CN115174354A

CN115174354A - Platform side data alarm method and device, monitoring equipment and readable storage medium

Info

Publication number: CN115174354A
Application number: CN202210866372.7A
Authority: CN
Inventors: 刘爽
Original assignee: Kelai Network Technology Co ltd
Current assignee: Kelai Network Technology Co ltd
Priority date: 2022-07-22
Filing date: 2022-07-22
Publication date: 2022-10-11

Abstract

The embodiment of the invention provides a platform side data alarm method, a platform side data alarm device, monitoring equipment and a readable storage medium, and relates to the technical field of networks. The fluctuation information of each monitoring index of each device to be monitored can be obtained through the fluctuation coefficient and the historical index value of each monitoring index, which are configured in advance on the alarm configuration platform, and the fluctuation information can represent the fluctuation range of the actual index value of each monitoring time point in the set time period of the current time period. And at the same monitoring time point, the fluctuation ranges of each device to be monitored, which correspond to the actual index values of the same monitoring index, are different. For each monitoring index of each device to be monitored, when the monitoring index is monitored in real time by utilizing fluctuation information, at the current monitoring time point, an alarm can be given in time when the actual index value of the monitoring index exceeds the fluctuation range of the monitoring index, and the phenomenon of false alarm and missing alarm is avoided.

Description

Platform side data alarm method and device, monitoring equipment and readable storage medium

Technical Field

The invention relates to the technical field of networks, in particular to a platform side data alarm method, a platform side data alarm device, monitoring equipment and a readable storage medium.

Background

In a large network application system, there are a large number of network devices of various types, and in order to ensure data security in the system, all the network devices need to be monitored. The alarm strategy executed by the existing alarm monitoring platform is to use the maximum value or the minimum value of each equipment index as an alarm threshold, so that a uniform fixed value is set for each equipment index of all network equipment as the alarm threshold.

However, due to differences between different network devices, each device index may also have a difference between each network device, and an alarm manner in the prior art may occur in a normal state of the network device, but an alarm monitoring platform reflects an abnormal condition of the network device, and a false alarm phenomenon occurs. Or, a certain network device is already in an overload running state, but the alarm monitoring platform does not reflect the condition that the network device is abnormal and fails to report.

Disclosure of Invention

The invention aims to provide a platform side data alarming method, a platform side data alarming device, monitoring equipment and a readable storage medium.

Embodiments of the invention may be implemented as follows:

in a first aspect, the present invention provides a method for platform-side data alarm, including:

acquiring fluctuation information corresponding to each monitoring index of each device to be monitored aiming at each device to be monitored;

the fluctuation information represents the fluctuation range of the actual index value of the monitoring index at each monitoring time point in the set time period of the current time cycle;

monitoring each monitoring index in real time based on the fluctuation information;

and when the actual index value of any one monitoring index at the current monitoring time point exceeds the corresponding up-down fluctuation range, alarming the monitoring index.

In an optional implementation manner, the step of obtaining fluctuation information corresponding to each monitoring index of the device to be monitored includes:

for each monitoring index, acquiring a historical index value corresponding to each monitoring time point of the monitoring index in the set time period of a historical time cycle;

determining a first fluctuation upper limit value and a first fluctuation lower limit value of the monitoring index corresponding to each monitoring time point in the set time period of the current time cycle based on a preset light alarm fluctuation coefficient and the historical index value to obtain light alarm fluctuation information of the monitoring index;

determining a second fluctuation upper limit value and a second fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in the set time period of the current time cycle based on a preset severe alarm fluctuation coefficient and the historical index value to obtain severe alarm fluctuation information of the monitoring index;

wherein the fluctuation information of the monitoring index includes the mild warning fluctuation information and the severe warning fluctuation information.

In an optional embodiment, the step of monitoring each monitoring index in real time based on the fluctuation information includes:

for each monitoring index, acquiring an actual index value of the monitoring index at the current monitoring time point;

comparing the actual index value with the first fluctuation upper limit value, the first fluctuation lower limit value, the second fluctuation upper limit value and the second fluctuation lower limit value corresponding to the current monitoring time point respectively;

when the actual index value is located between the first fluctuation upper limit value and the second fluctuation upper limit value or between the first fluctuation lower limit value and the second fluctuation lower limit value, judging that the monitoring index is abnormal and carrying out light warning on the monitoring index;

and when the actual index value is larger than the second fluctuation upper limit value or smaller than the second fluctuation lower limit value, judging that the monitoring index is abnormal and giving a heavy alarm to the monitoring index.

determining a fluctuation upper limit value and a fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in the set time period of the current time cycle based on a preset fluctuation coefficient and the historical index value to obtain fluctuation information of the monitoring index;

the step of monitoring each monitoring index in real time based on the fluctuation information includes:

comparing the actual index value with the fluctuation upper limit value and the fluctuation lower limit value corresponding to the current monitoring time point respectively;

and when the actual index value is larger than the fluctuation upper limit value or smaller than the fluctuation lower limit value, judging that the monitoring index is abnormal and giving an alarm to the monitoring index.

In an optional embodiment, the step of obtaining, for each device to be monitored, fluctuation information corresponding to each monitoring index of the device to be monitored includes:

generating a standard reference curve of the monitoring index according to each historical index value; wherein, the historical index value corresponding to the monitoring index at each monitoring time point exists on the standard reference curve;

generating a fluctuation upper limit curve and a fluctuation lower limit curve of the monitoring index based on a preset fluctuation coefficient and the standard reference curve to obtain the fluctuation information corresponding to the monitoring index;

the fluctuation information comprises a fluctuation upper limit curve and a fluctuation lower limit curve, the fluctuation upper limit curve is provided with a fluctuation upper limit value of the monitoring index corresponding to each monitoring time point, and the fluctuation lower limit curve is provided with a fluctuation lower limit value of the monitoring index corresponding to each monitoring time point.

comparing the actual index value with a fluctuation upper limit value corresponding to the current monitoring time on the fluctuation upper limit curve and a fluctuation lower limit value corresponding to the current monitoring time on the fluctuation lower limit curve respectively;

In an optional embodiment, the monitoring index includes at least one of CPU occupancy, memory usage, disk space occupancy, CPU temperature, network traffic size, traffic protocol component ratio, number of IP addresses in traffic, and number of ports in traffic.

In a second aspect, the present invention provides a platform-side data alarm device, including:

the acquisition module is used for acquiring fluctuation information corresponding to each monitoring index of each device to be monitored aiming at each device to be monitored; the fluctuation information represents the range within which the actual index value of the monitoring index can fluctuate up and down at each monitoring time point in the set time period of the current time cycle;

the monitoring module is used for monitoring each monitoring index in real time based on the fluctuation information; and when the actual index value of any one monitoring index at the current monitoring time point exceeds the corresponding range which can fluctuate up and down, alarming is carried out on the monitoring index.

In a third aspect, the present invention provides a monitoring device comprising: a memory storing a computer program executable by the processor and a processor executing the computer program when the monitoring device is run to implement the method according to any of the preceding embodiments.

In a fourth aspect, the present invention provides a readable storage medium, which stores a computer program, which is executed by a processor to implement the method of any one of the foregoing embodiments.

Compared with the prior art, the embodiment of the invention provides a platform side data alarm method, a platform side data alarm device, monitoring equipment and a readable storage medium. In this way, by setting corresponding fluctuation information for each monitoring index of each device to be monitored, the fluctuation information can represent the fluctuation range of the actual index value of the monitoring index at each monitoring time point within the set time period of the current time cycle. When the fluctuation information is utilized to monitor the monitoring index in real time, the real index value of the monitoring index can be timely alarmed when exceeding the fluctuation range up and down at the current monitoring time point, and the phenomenon of misinformation and missing report is avoided.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained according to the drawings without inventive efforts.

Fig. 1 is a schematic diagram of an architecture of a monitoring and early warning system according to an embodiment of the present invention.

Fig. 2 is a flowchart of a platform-side data alarm method according to an embodiment of the present invention.

Fig. 3 is a second flowchart of a platform-side data alarm method according to an embodiment of the present invention.

Fig. 4 is a third schematic flowchart of a platform-side data alarm method according to an embodiment of the present invention.

Fig. 5 is a fourth schematic flowchart of a platform-side data alarm method according to an embodiment of the present invention.

Fig. 6 is a schematic diagram of fluctuation information of a monitoring index according to an embodiment of the present invention.

Fig. 7 is a schematic structural diagram of a platform-side data alarm device according to an embodiment of the present invention.

Fig. 8 is a schematic structural diagram of a monitoring device according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all embodiments of the present invention. The components of embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a wide variety of different configurations.

Thus, the following detailed description of the embodiments of the present invention, presented in the figures, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention. All other embodiments, which can be obtained by a person skilled in the art without inventive step based on the embodiments of the present invention, are within the scope of protection of the present invention.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.

Furthermore, the appearances of the terms "first," "second," and the like, if any, are used solely to distinguish one from another and are not to be construed as indicating or implying relative importance.

It should be noted that the features of the embodiments of the present invention may be combined with each other without conflict.

In a large-scale network application system, a large number of various types of network devices exist, all the network devices need to be monitored in order to ensure the data security in the system, and each type of network device has hardware indexes such as CPU occupancy rate, memory utilization rate, disk space occupancy rate, CPU temperature and the like, and traffic indexes such as network traffic size, traffic protocol component proportion, the number of IP addresses in traffic, the number of ports in traffic and the like. These indicators may all or some need to be monitored based on different needs.

In the prior art, the following two methods exist for monitoring indexes of various types of network equipment:

first, for a certain index, an alarm threshold interval is set according to an extreme value, i.e., a maximum value or a minimum value occurring in all network devices. When the index of a certain network device exceeds the set alarm threshold range, an alarm is generated.

Secondly, all the network devices are grouped according to standards such as device types, working environments, network conditions and the like to obtain a plurality of device groups, and then an alarm threshold value is set for a certain index of each device group respectively to alarm. For example: grouping according to device types, such as servers, personal Computers (PCs), switches (SWs), routers, and the like; grouping according to the working environment, such as intranet equipment, extranet equipment, isolation area equipment and the like; and grouping according to network conditions, such as local area network equipment, metropolitan area network equipment and the like. For a certain index, different groups use different threshold conditions, and if the actual data value of the index of a certain network device exceeds the set threshold conditions, an alarm is generated.

However, the above two approaches have the following disadvantages:

the alarm rule configured in the first method is too rough, and two obvious disadvantages exist: firstly, different equipment types, working environments and network conditions of different equipment are different, but a uniform alarm threshold value interval is used; secondly, the working strength and the network condition of a single device are different at different time periods, but the alarm threshold interval of the single device at all times is single. The direct result of the above two disadvantages is: when a certain network device is in an overload running state, but the alarm threshold interval is higher than the actual data of the network device, the alarm monitoring platform cannot correctly and timely reflect the phenomena of abnormity and report missing of the network device. Or, a certain network device is actually in a normal working state, but the alarm threshold interval is relatively low for the actual data of the network device, and the alarm monitoring platform reflects that the network device is abnormal at the moment to alarm and fails to report.

The second method is to divide all network devices into a plurality of device groups, and then set the alarm threshold corresponding to each device group, although the accuracy of alarm can be improved to some extent, the improvement of accuracy is limited. Because, in a device group, the alarm monitoring platform also has no universality for all devices in the group due to the size of the alarm threshold, and the alarm monitoring platform may not sense in time when a certain network device is abnormal, resulting in a phenomenon of missing report. Similarly, when a certain network device is not abnormal, the alarm monitoring platform can generate an alarm and generate a false alarm.

Based on the above technical problems, the inventors have made creative efforts to propose the following technical solutions to solve or improve the above problems. It should be noted that the above prior art solutions have disadvantages which are the result of practical and careful study by the inventor, and therefore, the discovery process of the above problems and the solutions proposed by the embodiments of the present application in the following should be the contribution of the inventor to the present application in the creation process of the invention, and should not be understood as technical contents known to those skilled in the art.

The inventor finds out through long-term observation and research that hardware monitoring indexes (such as CPU occupancy rate, memory utilization rate, disk space occupancy rate, CPU temperature and the like) and flow monitoring indexes (network flow size, flow protocol component proportion, IP address quantity in flow, port quantity in flow and the like) of the network equipment have the characteristic of presenting a periodic variation trend along with time. The monitoring indicators of a network device will exhibit the same trend of change during the time period as during the previous historical time period. Based on the characteristic, the change condition of the monitoring indexes in the historical time period can be obtained and used as a reference to judge whether each monitoring index is abnormal in real time.

Therefore, the embodiment of the present invention provides a platform-side data alarm method, which can set corresponding fluctuation information for each monitoring index of each device to be monitored, where the fluctuation information can represent a fluctuation range of an actual index value of the monitoring index at each monitoring time point within a set time period of a current time period. When the fluctuation information is utilized to monitor the monitoring index in real time, the real index value of the monitoring index can be timely alarmed when exceeding the fluctuation range up and down at the current monitoring time point, and the phenomenon of misinformation and missing report is avoided. The following detailed description is made by way of examples, with reference to the accompanying drawings.

Referring to fig. 1, fig. 1 is a schematic diagram of a monitoring and early warning system according to an embodiment of the present invention. The monitoring device 110 and several devices to be monitored connected thereto may form a monitoring and early warning system, wherein the devices to be monitored may be, but are not limited to, network devices of the server 120, the personal computer 130, the desktop computer 140, the switch 150, and the like, the types of the devices to be monitored are only exemplarily shown in fig. 1, and the number of the devices to be monitored is not limited, which is subject to the practical application.

For example, in an enterprise, the devices to be monitored may be servers, office computers, servers, etc., and relatively speaking, the number of office computers may be greater than that of other devices. The platform-side data alarm method provided by the embodiment of the invention can be applied to the monitoring device 100, and the method can be implemented by the software of the alarm configuration platform 111 running on the monitoring device 100.

In a configuration interface of the alarm configuration platform 111, a user may configure a corresponding fluctuation coefficient for each monitoring index to obtain a fluctuation coefficient set. For each device to be monitored, after the alarm configuration platform 111 obtains the fluctuation coefficient set configured by the user, for each device to be monitored, the fluctuation information of each monitoring index can be obtained according to the fluctuation coefficient set and the historical index values of each monitoring index at different monitoring time points. Thus, by using the fluctuation information, the alarm configuration platform 111 can monitor each monitoring index of the plurality of devices to be monitored in real time and give an alarm in time when an abnormality occurs.

Taking a device to be monitored as an example of a monitoring object, the implementation details of the method are described below. Referring to fig. 2, fig. 2 is a schematic flow chart of a platform-side data alarm method according to an embodiment of the present invention, where the method includes steps S100 to S200:

s100, acquiring fluctuation information corresponding to each monitoring index of the equipment to be monitored aiming at each equipment to be monitored.

Each device to be monitored can comprise a plurality of monitoring indexes, one monitoring index of each device to be monitored can have fluctuation information corresponding to the monitoring index, and the fluctuation information can represent the fluctuation range of the actual index value of the monitoring index at each monitoring time point in the set period of the current time cycle.

S200, monitoring each monitoring index in real time based on fluctuation information, and giving an alarm to the monitoring index when the actual index value of any monitoring index at the current monitoring time point exceeds the corresponding up-down fluctuation range.

For each device to be monitored, after the fluctuation information of each monitoring index of the device to be monitored is obtained, each detection index can be detected in real time. At the current monitoring time point, if the actual index value of any one monitoring index exceeds the corresponding up-down fluctuation range, the monitoring index can be alarmed.

For example, assuming that the current time period is one week, the set period is 8 to 12, 5 seconds are used as the monitoring period, and each monitoring period corresponds to one monitoring time point. For fluctuation information corresponding to each monitoring index of each device to be monitored, the fluctuation information can represent the fluctuation range of the actual value of the monitoring index at each monitoring time point within 8-00.

Taking a monitoring index of the CPU occupancy as an example, if the current time is 8.

It should be noted that the above example is only an example, the time period may be divided into a year, a month, a day, and a week, and the set time period selected in a specific time period is not limited, and the number of monitoring time points in the set time period is also not limited. Time periods may also be distinguished by weekdays and weekdays.

The platform side data alarm method provided by the embodiment of the invention can set corresponding fluctuation information for each monitoring index of each device to be monitored, and the fluctuation information can represent the fluctuation range of the actual index value of the monitoring index at each monitoring time point in the set time period of the current time period. When the fluctuation information is utilized to monitor the monitoring index in real time, the real index value of the monitoring index can be timely alarmed when exceeding the fluctuation range up and down at the current monitoring time point, and the phenomenon of misinformation and missing report is avoided. Optionally, the monitoring index may include at least one of CPU occupancy, memory usage, disk space occupancy, CPU temperature, network traffic size, traffic protocol component proportion, number of IP addresses in traffic, and number of ports in traffic.

At each monitoring time point, monitoring indexes such as CPU occupancy rate, memory utilization rate, disk space occupancy rate, CPU temperature and the like can be instantaneous values. At each monitoring time point, the monitoring indexes such as the proportion of the traffic protocol components, the number of IP addresses in the traffic, the number of ports in the traffic and the like can be an accumulated value within 1 s.

The fluctuation information can be generated based on the fluctuation coefficient and the historical index value corresponding to each monitoring time point in the set time period of the device to be monitored in the historical time period. The fluctuation coefficient of each monitoring index can be obtained by the configuration of a user on an alarm configuration platform. The fluctuation coefficient of any monitoring index is suitable for all equipment to be monitored.

In the historical time period, the device to be monitored can acquire the historical index value corresponding to each monitoring time point in the preset time period by using the installed probe program or the hardware monitoring program of the device to be monitored, and report the acquired data to the alarm configuration platform. For the monitoring equipment, after receiving the historical index value corresponding to each monitoring time point in the preset time period of each monitoring index uploaded by each piece of equipment to be monitored, storing the data into the database, and generating an initial data table based on the data. Assuming that a total of m monitoring time points in a set time period total n devices to be monitored, each device to be monitored includes k monitoring indexes, the initial data table may be as follows:

in the initial data table, at each monitoring time point, the historical index values of each monitoring index of each device to be monitored are correspondingly stored, that is, "(monitoring indexes 1 to k)" in the table is actually: the method comprises the steps of monitoring the historical index values of the index 1, the historical index values of the index 2 and the historical index values of the index 3, wherein the historical index values of the index 2, the index 3 are \8230, and the historical index values of the index k are 8230. It will be appreciated that the table is merely a simple illustration and is not intended to be a limitation on the form in which the monitoring device stores data.

In a possible implementation manner, the fluctuation information includes a fluctuation upper limit value and a fluctuation lower limit value corresponding to each monitoring time point in the set period, and the fluctuation upper limit value and the fluctuation lower limit value of the same monitoring time point form a fluctuation range of the actual index value corresponding to the monitoring time point. Accordingly, referring to fig. 3, the above step S100 may include sub-steps S110 to S120.

S110, aiming at each monitoring index, acquiring a historical index value corresponding to each monitoring time point of the monitoring index in a set time period of a historical time cycle.

To obtain the fluctuation information of each monitoring index of each device to be monitored, a historical index value corresponding to each monitoring time point of the monitoring index in a set time period of a historical time period can be obtained from an initial data table.

And S120, determining a fluctuation upper limit value and a fluctuation lower limit value of the monitoring index corresponding to each monitoring time point in a set period of the current time cycle based on the preset fluctuation coefficient and the historical index value, and obtaining fluctuation information of the monitoring index.

In this embodiment, by using the obtained historical index value and the preset fluctuation coefficient, a fluctuation upper limit value and a fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in the set period of the current time cycle can be determined, and the fluctuation upper limit value and the fluctuation lower limit value corresponding to each monitoring time point form a fluctuation range of the actual index value at the monitoring time point.

Optionally, before the step S110, the method may further include a process of obtaining a preset fluctuation coefficient corresponding to each monitoring index, where the preset fluctuation coefficient corresponding to each monitoring index may be obtained by a user through configuration in advance on an alarm configuration platform.

Optionally, for each monitoring index, the step S200 may include sub-steps S210 to S230.

S210, acquiring an actual index value of the monitoring index at the current monitoring time point.

S220, comparing the actual index value with the fluctuation upper limit value and the fluctuation lower limit value corresponding to the current monitoring time point respectively.

And S230, when the actual index value is larger than the fluctuation upper limit value or smaller than the fluctuation lower limit value, judging that the monitoring index is abnormal and giving an alarm to the monitoring index.

In this embodiment, at the current monitoring time point, an actual index value of the monitoring index may be obtained first. And then, comparing the actual index value with the fluctuation upper limit value and the fluctuation lower limit value corresponding to the current monitoring time point respectively. And if the actual index value is larger than the fluctuation upper limit value or smaller than the fluctuation lower limit value, judging that the monitoring index is abnormal, giving an alarm to the monitoring index, and generating alarm information of the monitoring index of the equipment to be monitored. If the actual index value is between the fluctuation upper limit value and the fluctuation lower limit value, the monitoring index is normal, and no alarm is needed.

For example, each monday is a time period, taking the monitoring index of the CPU occupancy as an example, the monday is a current time period, the last monday or the last monday is used as a historical time period, and the historical index value of the CPU occupancy of each device to be monitored in each monitoring time point in 8. Assuming that the current monitoring time point is 8 of Monday.

Then at the current monitoring time point, the fluctuation upper limit value of the CPU occupancy is: 25% (+ 1 x%), the lower limit value of fluctuation is 25% (+ 1-x%), and the interval of fluctuation range is [25% (+ 1-x%), 25% (+ 1+ x%) ].

Suppose that at the current monitoring time point, the actual index value of the CPU occupancy is y%: when y% >25% (+ 1 +x%) or y% <25% (-x%), it is said that the CPU occupancy of the device to be monitored is abnormal, and an alarm is required; when 25% < 1-x% < y% <25% < 1+ x%, it is stated that the CPU occupancy of the device to be monitored is normal, and no alarm is required.

In another possible implementation manner, for each monitoring index of each device to be monitored, the fluctuation coefficient may be set as a mild alarm fluctuation coefficient and a severe alarm fluctuation coefficient, and the fluctuation information of the monitoring index may be divided into mild alarm fluctuation information and severe alarm fluctuation information. Accordingly, referring to fig. 4, the above step S100 may include sub-steps S101 to S103.

S101, acquiring a historical index value corresponding to each monitoring time point of each monitoring index in a set time period of a historical time cycle.

Wherein, the step S101 can refer to the above description of the step S110.

S102, determining a first fluctuation upper limit value and a first fluctuation lower limit value of the monitoring index corresponding to each monitoring time point in a set period of the current time cycle based on a preset light alarm fluctuation coefficient and a historical index value, and obtaining light alarm fluctuation information of the monitoring index.

For each monitoring index, a first fluctuation upper limit value and a first fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in a set period of the current time cycle can be determined by using the obtained historical index value and a preset light alarm fluctuation coefficient, and the first fluctuation upper limit value and the first fluctuation lower limit value corresponding to each monitoring time point form a first up-down fluctuation range of the actual index value at the monitoring time point.

S103, determining a second fluctuation upper limit value and a second fluctuation lower limit value of the monitoring index corresponding to each monitoring time point in a set period of the current time cycle based on a preset heavy alarm fluctuation coefficient and a historical index value, and obtaining heavy alarm fluctuation information of the monitoring index.

For each monitoring index, a second fluctuation upper limit value and a second fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in a set period of the current time cycle can be determined by using the obtained historical index value and a preset severe alarm fluctuation coefficient, and the second fluctuation upper limit value and the second fluctuation lower limit value corresponding to each monitoring time point form a second up-down fluctuation range of the actual index value at the monitoring time point.

The fluctuation coefficient comprises a mild alarm fluctuation coefficient and a severe alarm fluctuation coefficient. Optionally, before the step S101, the method may further include a process of obtaining a light alarm fluctuation coefficient and a heavy alarm fluctuation coefficient corresponding to each monitoring index, where the light alarm fluctuation coefficient and the heavy alarm fluctuation coefficient corresponding to each monitoring index may be obtained by a user performing configuration in advance on an alarm configuration platform.

Optionally, for each monitoring index, the step S200 may include sub-steps S201 to S204.

S201, obtaining an actual index value of the monitoring index at the current monitoring time point.

Wherein, the step S201 can refer to the above description of the step S210.

S202, comparing the actual index value with a first fluctuation upper limit value, a first fluctuation lower limit value, a second fluctuation upper limit value and a second fluctuation lower limit value corresponding to the current monitoring time point respectively.

S203, when the actual index value is located between the first fluctuation upper limit value and the second fluctuation upper limit value or between the first fluctuation lower limit value and the second fluctuation lower limit value, judging that the monitoring index is abnormal and slightly alarming the monitoring index.

And S204, when the actual index value is larger than the second fluctuation upper limit value or smaller than the second fluctuation lower limit value, judging that the monitoring index is abnormal and giving a heavy alarm to the monitoring index.

In this embodiment, at the current monitoring time point, an actual index value of the monitoring index may be obtained first. And then, comparing the actual index value with a first fluctuation upper limit value, a first fluctuation lower limit value, a second fluctuation upper limit value and a second fluctuation lower limit value which correspond to the current monitoring time point respectively.

If the actual index value is larger than the second fluctuation upper limit value or smaller than the second fluctuation lower limit value, judging that the monitoring index is severely abnormal, and performing severe alarm on the monitoring index to generate severe alarm information of the monitoring index of the equipment to be monitored; if the actual index value is located between the first fluctuation upper limit value and the second fluctuation upper limit value or between the first fluctuation lower limit value and the second fluctuation lower limit value, judging that the monitoring index is slightly abnormal, slightly alarming the monitoring index, and generating slight alarming information of the monitoring index of the equipment to be monitored; if the actual index value is between the first fluctuation upper limit value and the first fluctuation lower limit value, the monitoring index is normal, and no alarm is needed.

For example, similarly, each monday is a time period, taking the monitoring index of CPU occupancy as an example, the monday is a current time period, the monday is a historical time period, and the historical index value of the CPU occupancy of each device to be monitored in each monitoring time point in 8. Assuming that the current monitoring time point is 8 ₁ Percent, the severe alarm fluctuation coefficient is preset as x ₂ ％，x ₁ <x ₂ . If the CPU occupancy of the device to be monitored was 25% at 8.

Then at the current monitoring time point, the first fluctuation upper limit value of the CPU occupancy is: 25% (+ 1 +x) ₁ %), the first lower fluctuation limit was 25% ((1-x)%) ₁ %) the first of which can fluctuate up and down in the interval [ 25%. Multidot.1-x ] ₁ ％),25％*(1+x ₁ ％)](ii) a The second fluctuation upper limit value of the CPU occupancy rate is as follows: 25% (+ 1 +x) ₂ %), the second lower fluctuation limit was 25% ((1-x)%) ₂ %) and the second fluctuation range is interval [ 25%. Multidot.1-x ] ₂ ％),25％*(1+x ₂ ％)]

Suppose that at the current monitoring time point, the actual index value of the CPU occupancy is Y%: when the ratio of Y to the total weight of the components is equal to>25％*(1+x ₂ %) or Y%<25％*(1-x ₂ %) to indicate that the occupancy rate of the CPU of the equipment to be monitored is seriously abnormal, and a serious alarm is required; when 25% ((1-x)) ₂ ％)<Y％<25％*(1-x ₁ %) or 25% (+ 1 x) ₁ ％)<Y％<25％*(1+x ₂ %) to indicate that the CPU occupancy rate of the equipment to be monitored is slightly abnormal and a light alarm is required; when 25% ((1-x)) ₁ ％)<Y％<25％*(1+x ₁ %) to indicate that the CPU occupancy rate of the equipment to be monitored is normal without alarming.

In yet another possible implementation manner, for each monitoring index of each device to be monitored, the fluctuation information may be obtained by generating a fluctuation upper limit curve and a fluctuation lower limit curve by presetting a fluctuation coefficient. Accordingly, referring to fig. 5, the above step S100 may include sub-steps S101a to S103a.

S101a, aiming at each monitoring index, acquiring a historical index value corresponding to each monitoring time point of the monitoring index in a set time period of a historical time cycle.

And S102a, generating a standard reference curve of the monitoring index according to each historical index value.

And historical index values of the monitoring indexes corresponding to each monitoring time point can exist on the standard reference curve.

S103a, generating a fluctuation upper limit curve and a fluctuation lower limit curve of the monitoring index based on a preset fluctuation coefficient and a standard reference curve to obtain fluctuation information corresponding to the monitoring index.

In this embodiment, the fluctuation coefficient is a preset fluctuation coefficient, optionally, before the step S101a, the method may further include a process of obtaining the preset fluctuation coefficient corresponding to each monitoring index, where the preset fluctuation coefficient corresponding to each monitoring index may be obtained by a user through configuration in advance on an alarm configuration platform.

Please refer to fig. 6, where a monitoring index is taken as the CPU temperature as an example, and fig. 6 is a schematic diagram of fluctuation information of the monitoring index provided in an embodiment of the present invention. Taking the last friday as a historical time period, a standard reference curve can be generated based on the acquired historical index values of the CPU temperature of each device to be monitored at each monitoring time point in 8-00. Assuming that the preset fluctuation coefficient is 8 ℃, the standard reference curve can be obtained by respectively moving up 8 ℃ and moving down 8 ℃, and a fluctuation upper limit curve and a fluctuation lower limit curve can be obtained.

Optionally, for each monitoring index, the step S200 may include sub-steps S201a to S202a.

S201a, obtaining an actual index value of the monitoring index at the current monitoring time point.

Here, the step S201a may refer to the above description of the step S210.

S202a, comparing the actual index value with a fluctuation upper limit value corresponding to the current monitoring time on a fluctuation upper limit curve and a fluctuation lower limit value corresponding to the current monitoring time on a fluctuation lower limit curve respectively, and judging that the monitoring index is abnormal and giving an alarm when the actual index value is larger than the fluctuation upper limit value or smaller than the fluctuation lower limit value.

With reference to fig. 6, at the current monitoring time point 13, 00, there are three possibilities for monitoring the CPU temperature of the device, the first is that the CPU temperature is M1, M1 is smaller than the fluctuation lower limit value at the current monitoring time point on the fluctuation lower limit curve, the second is that the CPU temperature is M3, M3 is larger than the fluctuation upper limit value at the current monitoring time point on the fluctuation upper limit curve, and when the CPU temperature is M1 or M3, it can be determined that the CPU temperature is abnormal and an alarm is given. The third is that the CPU temperature is M2, M2 is larger than the fluctuation lower limit value of the fluctuation lower limit curve at the current monitoring time point and smaller than the fluctuation upper limit value of the fluctuation upper limit curve at the current monitoring time point, and the CPU temperature can be judged to be normal without warning at the moment.

It should be noted that, in the above embodiment, the values of the preset fluctuation coefficient, the mild alarm fluctuation coefficient, and the severe alarm fluctuation coefficient may be in a percentage form, or may be specific numerical values. And for the same monitoring index, the values of the preset fluctuation coefficient/the light alarm fluctuation coefficient/the heavy alarm fluctuation coefficient of the monitoring index corresponding to all the devices to be monitored can be consistent. For the same device to be monitored, values of preset fluctuation coefficients/light alarm fluctuation coefficients/heavy alarm fluctuation coefficients of different monitoring indexes are different. The execution sequence of each step in the method embodiments described above is not limited to that shown in the drawings, and the execution sequence of each step is subject to the practical application.

Compared with the prior art, the embodiment of the invention has the following beneficial effects:

(1) And for the same monitoring index, the same fluctuation coefficient is adopted by all the devices to be monitored. Due to differences among the devices to be monitored in the aspects of working environment, working intensity, device types and the like, historical index values of the devices to be monitored in the same monitoring index at the same monitoring time point are different, and further the fluctuation ranges of actual index values of the devices to be monitored in the same monitoring index at the same monitoring time point are different. Therefore, the fluctuation information of each monitoring index of each device to be monitored is obtained through the fluctuation coefficient and the historical index value of each monitoring index, which are configured in advance on the alarm configuration platform, and the real-time self-adaptive monitoring of each monitoring index of each device to be monitored can be realized.

(2) The method comprises the steps that corresponding to each device to be monitored, historical index values corresponding to each monitoring time point in a time period are set in a historical time period which can be obtained by an alarm configuration platform, fluctuation information corresponding to each monitoring index is generated based on a fluctuation coefficient and the historical index values corresponding to each monitoring time point in the time period which are obtained in the historical time period, and then the corresponding monitoring indexes are monitored in real time by utilizing the fluctuation information, so that whether the monitoring indexes are abnormal or not can be judged in a self-adaptive mode, an alarm is given when the monitoring indexes are abnormal, the real-time monitoring strength of each device to be monitored is enhanced, and the safety is guaranteed.

(3) The fluctuation coefficient corresponding to each monitoring index can be set by comprehensively considering the actual application conditions of all the devices to be monitored, so that the alarm configuration is more flexible.

(4) The fluctuation information corresponding to each monitoring index of each device to be monitored is generated, real-time detection and judgment are carried out at each monitoring time point by utilizing the fluctuation information, and the condition of false alarm and missing report is avoided.

In order to execute the corresponding steps in the above method embodiments and various possible embodiments, an implementation manner of the platform-side data alarm device is given below.

Referring to fig. 7, fig. 7 is a schematic structural diagram illustrating a platform-side data alarm device according to an embodiment of the present invention. The device comprises: an acquisition module 210 and a monitoring module 220.

An obtaining module 210, configured to obtain, for each device to be monitored, fluctuation information corresponding to each monitoring index of the device to be monitored; the fluctuation information represents the range within which the actual index value of the monitoring index can fluctuate up and down at each monitoring time point in the set time period of the current time cycle.

The monitoring module 220 is used for monitoring each monitoring index in real time based on fluctuation information; and when the actual index value of any one monitoring index at the current monitoring time point exceeds the corresponding range which can fluctuate up and down, alarming the monitoring index.

In a possible implementation, the obtaining module 210 may specifically be configured to: aiming at each monitoring index, acquiring a historical index value corresponding to each monitoring time point of the monitoring index in a set time period of a historical time cycle; determining a first fluctuation upper limit value and a first fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in a set time period of a current time cycle based on a preset light alarm fluctuation coefficient and a historical index value to obtain light alarm fluctuation information of the monitoring index; and determining a second fluctuation upper limit value and a second fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in a set time period of the current time cycle based on a preset severe alarm fluctuation coefficient and a historical index value to obtain severe alarm fluctuation information of the monitoring index. The fluctuation information of the monitoring indexes comprises light alarm fluctuation information and heavy alarm fluctuation information.

The monitoring module 220 may specifically be configured to: aiming at each monitoring index, acquiring an actual index value of the monitoring index at the current monitoring time point; comparing the actual index value with a first fluctuation upper limit value, a first fluctuation lower limit value, a second fluctuation upper limit value and a second fluctuation lower limit value corresponding to the current monitoring time point respectively; when the actual index value is located between the first fluctuation upper limit value and the second fluctuation upper limit value or between the first fluctuation lower limit value and the second fluctuation lower limit value, judging that the monitoring index is abnormal and carrying out light warning on the monitoring index; and when the actual index value is greater than the second fluctuation upper limit value or smaller than the second fluctuation lower limit value, judging that the monitoring index is abnormal and giving a heavy alarm to the monitoring index.

In another possible implementation, the obtaining module 210 may specifically be configured to: aiming at each monitoring index, acquiring a historical index value corresponding to each monitoring time point of the monitoring index in a set time period of a historical time cycle; and determining a fluctuation upper limit value and a fluctuation lower limit value corresponding to each monitoring time point of the monitoring index in a set time period of the current time cycle based on the preset fluctuation coefficient and the historical index value to obtain fluctuation information of the monitoring index.

The monitoring module 220 may be specifically configured to: aiming at each monitoring index, acquiring an actual index value of the monitoring index at the current monitoring time point; respectively comparing the actual index value with a fluctuation upper limit value and a fluctuation lower limit value corresponding to the current monitoring time point; and when the actual index value is larger than the fluctuation upper limit value or smaller than the fluctuation lower limit value, judging that the monitoring index is abnormal and giving an alarm to the monitoring index.

In another possible implementation, the obtaining module 210 may specifically be configured to: aiming at each monitoring index, acquiring a historical index value corresponding to each monitoring time point of the monitoring index in a set time period of a historical time cycle; generating a standard reference curve of the monitoring index according to each historical index value; historical index values of the monitoring indexes corresponding to each monitoring time point exist on the standard reference curve; generating a fluctuation upper limit curve and a fluctuation lower limit curve of the monitoring index based on a preset fluctuation coefficient and a standard reference curve to obtain fluctuation information corresponding to the monitoring index; the fluctuation information comprises a fluctuation upper limit curve and a fluctuation lower limit curve, the fluctuation upper limit curve is provided with a fluctuation upper limit value of the monitoring index corresponding to each monitoring time point, and the fluctuation lower limit curve is provided with a fluctuation lower limit value of the monitoring index corresponding to each monitoring time point.

The monitoring module 220 may be specifically configured to: aiming at each monitoring index, acquiring an actual index value of the monitoring index at the current monitoring time point; comparing the actual index values with a fluctuation upper limit value corresponding to the current monitoring time on the fluctuation upper limit curve and a fluctuation lower limit value corresponding to the current monitoring time on the fluctuation lower limit curve respectively; and when the actual index value is larger than the fluctuation upper limit value or smaller than the fluctuation lower limit value, judging that the monitoring index is abnormal and giving an alarm to the monitoring index.

In one possible implementation, the monitoring index may include at least one of CPU occupancy, memory usage, disk space occupancy, CPU temperature, network traffic size, traffic protocol component ratio, number of IP addresses in traffic, and number of ports in traffic.

It can be clearly understood by those skilled in the art that, for convenience and simplicity of description, the specific working process of the platform-side data alarm device 200 described above may refer to the corresponding process in the foregoing method embodiment, and is not described herein again.

Referring to fig. 8, fig. 8 is a schematic structural diagram of a monitoring device according to an embodiment of the present invention. The monitoring device 300 includes a processor 310, a memory 320, and a bus 330, the processor 310 being coupled to the memory 320 via the bus 330.

The monitoring device 300 may be a computing server, a personal computer, a smart phone, etc., and an alarm configuration platform may be run on the monitoring device 300.

The memory 320 may be used to store software programs, such as the platform-side data alert device shown in FIG. 7. The Memory 320 may be, but is not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Flash Memory (Flash), a Programmable Read-Only Memory (PROM), an Erasable Read-Only Memory (EPROM), an electrically Erasable Read-Only Memory (EEPROM), and the like. The processor 310 may be an integrated circuit chip having signal processing capabilities. The Processor 310 may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), application Specific Integrated Circuits (ASICs), field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.

The memory 320 stores computer programs executable by the processor 310. When the processor 310 executes the computer program, the platform-side data alarm method disclosed in the above embodiment is implemented.

It will be appreciated that the configuration shown in fig. 8 is merely illustrative and that the monitoring device 300 may also include more or fewer components than shown in fig. 8 or have a different configuration than shown in fig. 8. The components shown in fig. 8 may be implemented in hardware, software, or a combination thereof.

The embodiment of the invention also provides a readable storage medium, wherein a computer program is stored on the readable storage medium, and when the computer program is executed by a processor, the computer program realizes the platform side data alarm method disclosed by the embodiment. The readable storage medium may be, but is not limited to: various media capable of storing program code, such as a U disk, a removable hard disk, a ROM, a RAM, a PROM, an EPROM, an EEPROM, a FLASH disk, or an optical disk.

To sum up, the embodiment of the invention provides a platform side data alarm method, a platform side data alarm device, monitoring equipment and a readable storage medium, wherein for each piece of equipment to be monitored, fluctuation information corresponding to each monitoring index of the equipment to be monitored is firstly obtained, then each monitoring index is monitored in real time based on the fluctuation information, and when an actual index value of any one monitoring index at a current monitoring time point exceeds a corresponding fluctuation range, the monitoring index is alarmed. In this way, by setting corresponding fluctuation information for each monitoring index of each device to be monitored, the fluctuation information can represent the fluctuation range of the actual index value of the monitoring index at each monitoring time point within the set time period of the current time cycle. When the fluctuation information is utilized to monitor the monitoring index in real time, the real index value of the monitoring index can be timely alarmed when exceeding the fluctuation range up and down at the current monitoring time point, and the phenomenon of misinformation and missing report can be avoided.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A platform side data alarm method is characterized by comprising the following steps:

the fluctuation information represents the fluctuation range of the actual index value of the monitoring index in each monitoring time point in the set time period of the current time cycle;

2. The method according to claim 1, wherein the step of obtaining fluctuation information corresponding to each monitoring index of the device to be monitored comprises:

3. The method of claim 2, wherein the step of monitoring each of the monitoring indicators in real time based on the fluctuation information comprises:

4. The method according to claim 1, wherein the step of obtaining fluctuation information corresponding to each monitoring index of the device to be monitored comprises:

the step of monitoring each monitoring index in real time based on the fluctuation information comprises:

5. The method according to claim 1, wherein the step of obtaining fluctuation information corresponding to each monitoring index of each device to be monitored for each device to be monitored comprises:

6. The method of claim 5, wherein the step of monitoring each of the monitoring metrics in real time based on the fluctuation information comprises:

7. The method according to any one of claims 1 to 6, wherein the monitoring index includes at least one of CPU occupancy, memory usage, disk space occupancy, CPU temperature, network traffic size, traffic protocol component ratio, number of IP addresses in traffic, and number of ports in traffic.

8. A platform-side data alert device, comprising:

the monitoring module is used for monitoring each monitoring index in real time based on the fluctuation information; and when the actual index value of any one monitoring index at the current monitoring time point exceeds the corresponding range which can fluctuate up and down, alarming the monitoring index.

9. A monitoring device, comprising: a memory storing a computer program executable by the processor, and a processor executing the computer program when the monitoring device is run to implement the method of any one of claims 1 to 7.

10. A readable storage medium, characterized in that it stores a computer program which is executed by a processor to implement the method of any one of claims 1 to 7.