CN116260702A

CN116260702A - Method, device, computer equipment and storage medium for data monitoring

Info

Publication number: CN116260702A
Application number: CN202310005607.8A
Authority: CN
Inventors: 李景钊; 齐志彪
Original assignee: Shenzhen Pudu Technology Co Ltd
Current assignee: Shenzhen Pudu Technology Co Ltd
Priority date: 2023-01-04
Filing date: 2023-01-04
Publication date: 2023-06-13

Abstract

The present application relates to a method, apparatus, computer device, storage medium and computer program product for data monitoring. The method comprises the following steps: acquiring monitoring data from a target data source; extracting a target field from the monitoring data based on a data format corresponding to the target data source; mapping the target field to an index field according to a field mapping relation; calculating the index data in the index field based on the alarm triggering condition corresponding to the monitoring data to obtain a calculation result; and if the calculation result reaches the alarm threshold value corresponding to the alarm triggering condition, alarming based on an alarm strategy. By adopting the method, the monitoring efficiency of the intelligent equipment can be improved.

Description

Method, device, computer equipment and storage medium for data monitoring

Technical Field

The present application relates to the field of computer technology, and in particular, to a method, an apparatus, a computer device, a storage medium, and a computer program product for data monitoring.

Background

With the development of computer technology, intelligent devices are widely used in various application scenarios, but various problems may occur in the use process of the intelligent devices, and how to monitor the use process of the intelligent devices becomes an important problem. In the traditional technology, the efficiency is lower by analyzing the log of the intelligent equipment by a technician or finding out the problems generated by the intelligent equipment by user feedback.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a method, apparatus, computer device, computer readable storage medium, and computer program product for data monitoring that can improve efficiency.

In a first aspect, the present application provides a method of data monitoring. The method comprises the following steps:

acquiring monitoring data from a target data source;

extracting a target field from the monitoring data based on a data format corresponding to the target data source;

mapping the target field to an index field according to a field mapping relation;

calculating the index data in the index field based on the alarm triggering condition corresponding to the monitoring data to obtain a calculation result;

and if the calculation result reaches the alarm threshold value corresponding to the alarm triggering condition, alarming based on an alarm strategy.

In one embodiment, the calculating the index data in the index field based on the alarm triggering condition corresponding to the listening data includes:

determining a rule identifier corresponding to the monitoring data;

querying rule data corresponding to the rule identification;

extracting configuration conditions from the rule data, and taking the configuration conditions as alarm triggering conditions corresponding to the monitoring data;

And calculating the index data in the index field based on the alarm triggering condition.

In one embodiment, the method further comprises:

determining a plurality of configuration conditions corresponding to the target data source based on a configuration instruction;

combining the configuration conditions to obtain combined configuration conditions, and generating the rule data based on the combined configuration conditions;

the extracting the configuration condition from the rule data, and taking the configuration condition as the alarm triggering condition corresponding to the monitoring data comprises the following steps:

and extracting the combined configuration conditions from the rule data, and taking the combined configuration conditions as alarm triggering conditions corresponding to the monitoring data.

In one embodiment, the index data in the index field includes a plurality of index data obtained by a plurality of listens; the calculating the index data in the index field based on the alarm triggering condition, and obtaining a calculation result includes:

sequentially judging whether each index data meets the alarm triggering condition;

counting the number of index data meeting the alarm triggering condition;

and taking the numerical value obtained by counting as the calculation result.

In one embodiment, if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, alarming based on the alarm policy includes:

if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, generating an alarm message comprising the calculation result, the alarm triggering condition and the index field;

and if the current time is determined to be in the notification period and the time interval between the current time and the last time of alarm pushing is greater than the preset duration, pushing the alarm message.

In one embodiment, the method further comprises:

inquiring the alarm information which is not sent when the inquiry time is reached;

and pushing the undelivered alarm message if the expected pushing time corresponding to the undelivered alarm message is reached and the time interval between the current time and the time when the alarm pushing is carried out last time is greater than the preset duration.

In one embodiment, the obtaining snoop data from the target data source comprises:

configuring link information of a target data source to be monitored;

subscribing the target data source according to the link information;

and monitoring the subscribed target data source to obtain the monitoring data.

In a second aspect, the present application also provides a device for data monitoring. The device comprises:

the acquisition module is used for acquiring the monitoring data from the target data source;

the extraction module is used for extracting a target field from the monitoring data based on the data format corresponding to the target data source;

the mapping module is used for mapping the target field to the index field according to the field mapping relation;

the calculation module is used for calculating the index data in the index field based on the alarm triggering condition corresponding to the monitoring data to obtain a calculation result;

and the alarm module is used for alarming based on an alarm strategy if the calculation result reaches an alarm threshold corresponding to the alarm triggering condition.

In one embodiment, the computing module is further configured to:

determining a rule identifier corresponding to the monitoring data;

querying rule data corresponding to the rule identification;

In one embodiment, the apparatus further comprises:

The determining module is used for determining a plurality of configuration conditions corresponding to the target data source based on the configuration instruction;

the combination module is used for combining the configuration conditions to obtain combined configuration conditions and generating the rule data based on the combined configuration conditions;

the calculation module is further configured to extract the combined configuration condition from the rule data, and take the combined configuration condition as an alarm triggering condition corresponding to the monitoring data.

In one embodiment, the index data in the index field includes a plurality of index data obtained by a plurality of listens; the computing module is further configured to:

counting the number of index data meeting the alarm triggering condition;

and taking the numerical value obtained by counting as the calculation result.

In one embodiment, the alarm module is further configured to:

In one embodiment, the apparatus further comprises:

the query module is also used for querying the alarm message which is not sent when the query time is reached;

and the pushing module is used for pushing the undelivered alarm message if the expected pushing time corresponding to the undelivered alarm message is reached and the time interval between the current time and the time when the alarm pushing is carried out last time is greater than the preset duration.

In one embodiment, the acquiring module is further configured to:

configuring link information of a target data source to be monitored;

subscribing the target data source according to the link information;

and monitoring the subscribed target data source to obtain the monitoring data.

In a third aspect, the present application also provides a computer device. The computer device comprises a memory storing a computer program and a processor which when executing the computer program performs the steps of:

acquiring monitoring data from a target data source;

In a fourth aspect, the present application also provides a computer-readable storage medium. The computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:

acquiring monitoring data from a target data source;

In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the steps of:

Acquiring monitoring data from a target data source;

The method, apparatus, computer device, storage medium and computer program product for data monitoring described above obtain listening data from a target data source. And extracting a target field from the monitored data based on a data format corresponding to the target data source, and mapping the target field to an index field according to a field mapping relation, so that a field corresponding to a monitoring index can be extracted from the monitored data, and then calculating index data in the index field based on an alarm triggering condition corresponding to the monitored data to obtain a calculation result. And if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, alarming based on an alarm strategy. Therefore, the operation condition of the intelligent equipment can be rapidly judged according to the collected monitoring data, and the alarm can be timely carried out, so that the efficiency of monitoring the intelligent equipment is improved.

Drawings

FIG. 1 is an application environment diagram of a method of data monitoring in one embodiment;

FIG. 2 is a flow diagram of a method of data monitoring in one embodiment;

FIG. 3 is a flow chart of a method of index data calculation in one embodiment;

FIG. 4 is a logic diagram of a processing layer in one embodiment;

FIG. 5a is a timing diagram of a rule template and rule script generation method in one embodiment;

FIG. 5b is a schematic diagram of a rule script generation method in one embodiment;

FIG. 6a is a timing diagram of an alert triggering method in one embodiment;

FIG. 6b is a flow diagram of a method of sending an alert message in one embodiment;

FIG. 7 is a flow chart of a target data source monitoring method in one embodiment;

FIG. 8 is a schematic diagram of a link layer and a process layer in one embodiment;

FIG. 9 is a flow chart of a method of data monitoring in another embodiment;

FIG. 10 is a schematic diagram of an alert configuration method in one embodiment;

FIG. 11 is a flow chart of a method of data monitoring in yet another embodiment;

FIG. 12 is a block diagram of an apparatus for data monitoring in one embodiment;

FIG. 13 is a block diagram of an apparatus for data monitoring in one embodiment;

Fig. 14 is an internal structural diagram of a computer device in one embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application.

The method for monitoring data provided by the embodiment of the application can be applied to an application environment shown in fig. 1. Wherein the smart device 102 communicates with the server 104 over a network. The data storage system may store data that the server 104 needs to process. The data storage system may be integrated on the server 104 or may be located on a cloud or other network server. Server 104 obtains listening data from a target data source; extracting a target field from the monitored data based on a data format corresponding to the target data source; mapping the target field to the index field according to the field mapping relation; calculating the index data in the index field based on the alarm triggering condition corresponding to the monitoring data to obtain a calculation result; and if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, alarming based on an alarm strategy.

The smart device 102 may be, but is not limited to, various robots, personal computers, notebook computers, smart phones, tablet computers, internet of things devices, and portable wearable devices. The robot may be various service robots, navigation robots, meal delivery robots, sweeping robots, etc. The internet of things equipment can be an intelligent sound box, an intelligent television, an intelligent air conditioner, intelligent vehicle-mounted equipment and the like. The portable wearable device may be a smart watch, smart bracelet, headset, or the like.

The server 104 may be an independent physical server, or may be a server cluster formed by a plurality of service nodes in a blockchain system, where each service node forms a Peer-To-Peer (P2P) network, and the P2P protocol is an application layer protocol running on top of a transmission control protocol (TCP, transmission Control Protocol) protocol. The server may be a server cluster formed by a plurality of physical servers, and may be a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), basic cloud computing services such as big data and artificial intelligence platforms, and the like.

In one embodiment, as shown in fig. 2, a method for monitoring data is provided, and the method is applied to the server in fig. 1 for illustration, and includes the following steps:

s202, acquiring monitoring data from a target data source.

The target data source is a source of monitoring data and comprises a database, a file system or a message system and the like. The database may be a relational database or a non-relational database. For example, the database may be a MySql database, an Oracle database, or the like. The messaging system is a system for distributing published, subscribed messages and may be, for example, a Kafka messaging system. The monitoring data is data obtained by monitoring the intelligent equipment, and comprises configuration parameters, running state data, data for recording task execution conditions or data for recording abnormal events and the like of the intelligent equipment. For example, the monitored data may be a running mileage of the robot, a running time, a power amount, abnormal shutdown data, or positioning data, etc. For another example, the listening data may be a system memory of the smart watch, a screen resolution, or network connection data, etc.

S204, extracting a target field from the monitored data based on the data format corresponding to the target data source.

The data format is used for storing and representing the data, and can be a text format, a character format or other data formats. For example, the data format may be JSON (Java Script Object Notation, JS object profile) format. The JSON format represents data in serialized key-value pairs, the values in the key-value pairs can be objects, arrays, numbers, or strings, etc. When the value in the key value pair is an object, the object can nest the key value pair, and the values of the key value pairs of each level are downward nested to form a data format of a hierarchical structure. For example, the data format corresponding to the target data source may describe what fields are the keys and values of each level of key-value pairs, respectively, the target data source includes several levels of key-value pairs. The target field may be a field in the snoop data having a mapping relationship with the index field.

The server extracts the target field from the snoop data based on the data format corresponding to the target data source. Specifically, the server determines the hierarchical structure of the target data source based on the data format corresponding to the target data source, determines the position of the target field to be extracted in the monitored data according to the hierarchical structure of the target data source, and then extracts according to the position of the target field. For example, the server determines that the target field is the value of the third-layer key value pair, and extracts the value of the third-time key value pair to obtain the target field.

S206, mapping the target field to the index field according to the field mapping relation.

The field mapping relationship is a mapping relationship between the target field and the index field. For example, the field mapping relationship maps target field 1 to index field a; for another example, the field mapping relationship is that the sum of the target field 1 and the target field 2 is mapped to the index field B. The index field is a field corresponding to the monitoring index. The monitoring index is a parameter for measuring the running condition of the intelligent equipment, such as driving mileage, running time, standby time or power consumption per unit time length, etc.

The server maps the target field to the index field according to the field mapping relationship, specifically, the server may directly map the target field to the index field, or the server may calculate a plurality of target fields and map the calculation result to the index field.

And S208, calculating the index data in the index field based on the alarm triggering condition corresponding to the monitored data to obtain a calculation result.

The alarm triggering condition is a condition for judging whether to alarm or not. For example, the alert trigger condition may be that the driving range is less than a preset range; or the alarm triggering condition can be that the operation time length is less than the preset time length; or the alarm triggering condition may be that the power consumption per unit time is greater than a preset power value, etc.

In one embodiment, the index data in the index field includes a plurality of index data obtained by a plurality of listens; s208 specifically includes: sequentially judging whether each index data meets the alarm triggering condition; counting the number of index data meeting the alarm triggering condition; the counted value is used as the calculation result.

The server continuously monitors the intelligent equipment, maps the monitored data obtained by each monitoring into index data in an index field, counts the index data meeting the alarm triggering condition, and takes the numerical value obtained by counting as a calculation result. For example, if in the continuous monitoring process, 5 index data satisfy the alarm triggering condition, the number obtained by counting is 5, and the calculation result is 5.

S210, if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, alarming is carried out based on the alarm strategy.

The alarm threshold is a critical value for judging the size of the calculation result, and can be set according to the actual requirement of the application scene. For example, the alarm threshold may be set to 10, 15, 50, or the like. If the calculation result reaches the alarm threshold value corresponding to the alarm triggering condition, the intelligent equipment is possibly failed or abnormal in operation, and the server alarms based on the alarm strategy. For example, the server may push alert information to the client in the form of an in-station message, an interface callback, a mail, a short message, or an application message, etc.

In the above embodiment, the snoop data is obtained from the target data source. And extracting a target field from the monitored data based on a data format corresponding to the target data source, and mapping the target field to an index field according to a field mapping relation, so that a field corresponding to a monitoring index can be extracted from the monitored data, and then calculating index data in the index field based on an alarm triggering condition corresponding to the monitored data to obtain a calculation result. And if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, alarming based on an alarm strategy. Therefore, the operation condition of the intelligent equipment can be rapidly judged according to the collected monitoring data, and the alarm can be timely carried out, so that the efficiency of monitoring the intelligent equipment is improved.

In one embodiment, as shown in fig. 3, S208 specifically includes:

s302, determining rule identification corresponding to the monitored data.

S304, inquiring rule data corresponding to the rule identification.

S306, extracting configuration conditions from the rule data, and taking the configuration conditions as alarm triggering conditions corresponding to the monitoring data.

And S308, calculating the index data in the index field based on the alarm triggering condition.

The rule identifier is an identifier of the monitoring rule, and may include one or more of a number, a character, a letter or a special symbol. The rule data is related data for describing the monitoring rule, and comprises configuration conditions, threshold values or monitoring indexes of the monitoring rule.

In one embodiment, S304 further comprises, prior to: determining a plurality of configuration conditions corresponding to the target data source based on the configuration instruction; combining the configuration conditions to obtain combined configuration conditions, and generating rule data based on the combined configuration conditions; s306 specifically includes: and extracting the combined configuration conditions from the rule data, and taking the combined configuration conditions as alarm triggering conditions corresponding to the monitoring data.

The configuration instruction is an instruction for performing conditional configuration on the target data source, and may be an instruction triggered by clicking, sliding, dragging and other operations. For example, when the candidate condition on the configuration interface is clicked through the mouse, the configuration instruction is triggered, and the candidate condition selected through the mouse is the configuration condition corresponding to the data source. When a plurality of configuration conditions are selected based on the configuration instruction, the server combines the plurality of configuration conditions to obtain the combined configuration conditions. For example, the server may logically combine a plurality of configuration conditions to obtain a combined configuration condition. For example, if the configuration condition 1, the configuration condition 2, and the configuration condition 3 are selected based on the configuration instruction, the resulting combined configuration conditions may be "" configuration condition 1 'and "" configuration condition 2', or "" configuration condition 3 "".

In one embodiment, the server generates rule data based on the configuration conditions, the configuration thresholds, and the configuration metrics. The configuration threshold is an alarm threshold configured for the target data source, namely an alarm threshold of an alarm triggering condition corresponding to the target data source. For example, the server may obtain a configuration threshold entered through an input box in the configuration interface and take the entered configuration threshold as an alert threshold. The configuration index is a monitoring index for configuring the target data source, and can be selected from candidate indexes displayed in a configuration interface through a configuration instruction.

In one embodiment, as shown in fig. 4, the processing layer of the server obtains the configuration conditions selected by the user, and combines the configuration conditions. And then generating rule data based on the configuration index selected by the user, the combined configuration condition and the configuration threshold value, and converting the rule data into a rule script. The main program executes the rule script by calling the rule engine, takes the configuration condition in the rule data as an alarm triggering condition, and calculates the index data in the index field by the alarm triggering condition to obtain a calculation result. And if the calculation result reaches the configuration threshold (namely, the alarm threshold), alarming based on the alarm strategy.

In one embodiment, the server may also generate rule data based on the alert period, the monitoring range. And the user configures parameters such as conditions, threshold values, monitoring indexes, alarm periods, monitoring ranges and the like of the target data source through the configuration interface.

In one embodiment, as shown in fig. 5a, an operator selects configuration parameters such as configuration conditions, configuration indexes, configuration thresholds, and the like through a configuration interface, and a server generates a rule template according to the selected configuration parameters and sends the rule template to a rule service. The rule service converts the rule templates into rule scripts and saves the rule templates and rule scripts in a database and cache.

In one embodiment, as shown in fig. 5b, an operator establishes a monitoring rule, selects a configuration index and a monitoring condition through a management background according to a monitoring policy formulated based on the monitoring rule, and inputs an alarm threshold through a configuration interface. And the operator generates a rule template according to the configuration index, the configured monitoring condition and the alarm threshold value, and submits the rule template combination to the management background. The management background sends the rule templates to the processing layer, and the processing layer converts the rule templates into rule scripts and stores the rule scripts.

In the above embodiment, the server may configure parameters such as the condition, the threshold, the monitoring index, the alarm period, the monitoring range, and the like, and may combine the configured conditions to generate rule data according to the configured parameters. Therefore, the monitoring method is suitable for various intelligent devices, the application scene is expanded, and the system is convenient to maintain.

In one embodiment, S210 specifically includes: if the calculation result reaches the alarm threshold value corresponding to the alarm triggering condition, generating an alarm message comprising the calculation result, the alarm triggering condition and the index field; and if the current time is determined to be in the notification period and the time interval between the current time and the last time of alarm pushing is greater than the preset duration, pushing the alarm message.

The notification period is a period in which the alarm message is expected to be pushed, and can be set according to the requirement of a user. For example, the notification period may be 9:00-11:00. The preset duration is the duration of a time interval for carrying out alarm pushing in two adjacent times. For example, the preset time period may be 1 minute, 10 minutes, 15 minutes, or the like.

The server may generate an alarm message according to the message template, and may configure the message template, where the configured message template includes a notification manner, a content format, a language, and the like of the message. And the server edits the calculation result, the alarm triggering condition, the index field and the like according to the message template to obtain an alarm message. In one embodiment, one or more of a data source, a listening time, an alarm threshold, or a rule identification may also be included in the alarm message. In one embodiment, the server adds a pushed flag to the pushed alert message.

In one embodiment, as shown in FIG. 6a, the data monitoring system includes a monitoring service, a rules service, an alarm service, a Mysql database, redis, and the like. The monitoring service, the rule service and the alarm service are distributed micro-services. The monitoring service acquires monitoring data from the target data source, extracts target fields from the monitoring data based on the data format corresponding to the target data source, maps the target fields to index fields according to the field mapping relation, and then sends index data in the index fields to the rule service. And the rule service queries the rule from the Mysql database according to the rule identifier corresponding to the data source, and the Mysql database returns rule data to the rule service. The Redis sequentially judges whether each index data meets the alarm triggering condition in the rule data, counts the number of the index data meeting the alarm triggering condition and returns a counting result to the rule service. The rule service judges whether the counting result meets the alarm triggering condition. If the counting result meets the alarm triggering condition, the rule service limits the frequency of pushing the alarm message according to the configured alarm time interval. And if the current time is in the notification period and the time interval between the current time and the last time of alarm pushing is longer than the preset duration, pushing the alarm message.

In one embodiment, when the query time is reached, the unsent alert message is queried; and pushing the undelivered alarm message if the expected pushing time corresponding to the undelivered alarm message is reached and the time interval between the current time and the last time of alarm pushing is longer than the preset duration.

Wherein the inquiry time is the time of inquiring the alarm message which is not transmitted. For example, the server may query for an unsent alert message every one hour; alternatively, the server may query for the unsent alert message at a preset query time of 9:00, 11:00, etc.

In one embodiment, as shown in fig. 6b, the server queries the unsent alarm message at regular time, and if the expected sending time of the unsent alarm message is less than the current time, queries whether the redisjkey (cache key) corresponding to the alarm message exists. If the redis_key exists, indicating that the alarm message is sent within the previous preset time length, and marking the alarm message as a current limiting interception message in order to avoid network resource waste caused by frequently sending the alarm message; if the redisjkey does not exist, indicating that the alarm message is not sent within the previous preset time length, pushing the alarm message, and marking the alarm message as sent.

In the above embodiment, the server pushes the alarm message only when the current time is within the notification period, and the notification period may be set according to the user requirement, so that the message pushing may be performed according to the user requirement. When the time interval between the current time and the time when the last time of the alarm pushing is greater than a preset value, the server pushes the alarm message, so that the frequency of pushing the alarm message can be limited, and the waste of network resources caused by frequent message pushing is avoided.

In one embodiment, S202 specifically includes: configuring link information of a target data source to be monitored; subscribing to a target data source according to the link information; and monitoring the subscribed target data source to obtain monitoring data.

The link information is information for connecting with the target data source, and comprises an account number, a password, a network address and the like corresponding to the target data source. The server subscribes to the target data sources according to the link information of the target data sources and monitors the subscribed target data sources. Specifically, as shown in fig. 7, a user configures link information of a target data source at a web end, and a link layer performs a database-dropping operation on the target data source according to the configured link information. The link layer sends a data source snoop message to the kafka message queue, and when a response to the data source snoop message from the kafka message queue is received, the link layer consumes the data source snoop message. When the link layer receives a response from the kafka message queue to the consumption data source monitoring message sent by the link layer, the link layer subscribes to the data source through the database and continuously monitors the target data source. When the web side requests to stop monitoring the data source, the link layer sends a message for stopping monitoring the data source to the database and stops monitoring the target data source. The server extracts a target field from the monitored data based on a data format corresponding to the target data source; and mapping the target field to the index field according to the field mapping relation, and then sending the index field to a processing layer for processing.

In the above embodiment, the server configures the link information of the target data source to be monitored; subscribing to a target data source according to the link information; and monitoring the subscribed target data source to obtain monitoring data. Therefore, a plurality of data sources can be subscribed simultaneously, high-concurrency data monitoring is supported, and the monitoring efficiency of the target data sources is improved. And the compatibility with the existing monitoring system is stronger, and the reconstruction cost of the existing monitoring system is reduced.

In one embodiment, the data monitoring system comprises a link layer, a processing layer and an alarm layer, wherein each layer has independent logic input and logic output, can independently deploy services and can be connected through standard input and output. The link layer is used for preparing data, including obtaining monitoring data from a data source, and carrying out data cleaning, data conversion and data integration on the monitoring data. The processing layer is used for carrying out data calculation, including configuring alarm triggering conditions, threshold values and the like, and calculating index data according to the alarm triggering conditions. The alarm layer is used for carrying out data alarm. Specifically, as shown in fig. 8, the link layer acquires snoop data from a data source such as a message queue or a database, and then extracts a target field from the snoop data through an ETL (Extract-Transform-Load) extraction script and maps the target field to an index field to output to the processing layer. The link layer can also split and combine the data tables in the database and perform numerical processing, format conversion and the like. In addition, the link layer may configure the monitoring metrics. Specifically, the user can configure the monitoring index of the data source on the configuration interface, and when the server receives the index configuration instruction triggered by the configuration interface on the web side, the monitoring index configured by the user is determined based on the index configuration instruction. The processing layer configures alarm triggering conditions, alarm threshold values and the like, and generates rule scripts according to the configured alarm triggering conditions, alarm threshold values and monitoring indexes. And executing the rule script by the task main program of the processing layer, calculating the index data in the index field by calling the rule engine, and outputting the calculation result to the alarm layer.

In one embodiment, as shown in fig. 9, the link layer acquires the listening data and the configuration index, and then determines whether the listening data conforms to the listening policy, specifically, determines whether the listening data includes a target field corresponding to the configuration index. If the monitored data accords with the strategy, the link layer triggers the monitoring rule and sends the target field to the processing layer for calculation. The alarm layer inquires a rule script corresponding to the data source, calculates a target field by executing the rule script, and judges whether a calculation result reaches an alarm threshold value. And if the calculation result reaches the alarm threshold value, alarming based on an alarm strategy.

In one embodiment, the server configures the system prior to beginning monitoring of the smart device, including configuring a listening policy, an alarm policy, and a message notification format. As shown in fig. 10, the operator establishes a notification template and formulates a notification format based on the notification template. Specifically, the management background formulates a notification format according to the notification mode, the content format and the language in the notification template. The operator saves the notification format and sends the notification format to the alarm layer through the management background, and the alarm layer saves the notification format to the database. The operator configures a monitoring strategy at a configuration interface, specifically, when a management background receives an alarm configuration new instruction triggered by the operator, candidate configuration items are obtained from a database through a link layer, the alarm configuration interface is generated and displayed based on the candidate configuration items, and the operator selects products, monitoring indexes, data sources, rule identification and notification templates and a time period for notifying alarm messages at the alarm configuration interface. The management background integrates the configuration items selected by the operator and submits the configuration items to the link layer, and the link layer forms and stores the product identifiers selected by the operator, the monitoring indexes corresponding to the product identifiers, the data sources and the rule identifiers into a monitoring strategy. The alarming layer forms the rule mark, the informing template and the informing receiver mark selected by the operator into an alarming strategy and stores the alarming strategy. When the link layer monitors the intelligent device, firstly, a monitoring strategy corresponding to the data source is obtained, and a monitoring index and a rule identifier corresponding to the data source are determined according to the monitoring strategy. And then mapping the target field in the monitoring data acquired from the data source to the index field corresponding to the monitoring index. And calculating the index data in the index field based on the alarm triggering condition corresponding to the rule identification. If the calculation result reaches the alarm threshold value corresponding to the alarm triggering condition, generating an alarm message according to the notification format corresponding to the notification template in the alarm strategy, and pushing the alarm message according to the notification party identifier in the alarm strategy.

In one embodiment, as shown in FIG. 11, the method of data monitoring includes the steps of:

s1102, obtaining the monitoring data from the target data source.

S1104, extracting a target field from the monitored data based on the data format corresponding to the target data source.

S1106, mapping the target field to the index field according to the field mapping relation.

S1108, determining rule identification corresponding to the monitored data, and inquiring rule data corresponding to the rule identification.

S1110, extracting configuration conditions from the rule data, and taking the configuration conditions as alarm triggering conditions corresponding to the monitoring data.

S1112, judging whether each index data meets the alarm triggering condition in sequence, counting the number of the index data meeting the alarm triggering condition, and taking the counted number as a calculation result.

And S1114, if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, generating an alarm message comprising the calculation result, the alarm triggering condition and the index field.

S1116, if the current time is determined to be in the notification period and the time interval between the current time and the last time of alarm pushing is greater than the preset duration, pushing the alarm message.

S1118, when the query time arrives, the unsent alarm message is queried.

S1120, if the expected pushing time corresponding to the undelivered alarm message is reached and the time interval between the current time and the last time of the alarm pushing is greater than the preset duration, pushing the undelivered alarm message.

The specific contents of S1102 to S1120 described above may refer to the above specific implementation procedure.

It should be understood that, although the steps in the flowcharts related to the embodiments described above are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiment of the application also provides a data monitoring device for realizing the above related data monitoring method. The implementation of the solution provided by the device is similar to the implementation described in the above method, so the specific limitation in the embodiments of the device for monitoring one or more data provided below may be referred to the limitation of the method for monitoring data hereinabove, and will not be described herein.

In one embodiment, as shown in fig. 12, there is provided an apparatus for data monitoring, comprising: an acquisition module 1202, an extraction module 1204, a mapping module 1206, a calculation module 1208, and an alert module 1210, wherein:

an acquisition module 1202 for acquiring snoop data from a target data source;

the extracting module 1204 is configured to extract a target field from the listening data based on a data format corresponding to the target data source;

a mapping module 1206, configured to map the target field to the index field according to the field mapping relationship;

the calculation module 1208 is configured to calculate, based on an alarm triggering condition corresponding to the monitored data, the index data in the index field, so as to obtain a calculation result;

the alarm module 1210 is configured to alarm based on an alarm policy if the calculation result reaches an alarm threshold corresponding to an alarm triggering condition.

In one embodiment, the computing module 1208 is further configured to:

determining a rule identifier corresponding to the monitoring data;

querying rule data corresponding to the rule identification;

In one embodiment, as shown in fig. 13, the apparatus further comprises:

A determining module 1212, configured to determine a plurality of configuration conditions corresponding to the target data source based on the configuration instruction;

a combination module 1214, configured to combine the configuration conditions to obtain combined configuration conditions, and generate rule data based on the combined configuration conditions;

the calculation module 1208 is further configured to extract the combined configuration condition from the rule data, and take the combined configuration condition as an alarm triggering condition corresponding to the listening data.

In one embodiment, the index data in the index field includes a plurality of index data obtained by a plurality of listens; the calculation module 1208 is further configured to:

counting the number of index data meeting the alarm triggering condition;

the counted value is used as the calculation result.

In one embodiment, the alert module 1210 is further configured to:

if the calculation result reaches the alarm threshold value corresponding to the alarm triggering condition, generating an alarm message comprising the calculation result, the alarm triggering condition and the index field;

In one embodiment, the apparatus further comprises:

the query module 1216 is further configured to query an alarm message that is not sent when the query time is reached;

and the pushing module 1218 is configured to push the unsent alert message if the expected pushing time corresponding to the unsent alert message has arrived and the time interval between the current time and the time when the alert pushing is performed last time is greater than a preset duration.

In one embodiment, the acquisition module 1202 is further configured to:

configuring link information of a target data source to be monitored;

subscribing to a target data source according to the link information;

and monitoring the subscribed target data source to obtain monitoring data.

The various modules in the data monitoring apparatus described above may be implemented in whole or in part by software, hardware, and combinations thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a server, and the internal structure of which may be as shown in fig. 14. The computer device includes a processor, a memory, an Input/Output interface (I/O) and a communication interface. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface is connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device is for storing data monitoring data. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method of data monitoring.

It will be appreciated by those skilled in the art that the structure shown in fig. 14 is merely a block diagram of a portion of the structure associated with the present application and is not limiting of the computer device to which the present application applies, and that a particular computer device may include more or fewer components than shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided, comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the steps of the method embodiments described above when the computer program is executed.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored which, when executed by a processor, implements the steps of the method embodiments described above.

In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of the method embodiments described above.

It should be noted that, the user information (including, but not limited to, user equipment information, user personal information, etc.) and the data (including, but not limited to, data for analysis, stored data, presented data, etc.) referred to in the present application are information and data authorized by the user or sufficiently authorized by each party, and the collection, use and processing of the related data are required to comply with the related laws and regulations and standards of the related countries and regions.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in the various embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the various embodiments provided herein may include at least one of relational databases and non-relational databases. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processors referred to in the embodiments provided herein may be general purpose processors, central processing units, graphics processors, digital signal processors, programmable logic units, quantum computing-based data processing logic units, etc., without being limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The above examples only represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the present application. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application shall be subject to the appended claims.

Claims

1. A method of data monitoring, the method comprising:

acquiring monitoring data from a target data source;

2. The method of claim 1, wherein the calculating the indicator data in the indicator field based on the alarm trigger condition corresponding to the listening data comprises:

determining a rule identifier corresponding to the monitoring data;

querying rule data corresponding to the rule identification;

3. The method according to claim 2, wherein the method further comprises:

4. The method of claim 1, wherein the metric data in the metric field comprises a plurality of metric data obtained from a plurality of listens; the calculating the index data in the index field based on the alarm triggering condition, and obtaining a calculation result includes:

counting the number of index data meeting the alarm triggering condition;

and taking the numerical value obtained by counting as the calculation result.

5. The method of claim 1, wherein if the calculation result reaches the alarm threshold corresponding to the alarm triggering condition, alerting based on an alarm policy comprises:

6. The method of claim 5, wherein the method further comprises:

7. The method of claim 1, wherein the obtaining snoop data from the target data source comprises:

configuring link information of a target data source to be monitored;

subscribing the target data source according to the link information;

and monitoring the subscribed target data source to obtain the monitoring data.

8. An apparatus for data monitoring, the apparatus comprising:

9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, carries out the steps of the method of data monitoring of any one of claims 1 to 7.

10. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, carries out the steps of the method of data monitoring according to any one of claims 1 to 7.