IT (information technology) fault source diagnosis method and IT fault source diagnosis system

Abstract

Disclosed are an IT (information technology) fault source diagnosis method and an IT fault source diagnosis system. The method includes predefining a performance index model of an IT system; collecting performance data in the performance index model and generating performance index values; calculating an average performance value of the performance index values; judging whether the difference of a performance index value monitored at a certain time point and a predefined index value or the average performance value is larger than a preset threshold value or not, if yes, defining the performance index value at the time point as an abnormal event of performance indexes and defining multiple abnormal events occurring at a same time point as an abnormal event set; utilizing an association rule FP-tree frequency set algorithm to calculate the association relationship among the multiple abnormal events in the abnormal event set, and generating an association rule characteristic model; analyzing whether the abnormal events, occurring at the same time point, in the association rule characteristic model are caused by an IT fault source or not, if yes, defining the association rule characteristic model as a characteristic model of the IT fault source; matching the performance indexes collected in real time during operation of the IT system with the abnormal event sets in the characteristic model.

Description

technical field [0001] The invention relates to IT system fault diagnosis technology, in particular to an IT fault source diagnosis method and system. Background technique [0002] A complete IT system architecture is composed of multiple IT components. Traditional IT monitoring mainly adopts the deployment of corresponding professional monitoring systems at each component layer to monitor the corresponding IT components. The monitoring tools on the market, each tool only targets one component, such as operating system, database, middleware, network, server hardware, storage hardware, tape library hardware, data transmission tools, backup tools, etc. each has its own professional monitoring system . [0003] The IT system architecture is composed of multiple IT components. When an IT component fails, only the abnormality of the IT architecture caused by the failure triggers the monitoring scenario that has been preset by a specific professional monitoring system (monitoring...

AI Technical Summary

Problems solved by technology

However, the current IT system architecture is very complex. When an IT component abnormality belongs to a monitoring point not yet supported by its corresponding professional monitoring, or the corresponding monitoring point and monitoring threshold are not defined in the professional monitoring, each professional monitoring system may not be able to issue a corresponding alarm events; even if the professional monitoring system threshold is reached and an alarm event is generated, it usually only indicates that an IT component is running abnormally, and does not point to the real source of the fault. At this time, monitoring alarms are helping technicians to accurately analyze and quickly locate The real cause of the fault plays a limited role, which may sometimes lead to misjudgment, making it very difficult for technicians to locate the fault

Images