Alarm attribution method and device, electronic equipment, storage medium and program product

Abstract

The invention relates to the technical field of data processing, and discloses an alarm attribution method and device, electronic equipment, a storage medium and a program product, and the method comprises the steps: obtaining alarm information of a target service; extracting target meta-information for attribution from the alarm information; performing attribution analysis on the alarm information based on the target meta-information and at least one attribution strategy corresponding to the target service to obtain a first attribution result corresponding to the at least one attribution strategy; and performing fusion analysis on each first attribution result to obtain a target attribution result of the alarm information. Under the condition that the alarm information is obtained, the alarm information can be automatically subjected to attribution analysis, so that the time consumption of manual troubleshooting can be reduced, and the problem that the time consumption of alarm attribution is relatively long is solved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to an alarm attribution method, device, electronic device, storage medium and program product. Background Art

[0002] In the microservice architecture environment of the advertising platform, the system is composed of multi-level and multi-dimensional service components, forming an intricate network. Each service node not only has dependencies on other service nodes, but also may span different physical and virtual environments, involving diverse computing resources, storage systems, and network configurations. This complexity not only increases the frequency of daily problems, but also greatly increases the difficulty of troubleshooting.

[0003] In related technologies, when an alarm problem occurs online, the operation and maintenance personnel need to check the monitoring on the relevant platform and search for relevant business logs based on the alarm information, and then judge the cause of the problem based on experience. This manual investigation and alarm attribution method often takes a long time. Summary of the invention

[0004] In view of this, the present disclosure provides an alarm attribution method, apparatus, device, storage medium and program product to solve the problem that alarm attribution takes a long time.

[0005] In a first aspect, the present disclosure provides an alarm attribution method, the method comprising:

[0006] Get the target service's warning information;

[0007] extracting target meta information for attribution from the warning information;

[0008] Performing attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service, and obtaining a first attribution result corresponding to the at least one attribution strategy;

[0009] A fusion analysis is performed on each of the first attribution results to obtain a target attribution result of the alarm information.

[0010] In a second aspect, the present disclosure provides an alarm attribution device, the device comprising:

[0011] An information acquisition module is used to obtain the alarm information of the target service;

[0012] An information extraction module, used to extract target meta information for attribution from the alarm information;

[0013] an attribution analysis module, configured to perform attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service, and obtain a first attribution result corresponding to the at least one attribution strategy;

[0014] The result analysis module is used to perform a fusion analysis on each of the first attribution results to obtain a target attribution result of the alarm information.

[0015] In a third aspect, the present disclosure provides an electronic device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the alarm attribution method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0016] In a fourth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the alarm attribution method of the first aspect or any corresponding embodiment thereof.

[0017] In a fifth aspect, the present disclosure provides a computer program product, including computer instructions, which are used to enable a computer to execute the alarm attribution method of the above-mentioned first aspect or any corresponding embodiment thereof.

[0018] The alarm attribution method provided by the embodiment of the present disclosure, if the alarm information of the target service is obtained, the target meta information used for attribution is extracted from the alarm information. Therefore, the meta information required in the attribution analysis process can be automatically extracted from the alarm information, providing a basis for subsequent attribution analysis. Furthermore, the alarm information is automatically attributed and analyzed based on the target meta information and the different attribution strategies corresponding to the target service, and the first attribution results corresponding to each attribution strategy are obtained, so as to help fully understand the cause of the alarm information. And each first attribution result is fused and analyzed to obtain the target attribution result of the alarm information. Therefore, while automatically troubleshooting the cause of the alarm information, the accuracy of the attribution result can be improved through fusion analysis. In this embodiment, the entire attribution analysis process is automatically executed, and there is no need to manually troubleshoot the cause of the alarm information, so it can effectively reduce the time-consuming manual troubleshooting and improve the efficiency of alarm attribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the specific embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 is a flowchart of a first alarm attribution method according to an embodiment of the present disclosure;

[0021] Figure 2 is a flow chart of a second alarm attribution method according to an embodiment of the present disclosure;

[0022] Figure 3 is a schematic diagram of warning information according to an embodiment of the present disclosure;

[0023] Figure 4 is a flowchart of a third alarm attribution method according to an embodiment of the present disclosure;

[0024] Figure 5 is a hierarchical schematic diagram of an attribution system according to an embodiment of the present disclosure;

[0025] Figure 6 is a schematic diagram of a drill-down attribution function according to an embodiment of the present disclosure;

[0026] Figure 7 is a schematic diagram of analysis data of a rate of change analysis function according to an embodiment of the present disclosure;

[0027] Figure 8 is a schematic diagram of analysis data of an outlier analysis function according to an embodiment of the present disclosure;

[0028] Fig. 9 is a flowchart of a fourth alarm attribution method according to an embodiment of the present disclosure;

[0029] Fig.10 is a schematic diagram of a message card according to an embodiment of the present disclosure;

[0030] Fig.11 is a schematic diagram of a target group according to an embodiment of the present disclosure;

[0031] Fig.12 is a schematic diagram of a system architecture applicable to an advertising platform microservice architecture environment according to an embodiment of the present disclosure;

[0032] Fig.13 is a structural block diagram of an alarm attribution device according to an embodiment of the present disclosure;

[0033] Fig.14 is a structural block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0035] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0036] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0037] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0038] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0039] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0040] In the microservice architecture environment of the advertising platform, the system is composed of multi-level and multi-dimensional service components, forming an intricate network. Each service node not only has dependencies on other service nodes, but also may span different physical and virtual environments, involving diverse computing resources, storage systems, and network configurations. This complexity not only increases the frequency of daily problems, but also greatly increases the difficulty of troubleshooting.

[0041] In related technologies, when an alarm problem occurs online, the operation and maintenance personnel need to check the monitoring on the relevant platform and search the relevant business logs according to the alarm information, and then judge the cause of the problem based on experience. This manual investigation and alarm attribution method depends on the proficiency and experience of the operation and maintenance personnel, and is often time-consuming. If the root cause of the alarm cannot be found in time and the problem that caused the alarm cannot be solved, the alarm level and impact may be increased.

[0042] Especially for advertising services, since advertising services are very sensitive to errors, alarms will come one after another during daily duty, and dozens of alarm messages may be generated in a day. If the operation and maintenance personnel carefully check each alarm message, they may be overwhelmed and easily neglect it when manual intervention is really needed.

[0043] In addition, there are many reasons for the generation of alarm information, such as code logic problems, delays in service calls, excessive memory usage of a single machine, service online restart, short-term traffic surge, etc. It takes a lot of time to collect and organize the causes of the alarm, and it is difficult to determine the root cause of the alarm information.

[0044] In addition, there are many types of alarms, including daily alarms, continuous alarms, telephone alarms, short-term frequent alarms, etc. It takes a lot of time to summarize and analyze these alarms on a daily basis.

[0045] Based on the above analysis, it can be seen that how to reduce the time consumption of alarm attribution has become an urgent problem to be solved.

[0046] In view of this, according to an embodiment of the present disclosure, an alarm attribution method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0047] In this embodiment, a first alarm attribution method is provided, which can be used in an attribution system, such as a server of the attribution system, wherein the attribution system is used to perform attribution analysis on received alarm information. Figure 1 is a flow chart of a first alarm attribution method according to an embodiment of the present disclosure, such as Figure 1 As shown, the process includes the following steps:

[0048] Step S101, obtaining alarm information of a target service.

[0049] Specifically, the data alarm system provides alarm information in the microservice dimension based on metrics monitoring, error logs and other capabilities, and the attribution system obtains alarm information from the data alarm system.

[0050] Optionally, the alarm information includes at least one of the triggered alarm rule, basic alarm information, and alarm tag. Among them, the basic alarm information includes at least one of the alarm service, cluster, rule, alarm time, processing object, notification method, and diagnostic information. The alarm tag includes at least one of the microservice name, downstream call service, and downstream method. In addition, the basic alarm information, alarm tag, or alarm information may also include other information related to the alarm, which can be adjusted according to actual conditions and is not limited here.

[0051] Step S102: extracting target meta information for attribution from the alarm information.

[0052] Specifically, the information required by each attribution strategy in the process of attribution analysis is pre-set as target extraction information. Then, the relevant information is extracted from the warning information according to the target extraction information to obtain the target meta information.

[0053] Step S103: performing attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service to obtain a first attribution result corresponding to the at least one attribution strategy.

[0054] Specifically, the attribution strategy supported by the target service is pre-configured, and the target meta information is matched with the attribution strategy to determine whether the target meta information contains all the information required by the attribution strategy. If the target meta information can provide all the information required for the attribution strategy, the attribution strategy is executed to obtain the first attribution result of the attribution strategy.

[0055] Step S104, performing a fusion analysis on each first attribution result to obtain a target attribution result of the alarm information.

[0056] Specifically, the target attribution result can be determined according to the priority of each first attribution result. For example, the first attribution result with the highest priority is used as the target attribution result. Alternatively, a preset number of first attribution results are selected from the highest priority to the lowest priority as the target attribution result. Alternatively, relevant information is filtered out from the first attribution result according to a preset result template, and the preset result template is filled to obtain the target attribution result.

[0057] The alarm attribution method provided in this embodiment, if the alarm information of the target service is obtained, the target meta information used for attribution is extracted from the alarm information. Therefore, the meta information required in the attribution analysis process can be automatically extracted from the alarm information, providing a basis for subsequent attribution analysis. Furthermore, the alarm information is automatically attributed and analyzed based on the target meta information and different attribution strategies corresponding to the target service, and the first attribution results corresponding to each attribution strategy are obtained to help fully understand the cause of the alarm information. And each first attribution result is fused and analyzed to obtain the target attribution result of the alarm information. Therefore, while automatically troubleshooting the cause of the alarm information, the accuracy of the attribution result can be improved through fusion analysis. In this embodiment, the entire attribution analysis process is automatically executed, and there is no need to manually troubleshoot the cause of the alarm information, so it can effectively reduce the time-consuming manual troubleshooting and improve the efficiency of alarm attribution.

[0058] In this embodiment, a second alarm attribution method is provided, which can be used in an attribution system, such as a server of the attribution system. The attribution system is used to perform attribution analysis on received alarm information. Figure 2 is a flow chart of a second alarm attribution method according to an embodiment of the present disclosure, such as Figure 2 As shown, the process includes the following steps:

[0059] Step S201, obtaining alarm information of a target service, which can be referred to as the above step S101, will not be described in detail here.

[0060] Step S202: extract target meta information for attribution from the alarm information.

[0061] Specifically, the above step S202 includes:

[0062] Step S2021, obtaining target extraction information, where the target extraction information is used to determine information for attribution.

[0063] Optionally, as shown in Table 1, the target extraction information includes at least one of service description information, service call information, error code, database information, and message queue information. Among them, the service description information includes the name of the microservice. The service call information includes the calling method, downstream method, calling service source, and downstream calling service. The database information is relational database information, and the database information includes at least one of the database, data table, and database operation. The message queue information includes at least one of the consumption topic and the consumption group. It should be noted that in addition to the target extraction information mentioned above, the target extraction information may also include other information for attribution or related to alarms. It should be noted that the above-mentioned service information, service call information, and database information are only examples. In actual operation, these three types of information can be adjusted.

[0064] Optionally, the target extraction information also includes field names corresponding to various information, for example, Chinese field names and English field names of various information in the target extraction information.

[0065] Table 1 Target extraction information

[0066]

[0067]

[0068] Step S2022: Match the target extraction information in the warning information to obtain target meta information.

[0069] Specifically, the target extraction information is matched in the alarm information by matching methods such as regular matching and string matching. At the same time, for the missing information in the alarm information, the missing information can be queried by using methods such as the service interface for tracking the target service. Thus, the matched and queried information is assembled to obtain the target meta information.

[0070] For example, in combination with the content provided in Table 1, assuming that the English field name of the microservice name is PSM, the field value corresponding to PSM can be queried in the alarm information to obtain the microservice name. Similarly, the field value corresponding to the field name of each target extraction information is queried in the alarm information to obtain the content of the target extraction information. Assuming that there is no error code information in the alarm information, the error code information is queried according to the service interface. Then, the contents of all the obtained target extraction information are assembled to obtain the target meta information.

[0071] Step S203: Perform attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service to obtain a first attribution result corresponding to at least one attribution strategy. Please refer to the above step S103, which will not be described in detail here.

[0072] Step S204, performing fusion analysis on each first attribution result to obtain a target attribution result of the alarm information. Please refer to the above step S104, which will not be described in detail here.

[0073] The alarm attribution method provided in this embodiment obtains target meta information by matching target extraction information in alarm information. Therefore, it is possible to quickly and accurately query the information required for attribution, while reducing the probability of data query errors or omissions.

[0074] In some optional implementations, the above step S2022 includes:

[0075] Step a1, matching the warning information based on the target extraction information to obtain the first metadata.

[0076] It can be understood that the first meta information includes part or all of the target extraction information.

[0077] Step a2: determining missing information based on the target extraction information and the first metadata.

[0078] Specifically, a portion of the target extraction information that is different from the first meta information is determined as missing information.

[0079] Step a3: query the missing information based on the service interface of the target service to obtain the second meta information to obtain the target meta information, where the target meta information includes the first meta information and the second meta information.

[0080] Specifically, the service interface is an application programming interface (Application Programming Interface, API for short) of the tracking target service.

[0081] It should be noted that if there is no missing information, the target meta information only includes the first meta information.

[0082] Specifically, if there is no missing information, the first meta information is assembled to obtain the target meta information. If there is missing information, the first meta information and the second meta information are assembled to obtain the target meta information. That is, the first meta information and the second meta information are assembled into information with special status or authority in the attribution system.

[0083] In the alarm attribution method provided in this embodiment, if there is missing information after matching with the alarm information, the missing information is queried based on the service interface to obtain complete target meta information. Therefore, the accuracy and completeness of the target meta information can be ensured to reduce the error rate of attribution analysis.

[0084] As an example, Figure 3 As shown, Figure 3 It is an example of alarm information. The alarm information mainly includes three parts: the triggered alarm rule, the basic alarm information and the alarm tag. Among them, the basic alarm information includes the alarm service, cluster, rule, alarm time, processing object, notification method, and diagnostic information. The alarm tag includes the microservice name, downstream call service, and downstream method. In addition, the alarm information also includes other information related to the alarm. The alarm information can be matched according to the pre-set target extraction information, and the content of the target extraction information can be extracted from the alarm information to obtain the first meta information. If there is missing information, the missing information is further queried through the service interface to assemble it into the target meta information with the first meta information. Therefore, the alarm attribution method disclosed in the present invention can provide a basis for subsequent attribution analysis by automatically parsing and constructing the target meta information.

[0085] In this embodiment, a third alarm attribution method is provided, which can be used in an attribution system, such as a server of the attribution system. The attribution system is used to perform attribution analysis on received alarm information. Figure 4 is a flow chart of a third alarm attribution method according to an embodiment of the present disclosure, such as Figure 4 As shown, the process includes the following steps:

[0086] Step S301, obtaining alarm information of a target service, which can be referred to as the above step S101, will not be described in detail here.

[0087] Step S302: extracting target meta information for attribution from the alarm information. Please refer to the above step S101, which will not be described in detail here.

[0088] Step S303, performing attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service, and obtaining a first attribution result corresponding to at least one attribution strategy, wherein at least one attribution strategy is based on at least one attribution function, and at least one attribution function has a dependency relationship.

[0089] It should be noted that an attribution strategy may include one or more attribution functions, and different attribution strategies may reuse the same attribution function.

[0090] Specifically, the above step S303 includes: executing at least one attribution function based on the target meta information and the dependency relationship, obtaining a second attribution result corresponding to the at least one attribution function, so as to obtain a first attribution result, and the first attribution result includes the corresponding second attribution result.

[0091] It should be noted that each attribution function has two basic methods: execution conditions and execution actions. The execution action of the attribution function will only be executed when the attribution function is pointed to by the upstream and the execution conditions of the attribution function are met.

[0092] Specifically, the dependency relationship of each attribution function can be configured in the form of a directed acyclic graph to configure the attribution strategy of the target service. Then, each attribution strategy is executed based on the directed acyclic graph.

[0093] It should be noted that after obtaining the first attribution result or the second attribution result, the first attribution result and the second attribution result are written to the target storage area, so as to obtain the target attribution result of the target service by reading the first attribution result and the second attribution result in the target storage area.

[0094] Specifically, the target storage area includes a Go language context area (also called golang context).

[0095] Step S304, performing fusion analysis on each first attribution result to obtain a target attribution result of the alarm information. Please refer to the above step S104, which will not be described in detail here.

[0096] The alarm attribution method provided in this embodiment forms an attribution strategy based on at least one attribution function. Therefore, different attribution functions can be reused to configure different attribution strategies for target services. In addition, there is a dependency relationship between the attribution functions. Based on the dependency relationship, the attribution function is called to perform attribution analysis to obtain the attribution result. Therefore, the correctness of the execution logic of each attribution function can be ensured to avoid attribution errors.

[0097] In some optional implementations, performing at least one attribution function based on the target meta information and the dependency relationship to obtain a second attribution result corresponding to the at least one attribution function includes:

[0098] Step b1, calling at least one attribution function based on the dependency relationship.

[0099] For example, Figure 5 As shown, see Figure 5 The attribution functions shown are represented by a directed acyclic graph. After the upstream node of the attribution function is completed, the upstream node points to its downstream attribution function. If the current attribution function is pointed to by the upstream node, the current attribution function is called.

[0100] Step b2, matching the target meta information with the called target attribution function, if the match is successful, performing attribution analysis based on the target meta information and the target attribution function to obtain a second attribution result corresponding to the target attribution function.

[0101] It should be noted that if the match fails, the target attribution function will not be executed.

[0102] Specifically, the attribution function is configured with corresponding execution conditions and execution actions, and the target meta information is matched with the called target attribution function. If the target meta information meets the corresponding execution conditions, the execution action of the target attribution function is executed. If the target meta information fails to match the target attribution function, the execution conditions of the target attribution function are not met, and the execution action of the target attribution function will not be executed.

[0103] The alarm attribution method provided in this embodiment performs attribution analysis based on the target meta information and the target attribution function only if the target meta information successfully matches the called target attribution function. Therefore, it can ensure that the target meta information contains all the information required during the execution of the target attribution function to ensure the consistency and integrity of the data.

[0104] As an example, Figure 5As shown, the service nodes of the attribution system are divided into four layers: request layer, adapter layer, process layer and assembly layer. Among them, the request layer is used to parse various forms of input information (i.e., alarm information) to assemble target meta information. The adapter layer is used to call the service interface to confirm the accuracy of the target meta information of the request layer, and expand and fill in more content of the target meta information (i.e., missing information) to form a unified data input for the processing layer. The processing layer is used to execute various customized attribution strategies based on the directed acyclic graph of the attribution function, and write the attribution results to the target storage area. The assembly layer is used to aggregate the attribution results written in the target storage area and the target meta information to obtain the target attribution results.

[0105] exist Figure 5 In the attribution system shown, each service node has two basic information: execution conditions and execution actions. Only when the current service node is pointed to by the upstream and the execution condition of the current service node is successfully verified, the execution action corresponding to the current service node will be executed. Therefore, it is possible to automatically match the rule engine of the attribution system based on the target meta information and use the matching attribution strategy for attribution. It should be noted that the service nodes of the processing layer correspond to the attribution functions. It can be understood that based on Figure 5 The attribution system shown can quickly iterate the attribution strategy by simply improving the directed acyclic graph of the attribution system and supplementing the service nodes.

[0106] Exemplarily, as shown in Table 2, at least one attribution strategy includes at least one of system anomaly attribution, log aggregation analysis, abnormal traffic analysis, database slow query attribution, drill-down attribution, change event attribution, and automatic grouping of alarm events. Among them, system anomaly attribution can be analyzed through dynamic tracking and dotting, which is equivalent to checking monitoring and troubleshooting problems, thereby troubleshooting wireless ad hoc network system anomalies, remote procedure call (RPC) protection mechanism (also known as PPE), small traffic requests, and single machine problems. Log aggregation analysis can use error link propagation to obtain the log of the data alarm system, locate the error log of the abnormal service, and query the business log through the alarm information, and use the information recorded in the business log to locate the cause of the failure; or, use the business log to analyze hot advertisers and find the main source of abnormal traffic. Abnormal traffic analysis is used to find the request party with a large increase and the access party with new large traffic through monitoring indicators and change rate analysis functions. Database slow query attribution is used to automatically analyze the database slow query situation to assist in troubleshooting. Drill-down attribution is used to recursively analyze abnormal services and locate the root cause. Change event attribution is used to attribute through behavioral scenario analysis. For example, it is attributed to the service being online. Automatic grouping of alarm events is used to automatically pull in groups for processing in the case of telephone alarms, and automatically pull in the feasibility verification (Proof of Concept, POC) of the configured business line to coordinate the processing of alarm information. At the same time, continuous problem tracking, with historical alarm processing information fed back to the group, is convenient for follow-up investigation. In actual operation, the attribution function of the attribution strategy can be determined according to the policy details of each attribution strategy, and the attribution strategy can be configured through the combination configuration of the attribution function.

[0107] Table 2 Attribution strategy

[0108]

[0109]

[0110] In some optional implementations, the attribution analysis is performed based on the target meta information and the target attribution function in step b2 to obtain a second attribution result corresponding to the target attribution function, including:

[0111] Step b211: If the target attribution function is a drill-down attribution function, the target abnormal service is determined based on the target meta information.

[0112] Specifically, Figure 6 As shown, after the alarm information is obtained through the alarm service, the target meta information is extracted based on the alarm information, and the affected service and downstream service are filled based on the target meta information to determine the target abnormal service that reports the error.

[0113] Step b212, recursively perform attribution analysis on the downstream services of the target abnormal service to determine the root cause of the target abnormal service to obtain a second attribution result.

[0114] Specifically, the meta information of the downstream service is derived through the target meta information, and the root cause is recursively found. The second attribution result includes the root cause.

[0115] The alarm attribution method provided in this embodiment performs a recursive attribution analysis on the downstream services of the target abnormal service for the drill-down attribution function to determine the root cause of the target abnormal service. Therefore, the root cause of the target abnormal service can be deeply excavated, which is conducive to effectively solving the problem of generating alarm information.

[0116] In some optional implementations, the attribution analysis is performed based on the target meta information and the target attribution function in step b2 to obtain a second attribution result corresponding to the target attribution function, including:

[0117] Step b221, if the target attribution function is a change rate detection function, the alarm time range of the alarm information is obtained.

[0118] Specifically, the alarm time range may be determined according to the alarm time and duration carried in the alarm information.

[0119] Step b222, determining abnormal data of the target service within the alarm time range.

[0120] Specifically, abnormal data of the target service within the alarm time range is analyzed to obtain abnormal data.

[0121] Step b223, obtaining monitoring data of abnormal data outside the alarm time range.

[0122] That is, obtain monitoring data of abnormal data under normal conditions.

[0123] For example, if the data of category A is abnormal data, the monitoring data of the data of category A at a time other than the time range of this alarm is obtained.

[0124] Step b224, determining a second attribution result based on the change rate of the monitoring data and the abnormal data.

[0125] Specifically, if the change rate of the monitoring data and the abnormal data is greater than a preset threshold, it is determined that the abnormal data is related to the alarm information to obtain a second attribution result. If the change rate of the monitoring data and the abnormal data is less than or equal to the preset threshold, it is determined that the abnormal data is not related to the alarm information this time.

[0126] It is understandable that by comparing the monitoring data and abnormal data before and after the alarm, it is possible to determine whether the data has changed during the alarm period. If it has not changed, it indicates that the abnormal data is not caused by the current alarm information, but is a long-standing problem. Figure 7 The monitoring data of the creation success rate shown in the figure, assuming that 12:00-14:00 is the alarm time range, then Figure 7 It can be seen that Figure 7 The success rate represented by the top curve obviously changes significantly within the alarm time range, but is relatively stable at other times, indicating that the abnormal success rate above is related to this alarm information. Figure 7 Although the success rate represented by the lower curve is lower, there is no obvious change within the alarm time range, which means that the abnormal success rate below is irrelevant to the current alarm information.

[0127] The alarm attribution method provided in this embodiment determines the second attribution result by comparing the change rate of abnormal data in the alarm time range and other time periods. Therefore, it is possible to avoid mistakenly taking other abnormal conditions as the cause of the current alarm information, thereby further improving the accuracy of the alarm attribution analysis.

[0128] In some optional implementations, the target service includes at least one service instance. The attribution analysis is performed based on the target meta information and the target attribution function in step b2 to obtain a second attribution result corresponding to the target attribution function, including:

[0129] Step b231: If the target attribution function is an outlier analysis function, then obtain a service indicator of at least one service instance.

[0130] Step b232, comparing the service indicators between at least one service instance, determining the abnormal service instance, and obtaining a second attribution result.

[0131] It can be understood that if the service indicators of any service instance are significantly different from the service indicators of other service instances, it indicates that the service instance is a hot spot or bias problem, which may be related to this alarm information.

[0132] For example, Figure 8 As shown, Figure 8 The service indicators of other service instances are basically at the same level, but the service indicator of one service instance is obviously different from that of other service instances, which indicates that the service instance is likely to be related to this alarm information.

[0133] The alarm attribution method provided in this embodiment compares the service indicators between different service instances, so it is possible to quickly determine abnormal service instances to improve the efficiency of alarm attribution analysis.

[0134] In this embodiment, a fourth alarm attribution method is provided, which can be used in an attribution system, such as a server of the attribution system. The attribution system is used to perform attribution analysis on received alarm information. Fig. 9 is a flow chart of a fourth alarm attribution method according to an embodiment of the present disclosure, such as Fig. 9 As shown, the process includes the following steps:

[0135] Step S401, obtaining alarm information of a target service, which can be referred to as the above step S101, will not be described in detail here.

[0136] Step S402: extracting target meta information for attribution from the alarm information. Please refer to the above step S202, which will not be described in detail here.

[0137] Step S403: Perform attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service to obtain a first attribution result corresponding to at least one attribution strategy. Please refer to the above step S303, which will not be described in detail here.

[0138] Step S404: perform fusion analysis on each first attribution result to obtain a target attribution result of the alarm information.

[0139] Specifically, the above step S404 includes:

[0140] Step S4041, analyzing each first attribution result to determine the priority of the first attribution result.

[0141] Step S4042: Determine a target attribution result from the first attribution result based on the priority.

[0142] Specifically, the first attribution result with the highest priority can be selected as the target attribution result. Alternatively, a preset number of first attribution results can be selected as the target attribution result according to the priority. Alternatively, the first attribution results that meet the preset priority requirements can be screened out according to the priority as the target attribution result. Alternatively, at least one first attribution result can be screened out according to the priority, and the screened first attribution results can be fused and analyzed to obtain the target attribution result.

[0143] The alarm attribution method provided in this embodiment determines the target attribution result based on the priority of the first attribution result. Therefore, the possible causes of the alarm information can be more comprehensively understood through the first attribution results of different attribution strategies, and more reasonable attribution reasons can be screened out from different first attribution results to further improve the accuracy of the alarm attribution analysis.

[0144] It is worth noting that after the server of the attribution system obtains the target processing result, it can push the target attribution result to the processing object (such as the operation and maintenance personnel of the target service) in the form of a message card, so that the relevant processing object can understand the cause of the alarm information in a timely manner. Fig.10 As shown, the attribution system sends the target attribution result to the terminal corresponding to the processing object, so as to display the target attribution result on the terminal in the form of a message card. In addition, a view detail control is displayed in the area corresponding to the target attribution result, and the analysis details of the target attribution result can be viewed in response to the interactive operation of the view detail control. For example, the monitoring information and log information corresponding to the target attribution result can be viewed.

[0145] In some optional implementations, the alarm attribution method of the present disclosure also includes: determining a processing object of the target service; constructing a target group based on each processing object, the target group carrying historical alarm processing information of the target service, and the target group is used for each processing object to process the alarm information.

[0146] It should be noted that the processing objects include the accounts of the processing personnel related to the target service.

[0147] The alarm attribution method provided in this embodiment builds a target group based on each processing object of the target service, so as to facilitate the collaborative processing of alarm information between the processing objects. At the same time, the target group carries the historical alarm processing information of the target service, so it is convenient to continuously track the problem and troubleshoot the cause of the alarm information.

[0148] For example, Fig.11 As shown, a target group of each processing object can be constructed in the form of a group chat, and the target attribution results and historical alarm processing information are displayed in the target group. The conversation content of the processing object for the alarm information can be displayed in response to the conversation content input by the input control in the dialogue interface based on the target group.

[0149] As a specific application example, a target program is installed on the server of the attribution system. The target program is used to perform attribution analysis on the alarm information generated by the data alarm system based on the alarm attribution method disclosed in the present invention, and push the target attribution results obtained by the attribution analysis to the terminal to facilitate operation and maintenance personnel to view the target attribution results of the alarm information.

[0150] As another specific application example, Fig.12 As shown, Fig.12The system architecture adopts the alarm attribution method disclosed in the advertising platform microservice architecture environment. The system architecture mainly includes four modules: 1. Identification and analysis module. 2. Meta information construction module. 3. Attribution interface module. 4. Display interaction module. Among them, the identification and analysis module is used to identify log codes, alarm information, and business data codes, and send the identified information to the meta information construction module. The meta information construction module is used to inject extended information such as service-related information and business data-related information through pre-analysis of the software development kit (Software Development Kit, referred to as SDK), so as to facilitate querying and statistics of the causes of alarm information. Among them, service-related information includes current services, abnormal interfaces, and upstream and downstream services. Business data-related information includes business data codes, advertiser codes, and business data status. The information obtained from the pre-analysis is output in a structured manner, for example, logs, dot-by-dot, reports, etc. The attribution interface module is used to provide services for log query, log aggregation, monitoring query, and business development (Business Development, referred to as BD) query. The display interaction module is used to provide a unified operation and maintenance model, and provides external functions such as attribution cards, drill-down analysis, conclusion collection, and manual query.

[0151] It is worth noting that the alarm attribution method disclosed in the present invention can quickly locate the cause of the alarm information through an automated attribution method, significantly reducing the average recovery time of the alarm event. And through the drill-down attribution function, various alarms are systematically collected and analyzed, the root cause of the problem is quickly and accurately identified, the scope and duration of the problem's impact on the system and users are reduced, and the speed and accuracy of problem solving can be significantly improved. At the same time, this automated attribution method can realize an automated processing flow for common simple problems without manual intervention. In addition, it can also be further combined with an intuitive attribution interface and report to enable operation and maintenance personnel to quickly understand the cause of the alarm information, and provide automated preliminary diagnostic suggestions through target analysis results, reducing reliance on the personal experience of operation and maintenance personnel, so that operation and maintenance personnel can take effective remedial measures more quickly. Not only that, the alarm attribution method provided in the present invention configures the attribution strategy by combining attribution functions, so that the attribution strategy can be continuously optimized through the adjustment of the attribution function to adapt to the increasingly complex microservice environment and improve the overall service quality.

[0152] In this embodiment, an alarm attribution device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0153] This embodiment provides an alarm attribution device, such as Fig.13 As shown, including:

[0154] Information acquisition module 501, used to obtain alarm information of target service;

[0155] An information extraction module 502, used to extract target meta information for attribution from the warning information;

[0156] An attribution analysis module 503 is used to perform attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service, and obtain a first attribution result corresponding to the at least one attribution strategy;

[0157] The result analysis module 504 is used to perform a fusion analysis on each first attribution result to obtain a target attribution result of the alarm information.

[0158] In some optional implementations, the information extraction module 502 includes:

[0159] An information acquisition unit, used to acquire target extraction information, the target extraction information is used to determine information for attribution;

[0160] The information extraction unit is used to match the warning information based on the target extraction information to obtain the target meta information.

[0161] In some optional implementations, the information extraction unit includes:

[0162] A first information extraction subunit is used to match the warning information based on the target extraction information to obtain the first meta information;

[0163] A missing information determination subunit, used to determine the missing information based on the target extraction information and the first meta information;

[0164] The second information extraction subunit is used to query the missing information based on the service interface of the target service to obtain the second meta information so as to obtain the target meta information, and the target meta information includes the first meta information and the second meta information.

[0165] In some optional implementations, at least one attribution strategy is based on at least one attribution function, and at least one attribution function has a dependency relationship. The attribution analysis module 503 includes:

[0166] The attribution analysis unit is used to perform at least one attribution function based on the target meta information and the dependency relationship, obtain a second attribution result corresponding to the at least one attribution function, and obtain a first attribution result, wherein the first attribution result includes a corresponding second attribution result.

[0167] In some optional implementations, the attribution analysis unit includes:

[0168] A function calling subunit, configured to call at least one attributed function based on the dependency relationship;

[0169] The attribution analysis subunit is used to match the target meta information with the called target attribution function. If the match is successful, attribution analysis is performed based on the target meta information and the target attribution function to obtain a second attribution result corresponding to the target attribution function.

[0170] In some optional implementations, the attribution analysis subunit is specifically used to: if the target attribution function is a drill-down attribution function, determine the target abnormal service based on the target metadata; perform recursive attribution analysis on the downstream services of the target abnormal service to determine the root cause of the target abnormal service to obtain a second attribution result.

[0171] In some optional embodiments, the attribution analysis subunit is also specifically used for: if the target attribution function is a change rate detection function, obtaining the alarm time range of the alarm information; determining the abnormal data of the target service within the alarm time range; obtaining the monitoring data of the abnormal data outside the alarm time range; and determining a second attribution result based on the change rate of the monitoring data and the abnormal data.

[0172] In some optional implementations, the target service includes at least one service instance. The attribution analysis subunit is further specifically configured to: if the target attribution function is an outlier analysis function, obtain a service indicator of at least one service instance; compare the service indicators between at least one service instance, determine an abnormal service instance, and obtain a second attribution result.

[0173] In some optional implementations, the result analysis module 504 includes:

[0174] A first result analysis unit, used to analyze each first attribution result and determine the priority of the first attribution result;

[0175] The second result analysis unit is used to determine a target attribution result from the first attribution result based on the priority.

[0176] In some optional implementations, the attribution analysis device of the present disclosure further includes:

[0177] An object analysis module is used to determine the processing object of the target service;

[0178] The group construction module is used to construct a target group based on each processing object. The target group carries the historical alarm processing information of the target service. The target group is used for each processing object to process the alarm information.

[0179] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0180] The alarm attribution device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0181] The present disclosure also provides an electronic device having the above Fig.13 The alarm attribution device shown.

[0182] See also Fig.14 , Fig.14 is a structural block diagram of an electronic device provided by an optional embodiment of the present disclosure, such as Fig.14 As shown, the electronic device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.14 A processor 10 is taken as an example.

[0183] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0184] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0185] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0186] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0187] The electronic device further comprises a communication interface 30 for the electronic device to communicate with other devices or a communication network.

[0188] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0189] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0190] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. An alarm attribution method, characterized in that: The method comprises: Get the alarm information of the target service; extracting target meta information for attribution from the warning information; Performing attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service, and obtaining a first attribution result corresponding to the at least one attribution strategy; A fusion analysis is performed on each of the first attribution results to obtain a target attribution result of the alarm information.

2. The alarm attribution method according to claim 1, characterized in that: Extracting target meta information for attribution from the warning information includes: Obtaining target extraction information, wherein the target extraction information is used to determine information for attribution; The target meta information is obtained by matching the target extraction information in the warning information.

3. The alarm attribution method according to claim 2, characterized in that: The extracting information based on the target is matched in the warning information to obtain the target meta information, including: Matching the warning information based on the target extraction information to obtain first metadata; Determining missing information based on the target extraction information and the first meta information; The missing information is queried based on the service interface of the target service to obtain second meta information, so as to obtain the target meta information, where the target meta information includes the first meta information and the second meta information.

4. The alarm attribution method according to claim 1, characterized in that: The at least one attribution strategy is based on at least one attribution function, and the at least one attribution function has a dependency relationship; the attribution analysis is performed on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service to obtain a first attribution result corresponding to the at least one attribution strategy, including: The at least one attribution function is executed based on the target meta information and the dependency relationship to obtain a second attribution result corresponding to the at least one attribution function, so as to obtain the first attribution result, wherein the first attribution result includes the corresponding second attribution result.

5. The alarm attribution method according to claim 4, characterized in that: The performing the at least one attribution function based on the target meta information and the dependency relationship to obtain a second attribution result corresponding to the at least one attribution function includes: calling the at least one attribution function based on the dependency relationship; The target meta information is matched with the called target attribution function. If the match is successful, an attribution analysis is performed based on the target meta information and the target attribution function to obtain a second attribution result corresponding to the target attribution function.

6. The alarm attribution method according to claim 5, characterized in that: The performing attribution analysis based on the target meta information and the target attribution function to obtain a second attribution result corresponding to the target attribution function includes: If the target attribution function is a drill-down attribution function, determining a target abnormal service based on the target meta information; Recursive attribution analysis is performed on downstream services of the target abnormal service to determine the root cause of the target abnormal service to obtain the second attribution result.

7. The alarm attribution method according to claim 5, characterized in that: The performing attribution analysis based on the target meta information and the target attribution function to obtain a second attribution result corresponding to the target attribution function includes: If the target attribution function is a change rate detection function, obtaining the alarm time range of the alarm information; Determine abnormal data of the target service within the alarm time range; Acquire monitoring data of the abnormal data outside the alarm time range; Based on the change rate of the monitoring data and the abnormal data, the second attribution result is determined.

8. The alarm attribution method according to claim 5, characterized in that: The target service includes at least one service instance; the attribution analysis is performed based on the target meta information and the target attribution function to obtain a second attribution result corresponding to the target attribution function, including: If the target attribution function is an outlier analysis function, obtaining a service indicator of the at least one service instance; The service indicators between the at least one service instance are compared to determine the abnormal service instance to obtain the second attribution result.

9. The alarm attribution method according to claim 1, characterized in that: The performing fusion analysis on each of the first attribution results to obtain a target attribution result of the alarm information includes: Analyze each of the first attribution results to determine the priority of the first attribution results; The target attribution result is determined in the first attribution result based on the priority.

10. The alarm attribution method according to claim 1, characterized in that: The method further comprises: Determining a processing object of the target service; A target group is constructed based on each of the processing objects. The target group carries historical alarm processing information of the target service. The target group is used for each of the processing objects to process the alarm information.

11. An alarm attribution device, characterized in that: The device comprises: An information acquisition module is used to obtain the alarm information of the target service; An information extraction module, used to extract target meta information for attribution from the alarm information; an attribution analysis module, configured to perform attribution analysis on the alarm information based on the target meta information and at least one attribution strategy corresponding to the target service, and obtain a first attribution result corresponding to the at least one attribution strategy; The result analysis module is used to perform a fusion analysis on each of the first attribution results to obtain a target attribution result of the alarm information.

12. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the alarm attribution method according to any one of claims 1 to 10 by executing the computer instructions.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the alarm attribution method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the alarm attribution method according to any one of claims 1 to 10.

Images