Environment abnormity alarm method, device and equipment and storage medium

Abstract

The invention discloses an environment abnormity alarm method, device and equipment and a storage medium, and relates to the technical field of cloud computing, and the environment abnormity alarm method comprises the steps: building an operation and maintenance knowledge graph for a system environment based on a system configuration management database; generating an abnormal node in the operation and maintenance knowledge graph based on an anomaly detection result of the system environment, associating the abnormal node with an anomaly occurrence node, and updating the operation and maintenance knowledge graph; and traversing the updated operation and maintenance knowledge graph to obtain path information of the abnormal node in the operation and maintenance knowledge graph, and carrying out abnormity alarm according to the path information. Through the above technical scheme, aggregation query of abnormal information according to various node dimensions is realized, and information overload and alarm fatigue caused by frequent alarm are avoided.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to an environment abnormality alarm method, device, equipment and storage medium. Background Art

[0002] During the software development process, a dedicated test environment is often required, such as an on-cloud test environment or an off-cloud test environment for deployment and testing during the development cycle. The test environment needs to be regularly and automatically deployed, updated, and tested. For the test environment, there are usually environmental monitoring methods to automatically discover availability issues in the test environment.

[0003] Traditional technical solutions, due to the independence of monitoring environment systems or rule-based alarm processing, usually one notification email for each alarm. When operation and maintenance personnel receive a large number of alarm emails / notifications, they usually suffer from alarm fatigue, resulting in the loss of important alarm information, and difficulty in identifying and processing the numerous alarm information, resulting in low processing efficiency and difficulty in tracking.

[0004] Therefore, an efficient environmental abnormality alarm method is urgently needed. Summary of the invention

[0005] The present invention provides an environmental abnormality alarm method, device, equipment and storage medium to avoid alarm storms, information overload and alarm fatigue caused by abnormal alarm distributed notification.

[0006] According to one aspect of the present invention, a method for abnormal environment alarm is provided, the method comprising:

[0007] Establish an operation and maintenance knowledge graph for the system environment based on the system configuration management database; the operation and maintenance knowledge graph includes an on-cloud operation and maintenance knowledge graph and an off-cloud operation and maintenance knowledge graph;

[0008] Based on the anomaly detection results of the system environment, an abnormal node is generated in the operation and maintenance knowledge graph, and the abnormal node is associated with the abnormal occurrence node to update the operation and maintenance knowledge graph; wherein the abnormal node is used to characterize the abnormal attribute information of the abnormality occurring in the abnormal occurrence node;

[0009] The updated operation and maintenance knowledge graph is traversed to obtain the path information of the abnormal node in the operation and maintenance knowledge graph, and an abnormal alarm is issued according to the path information; wherein the path information is the link information between the starting node and the abnormal node in the operation and maintenance knowledge graph.

[0010] According to another aspect of the present invention, there is provided an abnormal environment alarm device, the device comprising:

[0011] A graph building module is used to build an operation and maintenance knowledge graph for the system environment based on the system configuration management database; wherein the operation and maintenance knowledge graph includes an on-cloud operation and maintenance knowledge graph and an off-cloud operation and maintenance knowledge graph;

[0012] A graph updating module is used to generate an abnormal node in the operation and maintenance knowledge graph based on the abnormal detection result of the system environment, and associate the abnormal node with the abnormal occurrence node to update the operation and maintenance knowledge graph; wherein the abnormal node is used to characterize the abnormal attribute information of the abnormality occurring at the abnormal occurrence node;

[0013] The alarm module is used to traverse the updated operation and maintenance knowledge graph, obtain the path information of the abnormal node in the operation and maintenance knowledge graph, and issue an abnormal alarm based on the path information; wherein the path information is the link information between the starting node and the abnormal node in the operation and maintenance knowledge graph.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal environment alarm method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the environmental abnormality alarm method described in any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the method for abnormal environment alarm according to any embodiment of the present invention is implemented.

[0020] The technical solution of the embodiment of the present invention, by constructing an operation and maintenance knowledge graph of the test environment, generates an abnormal node in the operation and maintenance knowledge graph when an abnormality is detected in the test environment, and associates the abnormal node with the node where the abnormality occurs, thereby realizing aggregate query of abnormal information according to various node dimensions, avoiding the traditional information mode of one alarm and one notification, facilitating user query, and avoiding the disadvantages of information overload and alarm fatigue caused by frequent alarms.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1a is a flow chart of an abnormal environment alarm method provided according to the first embodiment of the present invention;

[0024] Figure 1b This is a schematic diagram of the structure of an operation and maintenance knowledge graph provided according to the first embodiment of the present invention;

[0025] Figure 2a is a flow chart of an abnormal environment alarm method provided according to Embodiment 2 of the present invention;

[0026] Figure 2b It is a structural schematic diagram of an operation and maintenance knowledge graph with abnormal nodes added according to the second embodiment of the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of an abnormal environment alarm device provided according to Embodiment 3 of the present invention;

[0028] Figure 4 It is a structural schematic diagram of an electronic device for implementing the abnormal environment alarm method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1a A flowchart of an environment abnormality alarm method is provided for the first embodiment of the present invention. This embodiment is applicable to the case of testing the system environment. The method can be executed by an environment abnormality alarm device. The environment abnormality alarm device can be implemented in the form of hardware and / or software. The environment abnormality alarm device can be configured in various general computing devices, such as a server device integrated with a system environment. Figure 1a As shown, the method includes:

[0033] S110. Establish an operation and maintenance knowledge graph for the system environment based on the system configuration management database.

[0034] Among them, the operation and maintenance knowledge graph may include an on-cloud operation and maintenance knowledge graph and an off-cloud operation and maintenance knowledge graph; the system environment may include an on-cloud environment and an off-cloud environment, such as an on-cloud test environment and an off-cloud test environment. It should be noted that an on-cloud monitoring environment may be deployed in the on-cloud test environment, and an off-cloud monitoring environment may be deployed in the off-cloud test environment for abnormal monitoring. Optionally, the data table of the system configuration management database of the system environment has a data field to indicate whether the system environment is an on-cloud environment or an off-cloud environment.

[0035] S120. Based on the anomaly detection result of the system environment, an abnormal node is generated in the operation and maintenance knowledge graph, and the abnormal node is associated with the abnormal occurrence node to update the operation and maintenance knowledge graph.

[0036] Among them, the anomaly detection result may refer to the anomaly detection result of the on-cloud monitoring environment system on the on-cloud test environment or the anomaly detection result of the off-cloud monitoring environment system on the off-cloud test environment.

[0037] The abnormal node can be used to characterize the abnormal attribute information of the abnormality occurred in the abnormal node. An optional abnormal node represents an abnormality type; the abnormal node can refer to the node in the operation and maintenance knowledge graph corresponding to the object with abnormality in the system environment. Optionally, the node attributes of the abnormal node include node ID, abnormality type, abnormality information, abnormality occurrence time and latest detection time. The abnormality type can be used to characterize the type of abnormality occurred in the abnormal node, such as service abnormality or server abnormality. The abnormality information can be used to characterize the specific abnormality information of the abnormality occurred in the abnormal node, such as server access abnormality. The abnormality occurrence time can be used to characterize the creation time of the abnormal node, that is, the time when the abnormality represented by the abnormal node is first detected. The latest detection time can be used to characterize the latest detection time of the abnormality represented by the abnormal node.

[0038] Specifically, an abnormal node can be generated according to the abnormal detection result of the monitoring environment on the test environment, and the abnormal node can be associated with the abnormal occurrence node in the operation and maintenance knowledge graph to update the operation and maintenance knowledge graph. It should be noted that the association method between the abnormal node and the abnormal occurrence node can connect the nodes.

[0039] S130: traverse the updated operation and maintenance knowledge graph, obtain the path information of abnormal nodes in the operation and maintenance knowledge graph, and issue an abnormal alarm based on the path information.

[0040] Among them, the path information can be the link information between the starting node and the abnormal node in the operation and maintenance knowledge graph, which can be used to represent the full amount of alarm data in the operation and maintenance knowledge graph.

[0041] Specifically, after the operation and maintenance knowledge graph is updated according to the anomaly detection results, the abnormal nodes in the updated operation and maintenance knowledge graph can be traversed to obtain the path information of the abnormal nodes in the operation and maintenance knowledge graph, and the path information carrying the abnormal nodes is sent to the object in the system environment corresponding to the starting node in the operation and maintenance knowledge graph.

[0042] In an optional embodiment of the present invention, an operation and maintenance knowledge graph is established for the system environment based on the system configuration management database, including: according to the environmental dependencies of the system environment stored in the system configuration management database, taking the operation and maintenance node represented by the operation and maintenance personnel as the starting node, building an operation and maintenance knowledge graph for the system environment.

[0043] Among them, the environment dependency can be used to characterize the topological relationship of the system environment.

[0044] In the embodiment of the present invention, the system configuration management database stores the environment information of the system environment in the form of a relational database, that is, the environment topology of the system environment. An operation and maintenance knowledge graph is established for the system environment based on the system configuration management database. For example, the on-cloud operation and maintenance knowledge graph and the off-cloud operation and maintenance knowledge graph can be as follows: Figure 1b As shown in the figure, for the traditional off-cloud test environment, one application environment contains one or more environment nodes, one environment node contains one or more instances, and one instance is associated and deployed on one server. For the traditional on-cloud test environment, one application environment contains one or more templates, one template contains one or more containers, and one container is associated and deployed on one server. It should be noted that the starting node of both the on-cloud operation and maintenance knowledge graph and the off-cloud operation and maintenance knowledge graph is the operation and maintenance node that represents the operation and maintenance personnel.

[0045] The technical solution of the embodiment of the present invention, by constructing an operation and maintenance knowledge graph of the test environment, generates an abnormal node in the operation and maintenance knowledge graph when an abnormality is detected in the test environment, and associates the abnormal node with the node where the abnormality occurs, thereby realizing aggregate query of abnormal information according to various node dimensions, avoiding the traditional information mode of one alarm and one notification, facilitating user query, and avoiding the disadvantages of information overload and alarm fatigue caused by frequent alarms.

[0046] Embodiment 2

[0047] Figure 2a This is a flowchart of an environmental anomaly alarm method provided in the second embodiment of the present invention. This embodiment further refines the above embodiment and provides specific steps for generating anomaly nodes in the operation and maintenance knowledge graph based on the anomaly detection results of the system environment, associating the anomaly nodes with the anomaly occurrence nodes, and updating the operation and maintenance knowledge graph. It should be noted that for the undetailed parts of the embodiments of the present invention, please refer to the relevant descriptions of other embodiments, which will not be repeated here. Figure 2a As shown, the method includes:

[0048] S210. Establish an operation and maintenance knowledge graph for the system environment based on the system configuration management database.

[0049] S220: Obtain abnormal attribute information from the abnormality detection result, and determine the abnormality type and the abnormality occurrence node of the abnormality.

[0050] S230. According to the exception type and the exception occurrence node, determine whether an exception node corresponding to the exception type already exists in the operation and maintenance knowledge graph at the exception occurrence node.

[0051] S240. If it does not exist, create a new abnormal node in the operation and maintenance knowledge graph, associate the abnormal node with the abnormal occurrence node, and configure the node attributes of the abnormal occurrence node according to the abnormal attribute information.

[0052] Optionally, in an embodiment of the present invention, if an abnormal node corresponding to the abnormal type already exists at the abnormal occurrence node in the operation and maintenance knowledge graph, the latest detection time in the node attributes of the abnormal node is updated according to the abnormal detection time in the abnormal attribute information.

[0053] Specifically, after the monitoring environment completes the anomaly detection of the test environment, the anomaly type of the anomaly that occurred in the test environment, the object where the anomaly occurred in the test environment, and the node where the anomaly occurred can be determined from the anomaly detection results of the monitoring environment; the operation and maintenance knowledge graph can be traversed according to the anomaly type and the anomaly occurrence node to determine whether the anomaly occurrence node in the operation and maintenance knowledge graph already has an anomaly node corresponding to the anomaly type; if not, a new anomaly node is created in the operation and maintenance knowledge graph, and the anomaly node is associated with the anomaly occurrence node, and the node attributes of the anomaly occurrence node are configured according to the anomaly attribute information of the anomaly detection result, for example, the anomaly type, anomaly information, and anomaly occurrence time of the anomaly are determined from the anomaly attribute information, and the node attributes of the anomaly node are configured. If the anomaly occurrence node in the operation and maintenance knowledge graph already has an anomaly node corresponding to the anomaly type, it indicates that the anomaly has occurred in the history of the test environment, and the latest detection time in the node attributes of the anomaly node that already exists in the operation and maintenance knowledge graph can be updated to the anomaly detection time according to the anomaly detection time in the anomaly attribute information.

[0054] In the embodiment of the present invention, there is only one corresponding abnormal node for one abnormal type corresponding to the abnormal node, which can avoid multiple construction records from repeated alarms. The abnormal occurrence time and the latest detection time in the node attributes can be used to understand the existence duration of the abnormality of the abnormal node.

[0055] Optionally, the updated operation and maintenance knowledge graph can be Figure 2b As shown, server 2 and instance 3 are the nodes where the exception occurs, and are associated with an exception node respectively.

[0056] In another optional implementation of the embodiment of the present invention, the updating process of the operation and maintenance knowledge graph further includes: querying the node attributes of all abnormal nodes in the operation and maintenance knowledge graph, and deleting the abnormal nodes whose latest detection time in the node attributes is earlier than the current detection time; or, setting a life cycle for the abnormal node, and deleting the abnormal node if the node attribute of the abnormal node is not updated within the life cycle. Optionally, the duration of the life cycle can be adaptively set according to those skilled in the art.

[0057] By updating and deleting historical abnormal nodes in the operation and maintenance knowledge graph, the timeliness of abnormal nodes in the operation and maintenance knowledge graph is ensured.

[0058] S250: traverse the updated operation and maintenance knowledge graph, obtain the path information of the abnormal node in the operation and maintenance knowledge graph, and issue an abnormal alarm based on the path information.

[0059] Optionally, in an embodiment of the present invention, after the operation and maintenance knowledge graph is associated with the abnormal node, the alarm notification can be flexibly queried and sent according to actual needs. The present invention traverses the operation and maintenance knowledge graph according to the operation and maintenance personnel dimension, queries the path from the operation and maintenance personnel node to the abnormal node, obtains a specific path set, and sends an email to the operation and maintenance personnel at one time. Figure 2b After traversing the operation and maintenance knowledge graph shown, three paths from the operation and maintenance personnel node to the abnormal node can be obtained: 1) operation and maintenance node-application environment 1-environment node 1-instance node 2-server node 2-abnormal node 1; 2) operation and maintenance node-application environment 1-environment node 1-instance node 3-server node 2-abnormal node 1; 3) operation and maintenance node A-application environment 1-environment node 2-instance node 3-abnormal node 2.

[0060] By aggregating abnormal information based on the operation and maintenance personnel dimension, the number of alarms can be reduced, redundant alarm information can be reduced, the efficiency and accuracy of alarm management can be improved, and excessive alarm information can be prevented from interfering with the judgment and processing of operation and maintenance personnel.

[0061] The technical solution of the embodiment of the present invention configures an abnormal node for the abnormal occurrence node according to the abnormal type in the operation and maintenance knowledge graph, so that there is only one abnormal node for an abnormal type, and updates the abnormal detection record through the node attributes of the abnormal node, thereby avoiding multiple construction records caused by repeated alarms and reducing redundant alarm information.

[0062] Embodiment 3

[0063] Figure 3 A schematic diagram of the structure of an abnormal environment alarm device provided in Embodiment 3 of the present invention.

[0064] like Figure 3 As shown, the device comprises:

[0065] A graph building module 310 is used to build an operation and maintenance knowledge graph for the system environment based on the system configuration management database; wherein the operation and maintenance knowledge graph includes an on-cloud operation and maintenance knowledge graph and an off-cloud operation and maintenance knowledge graph;

[0066] A graph updating module 320 is used to generate an abnormal node in the operation and maintenance knowledge graph based on the abnormal detection result of the system environment, and associate the abnormal node with the abnormal occurrence node to update the operation and maintenance knowledge graph; wherein the abnormal node is used to characterize the abnormal attribute information of the abnormality occurring at the abnormal occurrence node;

[0067] The alarm module 330 is used to traverse the updated operation and maintenance knowledge graph, obtain the path information of the abnormal node in the operation and maintenance knowledge graph, and issue an abnormal alarm based on the path information; wherein the path information is the link information between the starting node and the abnormal node in the operation and maintenance knowledge graph.

[0068] The technical solution of the embodiment of the present invention, by constructing an operation and maintenance knowledge graph of the test environment, generates an abnormal node in the operation and maintenance knowledge graph when an abnormality is detected in the test environment, and associates the abnormal node with the node where the abnormality occurs, thereby realizing aggregate query of abnormal information according to various node dimensions, avoiding the traditional information mode of one alarm and one notification, facilitating user query, and avoiding the disadvantages of information overload and alarm fatigue caused by frequent alarms.

[0069] Optionally, the map updating module 320 includes:

[0070] An abnormality attribute information determination unit, used to obtain abnormality attribute information from the abnormality detection result, and determine the abnormality type of the abnormality and the abnormality occurrence node;

[0071] An abnormal node duplication checking unit is used to determine, according to the abnormal type and the abnormal occurrence node, whether the abnormal node corresponding to the abnormal type already exists in the operation and maintenance knowledge graph;

[0072] The abnormal node creation unit is used to create a new abnormal node in the operation and maintenance knowledge graph if it does not exist, associate the abnormal node with the abnormal node, and configure the node attributes of the abnormal node according to the abnormal attribute information.

[0073] Optionally, the map updating module 320 further includes:

[0074] The abnormal node updating unit is used to update the latest detection time in the node attribute of the abnormal node according to the abnormal detection time in the abnormal attribute information if an abnormal node corresponding to the abnormal type already exists at the abnormal node in the operation and maintenance knowledge graph.

[0075] Optionally, the node attributes of the abnormal node include node ID, abnormality type, abnormality information, abnormality occurrence time and latest detection time.

[0076] Optionally, the graph establishment module 310 can be specifically used to: build an operation and maintenance knowledge graph for the system environment based on the environmental dependencies of the system environment stored in the system configuration management database, taking the operation and maintenance node represented by the operation and maintenance personnel as the starting node; wherein the environmental dependencies are used to characterize the topological relationship of the system environment; wherein the system environment includes an on-cloud environment and an off-cloud environment.

[0077] Optionally, the device further comprises:

[0078] The node deletion module is used to query the node attributes of all abnormal nodes in the operation and maintenance knowledge graph, and delete the abnormal nodes whose latest detection time in the node attributes is earlier than the current detection time; or, set a life cycle for the abnormal node. If the node attributes of the abnormal node are not updated within the life cycle, the abnormal node will be deleted.

[0079] The abnormal environment alarm device provided in the embodiment of the present invention can execute the abnormal environment alarm method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0080] Embodiment 4

[0081] Figure 4 A schematic diagram of an electronic device 410 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0082] like Figure 4As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0083] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0084] The processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 411 executes the various methods and processes described above, such as an environmental abnormality alarm method.

[0085] In some embodiments, the environmental anomaly alarm method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the environmental anomaly alarm method described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured to execute the environmental anomaly alarm method in any other appropriate manner (e.g., by means of firmware).

[0086] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0087] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0088] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0089] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0090] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0091] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0092] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0093] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for an abnormal environment alarm, characterized in that: include: Establish an operation and maintenance knowledge graph for the system environment based on the system configuration management database; the operation and maintenance knowledge graph includes an on-cloud operation and maintenance knowledge graph and an off-cloud operation and maintenance knowledge graph; Based on the anomaly detection results of the system environment, an abnormal node is generated in the operation and maintenance knowledge graph, and the abnormal node is associated with the abnormal occurrence node to update the operation and maintenance knowledge graph; wherein the abnormal node is used to characterize the abnormal attribute information of the abnormality occurring in the abnormal occurrence node; The updated operation and maintenance knowledge graph is traversed to obtain the path information of the abnormal node in the operation and maintenance knowledge graph, and an abnormal alarm is issued according to the path information; wherein the path information is the link information between the starting node and the abnormal node in the operation and maintenance knowledge graph.

2. The method according to claim 1, characterized in that: Based on the anomaly detection result of the system environment, an abnormal node is generated in the operation and maintenance knowledge graph, and the abnormal node is associated with the abnormal occurrence node, and the operation and maintenance knowledge graph is updated, including: Obtaining anomaly attribute information from anomaly detection results, and determining the anomaly type and the node where the anomaly occurred; According to the exception type and the exception occurrence node, determine whether the exception occurrence node already has an exception node corresponding to the exception type in the operation and maintenance knowledge graph; If it does not exist, a new abnormal node is created in the operation and maintenance knowledge graph, the abnormal node is associated with the abnormal occurrence node, and the node attributes of the abnormal occurrence node are configured according to the abnormal attribute information.

3. The method according to claim 2, characterized in that Also includes: If an abnormal node corresponding to the abnormal type already exists at the abnormal occurrence node in the operation and maintenance knowledge graph, the latest detection time in the node attribute of the abnormal node is updated according to the abnormal detection time in the abnormal attribute information.

4. The method according to any one of claims 1 to 3, characterized in that: The node attributes of the abnormal node include node ID, abnormal type, abnormal information, abnormal occurrence time and latest detection time.

5. The method according to claim 1, characterized in that Establish an operation and maintenance knowledge graph for the system environment based on the system configuration management database, including: According to the environmental dependencies of the system environment stored in the system configuration management database, an operation and maintenance knowledge graph is constructed for the system environment with the operation and maintenance node represented by the operation and maintenance personnel as the starting node; wherein the environmental dependencies are used to characterize the topological relationship of the system environment; wherein the system environment includes an on-cloud environment and an off-cloud environment.

6. The method according to claim 1, characterized in that The update process of the operation and maintenance knowledge graph also includes: Query the node attributes of all abnormal nodes in the operation and maintenance knowledge graph, and delete the abnormal nodes whose latest detection time in the node attributes is earlier than the current detection time; or, set a life cycle for the abnormal node. If the node attributes of the abnormal node are not updated within the life cycle, delete the abnormal node.

7. An abnormal environment alarm device, characterized in that: include: A graph building module is used to build an operation and maintenance knowledge graph for the system environment based on the system configuration management database; wherein the operation and maintenance knowledge graph includes an on-cloud operation and maintenance knowledge graph and an off-cloud operation and maintenance knowledge graph; A graph updating module is used to generate an abnormal node in the operation and maintenance knowledge graph based on the abnormal detection result of the system environment, and associate the abnormal node with the abnormal occurrence node to update the operation and maintenance knowledge graph; wherein the abnormal node is used to characterize the abnormal attribute information of the abnormality occurring at the abnormal occurrence node; The alarm module is used to traverse the updated operation and maintenance knowledge graph, obtain the path information of the abnormal node in the operation and maintenance knowledge graph, and issue an abnormal alarm based on the path information; wherein the path information is the link information between the starting node and the abnormal node in the operation and maintenance knowledge graph.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal environment alarm method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal environment alarm method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the abnormal environment alarm method according to any one of claims 1 to 6.

Images