CN118250204A

CN118250204A - Current network event information processing method and device and computer equipment

Info

Publication number: CN118250204A
Application number: CN202211655045.3A
Authority: CN
Inventors: 李首正; 黄小华; 周泽展
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2022-12-22
Filing date: 2022-12-22
Publication date: 2024-06-25

Abstract

The present application relates to a method, an apparatus, a computer device, a storage medium and a computer program product for processing event information of an existing network. The method comprises the following steps: determining an internal operation system of a content distribution network and an external operation system associated with a current network corresponding to the content distribution network; monitoring trigger events affecting the operation of the current network in the internal operation system and the external operation system, and obtaining event information for recording the trigger events; determining a middleware flow matched with the event information based on the event source and the event type of the event information; and calling a middleware corresponding to the middleware flow, and carrying out information processing on the event information to obtain an event processing result. By adopting the method, the trigger events of different sources and different types associated with the same CDN can be monitored and processed uniformly, event processing results are obtained, subsequent analysis and processing are facilitated, and the working efficiency is improved.

Description

Current network event information processing method and device and computer equipment

Technical Field

The present application relates to the field of computer technology, and in particular, to a method, an apparatus, a computer device, a computer readable storage medium, and a computer program product for processing current network event information.

Background

The content delivery network (Content Delivery Network, CDN) is an intelligent virtual network built on an existing network basis. An existing network refers to an existing network, i.e., an operating network that has been put into commercial use. The CDN relies on the edge servers deployed in various places, and the current network users can obtain the required content nearby through the load balancing, content distribution, scheduling and other functional modules of the center platform, so that network congestion is reduced, and the access response speed and hit rate of the users are improved. To ensure that the existing network can continue to operate stably, event monitoring is typically performed on the internal operation system of the CDN and the external operation system that has an impact on the existing network of the CDN.

In the traditional on-line event information processing method, after the CDN operation system and the external operation system respectively monitor events and the on-line operation and maintenance are changed, operation and maintenance personnel are required to inquire respective event information of each system, and the information processing based on the event information is realized by means of man-machine interaction, so that more calculation and processing resources are required to be consumed for long-time information processing. Therefore, there is a problem in that efficiency is low in the process.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a current network event information processing method, apparatus, computer device, computer readable storage medium, and computer program product that can improve the working efficiency.

In a first aspect, the present application provides a method for processing current network event information. The method comprises the following steps:

Determining an internal operation system of a content distribution network and an external operation system associated with a current network corresponding to the content distribution network;

Monitoring trigger events affecting the operation of the existing network in the internal operation system and the external operation system, and obtaining event information for recording the trigger events;

Determining a middleware flow matched with the event information based on the event source and the event type of the event information;

and calling the middleware corresponding to the middleware flow, and carrying out information processing on the event information to obtain an event processing result.

In a second aspect, the application further provides a current network event information processing device. The device comprises:

The monitoring object determining module is used for determining an internal operation system of the content distribution network and an external operation system associated with the current network corresponding to the content distribution network;

the event information acquisition module is used for monitoring trigger events affecting the operation of the current network in the internal operation system and the external operation system and acquiring event information for recording the trigger events;

the middleware flow matching module is used for determining a middleware flow matched with the event information based on the event source and the event type of the event information;

And the information processing module is used for calling the middleware corresponding to the middleware flow, and processing the event information to obtain an event processing result.

In a third aspect, the present application also provides a computer device. The computer device comprises a memory storing a computer program and a processor which when executing the computer program performs the steps of:

In a fourth aspect, the present application also provides a computer-readable storage medium. The computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:

In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the steps of:

The present network event information processing method, apparatus, computer device, computer readable storage medium, and computer program product described above determine an internal operation system of a content distribution network, and an external operation system associated with a present network corresponding to the content distribution network; monitoring trigger events affecting the operation of the existing network in the internal operation system and the external operation system, and obtaining event information of recording the trigger events; determining a middleware flow matched with the event information based on the event source and the event type of the event information; and calling the middleware corresponding to the middleware flow to process the event information to obtain an event processing result, and uniformly monitoring and processing different sources and different types of trigger events associated with the same CDN current network to obtain an event processing result, so that subsequent analysis and processing are facilitated, and the work efficiency is improved.

Drawings

FIG. 1 is an application environment diagram of an active network event information processing method in one embodiment;

FIG. 2 is a flow diagram of a method for processing current network event information in one embodiment;

FIG. 3 is a schematic diagram of a different type of collector in one embodiment;

FIG. 4 is a diagram of middleware call principles in one embodiment;

FIG. 5 is a schematic diagram of an overall architecture of a monitoring end in one embodiment;

FIG. 6 is a diagram of a unified management interface in one embodiment;

FIG. 7 is a schematic diagram of push information in one embodiment;

FIG. 8 is a schematic diagram of a fault diagnosis result display interface in one embodiment;

FIG. 9 is a schematic diagram of a fault diagnosis result display interface in another embodiment;

FIG. 10 is a schematic diagram of an event query interface in one embodiment;

FIG. 11 is a flowchart of a current network event information processing method according to another embodiment;

FIG. 12 is a diagram of an on-the-fly event information processing process in one embodiment;

FIG. 13 is a block diagram showing a structure of an apparatus for processing event information in the present network in one embodiment;

FIG. 14 is an internal block diagram of a computer device in one embodiment;

Fig. 15 is an internal structural view of a computer device in one embodiment.

Detailed Description

The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.

First, the terms involved in the embodiments of the present application will be briefly explained:

CDN (Content Delivery Network ) is an intelligent virtual network built on the basis of the existing network, and by means of the edge servers deployed in various places, users can obtain required content nearby through load balancing, content delivery, scheduling and other functional modules of the center platform, network congestion is reduced, and user access response speed and hit rate are improved. The content distribution network nodes may be located in a plurality of sites and on a plurality of different networks. The nodes can dynamically transmit the content to each other, optimize the downloading behavior of the user, reduce the bandwidth cost required by the content provider, improve the downloading speed of the user and improve the stability of the system. The number of nodes required for the content distribution network varies with demand, and there may be tens of thousands of servers depending on the size of the object to be served.

Event bus: the event bus mode is realized based on a publish-subscribe mechanism, which is a centralized event handling mechanism that allows different components to communicate with each other without interdependence, thereby achieving a decoupling purpose. The event bus mode mainly comprises three parts, namely an event, an event bus and an event listener, wherein the event is generated by an event source and propagates on the event bus in a broadcasting mode; the event bus is an 'infrastructure' for realizing event propagation, and can be understood as a 'dispatch center' of an event bus mode, all events set forth in the system are broadcast on the event bus, and event listeners hung on the event bus from left to right receive the events published on the event bus; the event listener is used for listening to the objects of various events, and after the event listener receives the events issued on the event bus, the event listener judges the types of the events first, and if the events are interesting to the event listener, the event listener carries out corresponding processing and modifies the state of the event listener.

Event-driven: from an event point of view, the basic structure of the event driver is composed of an event collector, an event transmitter and an event processor. Wherein the event sender is responsible for distributing the events collected by the collector into the target object. Event handlers do specific event response work, which often need not be fully determined until the implementation phase.

MTTR (Mean time to repair, average repair time), is an average value that describes the repair time when a product transitions from a fault state to an operational state. The characteristics of the product determine the length of the average, for example: an automatic repair mechanism for hard disk errors or the failure of a computer system of the whole airport. In engineering, "average repair time" is a value that measures the maintainability of a product. Properly managing the fault can help significantly reduce the negative effects of the fault. In order to effectively manage faults, several key indicators should be monitored, knowledge of which eliminates guesswork and provides the operation and maintenance engineers with the data needed to make informed decisions.

In addition, the current network event information processing method can be applied to the cloud technology application field realized based on CDNs, such as cloud live broadcast, cloud on demand or cloud conference, and the like, namely, the method can be applied to the network transmission application scene of the cloud technology. Cloud technology (Cloud technology) refers to a hosting technology for integrating hardware, software, network and other series resources in a wide area network or a local area network to realize calculation, storage, processing and sharing of data. The cloud technology is based on the general names of network technology, information technology, integration technology, management platform technology, application technology and the like applied by the cloud computing business mode, can form a resource pool, and is flexible and convenient as required. Cloud computing technology will become an important support.

Background services of technical networking systems require a large amount of computing, storage resources, such as video websites, picture-like websites, and more portals. Along with the high development and application of the internet industry, each article possibly has an own identification mark in the future, the identification mark needs to be transmitted to a background system for logic processing, data with different levels can be processed separately, and various industry data needs strong system rear shield support and can be realized only through cloud computing.

Cloud computing (clouding) is a computing model that distributes computing tasks across a large pool of computers, enabling various application systems to acquire computing power, storage space, and information services as needed. The network that provides the resources is referred to as the "cloud". Resources in the cloud are infinitely expandable in the sense of users, and can be acquired at any time, used as needed, expanded at any time and paid for use as needed. As a basic capability provider of cloud computing, a cloud computing resource pool (abbreviated as a cloud platform) is established, which is generally called an IaaS (Infrastructure AS A SERVICE) platform, and multiple types of virtual resources are deployed in the resource pool for external clients to select for use. The cloud computing resource pool mainly comprises: computing devices (which are virtualized machines, including operating systems), storage devices, network devices.

According to the logic function division, a PaaS (Platform AS A SERVICE ) layer can be deployed on the IaaS, and a SaaS (Software AS A SERVICE ) layer is deployed above the PaaS layer, or the SaaS can be directly deployed on the IaaS. PaaS is a platform on which software runs, such as a database, web container, etc. SaaS is a wide variety of business software such as web portals, sms mass senders, etc. Generally, saaS and PaaS are upper layers relative to IaaS.

The present network event information processing method provided by the embodiment of the application relates to a cloud computing technology, and can be particularly applied to an application environment as shown in fig. 1. Referring to fig. 1, a client 102, a server 104, and a monitor 106 may be included in the implementation environment. The client 102 may communicate with the server 104 through a network, and obtain the required information from the server 104. The data storage system may store data that the server 104 needs to process. The data storage system may be integrated on the server 104 or may be located on a cloud or other server. The monitoring terminal 106 is configured to monitor an operation state of the server, and specifically includes: determining an internal operation system of a content distribution network and an external operation system associated with a current network corresponding to the content distribution network; monitoring trigger events affecting the operation of the existing network in the internal operation system and the external operation system, and obtaining event information of recording the trigger events; determining a middleware flow matched with the event information based on the event source and the event type of the event information; and calling a middleware corresponding to the middleware flow, and carrying out information processing on the event information to obtain an event processing result.

The server 104 may be a server cluster or a distributed system formed by a plurality of physical servers, and may also be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, basic cloud computing services such as big data and artificial intelligence platforms, and the like. The terminal may be, but is not limited to, a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc. The client 102 and the server 104, and the server 104 and the monitor 106 may be directly or indirectly connected through wired or wireless communication, which is not limited in this disclosure.

In one embodiment, as shown in fig. 2, a method for processing current network event information is provided, and the method is applied to the monitoring end 106 in fig. 1 for illustration, and includes the following steps:

Step 202, determining an internal operation system of the content distribution network and an external operation system associated with a current network corresponding to the content distribution network.

Wherein the content distribution network is an intelligent virtual network built on the basis of the existing network. The existing network corresponding to the content distribution network refers to an existing network that is a basis for the construction of the content distribution network, that is, a network that is running and has been put into commercial use. Unlike test networks that are only used for testing and are not formally in use, existing gateways are coupled with an operating system that is associated with a particular service. The operation system refers to the rules of organizing operations and corresponding resources under the rules, including all the documented operation rules of organizing operations, corresponding organizations set for completing the targets, external interfaces related to the corresponding organizations, and the like. The operation system is a complete process system, and the input is polished through a process with corresponding rules to be changed into the output of the organization, so that the continuation and development of the organization are ensured. An internal operating system of a content distribution network refers to an operating system responsible for maintaining the operation of the content distribution network. The external operation system refers to other operation systems associated with the CDN existing network besides the internal operation system, including but not limited to a monitoring system, a work order system, a machine room changing system, and the like. The present network event mainly comprises events generated by the internal operation system of the CDN and events generated by the external operation system of the CDN, namely, the internal operation system of the content distribution network and the external operation system associated with the present network corresponding to the content distribution network, which are monitored objects for event monitoring in the present application, and are information sources of event information obtained by monitoring.

Specifically, the monitoring end may determine, according to the network architecture and the operation system configuration of the content distribution network, an internal operation system of the content distribution network and an external operation system associated with a current network corresponding to the content distribution network. The monitoring end responds to the operation system selection event initiated by the operation staff to determine the internal operation system of the content distribution network and the external operation system associated with the current network corresponding to the content distribution network.

And 204, monitoring trigger events affecting the operation of the current network in the internal operation system and the external operation system, and obtaining event information for recording the trigger events.

The trigger event is an operation that can be identified, including a system event triggered by the system, and a user event triggered by the user. The system triggering event may be triggered automatically according to a set period, or may be triggered under a specific situation, for example, an error log is generated when an error occurs in the system, for example, after a new software version is released, a software update is automatically performed and an update record is generated, and so on. The user trigger event may be triggered by clicking a control or by inputting information. The event information refers to information for recording a trigger event. The event information may include at least a portion of information in an event source, an event object, an event time, an event type, or an event description. The event sources include an internal operating system and an external operating system; the event object is used for recording an object of a triggering event, such as node equipment in a CDN (content delivery network), and the event object can be characterized by an object identifier, wherein the object identifier can be a network address, a device number and the like; the event time is used for recording the triggering time of the event; the event description is used for recording specific content of the trigger event, and further, the event description may be a content summary of the event.

The event type refers to a specific type of a trigger event, and may include an up-down frame type, a platform information change type, a version change type, a device management type, a DNS (Domain NAME SYSTEM ) change type, a kernel (core) system event type, a configuration management type, an alarm type, an IDC (INTERNET DATA CENTER ) machine room change type, a script execution type, a work order event type, and the like, where each event type corresponds to a different trigger event. For example, the on-off shelf type corresponds to an on-off shelf event, the version change type corresponds to a version change event, and so on. The off-shelf event may be, for example, an off-shelf event for a certain service, a certain software version, or a certain function in a target service; the platform information refers to the platform information of the Internet information platform associated with the equipment, and can be characterized by a platform identifier; version changes may refer to changes in software or hardware versions. It will be appreciated that the information structure for recording event information of the monitored trigger event may also differ for different operating systems. The information structure may include a data structure, a data format, etc. of the event information. For example, some event information may lack data such as event time, and different event information may differ in the data format of event time.

Specifically, the monitoring end monitors trigger events affecting the operation of the current network in the internal operation system and the external operation system, and obtains event information for recording the trigger events. Further, the specific mode of the monitoring end for triggering event monitoring can be active monitoring or passive receiving. That is, the monitoring end can passively receive event information pushed by the operation system serving as the service party, and can actively monitor the triggering event of each operation system to obtain event information for recording the triggering event. The monitoring end may acquire initial messages acquired by the information acquisition scripts by using the information acquisition scripts of each operation system, and keep event information for recording triggering events affecting the operation of the current network in each initial message. The monitoring end can also acquire respective data acquisition addresses of the internal operation system and the external operation system, and based on the respective data acquisition addresses, trigger events influencing the operation of the existing network in the internal operation system and the external operation system are monitored to acquire event information for recording the trigger events.

In a specific implementation, as shown in fig. 3, corresponding collectors may be defined for different types of trigger events, so that the collectors may perform targeted monitoring on the events, so that the service system may implement collection of event information without deep participation. The collectors include the schema collector and standard collector (not shown) in fig. 3. The standard collector is used for collecting standard events such as configuration related events of the internal operation system, work order events of the external operation system and the like. The schema collector may include a plurality of types of collectors for collecting corresponding types of event information, for example, the on-off-shelf collector collects event information of an on-off-shelf event, the version change collector collects event information of a version change event, and so on.

Further, as shown in fig. 3, the schema collector may implement collection of event information by calling each functional module. The functional modules may include a message queue class functional module, an HTTP (Hyper Text Transfer Protocol ) class functional module, and common components. The message queue class function module provides a series of functions related to the collection mode of the message queue, such as a consumption function, a dynamic cache function, a distributed lock function and the like. The consumption functions include a Kafka (Kafka) consumption function and other types of message consumption functions. These functions are provided as generic functions to the collector, which uses the function modules in the message queue type module in a calling and dependent manner to collect events of the message queue type. By adopting the design mode, the effect of high cohesion and low coupling can be achieved, the schema service codes and the function codes are isolated, and the function codes can be conveniently reused. The HTTP type functional module provides functions related to HTTP collection, covers HTTP pushing and HTTP query collection, and comprises a routing function, a schema conversion function, an intermediate state caching function and a distributed lock function. Like the message queue class function module, it also provides the corresponding function code to achieve the cutting of the function code and the schema definition code. The common components provide all bypass functions such as log, DB (database), CONF (configuration), monitoring, alarm, etc. functions that can be relied upon by the Schema collector and the function base module. For example, in the process of event message collection, the index monitoring system for collection delay and survival of the collectors can ensure that the collectors are all in normal operation, and at the moment, the collectors can directly rely on the monitoring component in the realization to report the state of the collectors to the monitoring system so as to ensure the availability of the whole system. It can be appreciated that in practical application, various types of schema collectors and functional modules can be flexibly defined according to requirements of specific application scenarios.

Step 206, determining the middleware flow matched with the event information based on the event source and the event type of the event information.

Wherein, see above for specific limitation of event source and event type, not repeated here. The middleware is a type of software between the application system and the system software, uses basic services (functions) provided by the system software to connect various parts of the application system or different applications on the network, and can achieve the purposes of resource sharing and function sharing. The middleware flow refers to a middleware processing flow composed of a plurality of middleware connected in series.

As shown in fig. 4, the middleware may include a standard middleware, a data cleansing middleware, a format conversion middleware, and an event pushing middleware, classified according to functions. The standard middleware is used for realizing basic and general functions to which various types of event information are possibly applied, such as standard schema conversion, log recording, data check and check, shunting, monitoring and reporting, UUID (Universally Unique Identifier, universal unique identification code) addition, processing time addition and the like. The data cleaning middleware is responsible for processing collected event information in a non-standard format, perfecting and complementing irregular and imperfect event information, and specifically comprises address (tree) information conversion, IP information conversion, equipment information addition, field removal, event influence range modification, authority information and the like. For example, the device information in the event information of the operation system often only has the IP information of the device itself, and the middleware can perfect the device room information, the device province and the operator information for the downstream consumer of the event bus.

The format conversion middleware is also called schema splicing middleware and is responsible for converting the data format. For triggering events of service parties, event formats of unused systems are inconsistent, the event formats can be divided into sub-information containing different sub-fields by using a schema splicing middleware, and then schema splicing and conversion are carried out on each sub-information, so that the effect of unifying and regulating the schema formats is achieved. For example, the change time, the change type, the change state, the change person, the change system and the change description can be used as a basic sub-schema, the event information is used as a set of the basic sub-schema and other sub-schemas, and rule matching and distribution of different event subsets of different data types in the event bus can be completed in a splicing mode. As in fig. 4, each sub-schema may include xray shema, core schema, and so on. The event pushing middleware is responsible for pushing the processed regular event information, and specifically comprises a standard message queue, other service interfaces, an event bus, a fault positioning platform and the like.

Specifically, the monitoring end may correspond to each event source, and determine, for different event types in the event source, a mapping relationship between each event type and the middleware flow. After the event information is acquired, the mapping relation is queried according to the event source and the event type of the event information, and the middleware flow matched with the event information is determined. In a specific implementation, the monitoring end may determine a mapping relationship of event sources, event types, and middleware flows based on historical operation and maintenance experience.

Step 208, calling the middleware corresponding to the middleware flow, and carrying out information processing on the event information to obtain an event processing result.

The event processing result may include event report result, data check result, and update event information in a uniform format. It can be understood that the types of the middleware corresponding to the middleware flows are different, and the specific content of the event processing results is also different. Specifically, after determining the middleware flow matched with the event information, the monitoring end may call each middleware in turn according to each middleware contained in the middleware flow and the arrangement sequence of each middleware, and perform information processing on the event information to obtain a corresponding event processing result.

The present network event information processing method determines an internal operation system of a content distribution network and an external operation system associated with a present network corresponding to the content distribution network; monitoring trigger events affecting the operation of the existing network in the internal operation system and the external operation system, and obtaining event information of recording the trigger events; determining a middleware flow matched with the event information based on the event source and the event type of the event information; and calling the middleware corresponding to the middleware flow to process the event information to obtain an event processing result, and uniformly monitoring and processing different sources and different types of trigger events associated with the same CDN current network to obtain an event processing result, so that subsequent analysis and processing are facilitated, and the work efficiency is improved.

In one embodiment, step S204 includes at least one of: acquiring event information stored in respective message queues of an internal operation system and an external operation system; and monitoring trigger events influencing the operation of the current network in the internal operation system and the external operation system based on the network address, and obtaining event information for recording the trigger events.

Where a message is a unit of data transferred between two computers. The message may be very simple, e.g. only contain text strings; or may be more complex and may contain embedded objects. Messages are sent to a queue, which is a container that holds messages during their transmission. The message queue manager acts as a man-in-the-middle when relaying a message from its source to its destination. Wherein, the source of the message refers to the source of the message in the message transmission process, corresponds to the message transmitter, and the target of the message refers to the destination in the message transmission process, corresponds to the message receiver. The main purpose of the queues is to provide routing and to ensure delivery of messages; if the recipient is not available at the time the message is sent, the message queue will hold the message until it can be successfully delivered.

Specifically, in the operation process, both the internal operation system and the external operation system generate messages, and store the messages in corresponding message queues. Based on the above, the monitoring end can obtain event information for recording trigger events affecting the operation of the current network in the internal operation system and the external operation system by monitoring respective Message queues of each operation system and through an MQ (Message Queue) collecting and pushing mode. As shown in fig. 5, in an exemplary embodiment, on one hand, each operation system is deployed with an information collection script for message collection on an internet data center (INTERNET DATA CENTER, IDC), where the information collection scripts are usually loop scripts, initial messages collected by the information collection scripts are pushed to an initial message queue, and a monitoring end can obtain event information for recording a trigger event affecting current network operation by monitoring the initial messages in the initial message queue. Further, the initial message queue may include 15 topics of scene changes (Topic) and a default Topic, where the data formats in the Topic of each scene are consistent, and the default Topic has a lower priority. On the other hand, a service side MQ can be newly added, and the service side pushes the message reflecting the change of the current network to the service side MQ, so that the monitoring end can obtain event information for recording the trigger event affecting the operation of the current network by monitoring the message in the service side MQ.

In a specific application, acquiring event information stored in respective message queues of an internal operation system and an external operation system includes: acquiring initial messages stored in initial message queues of an internal operation system and an external operation system respectively; and screening the messages of the initial messages, and keeping the event information of the triggering event which is used for recording and influencing the operation of the current network in the initial messages. The initial message is acquired by the information acquisition scripts of the internal operation system and the external operation system. As described above, the information collection script is a loop script for message collection deployed on the internet data center for each operation system, so that message collection can be realized. Specifically, the monitoring end acquires initial messages stored in initial message queues of the internal operation system and the external operation system, performs message screening on the initial messages according to the association degree of each initial message and the current network, filters out non-event information in each initial message, and only keeps event information used for recording trigger events affecting the current network operation in each initial message. Event information is acquired based on information acquisition scripts configured by each operation system, so that the resource utilization rate is improved, and the efficiency is improved.

Furthermore, the monitoring end can monitor trigger events affecting the operation of the current network in the internal operation system and the external operation system based on the network address, and obtain event information for recording the trigger events. Wherein, the network address may include at least one of a data push address and a data acquisition address, that is, the service party may call the monitoring end interface to push data through the data push address, such as direct push in fig. 5; the service direction monitoring end can also provide a data acquisition address, and the monitoring end polls the acquired data based on the data acquisition address, such as the direct acquisition in fig. 5. The triggering event affecting the operation of the current network in the internal operation system and the external operation system can be monitored by directly pushing or directly collecting the data, and the event information for recording the triggering event is obtained.

In one particular application, the network address includes a data push address and a data acquisition address. In the case of this embodiment, monitoring trigger events affecting operation of the current network in the internal operation system and the external operation system based on the network address, obtaining event information recording the trigger events, includes: acquiring event information pushed by an internal operation system and an external operation system based on a data push address; acquiring respective data acquisition addresses of the internal operation system and the external operation system, and monitoring trigger events influencing the operation of the existing network in the internal operation system and the external operation system based on the respective data acquisition addresses to acquire event information for recording the trigger events. The event information is used for recording trigger events affecting the operation of the current network in the internal operation system and the external operation system. Specifically, the monitoring end can acquire event information pushed by the internal operation system and the external operation system based on the data push address, or acquire respective data acquisition addresses of the internal operation system and the external operation system, and monitor trigger events affecting the operation of the current network in the internal operation system and the external operation system based on the respective data acquisition addresses to acquire event information for recording the trigger events. The collection of event information based on the network address can support data pushing and data pulling based on the hypertext transfer protocol and the database, and is beneficial to expanding the application scene of the current network event information processing method.

In the above embodiment, a plurality of different acquisition modes are provided, all system interaction means in the current mainstream are supported, and great friendliness is provided for the access of an operation system, so that the flexibility of the current network event information processing method is improved.

In one embodiment, the present network event information processing method further includes: a middleware library is established that contains at least a portion of the middleware in the data cleansing middleware, the format conversion middleware, the standard middleware, or the event pushing middleware. In the case of this embodiment, step S206 includes: determining an information processing flow matched with the event information based on the event source and the event type of the event information; and determining a plurality of target middleware corresponding to the information processing flow in the middleware library and a middleware flow containing each target middleware.

Wherein specific definitions regarding data cleansing middleware, format conversion middleware, standard middleware or event pushing middleware are provided above. For example, as shown in fig. 4, corresponding to a change event of the internal operation system, the determined data processing flow is to sequentially perform log recording, add UUID, add processing time, perform schema conversion, and report an event bus, and the corresponding middleware flow includes standard middleware such as log recording, UUID addition, processing time addition, and the like, and format conversion middleware and event push middleware. Similarly, corresponding to the device management event of the internal operation system, the determined data processing flow is to sequentially perform log recording, data cleaning, schema conversion, UUID addition and message queue reporting, and the corresponding middleware flow comprises standard middleware such as log recording, UUID addition, and the like, as well as data cleaning middleware, format conversion middleware and event pushing middleware. Corresponding to the on-off event of the internal operation system, the determined data processing flow is a fault positioning platform for sequentially carrying out log record, adding processing time, data cleaning, schema conversion and reporting.

That is, the monitoring end may pre-establish a middleware library that includes at least a portion of the data cleansing middleware, the format conversion middleware, the standard middleware, or the event pushing middleware. After the event information is acquired, the monitoring end can determine an information processing flow matched with the event information based on the event source and the event type of the event information, and then screen out a target middleware corresponding to the information processing flow from a middleware library, so as to determine a middleware flow consisting of the target middleware.

In the above embodiment, the middleware library is first built, and after the event information is acquired, the middleware flow matched with the event information is determined, so that the requirements of the information processing flows of the event information with different sources and types can be matched through different middleware combination forms, which is beneficial to improving the flexibility of the current network event information processing method.

In one embodiment, determining an information processing flow matching the event information based on an event source and an event type of the event information includes: based on an event source of the event information, acquiring an information processing record aiming at the historical event information in the event source; and determining the historical processing flow corresponding to the information processing record as the information processing flow matched with the event information.

The event source is an internal operation system or an external operation system. The historical event information is consistent with the event type of the event information. Specifically, after the monitoring end obtains the event information of the triggering event, the monitoring end can obtain the information processing record of the historical event information consistent with the event type of the event information in the same event source based on the event source of the event information. Then, a history process flow corresponding to the information processing record is determined, and the history process flow is determined as an information process flow matching the event information. For example, for the on-off event of the internal operation system, the monitoring end may acquire an information processing record of event information of the on-off event of the history of the internal operation system, and determine a history processing flow corresponding to the information processing record as an information processing flow of event information of the on-off event that is currently acquired.

In this embodiment, based on the information processing record of the historical event information corresponding to the current event information, the information processing flow matched with the current event information is determined, which is equivalent to the process that can be applied to the current network event according to the historical operation and maintenance experience, and is beneficial to improving the efficiency.

In one embodiment, the event processing results include updated event information that satisfies the structural condition. Determining an information processing flow matched with the event information based on the event source and the event type of the event information, comprising: determining the information structure of respective event information of each event type in each event source; if the information structure does not meet the structural condition, determining that the information processing flow matched with the event information comprises a structure change flow.

The event information may include at least a portion of information in an event source, an event object, an event time, an event type, or an event description, among others. The information structure is used for representing the data arrangement mode of the event information, and can specifically comprise at least one of data composition or data format. The data composition may refer to data information constituting event information, such as event source, event object, event time, event type or event description, etc., and the data format may be a format of data information, such as a format of event time, a format of event source, a format of event object, etc. The event information meeting the structural condition means that the information structure of the event information meets the setting structure, and specifically may include at least one of a data composition meeting the setting data composition of the event information and a data format meeting the setting format of the event information.

Specifically, the monitoring end may determine an information structure of the event information of each event type in each event source, and determine that an information processing flow matched with the event information includes a structure change flow if the information structure does not meet a structural condition. Further, the target middleware corresponding to the structure change procedure may include at least one of a data cleansing middleware and a format conversion middleware.

In one specific application, the information structure includes a data structure and a data format; the structural conditions include data composition conditions and data format conditions. In the case of this embodiment, if the information structure does not satisfy the structural condition, determining that the information processing flow matching the event information includes the structure change flow includes: if the data composition does not meet the data composition condition, determining that the information processing flow matched with the event information comprises a data cleaning flow; if the data format does not meet the data format condition, determining that the information processing flow matched with the event information comprises a format conversion flow.

Specifically, as described above, the data cleansing flow is used for perfecting and complementing imperfect event information, based on which the monitoring end can determine that the information processing flow matched with the event information includes the data cleansing flow when missing information exists in the data composition of the event information and the data composition condition is not satisfied, so as to obtain updated event information of uniform data composition through data cleansing. Further, the format conversion process is used for converting the data format, based on which, the monitoring end can determine that the information processing process matched with the event information includes the format conversion process under the condition that the data format of the event information does not meet the data format condition, so as to obtain updated event information in a unified data format through format conversion.

In the above embodiment, the information processing flow matched with the event information is determined according to the information structure of the event information, so that updated event information with uniform information structure can be obtained, and the downstream service is supported to perform data uniform consumption, which is beneficial to expanding and improving the application scene of the event information.

In one embodiment, the middleware comprises event push middleware. In the case of this embodiment, the present network event information processing method further includes: and responding to the event subscription configuration operation, and displaying configured event subscription conditions.

Step S208 includes: under the condition that the event information meets the event subscription condition, calling an event pushing middleware to report the event information to an event bus; and acquiring pushing results of the event bus aiming at the event information and the associated information of the event information.

The specific limitation of the event pushing middleware is referred to above, and is not repeated herein. The event subscription configuration operation refers to an operation of performing unified subscription configuration on event information. As shown in fig. 6, the monitoring end is configured with a unified management interface of events, in which all accessed event types can be checked, and meanwhile, the enabling and disabling state of an event of a certain type can be determined through interface operation conditions, and operations of updating, deleting, checking and the like of the event information can be supported. The event type may be represented by a type identifier, which may include at least one of letters, coincidences, and numbers. Specific rights which can be subscribed, checked and consumed can be set for each event type, and meanwhile, an approval mechanism for the rights is established to ensure that the data has privacy and isolation. The event subscription condition refers to an event subscription rule configured through paging, for example, a certain HTTP service or a certain script service can be accessed to an event bus to subscribe to an concerned event stream, and for example, a matching rule of fields included in an event can be set to check all event information in the event stream, so that an event flowing to a consumer terminal is ensured to accord with the rule.

Specifically, the monitoring end can respond to the event subscription configuration operation, display configured event subscription conditions, and call the event pushing middleware to report the event information to the event bus under the condition that the event information meets the event subscription conditions. For example, the event schema may be configured in a coding manner, a format of a certain type of event information may be specified, and event information that does not conform to the format may be discarded, so as to ensure consistency and integrity of downstream event information, so as to meet different requirements of multiple event types, such as field selection, field type, field numerical range, field value enumeration, and so on. The interface of the coding configuration can be displayed through a floating window on the basis of the unified management interface. Further, after the event bus acquires the reported event information, as shown in fig. 7, the event information of a plurality of events associated with the same flow may be aggregated and then pushed to the target terminal. As in fig. 7, the aggregated event information includes version change information and installation package ID change information. The monitoring terminal can acquire the pushing result of the event bus aiming at the event information and the associated information of the event information so as to monitor the consumption condition of the event information.

In this embodiment, event information meeting the event subscription condition may be reported to the event bus by configuring the event subscription condition, and a push result of event summary for the event information and associated information of the event information may be obtained, so that it may be ensured that the event information flowing into the consumer meets the consumption requirement.

In one embodiment, the present network event information processing method further includes: displaying device information of the node device and event information associated with the node device corresponding to the node device of the current network; displaying a fault diagnosis result for the node device determined based on the device information and the event information; when the failure diagnosis result is abnormal, the failure diagnosis result is output.

The node device refers to devices of each node in the existing network, such as node routing, node servers and the like. The device information of the node device may include home information, core information, load information, alarm information, status information, and the like. The home information may refer to a home node of the node device; the core information may refer to a core record of the device operating system; the load information may include peak load of the device, average load over a set period of time, etc.; the status information may refer to a status code for characterizing the current operational status of the node device.

Specifically, the monitoring end may correspond to a node device of the current network, display device information of the node device and event information associated with the node device, and then perform fault diagnosis on the node device based on the device information and the event information, obtain a fault diagnosis result, and output the fault diagnosis result if the fault diagnosis result is abnormal. For example, as shown in fig. 8, the fault diagnosis result may include diagnosis results of various device information such as home information, core information, load information, and alarm information. Further, in the process of performing the device failure diagnosis, a reference time range may also be set, such as "the last half hour" in fig. 8, that is, the device failure diagnosis may be performed based on the device information and the event information of the node device in the reference time range. For example, if a node device has an operating system core record within half an hour, the diagnostic result of the core information is abnormal, indicating that the device is currently in a dangerous state, and may need to process or reject services from the existing network. It can be understood that besides core information, a plurality of inspection items such as performance load, monitoring system alarm and the like can be configured, so that the health state of the equipment is completely reflected.

Further, the device information and recent change events together determine the current availability status of the device. Based on the method, the monitoring end can evaluate the running state of the node equipment by combining the equipment information of the node equipment and the event information related to the node equipment, give out logic judgment of whether the node equipment is abnormal or not, and feed back the result to operation and maintenance personnel. That is, as shown in fig. 9, the fault diagnosis result may further include an equipment sub-health diagnosis result, an equipment status code diagnosis result, a machine room quality diagnosis result, a change event analysis result, and the like. The device sub-health diagnosis result can be determined according to the relation between the current operation index of the device and the set sub-health judgment index, and the sub-health judgment index can be set by combining the operation requirement of the device and the historical experience; the equipment state code diagnosis result is determined according to the current equipment state code, and if the current equipment state code indicates that the equipment is abnormal, the equipment state code diagnosis result is abnormal; the machine room quality diagnosis result is used for representing the safety and reliability of a machine room link of the machine room where the equipment is located.

In this embodiment, after the monitoring end collects the event information, the monitoring end performs equipment fault diagnosis by combining the event information and the equipment information, and outputs the diagnosis result under the condition that the diagnosis result is abnormal, so that loss caused by untimely monitoring can be reduced, and MTTR of the system is reduced.

In one embodiment, the event processing results include updated event information that satisfies the structural condition. In the case of this embodiment, the present network event information processing method further includes: responding to the query condition configuration operation, and displaying the configured information query condition; and responding to the information inquiry event, and displaying target update event information matched with the information inquiry condition in each update event information.

Wherein, see above for specific limitation of structural condition, not repeated here. It will be appreciated that where event information is converted into updated event information that is consistent in information structure, query operations for event information may be supported. Specifically, the monitoring end can respond to the query condition configuration operation to display the information query condition configured by the operation and maintenance personnel. The information query condition may be a query condition for each component of the event information, and as shown in fig. 10, each component may include an event source, an event type, and an IP address, a domain name, a platform name and a platform ID of a platform where the associated device is located, and the like. The time range of the event query may also be defined. The operation and maintenance personnel can configure information inquiry conditions by selecting or inputting information.

Then, the monitoring end responds to the information inquiry event and displays target update event information matched with the information inquiry condition in the update event information. It should be noted that, the triggering mode of the information query event is not unique, and may be automatically triggered after the configuration of the information query condition is completed, or may be triggered by operation and maintenance personnel through operation. For example, as shown in fig. 10, an information query event may be triggered when an operator clicks a "query" control, and then, the monitoring end responds to the information query event to display target update event information matched with the configured information query condition in each update event information. Further, the states in FIG. 10 refer to the current state of an event, including in progress, interrupted, successful, and so forth. The flow associated with the ongoing representative event is in progress. Further, it is also possible to select the target update event information selected by the corresponding field display section based on the field information of the update event information, and support the index trend and the aggregation analysis for the target update event information.

In this embodiment, the event information is processed into updated event information with a unified structure, so that query operation for the event information can be supported, analysis by operation and maintenance personnel based on the event information is facilitated, and stability of current network operation is improved.

In one embodiment, as shown in fig. 11, the present network event information processing method includes the steps of:

step S1101, determining an internal operation system of a content distribution network and an external operation system associated with a current network corresponding to the content distribution network;

Step S1102, establishing a middleware library including at least a part of middleware in the data cleaning middleware, the format conversion middleware, the standard middleware or the event pushing middleware;

step S1103, acquiring initial messages stored in respective initial message queues of the internal operation system and the external operation system;

The initial message is acquired by respective information acquisition scripts of the internal operation system and the external operation system;

step S1104, screening the initial messages, and reserving event information used for recording trigger events affecting the operation of the current network in the initial messages;

Step S1105, acquiring event information pushed by the internal operation system and the external operation system based on the data push address;

the event information is used for recording trigger events which influence the operation of the current network in the internal operation system and the external operation system;

step S1106, acquiring respective data acquisition addresses of an internal operation system and an external operation system, and monitoring trigger events affecting the operation of the current network in the internal operation system and the external operation system based on the respective data acquisition addresses to acquire event information for recording the trigger events;

step S1107, based on the event source of the event information, acquiring the information processing record aiming at the history event information in the event source;

The event source is an internal operation system or an external operation system; the historical event information is consistent with the event type of the event information;

step S1108, determining the history processing flow corresponding to the information processing record as the information processing flow matched with the event information;

Step S1109, determining a plurality of target middleware corresponding to the information processing flow in the middleware library, and a middleware flow including each target middleware;

step S1110, calling each target middleware corresponding to the middleware flow, and carrying out information processing on the event information to obtain updated event information meeting the data construction conditions and the data structure conditions;

step S1111, in response to the event subscription configuration operation, displaying configured event subscription conditions;

Step S1112, calling an event pushing middleware to report the updated event information to an event bus and acquiring a pushing result of the event bus aiming at the updated event information and the associated information of the updated event information under the condition that the updated event information meets the event subscription condition;

step S1113, corresponding to the node device of the current network, displaying device information of the node device and update event information associated with the node device;

step S1114, displaying the fault diagnosis result for the node device determined based on the device information and the update event information, and outputting the fault diagnosis result if the fault diagnosis result is abnormal;

Step S1115, in response to the query condition configuration operation, displaying the configured information query condition;

In step S1116, in response to the information query event, the target update event information matching the information query condition among the update event information is displayed.

In one embodiment, as shown in fig. 12, a data collection process of the present network event information processing method according to the present application is provided. The operation system of the present network comprises an internal operation system of the CDN and an external operation system which has influence on the operation of the present network of the CDN, and comprises a monitoring system, a work order system, a machine room changing system and the like, wherein the operation systems are all producers of events and main bodies needing to be collected. The collector at the monitoring end is responsible for collecting event information in the whole current network operation system. Event reporting means that the monitoring end sends regular event information to the event bus after completing event information acquisition and data processing, so that downstream consumption service can acquire corresponding event information from the event bus for consumption. Event discarding refers to the fact that certain event information is directly discarded after being collected, and is found to be unsatisfactory through data cleaning and regularity, and also does not need to be consumed.

Specifically, as shown in fig. 3 and fig. 4, the monitoring end is configured with a plurality of collectors of different types, and each collector is responsible for collecting event information of one type and corresponds to one middleware flow. The collector at the monitoring end can monitor the trigger event of each operation system in the mode of MQ or polling to obtain event information. In the implementation inside the collector, a bidirectional collection mode is supported for the current network change. That is, the service side may push information to the collector, or may be polled by the collector to collect recently occurring events. For service side pushing, the sensing, cleaning and processing of the event are performed until the event bus is latency-free, so that real-time processing can be ensured; for the collector polling collection service side, a time window and a collection window can be defined, event collection is carried out based on the time window and the collection window, then caching hash deduplication processing is carried out, and the situation that the event at critical time is lost can be avoided only by ensuring that the collection window is larger than the time window. For example, the event information of the triggering event occurring in the last 5min may be collected with 60S as a time window.

And then, the monitoring end carries out information processing on the event information based on the middleware flow matched with the event information. The information processing process starts with event information acquired by the collector, and enters a middleware flow corresponding to each event type, and each middleware in the middleware flow is called successively. The middleware can initiate an action, such as monitoring and reporting, event bus pushing and the like; the method can also be used for modifying and changing the event data, such as cleaning the original data to remove a part of useless data, reducing the size of a data transmission packet, or integrating a part of information of other systems to increment the original event information, such as adding corresponding provincial operator information and machine room information for IP, or converting the data format to obtain updated event information in a representation format, and pushing the updated event information to an event bus, so that downstream consumers can consume the event information conveniently.

As shown in fig. 12, if the collector has no corresponding data processing middleware and only data reporting middleware, data processing such as data cleaning and format conversion is not required, and the event can be directly reported to the event bus. If the collector has the corresponding data processing middleware, the collector sequentially executes the middleware according to the corresponding middleware flow to finish the processes of data cleaning, data preprocessing, data format conversion, monitoring and reporting, UUID injection and the like. The different processes are split into single atomic operations and packaged in different middleware, and can be divided into standard middleware, data cleaning middleware, event pushing middleware and schema splicing middleware according to types, event discarding is carried out if the obtained event information does not meet the inspection standard after all middleware processes are completed, and if the obtained event information meets the inspection characterization, the event is reported to an event bus, and the processes are finished.

Further, as shown in fig. 5, the scheme of the application supports various collection modes of event information, specifically including MQ monitoring, direct pushing, direct collection and the like, matches different middleware flows for different types of event information in different scenes through middleware flow matching, and calls a standardized module package to process the event information based on the middleware flows to obtain unified updated event information. The standardized module carries event drivers, which may include adding UUID, adding record event, scene change standardization, standardized check, reporting monitor/print log, unifying MQ output, and MQ output under specific scene, etc. That is, by adopting the scheme, the unified MQ can be obtained, and the corresponding update event information can be output according to the scene requirement under the specific scene.

By adopting the scheme, the fault discovery time of the existing network can be reduced, and a change detection means is added, so that the existing network operation and maintenance personnel can carry out fault discovery not only independently but also independently depending on the index monitoring system. The proportion of faults caused by the change is higher in all faults, and the faults can be timely stopped when the change is led to find out the influence of the network through the detection means of rich event information, and the faults are automatically rolled back and notified to operation and maintenance personnel. Furthermore, the scheme has operation and maintenance friendliness, the event of each operation and maintenance system supports the operation and maintenance to subscribe in a script mode, the observability of operation and maintenance personnel on the current network is greatly increased, and the tool box for the operation and maintenance personnel to process the current network problem is enriched. In addition, the scheme unifies the event schema and supports preprocessing, unified preprocessing can be carried out aiming at different event formats and types of different operation systems, the event schema is converted into a unified format, the event schema is convenient to process in a set of processes in subsequent detection, analysis and use, new fields and information can be added for the event in the preprocessing process, and more complete event information is provided for downstream detection atoms for processing.

In one possible implementation manner, the present network event information processing method can be applied to an application scenario of message queue acquisition. In the application scenario, the processor determines an internal operation system of the content distribution network and an external operation system associated with a current network corresponding to the content distribution network; and monitoring trigger events influencing the operation of the existing network in the internal operation system and the external operation system by collecting message queues respectively generated by the internal operation system and the external operation system in the operation process, and obtaining event information for recording the trigger events. Then, the processor determines a middleware flow matched with the event information based on the event source and the event type of the event information; and calling a middleware corresponding to the middleware flow, carrying out information processing on the event information, obtaining updated data information in a uniform format, and reporting the event information meeting the event subscription condition to an event bus.

In another possible implementation manner, the present network event information processing method can be applied to an application scenario of data information acquisition. In the application scenario, the processor determines an internal operation system of the content distribution network and an external operation system associated with a current network corresponding to the content distribution network; and monitoring trigger events influencing the operation of the current network in the internal operation system and the external operation system by collecting data information in respective operation state databases of the internal operation system and the external operation system, and obtaining event information for recording the trigger events. Then, the processor determines a middleware flow matched with the event information based on the event source and the event type of the event information; and calling middleware corresponding to the middleware flow to filter and refine the event information, so that the downstream application is convenient for data consumption.

It should be understood that, although the steps in the flowcharts related to the above embodiments are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiment of the application also provides an authentication device for realizing the above-mentioned related authentication method. The implementation of the solution provided by the device is similar to the implementation described in the above method, so the specific limitation in the embodiments of one or more authentication devices provided below may be referred to the limitation of the authentication method hereinabove, and will not be repeated here.

In one embodiment, as shown in fig. 13, there is provided an active network event information processing apparatus 1300, comprising: a monitor object determination module 1302, an event information acquisition module 1304, a middleware flow matching module 1306, and an information processing module 1308, wherein:

a monitoring object determining module 1302, configured to determine an internal operation system of a content distribution network and an external operation system associated with a current network corresponding to the content distribution network;

the event information obtaining module 1304 is configured to monitor a trigger event affecting operation of the current network in the internal operation system and the external operation system, and obtain event information for recording the trigger event;

a middleware stream matching module 1306, configured to determine a middleware stream that matches the event information based on the event source and the event type of the event information;

The information processing module 1308 is configured to invoke a middleware corresponding to the middleware flow, and perform information processing on the event information to obtain an event processing result.

In one embodiment, the event information acquisition module 1304 includes: the message queue monitoring unit is used for acquiring event information stored in message queues of the internal operation system and the external operation system; the event information is used for recording trigger events which influence the operation of the current network in the internal operation system and the external operation system; the network address monitoring unit is used for monitoring trigger events affecting the operation of the current network in the internal operation system and the external operation system based on the network address, and obtaining event information for recording the trigger events.

In one specific application, the message queue monitoring unit is specifically configured to: acquiring initial messages stored in initial message queues of an internal operation system and an external operation system respectively; the initial message is acquired by respective information acquisition scripts of the internal operation system and the external operation system; and screening the messages of the initial messages, and reserving event information used for recording trigger events affecting the operation of the current network in the initial messages.

In one specific application, the network address includes a data push address and a data acquisition address; the network address monitoring unit is specifically configured to: acquiring event information pushed by an internal operation system and an external operation system based on a data push address; the event information is used for recording trigger events which influence the operation of the current network in the internal operation system and the external operation system; acquiring respective data acquisition addresses of the internal operation system and the external operation system, and monitoring trigger events influencing the operation of the existing network in the internal operation system and the external operation system based on the respective data acquisition addresses to acquire event information for recording the trigger events.

In one embodiment, the present network event information processing apparatus 1300 further includes a middleware library creation module for creating a middleware library including at least a portion of the middleware of the data cleansing middleware, the format conversion middleware, the standard middleware, or the event push middleware. In the case of this embodiment, the middleware flow matching module 1306 includes: an information processing flow determining unit for determining an information processing flow matching the event information based on the event source and the event type of the event information; and the middleware flow determining unit is used for determining a plurality of target middleware corresponding to the information processing flow in the middleware library and a middleware flow containing each target middleware.

In one embodiment, the information processing flow determining unit is specifically configured to: based on the event source of the event information, acquiring an information processing record aiming at the historical event information in the event source; the event source is an internal operation system or an external operation system; the historical event information is consistent with the event type of the event information; and determining the historical processing flow corresponding to the information processing record as the information processing flow matched with the event information.

In one embodiment, the event processing results include updated event information that satisfies the structural condition. In the case of this embodiment, the information processing flow determination unit is specifically configured to: determining the information structure of respective event information of each event type in each event source; if the information structure does not meet the structural condition, determining that the information processing flow matched with the event information comprises a structure change flow.

In one specific application, the information structure includes a data structure and a data format; the structural conditions include data composition conditions and data format conditions. The information processing flow determining unit is specifically configured to: if the data composition does not meet the data composition condition, determining that the information processing flow matched with the event information comprises a data cleaning flow; if the data format does not meet the data format condition, determining that the information processing flow matched with the event information comprises a format conversion flow.

In one embodiment, the middleware comprises event push middleware. The present network event information processing apparatus 1300 further includes a subscription configuration module for: and responding to the event subscription configuration operation, and displaying configured event subscription conditions. The information processing module 1308 is specifically configured to: under the condition that the event information meets the event subscription condition, calling an event pushing middleware to report the event information to an event bus; and acquiring pushing results of the event bus aiming at the event information and the associated information of the event information.

In one embodiment, the present network event information processing apparatus 1300 further includes a fault diagnosis module for: the node equipment corresponding to the current network displays equipment information of the node equipment and event information associated with the node equipment; displaying a fault diagnosis result for the node device, which is determined based on the device information and the event information; and outputting a fault diagnosis result when the fault diagnosis result is abnormal.

In one embodiment, the present network event information processing apparatus 1300 further includes a query module for: responding to the query condition configuration operation, and displaying the configured information query condition; and responding to the information inquiry event, and displaying target update event information matched with the information inquiry condition in each update event information.

The respective modules in the above-described network event information processing apparatus may be implemented in whole or in part by software, hardware, and a combination thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a server, and the internal structure of which may be as shown in fig. 14. The computer device includes a processor, a memory, an Input/Output interface (I/O) and a communication interface. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface is connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device is used for storing data needed by the method. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for communicating with an external terminal through a network connection. The computer program, when executed by a processor, implements a method of current network event information processing.

In one embodiment, a computer device is provided, which may be a terminal, and an internal structure diagram thereof may be as shown in fig. 15. The computer device includes a processor, a memory, an input/output interface, a communication interface, a display unit, and an input means. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless mode can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program, when executed by a processor, implements a method of current network event information processing. The display unit of the computer equipment is used for forming a visual picture, and can be a display screen, a projection device or a virtual reality imaging device, wherein the display screen can be a liquid crystal display screen or an electronic ink display screen, the input device of the computer equipment can be a touch layer covered on the display screen, can also be a key, a track ball or a touch pad arranged on a shell of the computer equipment, and can also be an external keyboard, a touch pad or a mouse and the like.

It will be appreciated by those skilled in the art that the structures shown in fig. 14 and 15 are merely block diagrams of portions of structures associated with aspects of the present application and are not intended to limit the computer apparatus to which aspects of the present application may be applied, and that a particular computer apparatus may include more or less components than those shown, or may combine some of the components, or have a different arrangement of components.

In one embodiment, a computer device is provided, comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the steps of the method embodiments described above when the computer program is executed.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored which, when executed by a processor, carries out the steps of the method embodiments described above.

In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of the method embodiments described above.

It should be noted that, the user information (including but not limited to user equipment information, user personal information, etc.) and the data (including but not limited to data for analysis, stored data, presented data, etc.) related to the present application are information and data authorized by the user or sufficiently authorized by each party, and the collection, use and processing of the related data need to comply with the related laws and regulations and standards of the related country and region.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magneto-resistive random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (PHASE CHANGE Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in various forms such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The databases referred to in the embodiments provided herein may include at least one of a relational database and a non-relational database. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processor referred to in the embodiments provided in the present application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, or the like, but is not limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The foregoing examples illustrate only a few embodiments of the application and are described in detail herein without thereby limiting the scope of the application. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the application, which are all within the scope of the application. Accordingly, the scope of the application should be assessed as that of the appended claims.

Claims

1. A method for processing current network event information, the method comprising:

2. The method according to claim 1, wherein the monitoring the internal operation system and the external operation system for triggering events affecting the operation of the present network, obtaining event information recording the triggering events, comprises at least one of:

Acquiring event information stored in respective message queues of the internal operation system and the external operation system; the event information is used for recording trigger events which influence the operation of the existing network in the internal operation system and the external operation system;

And monitoring trigger events affecting the operation of the current network in the internal operation system and the external operation system based on network addresses, and obtaining event information for recording the trigger events.

3. The method of claim 2, wherein the obtaining event information stored in respective message queues of the internal operating system and the external operating system comprises:

Acquiring initial messages stored in initial message queues of the internal operation system and the external operation system respectively; the initial message is acquired by respective information acquisition scripts of the internal operation system and the external operation system;

and screening the initial messages, and reserving event information used for recording trigger events affecting the operation of the current network in the initial messages.

4. The method of claim 2, wherein the network address comprises a data push address and a data acquisition address;

The monitoring the trigger event affecting the operation of the present network in the internal operation system and the external operation system based on the network address, obtaining event information for recording the trigger event, includes:

Acquiring event information pushed by the internal operation system and the external operation system based on a data push address; the event information is used for recording trigger events which influence the operation of the existing network in the internal operation system and the external operation system;

acquiring respective data acquisition addresses of the internal operation system and the external operation system, and monitoring trigger events affecting the operation of the current network in the internal operation system and the external operation system based on the respective data acquisition addresses to acquire event information for recording the trigger events.

5. The method according to claim 1, wherein the method further comprises:

establishing a middleware library containing at least one part of middleware in a data cleaning middleware, a format conversion middleware, a standard middleware or an event pushing middleware;

The determining the middleware flow matched with the event information based on the event source and the event type of the event information comprises the following steps:

Determining an information processing flow matched with the event information based on the event source and the event type of the event information;

And determining a plurality of target middleware corresponding to the information processing flow in the middleware library and a middleware flow containing each target middleware.

6. The method of claim 5, wherein determining an information processing flow that matches the event information based on the event source and event type of the event information comprises:

based on the event source of the event information, acquiring an information processing record aiming at the historical event information in the event source; the event source is the internal operation system or the external operation system; the historical event information is consistent with the event type of the event information;

And determining the historical processing flow corresponding to the information processing record as the information processing flow matched with the event information.

7. The method of claim 5, wherein the event processing results include updated event information that satisfies a structural condition;

The determining an information processing flow matched with the event information based on the event source and the event type of the event information comprises the following steps:

determining the information structure of respective event information of each event type in each event source;

And if the information structure does not meet the structural condition, determining that the information processing flow matched with the event information comprises a structure change flow.

8. The method of claim 7, wherein the information structure comprises a data structure and a data format; the structural conditions comprise data construction conditions and data format conditions;

And if the information structure does not meet the structural condition, determining that the information processing flow matched with the event information comprises a structure change flow, wherein the structure change flow comprises the following steps:

If the data composition does not meet the data composition condition, determining that the information processing flow matched with the event information comprises a data cleaning flow;

And if the data format does not meet the data format condition, determining that the information processing flow matched with the event information comprises a format conversion flow.

9. The method of any one of claims 1 to 8, wherein the middleware comprises an event push middleware; the method further comprises the steps of:

Responding to the event subscription configuration operation, and displaying configured event subscription conditions;

And invoking middleware corresponding to the middleware flow, performing information processing on the event information to obtain an event processing result, wherein the method comprises the following steps:

Calling the event pushing middleware to report the event information to an event bus under the condition that the event information meets the event subscription condition;

And acquiring a pushing result of the event bus aiming at the event information and the associated information of the event information.

10. The method according to any one of claims 1 to 8, further comprising:

displaying equipment information of the node equipment and event information associated with the node equipment corresponding to the node equipment of the current network;

displaying a fault diagnosis result for the node device determined based on the device information and the event information;

And outputting the fault diagnosis result under the condition that the fault diagnosis result is abnormal.

11. The method according to any one of claims 1 to 8, wherein the event processing result includes updated event information satisfying a structural condition; the method further comprises the steps of:

Responding to the query condition configuration operation, and displaying the configured information query condition;

And responding to the information inquiry event, and displaying target update event information matched with the information inquiry condition in each update event information.

12. An on-line event information processing apparatus, the apparatus comprising:

13. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any one of claims 1 to 11 when the computer program is executed.

14. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 11.

15. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any one of claims 1 to 11.