether the alarm event message of the application server accords with a preset associated alarm rule, wherein the preset associated alarm rule is that a plurality of different monitoring indexes of the same equipment alarm simultaneously;
and if the alarm event message of the application server accords with the preset associated alarm rule, outputting alarm prompt information corresponding to the application server.
In summary, it can be seen that, in the embodiment provided by the application, the historical data of the application server is analyzed to determine the prediction baseline range corresponding to the monitoring index, and by comparing the real-time data with the prediction baseline range, the unknown abnormal condition of the application server can be found in time, and an alarm is given, so that the abnormal report missing condition caused by insufficient rule setting or incomplete consideration of abnormal scenes can be effectively avoided.
It should be noted that the units described in the embodiments of the present application may be implemented by software, and may also be implemented by hardware. Here, the name of the unit does not constitute a limitation of the unit itself in some cases, and for example, the acquisition unit may also be described as "a unit that acquires credential information of a target user".
The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), systems on a chip (SOCs), Complex Programmable Logic Devices (CPLDs), and the like.
Referring to fig. 4, fig. 4 is a schematic diagram of an embodiment of a machine-readable medium according to the present disclosure.
As shown in fig. 4, the present embodiment provides a machine-readable medium 400, on which a computer program 411 is stored, and when the computer program 411 is executed by a processor, the steps of the method for monitoring the early warning of the index in fig. 2 are implemented.
In the context of this application, a machine-readable medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
It should be noted that the machine-readable medium described above in this application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.
The computer readable medium may be embodied in the electronic device; or may exist separately without being assembled into the electronic device.
Referring to fig. 5, fig. 5 is a schematic diagram of a hardware structure of a server according to an embodiment of the present disclosure, where the server 500 may have a relatively large difference due to different configurations or performances, and may include one or more Central Processing Units (CPUs) 522 (e.g., one or more processors) and a memory 532, and one or more storage media 530 (e.g., one or more mass storage devices) storing applications 542 or data 544. Memory 532 and storage media 530 may be, among other things, transient storage or persistent storage. The program stored on the storage medium 530 may include one or more modules (not shown), each of which may include a series of instruction operations for the server. Still further, the central processor 522 may be configured to communicate with the storage medium 530, and execute a series of instruction operations in the storage medium 530 on the server 500.
The server 500 may also include one or more power supplies 526, one or more wired or wireless network interfaces 550, one or more input-output interfaces 558, and/or one or more operating systems 541, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, and so forth.
The steps performed by the monitoring index warning apparatus in the above embodiment may be based on the server structure shown in fig. 5.
It should be further noted that, according to the embodiment of the present application, the process of the method for monitoring an early warning of an index described in the flowchart of fig. 2 may be implemented as a computer software program. For example, embodiments of the present application include a computer program product comprising a computer program carried on a non-transitory computer readable medium, the computer program containing program code for performing the method illustrated in the flow chart diagram of fig. 2 described above.
Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.
While several specific implementation details are included in the above discussion, these should not be construed as limitations on the scope of the application. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.
The above description is only a preferred embodiment of the application and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the disclosure herein is not limited to the particular combination of features described above, but also encompasses other arrangements formed by any combination of the above features or their equivalents without departing from the spirit of the disclosure. For example, the above features may be replaced with (but not limited to) features having similar functions disclosed in the present application.
Claims (10)
1. An early warning method for monitoring indexes is characterized by comprising the following steps:
acquiring summary performance messages corresponding to K monitoring indexes in current unit time, wherein K is an integer greater than or equal to 1;
determining baseline ranges corresponding to the K monitoring indexes, wherein the baseline ranges corresponding to the K monitoring indexes correspond to historical data corresponding to the K monitoring indexes;
comparing data corresponding to a target monitoring index in the summarized performance message with a baseline range corresponding to the target monitoring index to obtain a target comparison result, wherein the target monitoring index is any one of the K monitoring indexes;
obtaining historical comparison results corresponding to the target monitoring index in N unit times before the current unit time, wherein N is an integer greater than or equal to 1, and the N unit times are adjacent to the current time;
if the target comparison result and the historical comparison result accord with the preset alarm condition, alarm prompt information corresponding to the target monitoring index is output, and the preset alarm condition has an association relation with the current unit time and the N unit times.
2. The warning method according to claim 1, wherein after obtaining the historical comparison results corresponding to N unit times before the current unit time, the method further comprises:
determining the current unit time and the variation trend of data corresponding to the target monitoring index in P unit times, wherein P is an integer greater than or equal to 1, the P unit times are unit times before the current unit time, and the P unit times are adjacent to the current time;
and if the variation trend of the data corresponding to the target monitoring index meets a preset trend alarm rule, outputting alarm prompt information corresponding to the target monitoring index, wherein the preset trend alarm rule has an association relation with the current unit time and the P unit times.
3. The warning method according to claim 1, wherein the determining the baseline range corresponding to the K monitoring indicators comprises:
determining a baseline calculation rule corresponding to each monitoring index in the K monitoring indexes;
acquiring historical summarized data corresponding to each monitoring index in the K monitoring indexes from a database according to the baseline calculation rule;
and determining a baseline range corresponding to each monitoring index in the K monitoring indexes according to the historical summarized data.
4. The early warning method according to any one of claims 1 to 3, wherein the outputting of the warning prompt information corresponding to the target monitoring index includes:
judging whether the alarm corresponding to the target monitoring index is a first alarm or not;
if the alarm corresponding to the target monitoring index is the first alarm, outputting alarm prompt information corresponding to the target monitoring index;
and if the alarm corresponding to the target monitoring index is not the first alarm, outputting alarm prompt information corresponding to the target monitoring index after a preset alarm interval.
5. The warning method according to any one of claims 1 to 3, wherein the method further comprises:
generating an alarm event message corresponding to the target monitoring index according to the alarm prompt information;
judging whether the alarm event message of the application server accords with a preset associated alarm rule, wherein the preset associated alarm rule is that a plurality of different monitoring indexes of the same equipment alarm simultaneously;
and if the alarm event message of the application server accords with the preset associated alarm rule, outputting alarm prompt information corresponding to the application server.
6. A monitoring index early warning device is characterized by comprising:
the device comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring summary performance messages corresponding to K monitoring indexes in the current unit time, and K is an integer greater than or equal to 1;
the determining unit is used for determining baseline ranges corresponding to the K monitoring indexes, and the baseline ranges corresponding to the K monitoring indexes correspond to historical data corresponding to the K monitoring indexes;
a comparison unit, configured to compare data corresponding to a target monitoring index in the summarized performance packet with a baseline range corresponding to the target monitoring index to obtain a target comparison result, where the target monitoring index is any one of the K monitoring indexes;
the obtaining unit is further configured to obtain historical comparison results corresponding to the target monitoring indicator in N unit times before the current unit time, where N is an integer greater than or equal to 1, and the N unit times are adjacent to the current time;
and the output unit is used for outputting alarm prompt information corresponding to the target monitoring index if the target comparison result and the historical comparison result accord with the preset alarm condition, wherein the preset alarm condition has an association relation with the current unit time and the N unit times.
7. The apparatus of claim 6,
the determining unit is further configured to determine a change trend of data corresponding to the target monitoring indicator in the current unit time and P unit times, where P is an integer greater than or equal to 1, the P unit times are unit times before the current unit time, and the P unit times are adjacent to the current time;
the output unit is further configured to output alarm prompt information corresponding to the target monitoring index if a variation trend of data corresponding to the target monitoring index meets a preset trend alarm rule, where the preset trend alarm rule has an association relationship with the current unit time and the P unit times.
8. The apparatus according to claim 6, wherein the determining unit is specifically configured to:
determining a baseline calculation rule corresponding to each monitoring index in the K monitoring indexes;
acquiring historical summarized data corresponding to each monitoring index in the K monitoring indexes from a database according to the baseline calculation rule;
and determining a baseline range corresponding to each monitoring index in the K monitoring indexes according to the historical summarized data.
9. A computer device, comprising:
a memory, a processor, and a bus system;
wherein the memory is used for storing programs, and the bus system is used for connecting the memory and the processor so as to enable the memory and the processor to communicate;
the processor is configured to execute a program in the memory, and the processor is configured to execute the warning method according to any one of claims 1 to 5 according to instructions in the program code.
10. A machine-readable medium comprising instructions which, when executed on a machine, cause the machine to perform the warning method of any one of claims 1 to 5.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110744874.8A CN113391981A (en) | 2021-06-30 | 2021-06-30 | Early warning method for monitoring index and related equipment |
| PCT/CN2022/087285 WO2023273520A1 (en) | 2021-06-30 | 2022-04-18 | Early warning method for monitoring indicator and related device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110744874.8A CN113391981A (en) | 2021-06-30 | 2021-06-30 | Early warning method for monitoring index and related equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113391981A true CN113391981A (en) | 2021-09-14 |
Family
ID=77624938
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110744874.8A Pending CN113391981A (en) | 2021-06-30 | 2021-06-30 | Early warning method for monitoring index and related equipment |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN113391981A (en) |
| WO (1) | WO2023273520A1 (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2022105685A1 (en) * | 2020-11-17 | 2022-05-27 | 中兴通讯股份有限公司 | Memory management method and device for optical transmission device, and storage medium |
| WO2023273520A1 (en) * | 2021-06-30 | 2023-01-05 | 中国民航信息网络股份有限公司 | Early warning method for monitoring indicator and related device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103544093A (en) * | 2012-07-13 | 2014-01-29 | 深圳市快播科技有限公司 | Monitoring and alarm control method and system |
| CN110489306A (en) * | 2019-08-26 | 2019-11-22 | 北京博睿宏远数据科技股份有限公司 | A kind of alarm threshold value determines method, apparatus, computer equipment and storage medium |
| CN110661659A (en) * | 2019-09-23 | 2020-01-07 | 上海艾融软件股份有限公司 | Alarm method, device and system and electronic equipment |
| CN111639011A (en) * | 2020-06-11 | 2020-09-08 | 支付宝(杭州)信息技术有限公司 | Data monitoring method, device and equipment |
| WO2020259421A1 (en) * | 2019-06-28 | 2020-12-30 | 深圳前海微众银行股份有限公司 | Method and apparatus for monitoring service system |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP6165886B2 (en) * | 2013-02-28 | 2017-07-19 | 株式会社日立製作所 | Management system and method for dynamic storage service level monitoring |
| CN107705149A (en) * | 2017-09-22 | 2018-02-16 | 平安科技（深圳）有限公司 | Data method for real-time monitoring, device, terminal device and storage medium |
| CN108572905B (en) * | 2018-04-23 | 2021-07-23 | 中国农业银行股份有限公司 | Monitoring method and system based on distributed computation |
| CN111563022B (en) * | 2020-05-12 | 2023-09-05 | 中国民航信息网络股份有限公司 | Centralized memory monitoring method and device |
| CN112596975A (en) * | 2020-12-15 | 2021-04-02 | 中国建设银行股份有限公司 | Method, system, equipment and storage medium for monitoring network equipment |
| CN113391981A (en) * | 2021-06-30 | 2021-09-14 | 中国民航信息网络股份有限公司 | Early warning method for monitoring index and related equipment |
-
2021
- 2021-06-30 CN CN202110744874.8A patent/CN113391981A/en active Pending
-
2022
- 2022-04-18 WO PCT/CN2022/087285 patent/WO2023273520A1/en unknown
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103544093A (en) * | 2012-07-13 | 2014-01-29 | 深圳市快播科技有限公司 | Monitoring and alarm control method and system |
| WO2020259421A1 (en) * | 2019-06-28 | 2020-12-30 | 深圳前海微众银行股份有限公司 | Method and apparatus for monitoring service system |
| CN110489306A (en) * | 2019-08-26 | 2019-11-22 | 北京博睿宏远数据科技股份有限公司 | A kind of alarm threshold value determines method, apparatus, computer equipment and storage medium |
| CN110661659A (en) * | 2019-09-23 | 2020-01-07 | 上海艾融软件股份有限公司 | Alarm method, device and system and electronic equipment |
| CN111639011A (en) * | 2020-06-11 | 2020-09-08 | 支付宝(杭州)信息技术有限公司 | Data monitoring method, device and equipment |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2022105685A1 (en) * | 2020-11-17 | 2022-05-27 | 中兴通讯股份有限公司 | Memory management method and device for optical transmission device, and storage medium |
| WO2023273520A1 (en) * | 2021-06-30 | 2023-01-05 | 中国民航信息网络股份有限公司 | Early warning method for monitoring indicator and related device |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2023273520A1 (en) | 2023-01-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10558544B2 (en) | Multiple modeling paradigm for predictive analytics | |
| CN111221702B (en) | Log analysis-based exception handling method, system, terminal and medium | |
| WO2020024376A1 (en) | Method and device for processing operation and maintenance monitoring alarm | |
| WO2023273520A1 (en) | Early warning method for monitoring indicator and related device | |
| US10848839B2 (en) | Out-of-band telemetry data collection | |
| CN113225339B (en) | Network security monitoring method and device, computer equipment and storage medium | |
| CN109815085B (en) | Alarm data classification method and device, electronic equipment and storage medium | |
| CN111258847B (en) | File handle monitoring and analyzing method, device, medium and equipment | |
| CN112256548B (en) | Abnormal data monitoring method and device, server and storage medium | |
| CN110727563A (en) | Cloud service alarm method and device for preset customer | |
| CN112306700A (en) | Abnormal RPC request diagnosis method and device | |
| US11897527B2 (en) | Automated positive train control event data extraction and analysis engine and method therefor | |
| CN111427749A (en) | Monitoring tool and method for ironic service in openstack environment | |
| CN110971488A (en) | Data processing method, device, server and storage medium | |
| CN110633165B (en) | Fault processing method, device, system server and computer readable storage medium | |
| CN110851316A (en) | Abnormity early warning method, abnormity early warning device, abnormity early warning system, electronic equipment and storage medium | |
| CN111181982B (en) | Abnormal data identification method and device, computing equipment and medium | |
| CN110011845B (en) | Log collection method and system | |
| CN109388546B (en) | Method, device and system for processing faults of application program | |
| CN113760568A (en) | Data processing method and device | |
| CN113765730A (en) | Method and device for monitoring data link network | |
| CN113138872A (en) | Abnormal processing device and method for database system | |
| US11765065B1 (en) | System and method for scalable telemetry | |
| CN116225746A (en) | Method, apparatus, device, storage medium and program product for determining system problem | |
| US20230334340A1 (en) | Automated positive train control event data extraction and analysis engine for performing root cause analysis of unstructured data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |