CN115733733A

CN115733733A - Monitoring alarm method, device, computer equipment and storage medium

Info

Publication number: CN115733733A
Application number: CN202211459535.6A
Authority: CN
Inventors: 王鹏培; 杜楠; 程鹏; 唐月标
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2022-11-16
Filing date: 2022-11-16
Publication date: 2023-03-03

Abstract

The application relates to a monitoring alarm method, a monitoring alarm device, computer equipment, a storage medium and a computer program product, and relates to the technical field of cloud computing. The method comprises the following steps: acquiring the stored unitized monitoring information based on a preset data acquisition rule; the unitized monitoring information comprises unitized metadata and monitoring data corresponding to the unitized metadata; the unitization metadata represents a unit type of a unit in the unitization system; determining alarm judgment information corresponding to the monitoring alarm type according to the unitized monitoring information, the preset monitoring alarm type and the alarm judgment rule corresponding to the monitoring alarm type; sending alarm information corresponding to the monitoring alarm category according to the alarm judgment information and a preset alarm mode rule; the alarm information is used for monitoring and alarming the unitized system. By adopting the method, the abnormal operation condition of the unitized system can be found in time, and the monitoring and alarming of the data of the unitized system are realized.

Description

Monitoring alarm method, device, computer equipment and storage medium

Technical Field

The present application relates to the field of cloud computing technologies, and in particular, to a monitoring alarm method, an apparatus, a computer device, a storage medium, and a computer program product.

Background

A cell is a self-contained collection that can perform all business operations, and contains all services required by all businesses, as well as data assigned to the cell. The unitized architecture is to deploy a plurality of units in all rooms of a total station by taking the units as basic units for system deployment, wherein any one unit deploys all applications required by the system, and data is a part of full data which is divided horizontally according to a certain dimension (usually a customer dimension). Unitization is the process of engineering services and data to fit the characteristics of a unit.

The unitized system generates data, such as business data and log data, during operation. In order to ensure the normal operation of the unitized system, the data of the unitized system needs to be monitored, abnormal operation conditions of the unitized system are discovered in time, and an alarm is given to inform operation and maintenance personnel of the unitized system.

However, there is currently a lack of monitoring alarm methods suitable for use in unitized systems.

Disclosure of Invention

In view of the above, there is a need to provide a monitoring alarm method, apparatus, computer device, computer readable storage medium and computer program product, which can be applied to a unitized system.

In a first aspect, the present application provides a monitoring alarm method. The method comprises the following steps:

acquiring the stored unitized monitoring information based on a preset data acquisition rule; the unitized monitoring information comprises unitized metadata and monitoring data corresponding to the unitized metadata; the unitization metadata represents a unit type of a unit in a unitization system;

determining alarm judgment information corresponding to the monitoring alarm type according to the unitized monitoring information, a preset monitoring alarm type and an alarm judgment rule corresponding to the monitoring alarm type;

sending alarm information corresponding to the monitoring alarm category according to the alarm judgment information and a preset alarm mode rule; the alarm information is used for monitoring and alarming the unitized system.

In one embodiment, when the monitoring alarm category is an intra-unit traffic alarm, the determining, according to the unitized monitoring information, a preset monitoring alarm category and an alarm determination rule corresponding to the monitoring alarm category, the alarm determination information corresponding to the monitoring alarm category includes:

classifying the unitized monitoring information according to unit types, and determining unitized monitoring information corresponding to each unit type;

for each unit type, calculating a calculation result of each monitoring index in the unit type according to unitized monitoring information corresponding to the unit type and a preset monitoring index;

for each monitoring index, determining alarm judgment information corresponding to the monitoring index under the unit type according to the calculation result of the monitoring index; the alarm judgment information is used for indicating whether an alarm action is triggered or not;

and forming alarm judgment information corresponding to the flow alarm in the unit by using the alarm judgment information corresponding to each monitoring index under each unit type.

In one embodiment, the calculating, according to the unitized monitoring information corresponding to the unit type and a preset monitoring index, a calculation result of each monitoring index in the unit type includes:

calculating and storing a calculation result of each first monitoring index in the unit type within unit time according to the unitized monitoring information corresponding to the unit type and a preset first monitoring index;

calculating a calculation result of each second monitoring index according to a stored calculation result of each first monitoring index and a preset second monitoring index in each unit time under the unit type; the second monitoring index comprises a same ratio of the first monitoring index and a ring ratio of the first monitoring index;

and forming the calculation result of each monitoring index under the unit type by using the calculation result of each first monitoring index and the calculation result of each second monitoring index.

In one embodiment, when the monitoring alarm category is a cross-unit abnormal traffic alarm, the determining, according to the unitized monitoring information, a preset monitoring alarm category and an alarm determination rule corresponding to the monitoring alarm category, the alarm determination information corresponding to the monitoring alarm category includes:

for each transaction in the unitized monitoring information, determining each node through which the transaction passes;

aiming at each node, establishing a mapping relation between the timestamp of the node and the node information of the node; the node information at least comprises a unit type;

sequencing the mapping relations corresponding to the nodes according to the time sequence, and determining the node sequence of the transaction passing through the nodes according to the sequenced mapping relations;

determining alarm judgment information corresponding to the transaction according to the unit type number of the unit types of the nodes in the node sequence; the alarm judgment information is used for indicating whether an alarm action is triggered or not;

and forming alarm judgment information corresponding to the cross-unit abnormal flow alarm by using the alarm judgment information corresponding to each transaction.

In one embodiment, the alarm mode rule includes an alarm level determination rule and an alarm sending rule; the sending the alarm information corresponding to the monitoring alarm category according to the alarm determination information and a preset alarm mode rule comprises:

generating alarm content according to the target alarm template and the alarm judgment information; the alarm content comprises an alarm type;

determining an alarm level corresponding to the alarm content according to the alarm content and a preset alarm level judgment rule;

and determining and sending the alarm information corresponding to the monitoring alarm category according to a preset alarm sending rule, the alarm content and the alarm level.

In one embodiment, the determining and sending the alarm information corresponding to the monitoring alarm category according to the preset alarm sending rule, the alarm content, and the alarm level includes:

judging whether the alarm type exists in the alarm types corresponding to the sent alarm information;

if the alarm type exists in the alarm types corresponding to the sent alarm information, updating the alarm times of the alarm type;

and determining alarm information corresponding to the monitoring alarm category according to the alarm content, the alarm level and the alarm times of the alarm type in the preset scanning time, and sending the alarm information.

In one embodiment, the method further comprises:

checking whether a personalized alarm template exists;

under the condition that the personalized alarm template exists, checking whether the personalized alarm template meets the preset alarm template condition;

and taking the individual alarm template as a target alarm template under the condition that the individual alarm template meets the preset alarm template condition.

In one embodiment, the sending the alarm information corresponding to the monitoring alarm category according to the alarm determination information and a preset alarm manner rule includes:

for each transaction, checking whether an alarm information interface of alarm judgment information corresponding to the transaction is closed;

and if the alarm information interface is not closed, sending alarm information corresponding to the transaction according to the alarm judgment information corresponding to the transaction and a preset alarm mode rule.

In one embodiment, the method further comprises:

receiving a switching alarm instruction sent by a unitized system; the switching alarm instruction comprises switching alarm information; the switching alarm information is alarm information generated by the unitized system according to the node switching condition of the unitized system;

and responding to the switching alarm instruction, and sending alarm information according to the switching alarm information and a preset alarm mode rule.

In a second aspect, the application further provides a monitoring and warning device. The device comprises:

the acquisition module is used for acquiring the stored unitized monitoring information based on a preset data acquisition rule; the unitized monitoring information comprises unitized metadata and monitoring data corresponding to the unitized metadata; the unitization metadata represents a unit type of a unit in a unitization system;

the first determining module is used for determining alarm judging information corresponding to the monitoring alarm type according to the unitized monitoring information, a preset monitoring alarm type and an alarm judging rule corresponding to the monitoring alarm type;

the first sending module is used for sending the alarm information corresponding to the monitoring alarm category according to the alarm judgment information and a preset alarm mode rule; and the alarm information is used for monitoring and alarming the unitized system.

In one embodiment, in the case that the monitoring alarm category is an intra-unit traffic alarm, the first determining module is specifically configured to:

In one embodiment, the first determining module is specifically configured to:

In one embodiment, in the case that the monitoring alarm type is a cross-unit abnormal traffic alarm, the first determining module is specifically configured to:

In one embodiment, the alarm mode rule includes an alarm level determination rule and an alarm sending rule; the first sending module is specifically configured to:

In one embodiment, the first sending module is specifically configured to:

and determining alarm information corresponding to the monitoring alarm category according to the alarm content, the alarm level and the alarm frequency of the alarm type within the preset scanning time, and sending the alarm information.

In one embodiment, the apparatus further comprises:

the first checking module is used for checking whether the personalized alarm template exists or not;

the second checking module is used for checking whether the personalized alarm template meets the preset alarm template condition or not under the condition that the personalized alarm template exists;

and the second determining module is used for taking the individual alarm template as a target alarm template under the condition that the individual alarm template meets the preset alarm template condition.

In one embodiment, the first sending module is specifically configured to:

In one embodiment, the apparatus further comprises:

the receiving module is used for receiving a switching alarm instruction sent by the unitized system; the switching alarm instruction comprises switching alarm information; the switching alarm information is alarm information generated by the unitized system according to the node switching condition of the unitized system;

and the second sending module is used for responding to the switching alarm instruction and sending alarm information according to the switching alarm information and a preset alarm mode rule.

In a third aspect, the application also provides a computer device. The computer device comprises a memory in which a computer program is stored and a processor, which when executing the computer program performs the steps of the first aspect.

In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium, on which a computer program is stored which, when executed by a processor, performs the steps of the first aspect described above.

In a fifth aspect, the present application further provides a computer program product. The computer program product comprising a computer program that when executed by a processor performs the steps of the first aspect described above.

The monitoring alarm method, the monitoring alarm device, the computer equipment, the storage medium and the computer program product acquire the stored unitized monitoring information based on the preset data acquisition rule; the unitized monitoring information comprises unitized metadata and monitoring data corresponding to the unitized metadata; the unitization metadata represents a unit type of a unit in a unitization system; determining alarm judgment information corresponding to the monitoring alarm type according to the unitized monitoring information, a preset monitoring alarm type and an alarm judgment rule corresponding to the monitoring alarm type; sending alarm information corresponding to the monitoring alarm category according to the alarm judgment information and a preset alarm mode rule; the alarm information is used for monitoring and alarming the unitized system. Therefore, the alarm judgment information corresponding to the preset monitoring alarm type is determined according to the stored unitized monitoring information, and the alarm information corresponding to the monitoring alarm type is sent according to the alarm judgment information corresponding to the monitoring alarm type, so that the abnormal operation condition of the unitized system can be found in time, and the monitoring alarm of the data of the unitized system is realized.

Drawings

FIG. 1 is a block diagram of a unitized monitoring system in one embodiment;

FIG. 2 is a block diagram of a unitized system in one embodiment;

FIG. 3 is a flow diagram of a method for monitoring alarms in one embodiment;

FIG. 4 is a flowchart illustrating the steps of determining alarm decision information corresponding to the monitored alarm category in one embodiment;

FIG. 5 is a flowchart illustrating the step of calculating the calculation result of each monitoring indicator in the unit type according to an embodiment;

FIG. 6 is a flowchart illustrating the steps of determining alarm decision information corresponding to the monitored alarm category in another embodiment;

FIG. 7 is a flowchart illustrating a step of sending alarm information corresponding to the monitored alarm category in one embodiment;

FIG. 8 is a flowchart illustrating the steps of determining and sending alarm information corresponding to the monitored alarm category in one embodiment;

FIG. 9 is a flowchart illustrating a monitoring alarm method according to another embodiment;

FIG. 10 is a flowchart illustrating a step of sending alarm information corresponding to the monitored alarm category in another embodiment;

FIG. 11 is a flowchart illustrating a monitoring alarm method according to another embodiment;

FIG. 12 is a block diagram of a monitoring alarm device in one embodiment;

FIG. 13 is a diagram illustrating an internal structure of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

The monitoring and warning method provided by the embodiment of the application can be applied to the application environment shown in fig. 1. The unitized monitoring system 100 includes an acquisition end 102, a data processing node 104, and a server node 106. The unitized monitoring system is used for monitoring the unitized system. The unitized monitoring system can be realized by a cloud computing platform. For example, the unitized monitoring system may be implemented by Platform as a service (PaaS). It is understood that the collection end 102, the data processing node 104 and the server node 106 included in the unitized monitoring system 100 may be implemented by separate hardware devices, or may be implemented by software modules. The unitized system is a system in which units are used as basic units for system deployment, all applications required by the system are deployed in any one unit, and data of any one unit is a part of the whole data which is horizontally divided according to a certain dimension (usually a customer dimension). A cell is a self-contained collection that can perform all business operations, and contains all services required by all businesses, as well as data assigned to the cell. The units may be physical units or logical units. It is understood that the unit may be a terminal or a server. The server may be implemented as a stand-alone server or as a server cluster consisting of a plurality of servers. In one embodiment, a unitized system comprises: access unit, fragmentation unit and common unit as shown in fig. 2. The access unit comprises an application node A1. The fragmentation unit comprises an application node B1, an application node C1, an application node B2 and an application node C2. The common unit comprises an application B proxy layer and an application node D1. The access unit is a unit for accessing data. The slicing unit is a unit for processing data. The common unit is a unit that performs a common operation.

In one embodiment, as shown in fig. 3, a monitoring alarm method is provided, which is described by taking the method as an example applied to the unitized monitoring system in fig. 1, and includes the following steps:

step 301, based on a preset data obtaining rule, obtaining the stored unitized monitoring information.

The unitized monitoring information comprises unitized metadata and monitoring data corresponding to the unitized metadata. The unitization metadata represents a unit type of a unit in the unitization system.

In the embodiment of the present application, the monitoring data may be data of a unitized system. The unitization metadata is metadata representing attributes of the unit. The unitization metadata may include physical metadata and logical metadata. The physical metadata is metadata representing attributes of physical units. The logical metadata is metadata representing attributes of the logical unit. The physical unit is a unit in which a physical location to which a machine environment deployed by a server or the like belongs is located. For example, A-001 is used to represent a server deployed at address A, unit number 001. A logical unit is a unit in the logical sense that has a certain business meaning. For example, 10 units can be divided according to the card tail number of the personal account, and person-01 represents the unit with the card tail number of 1 of the personal account. The unit type is the type of unit in the unitized system. For example, a unitized system may comprise: an access unit, a fragmentation unit and a common unit. The access unit is a unit for accessing data. The slicing unit is a unit for processing data. The common unit is a unit that performs a common operation. The slicing unit comprises: the device comprises a slicing unit 1, a slicing unit 2, a slicing unit 3 and a slicing unit 4. The unit type of the slicing unit 1 is the slicing unit 1.

And the server node acquires the unitized monitoring information from the storage space for storing the unitized monitoring information. The unitized monitoring information can be directly stored monitoring information acquired by the unitized monitoring system, or acquired monitoring information which is acquired by the unitized monitoring system after data processing is performed on the acquired data by the unitized monitoring system.

Step 302, determining alarm judgment information corresponding to the monitoring alarm type according to the unitized monitoring information, the preset monitoring alarm type and the alarm judgment rule corresponding to the monitoring alarm type.

In the embodiment of the application, the server node presets the monitoring alarm category. Wherein, the monitoring alarm category includes: intra-cell traffic alarms and cross-cell abnormal traffic alarms. And then, the server node determines alarm judgment information corresponding to the monitoring alarm type according to the unitized monitoring information, the monitoring alarm type and the alarm judgment rule corresponding to the monitoring alarm type.

Step 303, sending the alarm information corresponding to the monitoring alarm category according to the alarm determination information and the preset alarm mode rule.

The alarm information is used for monitoring and alarming the unitized system.

In the embodiment of the application, the server node generates the alarm information corresponding to the monitoring alarm category according to the alarm judgment information and the preset alarm mode rule. And then, the server node sends the alarm information corresponding to the monitoring alarm category.

In the traffic observation method, the stored unitized monitoring information is acquired based on a preset data acquisition rule; determining alarm judgment information corresponding to the monitoring alarm type according to the unitized monitoring information, the preset monitoring alarm type and the alarm judgment rule corresponding to the monitoring alarm type; and sending the alarm information corresponding to the monitoring alarm category according to the alarm judgment information and a preset alarm mode rule. Therefore, the alarm judgment information corresponding to the preset monitoring alarm type is determined according to the stored unitized monitoring information, and the alarm information corresponding to the monitoring alarm type is sent according to the alarm judgment information corresponding to the monitoring alarm type, so that the abnormal operation condition of the unitized system can be found in time, and the monitoring alarm of the data of the unitized system is realized.

In an embodiment, as shown in fig. 4, when the monitoring alarm category is an intra-unit traffic alarm, a specific process of determining alarm determination information corresponding to the monitoring alarm category according to unitized monitoring information, a preset monitoring alarm category and an alarm determination rule corresponding to the monitoring alarm category includes the following steps:

step 401, according to the unit type, classifying the unitized monitoring information, and determining the unitized monitoring information corresponding to each unit type.

In the embodiment of the application, the server node classifies the unitized monitoring information according to the unit types to obtain the unitized monitoring information corresponding to each unit type.

In one example, the server node presets normal data conditions. And then, the server node determines normal data in the unitized monitoring information according to the preset normal data condition and the unitized monitoring information. Specifically, the server node takes the unitized monitoring information meeting the preset normal data condition as normal data in the unitized monitoring information. Then, the server node classifies the normal data in the unitized monitoring information according to the unit types to obtain the unitized monitoring information corresponding to each unit type. Wherein the normal data condition is a condition for determining normal data in the unitized monitoring information. The normal data condition may be that the unitized monitoring information includes a type identifier of a unitized index type, and may also be that the type identifier of the unitized index type included in the unitized monitoring information is a preset type identifier. The type identifier is used for representing a unitized index type of the unitized monitoring information. The unitized metric types may include a metric class, a system class, and a link class. The index-type unitized monitoring information is unitized monitoring information which is related to transaction actions and does not relate to a transaction link, and the index-type unitized monitoring information is used for measuring whether a transaction is successful or not. The unitized monitoring information of the index class includes, but is not limited to, transaction amount, transaction time consumption, whether the transaction is successful, and transaction exception type. The unitized monitoring information of the system class is data of an operating system related to transactions. The unitized monitoring information of the system class includes, but is not limited to, monitoring data of a Java Virtual Machine (Java Virtual Machine, jvm) of the Operating system and monitoring data of the Operating System (OS). The link-class unitized monitoring information is unitized monitoring information related to the transaction action and related to the transaction link, and the link-class unitized monitoring information is used for representing the transaction link. A transaction link is a series of services that a transaction may involve. For example, a payment transaction involves multiple services, and a series of services such as an agreement inquiry service, a blacklist check service, a customer authentication service, etc. are invoked before payment, and the data of the whole link is concatenated to form a completed payment transaction. The link class unitized monitoring information includes, but is not limited to, link links and call relations.

Step 402, for each unit type, calculating a calculation result of each monitoring index in the unit type according to the unitized monitoring information corresponding to the unit type and a preset monitoring index.

In the embodiment of the application, the server node sets the monitoring index in advance. The monitoring index is an index for monitoring the unitized system. The monitoring indicators include, but are not limited to, transaction counts, average response elapsed time, number of failed transactions, type of failure anomaly, number of transaction jitters, number of transaction sudden increases and decreases, and duration of transaction sudden increases and decreases. Then, for each unit type, the server node calculates the calculation result of each monitoring index under the unit type according to the unitized monitoring information corresponding to the unit type, each monitoring index and the calculation rule corresponding to each monitoring index.

Step 403, for each monitoring index, according to the calculation result of the monitoring index, determining alarm determination information corresponding to the monitoring index in the unit type.

The alarm judgment information is used for indicating whether to trigger an alarm action.

In the embodiment of the present application, for each monitoring index, the server node sets a threshold of the monitoring index in advance. Then, the server node compares the calculation result of the monitoring index with the threshold value of the monitoring index. And if the calculation result of the monitoring index is greater than or equal to the threshold value of the monitoring index, triggering an alarm action. If the calculation result of the monitoring index is smaller than the threshold value of the monitoring index, the alarm action is not triggered.

In one embodiment, the monitoring indicator is an average response time. The server node presets a threshold value of the average response time to be 30 milliseconds. Then, the server node compares the calculation result of the monitoring index with the threshold value of the monitoring index. And if the calculation result of the monitoring index is greater than or equal to the threshold value of the monitoring index, triggering an alarm action. If the calculation result of the monitoring index is smaller than the threshold value of the monitoring index, the alarm action is not triggered.

And then, the server node determines alarm judgment information corresponding to the monitoring index under the unit type according to whether an alarm action is triggered. Wherein, the alarm judgment information at least comprises whether to trigger the alarm action.

In one example, whether the server node triggers an alarm action is used as alarm judgment information corresponding to the monitoring index under the unit type.

In another example, the server node determines index abnormality information corresponding to the monitoring index according to whether the monitoring index triggers an alarm action. The index abnormality information indicates an abnormal monitoring index. The index abnormality information includes a monitoring index identification of the monitoring index. Then, the server node takes whether to trigger an alarm action and index abnormality information as alarm judgment information corresponding to the monitoring index in the unit type.

Step 404, alarm determination information corresponding to each monitoring index under each unit type is formed into alarm determination information corresponding to the flow alarm in the unit.

In the embodiment of the application, the server node forms alarm judgment information corresponding to the flow alarm in the unit according to the alarm judgment information corresponding to each monitoring index under each unit type.

In the flow observation method, the unitized monitoring information is classified according to the unit type, and the unitized monitoring information corresponding to each unit type is determined; aiming at each unit type, calculating a calculation result of each monitoring index under the unit type according to the unitized monitoring information corresponding to the unit type and a preset monitoring index; aiming at each monitoring index, determining alarm judgment information corresponding to the monitoring index under the unit type according to the calculation result of the monitoring index; and forming alarm judgment information corresponding to the flow alarm in the unit by using the alarm judgment information corresponding to each monitoring index under each unit type. Therefore, the stored unitized monitoring information is subjected to aggregation calculation according to the unit types, the alarm judgment information corresponding to each monitoring index under each unit type is respectively determined, the alarm judgment information corresponding to the monitoring alarm type is determined according to the alarm judgment information corresponding to each monitoring index under each unit type, the data of the unitized system can be monitored through each preset monitoring index, the abnormal operation condition of the flow in the unit of the unitized system can be found in real time, the alarm is given, and the instantaneity of the monitoring alarm of the unitized system is improved.

In an embodiment, as shown in fig. 5, calculating a calculation result of each monitoring index in the unit type according to the unitized monitoring information corresponding to the unit type and a preset monitoring index includes:

step 501, calculating and storing the calculation result of each first monitoring index in the unit type in unit time according to the unitized monitoring information corresponding to the unit type and a preset first monitoring index.

In the embodiment of the present application, the server node sets the unit time in advance.

In one example, the server node receives a set time selected by a user through a front-end interface. Then, the server node may set the time as a unit time.

In another example, if the server node does not receive the set time selected by the user through the front-end interface, the server node may take the default time as the unit time. For example, the default time may be 1 hour.

Meanwhile, the server node presets a first monitoring index. The first monitoring index is an index for monitoring the unitized system in unit time. The first monitoring index includes, but is not limited to, transaction number, average response time, failure number, failure exception type, transaction jitter number, transaction sudden increase and decrease number, and transaction sudden increase and decrease duration. Then, the server node calculates the calculation result of each first monitoring index in the unit type in unit time according to the unitized monitoring information corresponding to the unit type, each first monitoring index and the calculation rule corresponding to each first monitoring index. Then, the server node stores the calculation results of the respective first monitoring indices in the unit type for the unit time.

In one example, the server node stores the calculation result of each first monitoring index in the unit type in the intra-unit traffic early warning hour table in unit time.

Step 502, calculating the calculation result of each second monitoring index according to the stored calculation result of each first monitoring index in each unit time and the preset second monitoring index in the unit type.

The second monitoring index comprises a same ratio of the first monitoring index and a ring ratio of the first monitoring index.

In the embodiment of the present application, the server node sets the second monitoring index in advance. Wherein the second monitoring index is used to represent the change of the first monitoring index in each unit time. Then, the server node acquires the stored calculation results of the first monitoring indexes in the unit type in each unit time. In one example, the server node may periodically scan the calculation of the first monitoring indicator in the intra-unit traffic alert hour table. Then, the server node calculates the calculation result of each second monitoring index according to the stored calculation result of each first monitoring index, each second monitoring index and the calculation rule corresponding to each second monitoring index in each unit time under the unit type.

Step 503, the calculation result of each first monitoring index and the calculation result of each second monitoring index form the calculation result of each monitoring index under the unit type.

In the embodiment of the present application, the server node constructs the calculation result of each monitoring index in the unit type from the calculation result of each first monitoring index and the calculation result of each second monitoring index.

In the flow observation method, the calculation result of each first monitoring index in the unit type is calculated and stored in unit time according to the unitized monitoring information corresponding to the unit type and the preset first monitoring index; calculating the calculation result of each second monitoring index according to the stored calculation result of each first monitoring index in each unit time and a preset second monitoring index; and forming the calculation result of each monitoring index under the unit type by using the calculation result of each first monitoring index and the calculation result of each second monitoring index. Therefore, the stored unitized monitoring information is subjected to the convergence calculation according to the unit types, not only is the calculation result of the first monitoring index calculated, but also the calculation result of the second monitoring index is calculated, so that the unitized system can be monitored in real time in each unit time, the impending abnormity of the unitized system can be predicted through the change of the first monitoring index in each unit time, operation and maintenance personnel can intervene in advance to prevent the occurrence of the abnormity, the monitoring alarm predictability of the unitized system is improved, and the monitoring alarm instantaneity and effectiveness of the unitized system are further improved. Meanwhile, the monitoring data of the unitized system can be analyzed in a longer time range by calculating the second monitoring index, and the unitized system can be monitored from a wider visual sense to the abnormity of the data, so that the multi-angle monitoring is realized.

In one embodiment, the first monitoring index is an average response elapsed time, and the unit time is 1 hour, and the first monitoring index is a ring ratio increase speed of the average response elapsed time. The server node acquires the stored average response time of 25 milliseconds before 1 hour, 15 milliseconds before 2 hours and 14 milliseconds before 3 hours. Then, the server node calculates a ring ratio increase rate of the average response time consumed before 1 hour to be 66.7% and a ring ratio increase rate of the average response time consumed before 2 hours to be 7.1% according to the stored calculation results of the first monitoring indexes, the second monitoring indexes and the calculation rules corresponding to the second monitoring indexes in the unit type in each unit time. Then, the server node constructs the calculation result of the monitoring index under the unit type by using the calculation result of the first monitoring index and the calculation result of the second monitoring index. Then, for the average response time consumption of the first monitoring index, the server node compares each calculation result of the average response time consumption with a threshold value of 30 milliseconds of the average response time consumption. And if all the calculation results of the average response time consumption are smaller than the threshold value of the average response time consumption, the alarm action is not triggered. Meanwhile, aiming at the ring ratio increase speed consumed by the average response of the second monitoring index, the server node compares each calculation result of the ring ratio increase speed consumed by the average response with the threshold value of 30% of the ring ratio increase speed consumed by the average response. And if the calculation result of the ring ratio increase speed consumed by the average response before 2 hours is less than the threshold value of the ring ratio increase speed consumed by the average response, the alarm action is not triggered. And if the calculation result of the ring ratio increase speed consumed by the average response before 1 hour is larger than the threshold value of the ring ratio increase speed consumed by the average response, triggering an alarm action. And then, the server node determines alarm judgment information corresponding to each monitoring index under the unit type according to whether the alarm action is triggered. It can be seen that while the average response time in the last three hours is within the normal range of the monitoring threshold, the last 1 hour is much more than 2 hours ago, and the abnormality in the amplification is often a precursor of the abnormality of the program. Therefore, by simultaneously adopting the first monitoring index and the second monitoring index, the abnormity can be analyzed through monitoring in a wider range, operation and maintenance personnel can intervene in advance, the accident is prevented, the predictability of the monitoring alarm of the unitized system is improved, and the instantaneity and the effectiveness of the monitoring alarm of the unitized system are further improved.

In an embodiment, as shown in fig. 6, when the monitoring alarm category is a cross-unit abnormal traffic alarm, a specific process of determining alarm determination information corresponding to the monitoring alarm category according to the unitized monitoring information, a preset monitoring alarm category and an alarm determination rule corresponding to the monitoring alarm category includes the following steps:

step 601, for each transaction in the unitized monitoring information, determining each node through which the transaction passes.

In the embodiment of the application, for each transaction in the unitized monitoring information, the server node determines each node through which the transaction passes according to the transaction information of the transaction. Wherein, a plurality of nodes are included in the unit of the unitized system. The node may be a server node.

Step 602, for each node, establishing a mapping relationship between the timestamp of the node and the node information of the node.

Wherein the node information includes at least a cell type.

In the embodiment of the application, the server node determines the timestamp corresponding to each node and the node information corresponding to each node according to the transaction information of the transaction. Wherein the node information is information of a unit of the unitized system. The node information may also include time consumption. Then, for each node, the server node establishes a mapping relation between the timestamp of the node and the node information of the node.

Step 603, according to the time sequence, sequencing the mapping relations corresponding to the nodes, and according to the sequenced mapping relations, determining the node sequence of the transaction passing through the nodes.

In the embodiment of the application, the server nodes sequence the mapping relations corresponding to the nodes according to the time sequence. Then, the server node takes the sequence of each node in the sorted mapping relationship as the node sequence of the transaction passing through each node.

Step 604, determining alarm determination information corresponding to the transaction according to the unit type number of the unit types of the nodes in the node sequence.

In the embodiment of the application, the server node presets the threshold value of the number of categories corresponding to one transaction. Wherein, the threshold value of the number of categories can be 3, 4 or 5. For example, the number of categories threshold may be 5. Then, the server node calculates the number of categories of the unit types in the node sequence according to the unit types corresponding to the nodes in the node sequence. The server node then compares the number of categories to which the node order corresponds to a threshold number of categories. If the category number corresponding to the node sequence is smaller than the threshold value of the category number, the alarm action is not triggered. And if the category number corresponding to the node sequence is greater than or equal to the category number threshold, triggering an alarm action.

In one example, the server node sets a threshold of the number of categories and a threshold of the number of sharded units corresponding to one transaction in advance. Wherein, the threshold of the number of the fragmentation units may be 2. Then, the server node calculates the category number of the unit type in the node sequence according to the unit type corresponding to each node in the node sequence. The server node then compares the number of categories to which the node order corresponds to a threshold number of categories. And if the category number corresponding to the node sequence is smaller than the threshold value of the category number, not triggering the alarm action. And if the category number corresponding to the node sequence is greater than or equal to the threshold value of the category number, triggering an alarm action. Meanwhile, the server node calculates the number of the fragmentation units of which the unit types in the node sequence are the fragmentation units according to the unit types corresponding to the nodes in the node sequence. Then, the server node compares the number of the fragmentation units corresponding to the node sequence with the fragmentation unit number threshold value. And if the number of the fragmentation units corresponding to the node sequence is less than the fragmentation unit number threshold, not triggering an alarm action. And if the number of the fragmentation units corresponding to the node sequence is greater than or equal to the fragmentation unit number threshold, triggering an alarm action.

And then, the server node determines alarm judgment information corresponding to the transaction according to whether the alarm action is triggered. Wherein, the alarm judgment information at least comprises whether to trigger the alarm action.

In one example, the server node will trigger an alarm action as the alarm decision information corresponding to the transaction.

In another example, the server node generates a cross-unit abnormal traffic alarm identifier corresponding to the alarm triggering action while the alarm triggering action is triggered. The cross-unit abnormal traffic alarm identifier is used for representing the category of the cross-unit abnormal traffic alarm. The types of the cross-unit abnormal traffic alarm comprise unit type number abnormality and fragmentation unit number abnormality. And then, the server node determines cross-unit abnormal information corresponding to the transaction according to the cross-unit abnormal flow alarm identifier of the transaction. And the cross-unit abnormal information comprises cross-unit abnormal flow alarm identification. Specifically, the server node may identify the cross-unit abnormal traffic alarm of the transaction as cross-unit abnormal information corresponding to the transaction. Then, the server node takes whether to trigger the alarm action and the cross-unit abnormal information as the alarm judgment information corresponding to the transaction.

Step 605, the alarm determination information corresponding to each transaction is formed into alarm determination information corresponding to the cross-unit abnormal flow alarm.

In the embodiment of the application, the server node forms alarm judgment information corresponding to cross-unit abnormal flow alarm by using the alarm judgment information corresponding to each transaction.

In the flow observation method, each node through which each transaction passes is determined for each transaction in the unitized monitoring information; aiming at each node, establishing a mapping relation between the timestamp of the node and the node information of the node; sequencing the mapping relations corresponding to the nodes according to the time sequence, and determining the node sequence of the transaction passing through the nodes according to the sequenced mapping relations; determining alarm judgment information corresponding to the transaction according to the unit type number of the unit types of the nodes in the node sequence; and forming alarm judgment information corresponding to the cross-unit abnormal flow alarm by using the alarm judgment information corresponding to each transaction. Therefore, whether cross-unit abnormity exists in the transaction or not is judged through the number of unit types of nodes passed by the transaction, whether alarm action is triggered or not is judged, the unitized system can be monitored and analyzed from multiple angles such as whether the flow distribution of unit dimensions is balanced or not, the number of flow passing units and the flow direction of the flow, and the cross-unit abnormal flow of the unitized system is monitored. In addition, the data of the unitized system is monitored through the number of the fragmented units of one transaction, the cross-unit abnormal operation condition possibly existing in the unitized system can be found in time, the alarm is given, and the instantaneity of the monitoring alarm of the unitized system is further improved.

In one embodiment, as shown in fig. 7, the alarm mode rule includes an alarm level determination rule and an alarm sending rule; according to the alarm judgment information and the preset alarm mode rule, the specific process of sending the alarm information corresponding to the monitoring alarm category comprises the following steps:

step 701, generating alarm content according to the target alarm template and the alarm judgment information.

Wherein the alarm content comprises an alarm type.

In the embodiment of the application, the server node determines the target alarm template in advance. In one example, the server node may pre-store a default alert template. The server node may then use the default alarm template as the target alarm template. Wherein, the default alarm template may include: time of alarm and type of alarm. For example, the default alarm template may be at alarm time A, alarm type B, number of related transactions C, and influence scope D. The alarm type is the type of the abnormal event that triggers the alarm action. The types of alarms may include: intra-cell traffic alarms and cross-cell abnormal traffic alarms. The intra-cell traffic alarms may include various monitoring indicator anomaly alarms. The cross-unit abnormal traffic alarm can comprise unit type category number abnormal alarm and fragmentation unit number abnormal alarm.

And then, the server node determines the alarm time and the alarm type according to the alarm judgment information. In one example, the server node takes the time when the alarm determination information is generated as the alarm time. Meanwhile, the server node determines the alarm type according to the monitoring index identifier or the cross-unit abnormal flow alarm identifier included in the alarm judgment information. And then, the server node converts the alarm time and the alarm type into alarm content according to the target alarm template.

Step 702, determining the alarm level corresponding to the alarm content according to the alarm content and the preset alarm level determination rule.

In the embodiment of the application, the server node presets an alarm level judgment rule. And then, the server node determines the alarm level corresponding to the alarm content according to the alarm content and the alarm level judgment rule. And the alarm level judgment rule is used for judging the alarm level corresponding to the alarm content. The alert level indicates the urgency of the alert.

In one example, the alarm level decision rule includes a correspondence between alarm types and alarm levels. And then, the server node determines the alarm level corresponding to the alarm content according to the corresponding relation between the alarm type and the alarm level and the alarm type in the alarm content.

In one embodiment, the alarm type of the abnormal alarm for the second monitoring indicator corresponds to an alarm level next to the emergency alarm. Therefore, operation and maintenance personnel can intervene in advance as soon as possible aiming at the impending abnormity of the unitized system, so as to prevent the occurrence of the abnormity, further improve the predictability of the monitoring alarm of the unitized system, and further improve the instantaneity and the effectiveness of the monitoring alarm of the unitized system.

And 703, determining and sending the alarm information corresponding to the monitoring alarm category according to a preset alarm sending rule, alarm content and alarm level.

In the embodiment of the application, the server node sets the alarm sending rule in advance. Wherein the alarm sending rule indicates a sending mode of the alarm information. And then, the server node forms alarm information corresponding to the monitoring alarm category by the alarm content and the alarm level. The server node then stores the alert information. In one example, the server node stores the alert information in an alert list. And simultaneously, the server node sends the alarm information according to the alarm sending rule.

In one example, the server node determines the sending time of the alarm information according to the alarm sending rule and the alarm level of the alarm information. Then, the server node transmits the alarm information at the transmission time of the alarm information.

In the flow observation method, alarm content is generated according to a target alarm template and alarm judgment information; determining an alarm level corresponding to the alarm content according to the alarm content and a preset alarm level judgment rule; and determining and sending the alarm information corresponding to the monitoring alarm category according to a preset alarm sending rule, alarm content and alarm level. Therefore, by sending the alarm information carrying the alarm type and the alarm level, the working personnel can determine the fault of the unitized system in time according to the alarm type, reasonably arrange the handling time of the fault of the unitized system according to the alarm level and improve the accuracy and effectiveness of monitoring and alarming of the unitized system.

In one embodiment, as shown in fig. 8, a specific process of determining and sending alarm information corresponding to a monitored alarm category according to a preset alarm sending rule, alarm content and alarm level includes the following steps:

step 801, judging whether the alarm type exists in the alarm types corresponding to the sent alarm information.

In the embodiment of the application, the server node acquires each sent alarm message. In one example, the server node obtains each alarm information that has been sent from the alarm list. Then, the server node compares the alarm type with the alarm types corresponding to the sent alarm information in sequence, and judges whether the alarm type exists in the alarm types corresponding to the sent alarm information.

Step 802, if the alarm type exists in the alarm types corresponding to the sent alarm information, updating the alarm times of the alarm type.

In the embodiment of the application, if the alarm type exists in the alarm types corresponding to the sent alarm information, the server node adds 1 to the alarm times of the alarm type to complete the updating of the alarm times of the alarm type.

Step 803, according to the alarm content, the alarm level and the alarm times of the alarm type within the preset scanning time, determining the alarm information corresponding to the monitoring alarm type, and sending the alarm information.

In the embodiment of the application, the server node sets the scanning time in advance. Wherein the scanning time is a period of time. For example, the scan time may be 5 minutes. Then, the server node counts the alarm times of the alarm type within the preset scanning time. Then, the server node constructs the alarm information corresponding to the monitoring alarm category according to the alarm content, the alarm level and the alarm times of the alarm type in the preset scanning time. The server node then stores the alert information. In one example, the server node stores the alert information in an alert list. And simultaneously, the server node sends the alarm information according to the alarm sending rule.

In one embodiment, the alarm information corresponding to the monitoring alarm category is "node switching occurs E times in approximately five minutes, please process".

In the traffic observation method, whether the alarm type exists in the alarm types corresponding to the sent alarm information is judged; if the alarm type exists in the alarm types corresponding to the sent alarm information, updating the alarm times of the alarm type; and determining alarm information corresponding to the monitoring alarm category according to the alarm content, the alarm level and the alarm frequency of the alarm type within the preset scanning time, and sending the alarm information. Therefore, by compressing the alarm information with the same alarm type, a large amount of repeated alarm information is not directly sent, but the repeated alarm information is compressed into one piece to be sent to operation and maintenance personnel, so that the occurrence of tsunami caused by frequent alarm after the abnormity of the unitized system occurs is reduced, the operation and maintenance personnel can pay attention to the useful alarm information, the flooding of a large amount of information is prevented, the simplicity of monitoring and alarming of the unitized system is improved, and the accuracy and the effectiveness of monitoring and alarming of the unitized system are further improved.

In one embodiment, as shown in fig. 9, the monitoring alarm method further includes the following steps:

step 901, checking whether a personalized alarm template exists.

In the embodiment of the application, the server node checks whether the personalized alarm template exists. Specifically, the server node checks whether the identifier of the personalized alarm template is set. The personalized alarm template is an alarm template of a non-default alarm template set by a user through a front-end interface.

And 902, checking whether the individual alarm template meets the preset alarm template condition or not under the condition that the individual alarm template exists.

In the embodiment of the application, the server node presets the alarm template condition. Wherein, the alarm template condition is used for measuring whether the alarm template is qualified or not. The alarm template conditions may include the length of the alarm content and whether the alarm content has illegal characters. For example, the alarm template condition may be whether the alarm content has a length of less than 1000 words and the alarm content of a digital type has illegal characters. And under the condition that the individual alarm template exists, the server node checks whether the individual alarm template meets the alarm template condition.

And under the condition that the personalized alarm template does not exist, the server node takes the default alarm template as a target alarm template.

And 903, taking the personalized alarm template as a target alarm template under the condition that the personalized alarm template meets the preset alarm template conditions.

In the embodiment of the application, the server node takes the personalized alarm template as the target alarm template under the condition that the personalized alarm template meets the preset alarm template condition.

And under the condition that the individual alarm template does not meet the preset alarm template condition, the server node takes the default alarm template as a target alarm template.

In the flow observation method, whether a personalized alarm template exists is checked; under the condition that the individual alarm template exists, whether the individual alarm template meets the preset alarm template condition is checked; and under the condition that the individual alarm template meets the preset alarm template conditions, taking the individual alarm template as a target alarm template. Therefore, under the condition that the individualized alarm template exists, the individualized alarm template is checked, the individualized alarm template passing the check is used as a target alarm template, and the individuation of the monitoring alarm of the unitized system is improved.

In one embodiment, as shown in fig. 10, a specific process of sending the alarm information corresponding to the monitoring alarm category according to the alarm determination information and the preset alarm mode rule includes the following steps:

step 1001, for each transaction, checks whether the alarm information interface of the alarm determination information corresponding to the transaction is closed.

In the embodiment of the application, the server node provides an alarm information interface of alarm judgment information corresponding to each transaction in advance. The alarm information interface is used for a user to open or close the alarm information corresponding to the alarm information interface. Then, aiming at each transaction, the server node checks whether an alarm information interface of the alarm judgment information corresponding to the transaction is closed.

Step 1002, if the alarm information interface is not closed, sending alarm information corresponding to the transaction according to alarm determination information corresponding to the transaction and a preset alarm mode rule.

In the embodiment of the application, if the alarm information interface is not closed, the server node sends the alarm information corresponding to the transaction according to the alarm determination information corresponding to the transaction and a preset alarm mode rule.

If the alarm information interface is closed, the server node does not send the alarm information corresponding to the transaction according to a preset alarm mode rule.

In the flow observation method, whether an alarm information interface of alarm judgment information corresponding to each transaction is closed or not is checked aiming at each transaction; and if the alarm information interface is not closed, sending alarm information corresponding to the transaction according to alarm judgment information corresponding to the transaction and a preset alarm mode rule. The unit system may cross units in partial scenes, for example, a certain service in the unit is unavailable, the service of the standby unit takes over the transaction, the transaction is forwarded to the standby unit at the moment, and the normal phenomenon that one transaction passes through two fragment units at the moment is generated. Therefore, an alarm information interface is provided, when a cross-unit scene occurs after switching, operation and maintenance personnel can call the alarm information interface to close the alarm information, detect the switch of the alarm information interface before sending the alarm information subsequently, judge whether to send the alarm information, and can combine the actual conditions of the unitized system to avoid repeatedly sending wrong alarm information, improve the monitoring alarm mobility of the unitized system, and further improve the accuracy and effectiveness of the monitoring alarm of the unitized system.

In one embodiment, as shown in fig. 11, the monitoring and alarming method further includes the following steps:

step 1101, receiving a switching alarm instruction sent by the unitization system.

Wherein, the switching alarm instruction comprises switching alarm information. The switching alarm information is alarm information generated by the unitized system according to the node switching condition of the unitized system.

In the embodiment of the application, the server node receives a switching alarm instruction sent by the unitization system. The switching alarm instruction is used for instructing the server node to carry out switching alarm of the unitized system. The handover alarm information indicates a handover situation of the unitized system.

The unitized system is a distributed service. When unavailable scenes such as abnormal service and the like occur in the unit of the unitized system, the unitized system automatically identifies the currently available nodes and forwards the transaction to the available nodes for processing. At this time, the service operation state of the unitized system is switched once. Then, the unitized system generates a piece of switching alarm information according to the forwarding condition. For example, when the transaction is originally conducted on the X machine, the X machine fails due to other reasons such as machine performance, and the transaction cannot be conducted any more, the unitized system forwards the subsequently accessed transaction to the Y machine, and the switching alarm information is "X failure occurs at time Z and is switched to Y". Then, the unitized system sends a switching alarm instruction carrying switching alarm information.

Step 1102, in response to the switching alarm instruction, sending alarm information according to the switching alarm information and a preset alarm mode rule.

In the embodiment of the application, the server node responds to the switching alarm instruction and generates alarm information according to the switching alarm information and a preset alarm mode rule. And then, the server node sends alarm information according to the alarm mode rule.

In the flow observation method, a switching alarm instruction sent by a unitized system is received; and responding to the switching alarm instruction, and sending alarm information according to the switching alarm information and a preset alarm mode rule. Therefore, by providing the interface, when the distributed service operation state generates an alarm, the generated switching alarm information is informed to the server node through the calling interface, the server node completes the alarm, the distributed flow switching alarm monitored by the unitized system is realized, and the monitoring alarm diversity of the unitized system is improved. In addition, as the unitized system is a distributed service, a large number of service nodes exist and are deployed in the cloud container, and when network layer jitter is unavailable, a large number of scenes of switching among the nodes exist. For example, within 5 minutes, thousands of switches may occur, which may place a significant burden on the operation and maintenance personnel if thousands of alarm messages are sent directly, and repeating similar alarms may cause the operation and maintenance personnel to ignore other useful alarms. If the alarm information with the same alarm type is subjected to alarm compression, a large amount of repeated alarm information is not directly sent, but the repeated alarm information is compressed into one piece and sent to operation and maintenance personnel, so that the occurrence of tsunami caused by frequent alarms after the abnormity of the unitized system occurs can be reduced, the operation and maintenance personnel can pay attention to the useful alarm information, the flooding of a large amount of information is prevented, the simplicity of monitoring and alarming of the unitized system is improved, and the accuracy and effectiveness of monitoring and alarming of the unitized system are further improved.

It should be understood that, although the steps in the flowcharts related to the embodiments described above are shown in sequence as indicated by the arrows, the steps are not necessarily performed in sequence as indicated by the arrows. The steps are not limited to being performed in the exact order illustrated and, unless explicitly stated herein, may be performed in other orders. Moreover, at least a part of the steps in the flowcharts related to the embodiments described above may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, and the execution order of the steps or stages is not necessarily sequential, but may be rotated or alternated with other steps or at least a part of the steps or stages in other steps.

Based on the same inventive concept, the embodiment of the application also provides a monitoring and alarming device for realizing the monitoring and alarming method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the method, so the specific limitations in one or more embodiments of the monitoring and warning device provided below can be referred to the limitations of the monitoring and warning method in the above, and are not described herein again.

In one embodiment, as shown in fig. 12, there is provided a monitoring alarm device 1200, comprising: an obtaining module 1210, a first determining module 1220, and a first sending module 1230, wherein:

an obtaining module 1210, configured to obtain stored unitized monitoring information based on a preset data obtaining rule; the unitized monitoring information comprises unitized metadata and monitoring data corresponding to the unitized metadata; the unitization metadata represents a unit type of a unit in a unitization system;

a first determining module 1220, configured to determine alarm determination information corresponding to the monitoring alarm category according to the unitized monitoring information, a preset monitoring alarm category, and an alarm determination rule corresponding to the monitoring alarm category;

the first sending module 1230 is configured to send alarm information corresponding to the monitoring alarm category according to the alarm determination information and a preset alarm mode rule; and the alarm information is used for monitoring and alarming the unitized system.

Optionally, in the case that the monitoring alarm category is an intra-unit traffic alarm, the first determining module 1220 is specifically configured to:

Optionally, the first determining module 1220 is specifically configured to:

calculating a calculation result of each second monitoring index according to a calculation result of each first monitoring index and a preset second monitoring index which are stored in each unit time and under the unit type; the second monitoring index comprises a same ratio of the first monitoring index and a ring ratio of the first monitoring index;

Optionally, in the case that the monitoring alarm category is a cross-unit abnormal traffic alarm, the first determining module 1220 is specifically configured to:

Optionally, the alarm mode rule includes an alarm level determination rule and an alarm sending rule; the first sending module 1230 is specifically configured to:

and determining and sending alarm information corresponding to the monitoring alarm category according to a preset alarm sending rule, the alarm content and the alarm level.

Optionally, the first sending module 1230 is specifically configured to:

Optionally, the apparatus 1200 further includes:

Optionally, the first sending module 1230 is specifically configured to:

Optionally, the apparatus 1200 further includes:

All or part of the modules in the monitoring and warning device can be realized by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in fig. 13. The computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless communication can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by a processor to implement a monitoring alarm method. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.

Those skilled in the art will appreciate that the architecture shown in fig. 13 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In an embodiment, a computer device is provided, comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the steps of the above method embodiments when executing the computer program.

In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which computer program, when being executed by a processor, carries out the steps of the above-mentioned method embodiments.

In an embodiment, a computer program product is provided, comprising a computer program which, when being executed by a processor, carries out the steps of the above-mentioned method embodiments.

It should be noted that, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, presented data, etc.) referred to in the present application are information and data authorized by the user or sufficiently authorized by each party.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, database, or other medium used in the embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high-density embedded nonvolatile Memory, resistive Random Access Memory (ReRAM), magnetic Random Access Memory (MRAM), ferroelectric Random Access Memory (FRAM), phase Change Memory (PCM), graphene Memory, and the like. Volatile Memory can include Random Access Memory (RAM), external cache Memory, and the like. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), among others. The databases involved in the embodiments provided herein may include at least one of relational and non-relational databases. The non-relational database may include, but is not limited to, a block chain based distributed database, and the like. The processors referred to in the embodiments provided herein may be general purpose processors, central processing units, graphics processors, digital signal processors, programmable logic devices, quantum computing based data processing logic devices, etc., without limitation.

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present application. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. A monitoring alarm method, the method comprising:

2. The method according to claim 1, wherein, in a case that the monitoring alarm category is an intra-cell traffic alarm, the determining the alarm determination information corresponding to the monitoring alarm category according to the unitized monitoring information, a preset monitoring alarm category and an alarm determination rule corresponding to the monitoring alarm category comprises:

classifying the unitized monitoring information according to unit types, and determining the unitized monitoring information corresponding to each unit type;

3. The method according to claim 2, wherein the calculating, according to the unitized monitoring information corresponding to the unit type and preset monitoring indexes, the calculation result of each monitoring index in the unit type includes:

4. The method according to claim 1, wherein in a case that the monitoring alarm category is a cross-unit abnormal traffic alarm, the determining the alarm determination information corresponding to the monitoring alarm category according to the unitized monitoring information, a preset monitoring alarm category and the alarm determination rule corresponding to the monitoring alarm category includes:

5. The method according to claim 1, wherein the alarm manner rule includes an alarm level decision rule and an alarm sending rule; the sending the alarm information corresponding to the monitoring alarm category according to the alarm determination information and a preset alarm mode rule comprises:

6. The method according to claim 5, wherein the determining and sending the alarm information corresponding to the monitoring alarm category according to the preset alarm sending rule, the alarm content and the alarm level comprises:

7. The method of claim 5, further comprising:

checking whether a personalized alarm template exists;

under the condition that the individual setting alarm template exists, checking whether the individual setting alarm template meets the preset alarm template condition or not;

8. The method according to claim 4, wherein the sending the alarm information corresponding to the monitoring alarm category according to the alarm determination information and a preset alarm manner rule comprises:

9. The method of claim 1, further comprising:

10. A monitoring and alarm device, the device comprising:

11. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor realizes the steps of the method of any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 9.

13. A computer program product comprising a computer program, characterized in that the computer program realizes the steps of the method of any one of claims 1 to 9 when executed by a processor.