CN115080356B - Abnormity warning method and device - Google Patents
Abnormity warning method and device Download PDFInfo
- Publication number
- CN115080356B CN115080356B CN202210856146.0A CN202210856146A CN115080356B CN 115080356 B CN115080356 B CN 115080356B CN 202210856146 A CN202210856146 A CN 202210856146A CN 115080356 B CN115080356 B CN 115080356B
- Authority
- CN
- China
- Prior art keywords
- value
- monitoring
- monitoring index
- abnormal
- curve
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/302—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Quality & Reliability (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Alarm Systems (AREA)
Abstract
The embodiment of the specification provides an abnormal alarm method and device. In the method, at each sampling period, the following steps are carried out: sampling a value of a monitoring index associated with the service application; judging whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value or not; if the number of the N arrays is larger than the preset value, obtaining N arrays; wherein, the N arrays comprise: an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and an N-1 array consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value; performing curve fitting on the N groups to obtain parameters of a fitted curve; and determining whether to carry out abnormal alarm according to the parameters of the fitted curve. The method and the device of the embodiment of the specification can improve the accuracy of abnormal alarm and avoid false alarm.
Description
Technical Field
One or more embodiments of the present specification relate to network communication technology, and more particularly, to an abnormality warning method and apparatus.
Background
With the development of the internet, a large amount of service applications appear, in order to ensure the normal operation of various service applications, the operation condition of the service applications needs to be monitored, and when the monitoring indexes are found to be abnormal, an alarm is given.
At present, the method for performing an abnormal alarm mainly includes: and in the service operation process, collecting the monitoring index, judging whether the value of the collected monitoring index is larger than a preset index threshold value, if so, determining that an abnormal symptom appears, and giving an alarm. For example, currently, a plane-oriented programming (AOP) technology is available, a plane program is injected into a service application program through a tangent point of the service application, and various functions corresponding to the service application are implemented based on a plane security technology, such as monitoring whether privacy data is leaked during the operation of the service application. And the injection of the tangent plane program may cause an exception to occur in the operation of the business application, so that an exception alarm needs to be performed.
However, in the current abnormal alarm method, when the acquired monitoring index value is greater than the index threshold value, an abnormal sign appears, which often causes erroneous judgment, and thus erroneous alarm processing is performed.
Disclosure of Invention
One or more embodiments of the present specification describe an abnormality warning method and apparatus, which can perform abnormality warning more accurately.
According to a first aspect, an abnormal alarm method is provided, wherein the method performs, at each sampling period:
sampling the value of the monitoring index;
judging whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value or not; if it is greater than the above-mentioned range,
obtaining N number groups; wherein N is an integer greater than 1, the N number groups comprising: an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and N-1 arrays consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value;
performing curve fitting on the N groups to obtain parameters of a fitted curve;
and determining whether to carry out abnormal alarm according to the parameters of the fitted curve.
Wherein the monitoring index includes any one of the following:
monitoring indexes of the injected section for the service application;
monitoring an index of a service provided for a business application;
aiming at the monitoring index of the operating system level;
monitoring indexes aiming at the JAVA virtual machine.
Wherein, the curve fitting of the N number groups to obtain the parameters of the fitted curve comprises the following steps:
performing curve fitting in an exponential function form on the N groups;
wherein the expression of the exponential function characterizing the curve is:
(ii) a Wherein y corresponds to the monitoring index value, x corresponds to the time point of the sampling period, and a and b are divided intoParameters that are exponential functions, respectively;
and obtaining the value of the parameter b of the fitted curve.
Wherein, the determining whether to perform abnormal alarm according to the parameters of the fitted curve comprises:
judging whether the value of the obtained parameter B is larger than a preset parameter threshold value B1 or not; b1 represents the tolerance of the number of sampling periods which are continued when the monitoring index value is at a high position;
if the number of the alarm bits is larger than the preset threshold, determining to perform abnormal alarm, otherwise, not performing the abnormal alarm.
After the parameter B is judged to be greater than the preset value B1 and before the abnormal alarm is determined, the method further comprises the following steps:
calculating the median or average value of N monitoring index values in the N arrays;
and judging whether the calculated median or the average value is larger than the index threshold value, if so, performing abnormal alarm, and providing the N monitoring index values serving as monitoring abnormal data to the outside.
After judging that the value of the parameter B is larger than the preset B1, the method further comprises the following steps:
judging whether the value of the obtained parameter B is larger than a preset B2 or not; b2 is greater than B1;
if the value of the parameter B is larger than the preset B2, determining that an abnormal symptom that the monitoring index value is continuously high appears at present;
and if the value of the parameter B is smaller than B2 and larger than B1, determining that an abnormal symptom that the monitoring index value is temporarily high currently occurs.
After the abnormal alarm is carried out, the method further comprises the following steps:
acquiring monitoring abnormal data of at least two visual angles according to at least two dimensions of a tangent plane service module, a service application where the tangent plane service module is located, a machine where the service application is located and a machine room where the machine is located;
and comprehensively judging whether fault emergency treatment is required at present or not according to the monitoring abnormal data of the at least two visual angles and the log of the corresponding dimension, and if so, carrying out fault emergency treatment of the corresponding dimension.
Wherein, when the dimension comprises a dimension of a tangent plane service module, the fault emergency treatment comprises: closing the tangent points causing monitoring abnormity in the tangent plane service module;
and/or the presence of a gas in the gas,
when the dimension comprises a dimension of a service application in which the tangent plane service module is positioned, the fault emergency treatment comprises the following steps: a function of closing the service application;
and/or the presence of a gas in the atmosphere,
when the dimension comprises a machine/machine room where the service application is located, the fault emergency treatment comprises: and the service processed by the machine/machine room is guided to at least one of other machines/machine rooms, the machine/machine room is restarted, the service application in the machine/machine room is unloaded, and the service application in the machine/machine room is upgraded.
According to a second aspect, there is provided an abnormality warning device, comprising:
the monitoring index value acquisition module is configured to sample the value of the monitoring index associated with the service application in each sampling period;
the starting module is configured to judge whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value; if the current value is larger than the preset value, triggering a curve fitting module;
a curve fitting module configured to obtain N groups; wherein, the N arrays comprise: an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and an N-1 array consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value; performing curve fitting on the N groups to obtain parameters of a fitted curve;
and the alarm module is configured to determine whether to carry out abnormal alarm according to the parameters of the fitted curve.
According to a third aspect, there is provided a computing device comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements a method as described in any embodiment of the specification.
The method and the device for alarming the abnormality provided by each embodiment of the specification can at least achieve the following beneficial effects:
1. the abnormal alarm can be more accurately carried out, and the misinformation is reduced. For example, whether the abnormal rise of the monitoring index value belongs to the abnormal situation of the type of 'burr' can be distinguished, so that the type of burr is filtered, abnormal alarm is not performed for the abnormal rise, the alarm amount is reduced, and false alarm is reduced.
2. The method adopting the mathematical means, namely the method based on curve fitting, is not a statistical method, has higher efficiency and small calculated amount, and can meet the real-time requirement of abnormal alarm of mass services.
3. When alarming, the method can further provide an abnormal type, such as an abnormal type with a monitoring index value lasting high or an abnormal type with a monitoring index value short-term high, thereby enriching the alarming content and being more beneficial to troubleshooting.
Drawings
In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the description below are some embodiments of the present specification, and other drawings can be obtained by those skilled in the art without creative efforts.
FIG. 1 is a schematic diagram of a graph of spike types formed by monitoring index values sampled over a plurality of sampling periods.
FIG. 2 is a flow diagram of a method of abnormal alerting in one embodiment of the present description.
FIG. 3 is a schematic diagram of a continuous high-order type graph formed by monitoring index values sampled in a plurality of sampling periods.
FIG. 4 is a schematic diagram of a graph of a transient high-order type formed by monitoring indicator values sampled over a plurality of sampling periods.
FIG. 5 is a graph illustrating jitter patterns formed by monitoring indicator values sampled over a plurality of sampling periods.
Fig. 6 is a flowchart of an abnormality warning method in another embodiment of the present specification.
Fig. 7 is a schematic structural diagram of an abnormality warning device in one embodiment of the present specification.
Fig. 8 is a schematic structural diagram of an abnormality warning device in another embodiment of the present specification.
Detailed Description
As described above, in the conventional abnormal alarm method, when the acquired monitoring index value is greater than the index threshold value, it is determined that an abnormal sign appears, which often results in erroneous judgment, and thus erroneous alarm processing is performed. For example, a monitoring index of a tangent plane program is sampled, and due to various reasons, such as network jitter, CPU scheduling, memory occupation and release, garbage collection, and the like, the monitoring index value (such as a tangent point response time) obtained by sampling may be abnormally increased and be larger than an index threshold value within a very short sampling period, such as a sampling period or two sampling periods, but within most sampling periods, the sampled monitoring index value is smaller than the index threshold value and belongs to a normal range. If the sampling curve of the monitoring index value is drawn, the curve of the monitoring index value is in a curve shape of a 'burr' type in a continuous sampling period. For example, in one embodiment, referring to fig. 1, the X-axis of fig. 1 is an axis representing a sampling time in minutes, and the Y-axis is an axis representing a tangent point response time as a monitoring index value in seconds, and it can be seen that the curve in fig. 1 exhibits a curve shape of a "glitch" type. In this case, the fluctuation is only a momentary fluctuation caused by external reasons such as network jitter or CPU scheduling, and the fluctuation usually disappears naturally, and the normal operation of the service application is not affected and no alarm is needed because the operation of the service application or the section program is abnormal. However, according to the processing method in the prior art, as long as the obtained monitoring index value is greater than the index threshold value, the abnormal symptom is considered to appear, and an alarm is given, so that an error alarm is caused, and after the manager knows the error alarm, a series of abnormal troubleshooting processing is performed, so that waste of various resources is caused.
Further, in actual service implementation, due to complex and various reasons, the number of the monitored "glitches" is usually huge, and according to the prior art, unnecessary frequent alarms are caused, thereby causing great trouble to abnormal alarm management.
The scheme provided by the specification is described below with reference to the accompanying drawings.
It is first noted that the terminology used in the embodiments of the present invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the description of the invention and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
Fig. 2 is a flowchart of an abnormality warning method in one embodiment of the present specification. The execution subject of the method is an abnormal alarm device. It is to be understood that the method may also be performed by any apparatus, device, platform, cluster of devices having computing, processing capabilities. The method is carried out circularly in each sampling period for sampling the monitoring index. Referring to fig. 2, the method includes:
step 201: and sampling the value of the monitoring index in the current sampling period.
Step 203: judging whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value or not; if yes, step 205 is executed, otherwise, the next sampling period is entered, and the step 201 is returned to.
Step 205: obtaining N number groups; wherein, these N arrays include: the device comprises an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and N-1 arrays consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value.
Step 207: and sorting the N groups according to a time sequence, and then carrying out curve fitting to obtain parameters of a fitted curve.
Step 209: and determining whether to carry out abnormal alarm according to the parameters of the fitted curve.
As can be seen from the flow shown in fig. 2, in the abnormal warning method provided in the embodiment of the present specification, when the acquired monitoring index value is greater than the index threshold, instead of directly determining that an abnormal symptom occurs and warning, curve fitting is performed by using the monitoring index value and the monitoring index values in the previous/subsequent sampling periods, and whether an abnormal symptom occurs and warning is determined according to parameters of a curve after fitting. And determining whether the fitted curve conforms to the characteristics of the abnormal curve according to the parameters of the fitted curve, thereby determining whether to perform abnormal alarm. Therefore, the method of the embodiment can more accurately alarm the abnormality and reduce the false alarm.
In the method shown in fig. 2, instead of using statistical means to calculate whether the monitoring index values are abnormal once or several times to determine whether to perform abnormal alarm, mathematical means is used to perform curve fitting, and the principle is to determine whether to perform abnormal alarm by describing the trend of the abnormal point location curve to determine whether to perform abnormal symptom. As known to those skilled in the art, mathematical means have the advantage of being more efficient and more timely than statistical means. In the face of the existing massive business application, massive monitoring indexes and massive monitoring requirements, massive abnormal monitoring indexes can appear at a server end, some of the massive abnormal monitoring indexes are caused by accidental interference factors, no alarm is needed, and some of the massive abnormal monitoring indexes are required to be timely alarmed before a fault occurs. If a statistical method is used, massive operations are required, and the real-time requirement of abnormal alarm of massive services can hardly be met, but the method adopting the mathematical method of the embodiment of the specification, namely the method based on curve fitting, has higher efficiency and small calculated amount, and can meet the real-time requirement of abnormal alarm of massive services.
The method and the device in the embodiment of the specification can be applied to various service scenes, so that abnormal alarms of various monitoring indexes are realized. For example, the method can be applied to the following service scenarios:
and a first service scene is used for alarming the abnormity of the facet program.
Currently, an Aspect Oriented Programming (AOP) technique is emerging. Various service applications, such as service applications in a server or service applications in a terminal device, can be injected into a tangent plane program through a tangent point, thereby realizing various functions. Even if the tangent plane program is verified to be qualified before running, after the tangent plane program is injected into the program of the business application, the two programs need to be coupled, so that an exception may occur in the running of the tangent plane program, and therefore, the business scenario one occurs, that is, an exception alarm of the tangent plane program needs to be performed.
In the first service scenario, the monitoring index is a monitoring index of a section injected by a service application, and is used for monitoring whether the operation of a section program is abnormal.
In an embodiment of the present disclosure, the monitoring index of the tangent plane may include any one of the following:
a minute interception number (tpm), which represents the number of times of intercepting abnormal operations of a business application by a section program per minute;
a tangent point response time (rt) representing a length of time from entering a tangent point to performing a tangent procedure at the tangent point until ending the tangent procedure and leaving the tangent point;
and (4) throwing exception times (exception), wherein the throwing exception times represent the times of throwing exception data when the section program is abnormal.
And a second service scene is an abnormal alarm aiming at one service provided by the service application.
The business application needs to provide services to the outside, such as a face brushing service, a data reading service, and the like, and therefore, an abnormal alarm needs to be given to the provided services. As mentioned above, after the tangent plane program is injected into the program of the business application, since the two programs need to be coupled, it may also cause an exception to the service provided by the business application,
in the second service scenario, the monitoring indexes are as follows: monitoring metrics for a service provided by a business application. Such as time consumed by service and number of failures, time consumed by message subscription and number of failures, etc.
And a third service scene is abnormal alarm aiming at the operating system.
In the third service scenario, the monitoring indexes are as follows: aiming at the monitoring index of the operating system level. Such as CPU usage, memory usage, CPU load, etc.
And fourthly, service scene is abnormal alarm aiming at the JAVA virtual machine.
In the fourth service scenario, the monitoring indexes are as follows: and aiming at monitoring indexes of the JAVA virtual machine. Such as the time consumption and number of YGCs, the time consumption and number of FGCs.
Each step shown in fig. 2 will be described with reference to the accompanying drawings and various examples.
First for step 201: in each sampling period, the value of the monitoring index is sampled.
As described above, the monitoring indicator in this step 201 may be any one of the monitoring indicators in the four service scenarios, for example, the monitoring indicator is a tangent point response time (rt).
The sampling period is determined by the monitoring requirement, such as once per second, or once per minute, or once per day, etc.
In an embodiment of the present specification, a tangent plane program, that is, a monitoring enhancement code, may be injected through a tangent point in a service application, and a value of a monitoring index is sampled through the injected monitoring enhancement code.
Next for step 203: judging whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value or not; if yes, go to step 205, otherwise, go to the next sampling period, go back to step 201.
In the embodiment of the present specification, an index threshold value, denoted as M, needs to be set in advance. The size of the index threshold may be set according to expert experience. For example, when the monitoring index is the tangent point response time, the expert experience has determined that the tangent point response time is normally less than 0.03 second. Therefore, M =0.03 may be set. It can be understood that, for different service scenarios, different monitoring indexes, and different index thresholds, the size of the index threshold is different.
The index threshold M is used to determine whether to start a subsequent abnormal alarm processing procedure, i.e., whether to start a subsequent curve fitting process. And if the current monitoring index value sampled in the current sampling period is larger than the preset index threshold, starting the subsequent curve fitting process.
Next for step 205: obtaining N number groups; wherein, the N arrays comprise: the device comprises an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and N-1 arrays consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value.
In step 205, for example, if the current sampling period is time t1, and the monitoring index value sampled at the time t1 is greater than M, and subsequent curve fitting needs to be started, then to better describe the variation of the monitoring index value near the time t1, which is an abnormal point location, a total of N monitoring index values near the time t1 may be obtained to determine the trend of the abnormal point location curve. In the embodiment of the present specification, the N monitoring index values may be: the monitoring index value sampled at the time t1 and N-1 sampling periods before the time t1, or the monitoring index value sampled at the time t1 and N-1 sampling periods after the time t1, or the monitoring index value sampled at the time t1 and sampling periods before and after the time t 1.
For example, at a current sampling period, that is, at time T1, T1 time may be delayed, that is, time of waiting for N2 sampling periods is further delayed, to obtain values of N2 monitoring indexes collected in N2 sampling periods after time T1, and at the same time, to obtain values of N1 monitoring indexes sampled in N1 sampling periods before time T1, so as to obtain N = (N1 + N2+ 1) monitoring index values, where the N monitoring index values and corresponding time points thereof respectively form N arrays.
Next, for step 207: and carrying out curve fitting on the N groups after time sequencing to obtain parameters of the fitted curve.
In the embodiment of the description, whether the monitoring index value is abnormal or not is calculated for one time or several times respectively by using a statistical means to determine whether to alarm or not, but curve fitting is performed by using a mathematical means, and the principle is that whether an abnormal symptom occurs or not is determined by depicting the trend of an abnormal point position curve, so that the efficiency is higher, and the real-time requirement of abnormal alarm of mass services can be met.
In step 207, the N groups are sorted according to time to obtain N monitoring index values collected at the time of the N sampling periods, which are arranged according to the time sequence, and the N monitoring index values are subjected to curve fitting. In the embodiments of the present disclosure, various existing methods may be used for curve fitting, such as a MATLAB (matrix & laboratory) technique.
The analysis of the characteristics of the alarm service can be known, and when the monitoring index value is abnormal, the monitoring index value generally corresponds to the following four conditions:
case 1: the monitoring of the index value is only a momentary sudden increase.
In this case 1, monitoring indicator values above the monitoring threshold are only acquired for a short length of time (i.e. for a few consecutive sampling periods, such as one or two consecutive sampling periods). And the monitoring index values acquired in other sampling periods are not more than the monitoring threshold value and are in a normal state. The graph formed by the monitoring index value in case 1 may be a "spike" type graph as shown in fig. 1.
Case 2: and monitoring the index value to be continuously high.
In this case 2, the monitoring index value larger than the monitoring threshold value is acquired for a long period of time (i.e., for a long continuous sampling period, such as for 10 continuous sampling periods). The curve formed by the monitoring index value in this case 2 may be a "continuously high" type curve. For example, referring to fig. 3, in fig. 3, the X-axis is an axis representing a sampling time in minutes, and the Y-axis is an axis representing a tangent point response time as a monitoring index value in seconds, and it can be seen that the graph in fig. 3 exhibits a curved shape of a "continuously high" type.
Case 3: and monitoring the high bit of the index value.
In this case 3, the monitoring index value greater than the monitoring threshold value is acquired in a relatively short time period (i.e., in relatively few consecutive sampling periods, such as more than 2 and less than 10 consecutive sampling periods), and the monitoring index values acquired in other sampling periods are not greater than the monitoring threshold value, and the monitoring index value is in a normal state. The graph formed by the monitoring index values in this case 3 may be a "short-lived high-order" type of graph. For example, in one embodiment, referring to fig. 4, the X-axis in fig. 4 is an axis representing the sampling time in minutes, and the Y-axis is an axis representing the tangent point response time as the monitoring index value in seconds, and it can be seen that the curve in fig. 4 exhibits a curve shape of the "short-lived high" type.
Case 4: and monitoring the fluctuation of the index value.
In this case 4, the monitoring index fluctuates, that is, the monitoring index value continuously changes in alternation of an abrupt increase and an abrupt decrease in successive sampling periods. The graph formed by the monitoring index value in this case 4 may be a "jitter" type of graph. For example, in one embodiment, referring to fig. 5, the X-axis of fig. 5 is an axis representing the sampling time in minutes, and the Y-axis is an axis representing the response time of the tangent point as the monitoring index value in seconds, it can be seen that the curve of fig. 5 exhibits a curve shape of the "jitter" type.
Combining the abnormal characteristics of the monitoring index values in the 4 cases, it can be seen that the identification of the four types of curves shown in fig. 1, 3, 4 and 5 is critical to continuously monitor the abnormal monitoring index value, and the trend of the curve formed by the abnormal monitoring index value needs to be described by a relatively significant index. Considering that the exponential function is much more sensitive to the two ends of the curve than to the center, the center can correspond to the moment when the curve fitting is started, such as the moment t1 described above, and the two ends of the curve can correspond to consecutive moments around the moment t1, such as before and after the moment t 1. Therefore, the exponential function can better satisfy the analysis of the abnormal characteristics of the monitoring index value in the embodiment of the present specification, that is, the determination effect on the curve trend is better, for example, the type of the curve can be well identified to which of the above four cases, so as to better determine whether an abnormal alarm should be performed, and further, a specific type of the current abnormality can be provided during the alarm.
Therefore, in step 207, a curve fitting in the form of an exponential function is performed on the N number groups. Wherein, the function relation that the curve of exponential function form accords with is:
wherein, y represents the monitoring index value, x represents the time point of the sampling period, and a and b are parameters of the exponential function respectively.
Therefore, in step 207, the values of the parameter a and the parameter b of the curve can be obtained for the fitted exponential function form curve.
Preferably, the characteristics of the curve in the form of an exponential function and the characteristics of the anomaly of the monitoring index value are combined, so that in practice, the magnitude of the parameter a has a small influence on the process of the abnormal alarm and can not be considered, while the magnitude of the parameter b greatly influences the process of the abnormal alarm, and therefore, in step 207, for the fitted curve in the form of an exponential function, only the value of the parameter b can be obtained without obtaining the parameter a of the curve.
The following analysis shows why the parameter a has little influence on the abnormal alarm process and can be disregarded, while the parameter b greatly influences the abnormal alarm process and needs to obtain the value of b. The reason is as follows:
expression of exponential function form curve
It can be found that the positive and negative values of the values of a and b have the following influence on the curve trend in the form of an exponential function:
When the a value > 0:
in the case of b values > 0: the curve is in a growing trend, and the larger b is, the higher y is, the higher the growing speed is.
In case of b value < 0: the curve shows a descending trend, and the smaller b is, the faster y is.
In the case of a value > 0: the curve is in a growing trend, and the larger the a is, the more forward the curve is grown.
In case of a value < 0:
since the value y is a negative number and there is no negative number in the scene of the monitoring index, a <0 does not occur.
As can be seen from the above example scenario, the decision as to whether the curve trend is increasing or decreasing depends mainly on the parameter b: when b is greater than 0, the curve is in a growth trend, and the larger the b is, the more the b is; when b is less than 0, the curve is in a descending trend, and the smaller b is, the smaller the increase is.
In conclusion, it can be concluded that:
the magnitude of the value of parameter a characterizes: monitoring the time of the index value abnormity, wherein the smaller the value of the parameter a is, the earlier the time of the abnormity is, the larger the value of the parameter a is, and the later the time of the abnormity is. However, in the embodiment of the present specification, when the monitoring index value of the anomaly starts to appear, the early and late of the appearance time cannot help to distinguish whether the anomaly symptom really appears at present or not, and whether the anomaly alarm should be performed or not. Therefore, the value of the parameter a may not be calculated.
The magnitude of the value of parameter b characterizes: and monitoring the time length of the index value which is continuously abnormal. The time length represented by the parameter b can help to distinguish whether the abnormal symptom really appears at present or not and whether the alarm is supposed to be given or not. For example, if the time length represented by the parameter b is small, it can be shown that the abnormal condition corresponds to the "glitch" type of the above-mentioned condition 1, and therefore, it can be obtained that the current condition is not an abnormal precursor, and an abnormal alarm is not required. For another example, if the length of time represented by the parameter b is long, it may be a continuous high-order case corresponding to the above case 2, and therefore, it can be found that the current abnormality is a precursor and an abnormality alarm needs to be performed.
Next for step 209: and determining whether to carry out abnormal alarm according to the parameters of the fitted curve.
As described above, the curve in the form of an exponential function fitted by the N number groups is determined in step 207, and the value of the parameter b of the curve is determined, so that in step 209, it is determined whether an abnormal sign is present or not and whether an abnormal alarm needs to be given according to the value of the parameter b.
In the embodiment of this specification, one implementation procedure of this step 209 includes:
step 2091: and judging whether the obtained value of the parameter B is larger than a preset parameter threshold value B1, if so, executing a step 2093, otherwise, executing a step 2095.
Step 2093: and determining that an abnormal alarm needs to be carried out.
Step 2095: and determining not to carry out abnormal alarm.
The parameter threshold B1 is characterized by a tolerance to the number of sampling periods (i.e., the duration) during which the monitoring indicator value stays high. The tolerance can be determined according to various factors such as the type of the monitoring index, the service scene, the monitoring requirement and the like. For example, B1=0.03. It can be known from the characteristics of the curves shown in fig. 1, fig. 3, fig. 4, and fig. 5 that the number of sampling periods (i.e., the duration) during which the monitoring index value is at the high level determines whether an abnormal symptom occurs, for example, when the number of sampling periods (i.e., the duration) is very small, corresponding to a case where B is less than or equal to B1, it indicates that a "glitch" type situation occurs currently within the tolerance indicated by B1, that is, it is likely that an instantaneous fluctuation is caused by an external reason such as network jitter or CPU scheduling, and the fluctuation usually disappears naturally, and it is not because an abnormality occurs in the operation of the service application, the normal operation of the service application is not affected, and an abnormal alarm is not required. For another example, if the number of the continuous sampling periods (i.e. the duration of the continuous sampling period) is very long, for example, 10 continuous sampling periods, which corresponds to the case that B is greater than B1, it indicates that the tolerance indicated by B1 is exceeded, and a "continuous high-order" type case currently occurs, which is likely to be caused by an abnormality occurring in the monitored object, such as a service of a business application or a tangent plane program, and thus is an abnormal symptom, and an abnormal alarm needs to be performed.
In an embodiment of the present specification, the problem domain of the function may be further reduced, and a monitoring index value of a sampling point within a reasonable distribution range is selected, for example, a point sudden increase is particularly large, which may seriously damage the statistical interval of the sample, so that the excessive influence of the sudden increase may be eliminated in a median or average manner, thereby further reducing the probability of false alarm. In this case, after determining that the value of the parameter B is greater than B1 set in advance in step 2091, and before executing step 2093, the method further includes:
calculating the median or average value of N monitoring index values in N arrays;
and judging whether the calculated median or the average is larger than the index threshold value M, if so, executing the determination in the step 2093 to perform an abnormal alarm, and further, providing the N monitoring index values in the N arrays to an administrator as monitoring abnormal data.
As described above, by comparing the magnitude of the parameter B with the parameter threshold B1, it is possible to distinguish whether a curve of a spur type is currently present, and thus to distinguish whether an abnormal alarm should be performed. Further, in an embodiment of the present specification, when it is determined that an abnormal alarm needs to be performed, it may further be distinguished what kind of abnormal condition is currently present, so that a specific condition of the abnormal condition may be provided when the alarm is performed. Thus, after determining that the value of the parameter B is greater than the preset value B1 in step 2091, the method further includes:
step 209A: judging whether the value of the obtained parameter B is greater than a preset B2 or not; wherein B2 is greater than B1;
step 209B: if the value of the parameter B is greater than the preset B2, determining that an abnormal symptom that the monitoring index value is continuously high currently occurs, namely corresponding to the situation 2;
when the process goes to step 209B, the value of the parameter B is not only greater than B1, but also greater than B2, which is set in advance, indicating that the monitoring index value is high for a long time, i.e. is an abnormal value, and thus corresponds to the above case 2 and fig. 3.
Step 209C: if the value of the parameter B is smaller than B2 and larger than B1, it is determined that an abnormal symptom in which the monitoring index value is momentarily high is currently present, that is, it corresponds to the above case 3.
When the step 209C is executed, the value of the parameter B is greater than B1 but less than B2, which indicates that the monitoring index value is high in a relatively short time, and thus corresponds to the above case 3 and fig. 4.
Referring to fig. 1, 3, 4 and 5, in one embodiment of the present description, B1=0.03 and B2=0.1.
Therefore, when an abnormal alarm occurs, not only the current abnormal symptom can be notified, but also the specific type of the current abnormal symptom can be notified, for example, the abnormal type belongs to the abnormal type shown in the above case 2 or the above case 3, so that the information amount of the alarm is further enriched, and the subsequent troubleshooting is facilitated.
Thus far, an abnormal alarm has been implemented. In an embodiment of the present specification, after the abnormal alarm is performed, further comprehensive analysis may be performed to determine whether a fault occurs, so as to perform emergency processing. At this time, step 209 further includes:
acquiring monitoring abnormal data of at least two visual angles according to at least two dimensions of a tangent plane service module, a service application where the tangent plane service module is located, a machine where the service application is located and a machine room where the machine is located; and comprehensively judging whether the current fault emergency treatment is needed or not according to the monitoring abnormal data of the at least two visual angles and the log of the corresponding dimension, and if so, carrying out the fault emergency treatment of the corresponding dimension.
In one embodiment of the present specification, when the dimension includes a dimension of a tangent plane service module, the fault emergency handling includes: and closing the tangent point causing abnormal monitoring in the tangent plane service module.
In an embodiment of the present specification, when the dimension includes a dimension of a service application in which a tangent plane service module is located, the fault emergency processing includes: and closing the function of the service application.
In one embodiment of the present description, when the dimension includes a machine/room in which the service application is located, the fault emergency treatment includes at least one of: and the service processed by the machine/machine room is guided to other machines/machine rooms, the machine/machine room is restarted, the service application or the tangent program in the machine/machine room is unloaded, and the service application or the tangent program in the machine/machine room is upgraded.
For a more clear explanation, the abnormal warning method in one embodiment of the present invention is explained by the method flow shown in fig. 6. Referring to fig. 6, the method includes:
step 601: and sampling the value of the monitoring index in the current sampling period.
Step 603: judging whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value M or not; if yes, step 605 is executed, otherwise, the next sampling period is entered, and the step 601 is returned to.
Step 605: resulting in a plurality of arrays, such as 16 arrays.
The 16 arrays include: the time point and the current monitoring index value corresponding to the current sampling period form 1 array, the time point and the corresponding monitoring index value corresponding to the 10 sampling periods before the current sampling period form 10 arrays, and the time point and the corresponding monitoring index value corresponding to the 5 sampling periods after the current sampling period form 5 arrays.
Step 607: and sorting the 16 groups according to a time sequence, and then carrying out curve fitting in an exponential function form to obtain the value of the parameter b of the fitted curve.
Step 609: it is determined whether B > B1, if so, step 613 is performed, otherwise step 611 is performed.
Step 611: and returning to the step 601 without performing exception alarm.
Step 613: calculating the median of 16 monitoring index values in the 16 arrays, judging whether the median is greater than M, if so, executing step 615, otherwise, executing step 611.
Step 615: it is determined whether B > B2, if so, step 617 is performed, otherwise step 619 is performed.
Step 617: and (5) performing abnormal alarm, determining and notifying that an abnormal symptom with a continuous high monitoring index value exists at present, and returning to the step 601.
Step 619: and (4) performing exception alarm, determining and notifying that an exception symptom with a transient high monitoring index value exists at present, and returning to the step 601.
In one embodiment of the present description, an abnormality warning device is provided. Referring to fig. 7, the apparatus includes:
a monitoring index value acquisition module 701 configured to sample a value of a monitoring index associated with the service application in each sampling period;
a starting module 702 configured to determine whether a current monitoring index value sampled in a current sampling period is greater than a preset index threshold; if the current value is larger than the preset value, triggering a curve fitting module;
a curve fitting module 703 configured to obtain N number groups; wherein, the N arrays comprise: an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and N-1 arrays consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value; performing curve fitting on the N groups to obtain parameters of a fitted curve;
and an alarm module 704 configured to determine whether to perform an abnormal alarm according to the parameters of the fitted curve.
In one embodiment of the apparatus of the present disclosure, the monitoring indicator includes any one of:
monitoring indexes of the injected section for the service application;
monitoring an index of a service provided for a business application;
aiming at the monitoring index of the operating system level;
monitoring indexes aiming at the JAVA virtual machine.
In one embodiment of the apparatus of the present specification, the curve fitting module 703 is configured to perform:
carrying out curve fitting in an exponential function form on the N groups;
wherein the expression of the exponential function characterizing the curve is:
(ii) a Wherein y corresponds to a monitoring index value, x corresponds to a time point of a sampling period, and a and b are parameters of an exponential function respectively;
and obtaining the value of the parameter b of the fitted curve.
In one embodiment of the apparatus of the present description, the alarm module 703 is configured to perform:
judging whether the value of the obtained parameter B is larger than a preset parameter threshold value B1 or not; b1 represents the tolerance of the number of sampling periods which are continued when the monitoring index value is in a high position;
if the value is larger than the preset value, determining to perform abnormal alarm, otherwise, not performing abnormal alarm.
In one embodiment of the apparatus of the present description, the alert module 704 is configured to perform:
after the value of the parameter B is judged to be larger than the preset B1, and before the abnormal alarm is determined, calculating the median or the average value of N monitoring index values in the N arrays; and judging whether the calculated median or the average value is larger than the index threshold value, if so, performing exception warning, and providing N monitoring index values in the N arrays as monitoring exception data to an administrator.
In one embodiment of the apparatus of the present description, the alert module 704 is configured to perform: after the value of the parameter B is judged to be larger than the preset B1, judging whether the obtained value of the parameter B is larger than a preset B2; b2 is greater than B1; if the value of the parameter B is larger than the preset B2, determining that an abnormal symptom that the monitoring index value is continuously high appears at present; if the value of the parameter B is smaller than B2 and larger than B1, it is determined that an abnormal symptom in which the monitoring index value is temporarily high currently occurs.
Referring to fig. 8, in an embodiment of the present specification, the abnormality warning apparatus further includes a fault handling module 801, and the fault handling module 801 is configured to perform:
acquiring monitoring abnormal data of at least two visual angles according to at least two dimensions of a tangent plane service module, a service application where the tangent plane service module is located, a machine where the service application is located and a machine room where the machine is located;
and comprehensively judging whether fault emergency treatment is required at present or not according to the monitoring abnormal data of the at least two visual angles and the log of the corresponding dimension, and if so, carrying out fault emergency treatment of the corresponding dimension.
In one embodiment of the apparatus of the present specification illustrated in fig. 8, when the dimension comprises a dimension of a tangent plane service module, the fault emergency handling comprises: closing the tangent point causing monitoring abnormity in the tangent plane service module;
and/or the presence of a gas in the gas,
when the dimension comprises the dimension of the service application in which the tangent plane service module is positioned, the fault emergency treatment comprises the following steps: a function of closing the service application;
and/or the presence of a gas in the atmosphere,
when the dimension comprises a machine/machine room where the service application is located, the fault emergency treatment comprises the following steps: and the service processed by the machine/machine room is guided to other machines/machine rooms, the machine/machine room is restarted, the service application in the machine/machine room is unloaded, and the service application in the machine/machine room is upgraded.
It should be noted that, the modules described above are usually implemented at a server side, and may be respectively disposed in independent servers, or a combination of some or all of the modules may be disposed in the same server. The Server may be a single Server or a Server cluster composed of a plurality of servers, and the Server may be a cloud Server, also called a cloud computing Server or a cloud host, which is a host product in a cloud computing service system, so as to solve the defects of large management difficulty and weak service expansibility existing in the traditional physical host and virtual Private Server (VPs) service. The modules can also be implemented in a computer terminal with strong computing power.
An embodiment of the present specification provides a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of any of the embodiments of the specification.
One embodiment of the present specification provides a computing device comprising a memory and a processor, the memory having stored therein executable code, the processor implementing a method in accordance with any one of the embodiments of the specification when executing the executable code.
It is to be understood that the illustrated construction of the embodiments herein is not to be construed as limiting the apparatus of the embodiments herein specifically. In other embodiments of the description, the apparatus may include more or fewer components than illustrated, or some components may be combined, some components may be separated, or a different arrangement of components may be used. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, as for the apparatus embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this disclosure may be implemented in hardware, software, hardware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
The above-mentioned embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the present invention should be included in the scope of the present invention.
Claims (8)
1. The abnormal warning method comprises the following steps of:
sampling the value of the monitoring index;
judging whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value or not; if it is greater than the above-mentioned range,
obtaining N number groups; wherein N is an integer greater than 1, the N number of groups comprising: an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and N-1 arrays consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value;
performing curve fitting on the N groups to obtain parameters of a fitted curve;
determining whether to carry out abnormal alarm according to the parameters of the fitted curve;
wherein the curve fitting the N number of groups to obtain parameters of a fitted curve includes:
performing curve fitting in an exponential function form on the N groups;
wherein the expression of the exponential function characterizing the curve is:
(ii) a Wherein y corresponds to a monitoring index value, x corresponds to a time point of a sampling period, and a and b are parameters of an exponential function respectively; and
obtaining the value of the parameter b of the fitted curve;
wherein, the determining whether to perform abnormal alarm according to the parameters of the fitted curve comprises:
judging whether the value of the obtained parameter B is larger than a preset parameter threshold value B1 or not; b1 represents the tolerance of the number of sampling periods which are continued when the monitoring index value is at a high position;
if the value is larger than the preset value, determining to perform abnormal alarm, otherwise, not performing abnormal alarm.
2. The method of claim 1, wherein the monitoring indicator comprises any one of:
monitoring indexes of the injected section for the service application;
monitoring an index of a service provided for a business application;
aiming at the monitoring index of the operating system level;
monitoring indexes aiming at the JAVA virtual machine.
3. The method according to claim 1, wherein after determining that the value of the parameter B is greater than the preset B1 and before determining to perform the abnormal alarm, the method further comprises:
calculating the median or average value of N monitoring index values in the N arrays;
and judging whether the calculated median or the average value is larger than the index threshold value, if so, performing abnormal alarm, and providing the N monitoring index values serving as monitoring abnormal data to the outside.
4. The method of claim 1, further comprising, after determining that the value of the parameter B is greater than a preset B1:
judging whether the value of the obtained parameter B is larger than a preset B2 or not; b2 is greater than B1;
if the value of the parameter B is larger than the preset B2, determining that an abnormal symptom that the monitoring index value is continuously high appears at present;
if the value of the parameter B is smaller than B2 and larger than B1, it is determined that an abnormal symptom in which the monitoring index value is temporarily high currently occurs.
5. The method of claim 1, further comprising, after performing an exception alert:
obtaining monitoring abnormal data of at least two visual angles according to at least two dimensions of a tangent plane service module, service application where the tangent plane service module is located, a machine where the service application is located and a machine room where the machine is located;
and comprehensively judging whether the current fault emergency treatment is needed or not according to the monitoring abnormal data of the at least two visual angles and the log of the corresponding dimension, and if so, carrying out the fault emergency treatment of the corresponding dimension.
6. The method of claim 5, wherein when the dimension comprises a dimension of a tangent plane service module, the fault emergency treatment comprises: closing the tangent point causing monitoring abnormity in the tangent plane service module;
and/or the presence of a gas in the gas,
when the dimension comprises a dimension of a service application in which the tangent plane service module is positioned, the fault emergency treatment comprises the following steps: a function of closing the service application;
and/or the presence of a gas in the gas,
when the dimension comprises a machine/machine room where the service application is located, the fault emergency treatment comprises at least one of the following: and the service processed by the machine/machine room is guided to other machines/machine rooms, the machine/machine room is restarted, the service application or the tangent plane program in the machine/machine room is unloaded, and the service application or the tangent plane program in the machine/machine room is upgraded.
7. An abnormality warning device, comprising:
the monitoring index value acquisition module is configured to sample the value of the monitoring index associated with the service application in each sampling period;
the starting module is configured to judge whether the current monitoring index value sampled in the current sampling period is larger than a preset index threshold value; if the current value is larger than the preset value, triggering a curve fitting module;
a curve fitting module configured to obtain N number groups; wherein, the N arrays comprise: an array consisting of a time point corresponding to the current sampling period and the current monitoring index value, and N-1 arrays consisting of time points corresponding to N-1 sampling periods before and/or after the current sampling period and the corresponding monitoring index value; performing curve fitting on the N groups to obtain parameters of a fitted curve;
the alarm module is configured to determine whether to carry out abnormal alarm according to the parameters of the fitted curve;
wherein the curve fitting module is configured to perform:
performing curve fitting in an exponential function form on the N groups;
wherein the expression of the exponential function characterizing the curve is:
(ii) a Wherein y corresponds to a monitoring index value, x corresponds to a time point of a sampling period, and a and b are parameters of an exponential function respectively;
obtaining the value of the parameter b of the fitted curve;
the alert module is configured to perform:
judging whether the value of the obtained parameter B is larger than a preset parameter threshold value B1 or not; b1 represents the tolerance of the number of sampling periods which are continued when the monitoring index value is in a high position;
if the value is larger than the preset value, determining to perform abnormal alarm, otherwise, not performing abnormal alarm.
8. A computing device comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements the method of any of claims 1-6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210856146.0A CN115080356B (en) | 2022-07-21 | 2022-07-21 | Abnormity warning method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210856146.0A CN115080356B (en) | 2022-07-21 | 2022-07-21 | Abnormity warning method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115080356A CN115080356A (en) | 2022-09-20 |
| CN115080356B true CN115080356B (en) | 2022-12-13 |
Family
ID=83260306
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210856146.0A Active CN115080356B (en) | 2022-07-21 | 2022-07-21 | Abnormity warning method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115080356B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115437889B (en) * | 2022-11-08 | 2023-03-10 | 统信软件技术有限公司 | Emergency processing method, system and computing equipment |
| CN116501551B (en) * | 2023-06-21 | 2023-09-15 | 山东远桥信息科技有限公司 | Data alarm generation and recovery processing method |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107592236A (en) * | 2016-07-07 | 2018-01-16 | 北京奇虎科技有限公司 | The monitoring method and device of a kind of related business datum of promotion message |
| CN108694106A (en) * | 2017-04-07 | 2018-10-23 | 中国移动通信有限公司研究院 | A kind of power consumption of terminal performance monitoring method, device and control platform |
| CN109936470A (en) * | 2017-12-18 | 2019-06-25 | 中国电子科技集团公司第十五研究所 | A kind of method for detecting abnormality |
| WO2021179572A1 (en) * | 2020-03-12 | 2021-09-16 | 平安科技（深圳）有限公司 | Operation and maintenance system anomaly index detection model optimization method and apparatus, and storage medium |
| CN113590427A (en) * | 2021-08-09 | 2021-11-02 | 中国建设银行股份有限公司 | Alarm method, device, storage medium and equipment for monitoring index abnormity |
| CN113612656A (en) * | 2021-07-26 | 2021-11-05 | 招商银行股份有限公司 | Network flow detection method and device, terminal equipment and storage medium |
| CN114706733A (en) * | 2022-05-30 | 2022-07-05 | 支付宝(杭州)信息技术有限公司 | Section program abnormity monitoring method and device |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9471544B1 (en) * | 2012-05-24 | 2016-10-18 | Google Inc. | Anomaly detection in a signal |
| CN111459761B (en) * | 2020-04-01 | 2024-03-01 | 广州虎牙科技有限公司 | Redis configuration method, device, storage medium and equipment |
| CN113726559B (en) * | 2021-08-09 | 2023-10-27 | 国网福建省电力有限公司 | Based on artificial intelligence network safety analysis early warning system |
-
2022
- 2022-07-21 CN CN202210856146.0A patent/CN115080356B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107592236A (en) * | 2016-07-07 | 2018-01-16 | 北京奇虎科技有限公司 | The monitoring method and device of a kind of related business datum of promotion message |
| CN108694106A (en) * | 2017-04-07 | 2018-10-23 | 中国移动通信有限公司研究院 | A kind of power consumption of terminal performance monitoring method, device and control platform |
| CN109936470A (en) * | 2017-12-18 | 2019-06-25 | 中国电子科技集团公司第十五研究所 | A kind of method for detecting abnormality |
| WO2021179572A1 (en) * | 2020-03-12 | 2021-09-16 | 平安科技（深圳）有限公司 | Operation and maintenance system anomaly index detection model optimization method and apparatus, and storage medium |
| CN113612656A (en) * | 2021-07-26 | 2021-11-05 | 招商银行股份有限公司 | Network flow detection method and device, terminal equipment and storage medium |
| CN113590427A (en) * | 2021-08-09 | 2021-11-02 | 中国建设银行股份有限公司 | Alarm method, device, storage medium and equipment for monitoring index abnormity |
| CN114706733A (en) * | 2022-05-30 | 2022-07-05 | 支付宝(杭州)信息技术有限公司 | Section program abnormity monitoring method and device |
Non-Patent Citations (2)
| Title |
|---|
| Identifying Intermittent Faults to Restrain BIT False Alarm based on EMD and HMM;Zhendong Shen;《IEEE》;20200205;全文 * |
| 基于负荷突变的配电系统故障告警研究与实现;霍健等;《山东电力技术》;20180225(第02期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115080356A (en) | 2022-09-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN115080356B (en) | Abnormity warning method and device | |
| CN110661659B (en) | Alarm method, device and system and electronic equipment | |
| CN108270618B (en) | Alarm determination method, device and alarm system | |
| US10558545B2 (en) | Multiple modeling paradigm for predictive analytics | |
| CN109002031B (en) | Method applied to equipment fault diagnosis and intelligent early warning of monitoring system | |
| EP2907085B1 (en) | Autonomic network sentinels | |
| CN108845912B (en) | Service interface calls the alarm method of failure and calculates equipment | |
| CN111309562B (en) | Method, device, equipment and storage medium for predicting server faults | |
| CN109656786B (en) | Log acquisition method and device | |
| CN115529595A (en) | Method, device, equipment and medium for detecting abnormity of log data | |
| CN110674149B (en) | Service data processing method and device, computer equipment and storage medium | |
| CN114676019A (en) | Method, device, equipment and storage medium for monitoring state of central processing unit | |
| CN113806045A (en) | Task allocation method, system, device and medium | |
| CN109150626A (en) | FTP service monitoring method, device, terminal and computer readable storage medium | |
| CN111062503B (en) | Power grid monitoring alarm processing method, system, terminal and storage medium | |
| CN110704313B (en) | JAVA virtual machine memory leakage detection method and device | |
| CN110990223A (en) | Monitoring alarm method and device based on system log | |
| CN114490091B (en) | Method and device for monitoring rule engine performance in industrial data acquisition management system | |
| CN114531338A (en) | Monitoring alarm and tracing method and system based on call chain data | |
| CN110120893B (en) | Method and device for positioning network system security problem | |
| CN112799911A (en) | Node health state detection method, device, equipment and storage medium | |
| CN107566187B (en) | SLA violation monitoring method, device and system | |
| CN112181600A (en) | Cloud computing resource management method and system | |
| CN112134760A (en) | Link state monitoring method, device, equipment and computer readable storage medium | |
| CN114138620B (en) | Cloud platform log explosion detection method, device, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |