Monitoring alarm method, device, equipment and computer-readable storage medium

Abstract

The present invention discloses a monitoring alarm method, apparatus, device, and computer-readable storage medium. The monitoring alarm method comprises: receiving alarm data and detecting whether the alarm data is a single indicator alarm; if the alarm data is a single indicator alarm, detecting whether matching data that matches the single indicator alarm exists in cached data corresponding to the alarm data; if matching data exists, adjusting the matching data based on the single indicator alarm, using the adjusted matching data as new cached data, detecting whether the new cached data meets an alarm triggering condition; and outputting a new alarm if the alarm triggering condition is met. This method reduces the occurrence of useless alarms and improves operation and maintenance efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of fintech, and in particular to a monitoring alarm method, apparatus, device, and computer-readable storage medium. Background Art

[0002] With the continuous development of Fintech, especially internet-based finance, more and more technologies are being applied in the financial sector. For example, monitoring and alarm technology, which is closely linked to Fintech, currently primarily generates alerts based on a single monitoring metric in the server monitoring industry. However, single-metric alerts often fail to help operations personnel determine the actual status of the server. When receiving an alert, they must manually review other metrics to comprehensively assess server health before proceeding. Furthermore, the rapid development of fields such as big data and machine learning in recent years has led to an increase in the frequency of alerts triggered by elevated single-metric values. In reality, in most cases, these alerts do not require special action by operations personnel, making them useless. Furthermore, with the continuous expansion of business, the number of servers is increasing, while operations personnel are scarce, making them increasingly overwhelmed by the overwhelming volume of alerts.

[0003] Therefore, how to reduce the occurrence of useless alarms and improve operation and maintenance efficiency has become a technical problem that needs to be solved urgently. Summary of the Invention

[0004] The main purpose of the present invention is to provide a monitoring alarm method, device, equipment and computer-readable storage medium, aiming to solve the technical problem of how to reduce the occurrence of useless alarms and improve operation and maintenance efficiency.

[0005] To achieve the above objectives, the present invention provides a monitoring alarm method, apparatus, device, and computer-readable storage medium. The monitoring alarm method includes:

[0006] Receive alarm data and detect whether the alarm data is a single indicator alarm;

[0007] If the alarm data is a single indicator alarm, detecting whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data;

[0008] If the matching data exists, the matching data is adjusted based on the single indicator alarm, and the adjusted matching data is used as new cache data, and the new cache data is detected to determine whether it meets the alarm triggering condition;

[0009] If the alarm triggering conditions are met, a new alarm is output.

[0010] Optionally, after the step of detecting whether there is matching data matching the single indicator alarm in the cache data corresponding to the alarm data, the following steps are included:

[0011] If not, the alarm type of the single indicator alarm is determined, and a target policy is generated according to a preset policy setting rule and the alarm type, and the target policy is cached.

[0012] Optionally, the adjustment includes updating, and the step of adjusting the matching data based on the single indicator alarm includes:

[0013] Calculate the difference between the historical alarm time of the matching data and the current alarm time of the single indicator alarm, and detect whether the difference is greater than a preset time limit;

[0014] If it is greater, the historical alarm time and historical alarm type in the matching data are updated according to the single indicator alarm.

[0015] Optionally, the adjustment includes adding, after the step of detecting whether the difference is greater than a preset time limit, the following steps are included:

[0016] If it is less than or equal to, the historical alarm time and historical alarm type in the matching data are kept unchanged, and the alarm type of the single indicator alarm is added to the matching data.

[0017] Optionally, the step of detecting whether the new cached data meets an alarm triggering condition includes:

[0018] Obtain all alarm types included in the policy corresponding to the single indicator alarm, and detect whether the new cache data includes all alarm types;

[0019] If the new cached data includes all alarm types, it is determined that the new cached data meets the alarm triggering condition.

[0020] Optionally, after the step of detecting whether the new cache data includes all alarm types, the following steps are included:

[0021] If the new cache data does not include all alarm types, it is determined that the new cache data does not meet the alarm triggering condition, and the steps of receiving the alarm data and detecting whether the alarm data is a single indicator alarm are continued.

[0022] Optionally, after the step of receiving the alarm data and detecting whether the alarm data is a single indicator alarm, the following steps are included:

[0023] If the alarm data is a composite indicator, determining whether the abnormal indicator value carried by the composite indicator is greater than a preset threshold;

[0024] If the abnormal indicator value carried by the composite indicator is greater than the preset threshold, an alarm message is output.

[0025] In addition, to achieve the above-mentioned purpose, the present invention further provides a monitoring and alarming device, which includes:

[0026] A receiving module is used to receive alarm data and detect whether the alarm data is a single indicator alarm;

[0027] A detection module, configured to detect, if the alarm data is a single indicator alarm, whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data;

[0028] a storage module configured to adjust the matching data based on the single indicator alarm if the matching data exists, and use the adjusted matching data as new cache data, and detect whether the new cache data meets the alarm triggering condition;

[0029] The output module is used to output a new alarm if the alarm triggering conditions are met.

[0030] In addition, to achieve the above-mentioned purpose, the present invention also provides a monitoring alarm device;

[0031] The monitoring alarm device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein:

[0032] When the computer program is executed by the processor, the steps of the monitoring alarm method described above are implemented.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer storage medium;

[0034] The computer storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the monitoring and alarm method described above are implemented.

[0035] The embodiments of the present invention provide a monitoring alarm method, apparatus, device, and readable storage medium. The method receives alarm data and detects whether the alarm data is a single indicator alarm. If the alarm data is a single indicator alarm, the method detects whether there is matching data matching the single indicator alarm in the cache data corresponding to the alarm data. If there is matching data, the method adjusts the matching data based on the single indicator alarm and uses the adjusted matching data as new cache data to detect whether the new cache data meets the alarm triggering condition. If the alarm triggering condition is met, the method outputs a new alarm. By obtaining new cache data when it is determined that the alarm data is a single indicator alarm and there is matching data matching the single indicator alarm in the cache data, and outputting a new alarm when the new cache data meets the alarm triggering condition, the method also deletes the new cache data. This improves the accuracy and usability of monitoring alarms, avoids the phenomenon of issuing an alarm as soon as the alarm data is received in the prior art, saves manpower and maintenance costs, and only issues an alarm when the alarm data meets certain conditions, thereby improving operational efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Schematic diagram of the structure of the monitoring and alarm device for the hardware operating environment involved in the embodiment of the present invention;

[0037] Figure 2 This is a flow chart of a first embodiment of the monitoring and alarming method of the present invention;

[0038] Figure 3 This is a schematic diagram of the system structure of an embodiment of the monitoring and alarming device of the present invention.

[0039] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0040] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0041] like Figure 1 As shown, Figure 1 It is a schematic diagram of the structure of the monitoring and alarm equipment of the hardware operating environment involved in the embodiment of the present invention.

[0042] like Figure 1As shown, the monitoring alarm device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0043] Optionally, the monitoring and alarm device may also include a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, and the like. Among them, the sensors include light sensors, motion sensors, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display screen according to the brightness of the ambient light, and the proximity sensor may turn off the display screen and / or backlight when the terminal device is moved to the ear. Of course, the monitoring and alarm device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0044] Those skilled in the art will understand that Figure 1 The terminal structure shown in the figure does not constitute a limitation to the terminal, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0045] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a monitoring alarm program.

[0046] exist Figure 1 In the monitoring and alarm device shown, the network interface 1004 is mainly used to connect to the backend server and communicate data with the backend server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the monitoring and alarm program stored in the memory 1005 and perform the following operations:

[0047] Receive alarm data and detect whether the alarm data is a single indicator alarm;

[0048] If the alarm data is a single indicator alarm, detecting whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data;

[0049] If the matching data exists, the matching data is adjusted based on the single indicator alarm, and the adjusted matching data is used as new cache data, and the new cache data is detected to determine whether it meets the alarm triggering condition;

[0050] If the alarm triggering conditions are met, a new alarm is output.

[0051] The present invention provides a monitoring alarm method. In the first embodiment of the monitoring alarm method, referring to Figure 2 , the monitoring alarm method includes the following steps:

[0052] Step S10: receiving alarm data and detecting whether the alarm data is a single indicator alarm;

[0053] In this embodiment, a channel system, which may be named Channel, is provided. This channel system is used to enable communication between different programs. In addition, the channel system can be used to cache data objects. In this embodiment, alarm information is first received. After receipt, the received alarm data is placed in the Channel. Simultaneously, a preset processing program is started to extract the alarm data from the Channel. In this embodiment, the number of processing programs is not limited. When a processing program extracts alarm data from the Channel, the Channel automatically deletes the alarm data, thereby ensuring that the same alarm data is not processed simultaneously by different processing programs.

[0054] In this embodiment, a single indicator alarm mainly includes but is not limited to the following three elements: Endpoint (the unique identifier of the server), Timestamp (the alarm time), and AlarmType (the alarm type). These three elements can be used to determine which server, when, and what abnormality an alarm occurred. In addition, it should be noted that cache in the traditional sense refers to a high-speed memory with an access speed faster than general random access memory (RAM). In this embodiment, the channel system's cache not only stores the matching data in the cached data that matches the single indicator alarm and the new cached data, but also automatically deletes the alarm data immediately after the processing program extracts it, preventing the alarm data from being repeatedly extracted by different processing programs.

[0055] Currently, most monitoring systems have individual indicator strategy components. When the monitored value of any indicator reaches the set threshold, the system will issue an abnormal indicator alarm to the operation and maintenance personnel. In this embodiment, the alarm strategy is not limited to a single indicator but includes multiple indicators. When multiple indicators are abnormal, an alarm message is output, thereby improving the effectiveness of the alarm. The mapping relationship between the alarm strategy and the alarm indicator is set according to the actual situation. In this embodiment, the following settings can be adopted:

[0056]

[0057] Table 1

[0058] Among them, No. 1: When a server has abnormal alarms for the three indicators cpu.iowait, disk.io.util, and disk.io.write_request within the preset time (30 seconds, configurable), an array card damage alarm will be issued.

[0059] Number 2: When a server shows abnormal alarms for the two indicators agent.alive and ping.available within the preset time (30 seconds, configurable), a downtime alarm will be issued.

[0060] Number 3: When a server displays abnormal alarms for the cpu.iowait and mem.memfree.percent indicators within the preset time (30 seconds, configurable), a memory bank failure alarm will be issued.

[0061] Therefore, in this embodiment, the server system provides an interface for receiving alarm data sent by each client, such as a single indicator alarm. After receiving the alarm data, it is also necessary to determine whether the alarm data is a single indicator alarm (that is, to detect whether the currently received alarm data carries a preset indicator tag. If it carries an indicator tag, and there is only one, then the alarm data is determined to be a single indicator alarm. However, if the alarm data does not carry a preset indicator tag, but carries a preset stop signal, it will actively stop monitoring the alarm detection). If so, the alarm data is placed in the channel, and a processing program - worker (worker) is started to continuously obtain the alarm data in the channel to execute the strategy. However, if the alarm data is a preset stop signal, the worker will be actively stopped.

[0062] Step S20: If the alarm data is a single indicator alarm, detecting whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data;

[0063] When it is determined that the alarm data is a single indicator alarm, the Endpoint, Timestamp, AlarmType and other information carried by the single indicator alarm itself can be obtained. Based on this information, the cached data in the system can be read to check whether matching data has been cached before. That is, whether there is matching data that matches the single indicator alarm in the cached data corresponding to the alarm data, and different operations can be performed based on different detection results.

[0064] For example, the alarm types include array card damage, system downtime, and memory module failure. The strategies for array card damage include a, b, and c; the strategies for system downtime include e and d; and the strategies for memory module failure include a and e. If the indicator corresponding to the received single-metric alarm is a, then the matching data can be determined to include a corresponding to array card damage and a corresponding to memory module failure. The matching data is the same data in the cache as the single-metric alarm.

[0065] Step S30: If the matching data exists, the matching data is adjusted based on the single indicator alarm, and the adjusted matching data is used as new cache data to detect whether the new cache data meets the alarm triggering condition;

[0066] When it is determined that there is matching data that matches the single indicator alarm, the cache can be locked, and it can be determined whether the difference between the alarm time of the cached matching data and the alarm time of this alarm (i.e., the single indicator alarm) exceeds the preset time limit, so that the matching data can be adjusted according to the single indicator alarm, thereby obtaining the adjusted new cache data. That is, when the difference between the alarm time of the matching data and the alarm time of this alarm exceeds the preset time limit, the alarm time and alarm type in the cache can be updated, that is, the alarm time and alarm type of the matching data are replaced with the alarm time and alarm type of the single indicator alarm. However, if the difference between the alarm time of the matching data and the alarm time of this alarm does not exceed the preset time limit, the alarm type of this single indicator alarm can be added to the cache and unlocked. At this time, the alarm time and alarm type of the matching data will not be changed and will continue to be retained. It should be noted that if there is no matching data that matches the single indicator alarm, all rules related to the single indicator alarm can be directly read, and all policies related to the alarm type of the single indicator alarm and the single indicator alarm can be cached.

[0067] Among them, according to actual needs, there may be multiple processing program workers running at the same time. In order to avoid multiple workers processing a single indicator alarm at the same time, resulting in a waste of resources, when it is determined that a worker is processing a single indicator alarm, the cache can be locked to prevent other workers from processing this single indicator alarm again.

[0068] In this embodiment, after acquiring new cached data, it is possible to detect whether the new cached data meets the triggering alarm condition, and perform different operations based on different judgment and detection results. The new cached data can be cached data adjusted based on a single indicator alarm. The alarm condition can be set by the user based on their own preferences.

[0069] Step S40: If the alarm triggering condition is met, a new alarm is output.

[0070] When it is determined that the new cached data meets the alarm triggering conditions, the new alarm can be directly output, and after the output is completed, the new cached data can be deleted. However, if the new cached data does not meet the alarm triggering conditions, the next single indicator alarm can be obtained and the same processing can be performed. That is, in this embodiment, it is determined whether the cached data contains all the alarm types involved in the strategy corresponding to the single indicator alarm; if not all alarm types are included, the next single indicator alarm is processed; if all alarm types are included, a new alarm is issued. In addition, in this embodiment, multiple workers can be started at the same time (using channels, cache locking, and unlocking are all for multiple workers to work at the same time to increase processing speed).

[0071] To help understand the monitoring alarm processing in this embodiment, the following example illustrates this. For example, suppose three policies (Table 1) are configured for array card damage, downtime, and memory module failure. A single indicator alarm (Endpoint1, Timestamp1, AlarmType1-cpu.iowait) is received. The two policies associated with this alarm are numbered 1 and 3. Therefore, the following content is cached:

[0072] Key (key) - (endpoint1, array card damage), value - (Timestamp1, AlarmType1 - cpu.iowait);

[0073] Key-(endpoint1, memory module failure), value-(Timestamp1, AlarmType1-cpu.iowait).

[0074] Because the array card damage policy requires three single indicator alarms, and the memory module failure policy requires two single indicator alarms, the conditions for issuing a new alarm are not met. Therefore, the worker enters the waiting stage, waiting for the next single indicator alarm.

[0075] One second later, a new indicator alarm (Endpoint2, Timestamp2, AlarmType1-cpu.iowait) is received.

[0076] Because Key-(endpoint2, xxx) does not exist in the cache, a new key is cached. The cached result is as follows:

[0077] Key-(endpoint1, array card damaged), value-(Timestamp1, AlarmType1-cpu.iowait);

[0078] Key-(endpoint1, memory module failure), value-(Timestamp1, AlarmType1-cpu.iowait);

[0079] Key-(endpoint2, array card damage), value-(Timestamp2, AlarmType1-cpu.iowait);

[0080] Key-(endpoint2, memory module failure), value-(Timestamp2, AlarmType1-cpu.iowait).

[0081] One second later, a new indicator alarm (Endpoint1, Timestamp3, AlarmType2-disk.io.util) is received. Because Timestamp1 and Timestamp3 are within the preset time limit, the cache is updated. After the update, the cache status is as follows:

[0082] Key: (endpoint1, array card damaged), value: (Timestamp1, AlarmType1-cpu.iowait, AlarmType2-disk.io.util);

[0083] Key-(endpoint1, memory module failure), value-(Timestamp1, AlarmType1-cpu.iowait);

[0084] Key-(endpoint2, array card damage), value-(Timestamp2, AlarmType1-cpu.iowait);

[0085] Key-(endpoint2, memory module failure), value-(Timestamp2, AlarmType1-cpu.iowait).

[0086] One second later, a new indicator alarm is received (Endpoint1, Timestamp4, AlarmType3-mem.memfree.percent). Because Timestamp1 and Timestamp3 are within the preset time limit, the cache is updated. After the update, the cache status is as follows:

[0087] Key: (endpoint1, array card damaged), value: (Timestamp1, AlarmType1-cpu.iowait, AlarmType2-disk.io.util);

[0088] Key-(endpoint1, memory failure), value-(Timestamp1, AlarmType1-cpu.iowait, AlarmType3-mem.memfree.percent);

[0089] Key-(endpoint2, array card damage), value-(Timestamp2, AlarmType1-cpu.iowait);

[0090] Key-(endpoint2, memory module failure), value-(Timestamp2, AlarmType1-cpu.iowait).

[0091] At this point, the key (endpoint1, memory failure) has met the policy conditions, a new alarm (endpoint1, Timestamp1, AlarmType - memory failure) is issued, and the cache is cleared. After the clearing, the cache status is as follows:

[0092] Key: (endpoint1, array card damaged), value: (Timestamp1, AlarmType1-cpu.iowait, AlarmType2-disk.io.util);

[0093] Key-(endpoint1, memory failure), value-(Timestamp1, AlarmType1-cpu.iowait, AlarmType3-mem.memfree.percent);

[0094] Key-(endpoint2, array card damage), value-(Timestamp2, AlarmType1-cpu.iowait);

[0095] Key-(endpoint2, memory module failure), value-(Timestamp2, AlarmType1-cpu.iowait).

[0096] After the above processing by the worker, the number of single indicator alarms can be greatly reduced, thereby improving the accuracy and availability of alarms and saving manpower and maintenance costs.

[0097] In this embodiment, alarm data is received and whether the alarm data is a single indicator alarm is detected; if the alarm data is a single indicator alarm, whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data; if there is matching data, the matching data is adjusted based on the single indicator alarm, and the adjusted matching data is used as new cache data to detect whether the new cache data meets the triggering alarm condition; if the triggering alarm condition is met, a new alarm is output. By obtaining new cache data when it is determined that the alarm data is a single indicator alarm and there is matching data that matches the single indicator alarm in the cache data, and outputting a new alarm when the new cache data meets the triggering alarm condition, and deleting the new cache data, the accuracy and availability of monitoring alarms are improved, avoiding the phenomenon in the prior art of issuing an alarm as soon as the alarm data is received, and saving manpower and maintenance costs. Alarms are only issued when the alarm data meets certain conditions, thereby improving operational efficiency.

[0098] Furthermore, based on the first embodiment of the present invention, a second embodiment of the monitoring alarm method of the present invention is proposed. This embodiment is step S20 of the first embodiment of the present invention, after the step of detecting whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data, including:

[0099] Step a: If the target policy does not exist, generate a target policy according to the preset policy setting rules and the alarm type, and cache the target policy.

[0100] In this embodiment, when it is determined that the cached data corresponding to the alarm data does not contain matching data that matches the single indicator alarm, the alarm type of the single indicator alarm can be determined first, and a target policy can be generated based on the alarm type and the preset policy setting rules. For example, when the alarm type of the single indicator alarm is a memory bank failure, the indicators that may induce the memory bank failure can be determined first, and these indicators can be combined to determine the memory bank failure based on the combination. For example, as long as both the CPU IO wait percentage and the remaining memory percentage generate an alarm, the memory bank failure can be determined. In this case, this combination can be used as the target policy, and the target policy and the single indicator alarm can be cached. In addition, some alarm types may have multiple policies. Therefore, in this embodiment, when generating multiple target policies, all multiple target policies can be cached. The preset policy setting rules can be policy setting rules set in advance by the user, and the policy setting rules require first determining the fault type, then determining all the inducing factors (i.e., indicators) corresponding to the fault type, and then constructing a policy based on the fault type and indicators. The policy can include multiple indicators and can be set according to the user's needs.

[0101] In this embodiment, when it is determined that there is no matching data in the cached data, a target corresponding to the alarm type of the single indicator alarm can be directly generated and cached, thereby ensuring the accuracy of the cached single indicator alarm data.

[0102] Furthermore, the step of adjusting the matching data based on the single indicator alarm includes:

[0103] Step b: calculating the difference between the historical alarm time of the matching data and the current alarm time of the single indicator alarm, and detecting whether the difference is greater than a preset time limit;

[0104] In this embodiment, adjustment includes updating, that is, the adjustment operation on the cached data includes the update operation on the cached data. When it is determined that there is matching data in the cached data, the alarm time of the matching data (i.e., the historical alarm time) can be extracted from the cached data, and the alarm time of the single indicator alarm received this time (i.e., the current alarm time) can be extracted, and then the difference between the historical alarm time and the current alarm time can be calculated, and then the difference can be detected to see if it is greater than the preset time limit value, and different operations can be performed according to different detection results. Among them, the preset time limit value can be any time limit value set in advance by the user.

[0105] Step c: If it is greater than, then update the historical alarm time and historical alarm type in the matching data according to the single indicator alarm.

[0106] If the difference is greater than the preset time limit, the matching data can be updated directly based on the single indicator alarm. This means obtaining the current alarm time and type carried in the single indicator alarm, and obtaining the historical alarm time and type from the matching data. The historical alarm time is then updated with the current alarm time until the historical alarm time and current alarm time are consistent. The historical alarm type is then updated with the current alarm type until the historical alarm type and current alarm type are consistent. The historical alarm type is the alarm type of the matching data.

[0107] In this embodiment, when it is determined that the difference between the historical alarm time and the current alarm time is greater than the preset time limit, the historical alarm time and historical alarm type in the matching data are updated, thereby ensuring the accuracy of the newly obtained cached data.

[0108] Furthermore, after the step of detecting whether the difference is greater than a preset time limit, the following steps are included:

[0109] Step d: If it is less than or equal to, keep the historical alarm time and historical alarm type in the matching data unchanged, and add the alarm type of the single indicator alarm to the matching data.

[0110] If the difference is less than or equal to the preset time limit, the single indicator alarm data can be directly stored. In this case, the historical alarm time and historical alarm type in the matching data remain unchanged. Instead, the alarm type of the single indicator alarm is directly added to the matching data to complete the storage of the single indicator alarm. Adjustment includes addition, that is, the adjustment operation on the cached data includes the addition operation on the cached data.

[0111] In this embodiment, when it is determined that the difference between the relevant alarm time and the current alarm time is less than or equal to the preset time limit value, the alarm type of the single indicator alarm is stored in the matching data without modifying the existing data in the matching data, thereby ensuring the accuracy of the newly cached data obtained.

[0112] Furthermore, the step of detecting whether the new cached data meets the alarm triggering condition includes:

[0113] Step e: obtaining all alarm types included in the policy corresponding to the single indicator alarm, and detecting whether the new cached data includes all alarm types;

[0114] In this embodiment, after obtaining new cache data, it is also necessary to obtain all alarm types contained in the policy corresponding to the single indicator alarm, and detect whether the new cache data contains all alarm types, and then perform different operations based on different detection results.

[0115] Step f: If the new cached data includes all alarm types, it is determined that the new cached data meets the alarm triggering condition.

[0116] When it is determined that the new cache data contains all alarm types, it can be determined that the new cache data meets the alarm triggering condition, and the alarm can be directly output at this time.

[0117] In this embodiment, when it is determined that the new cached data contains all alarm types, it is determined that the new cached data meets the alarm triggering condition, thereby improving the effectiveness of the alarm.

[0118] Furthermore, after the step of detecting whether the new cache data includes all alarm types, the following steps are included:

[0119] Step h: If the new cached data does not include all alarm types, it is determined that the new cached data does not meet the alarm triggering condition, and the steps of receiving the alarm data and detecting whether the alarm data is a single indicator alarm are continued.

[0120] When it is found through judgment that the new cached data does not contain all alarm types, but only some alarm types, it can be determined that the new cached data does not meet the alarm triggering conditions. At this time, the next single indicator alarm can be processed, that is, the steps of receiving alarm data and detecting whether the alarm data is a single indicator alarm can be continued.

[0121] In this embodiment, when it is determined that the new cached data does not include all alarm types, the next single indicator alarm is processed, thereby improving the efficiency of alarms and avoiding the occurrence of useless alarms.

[0122] Furthermore, based on the first embodiment of the present invention, a third embodiment of the monitoring alarm method of the present invention is proposed. This embodiment is step S10 of the first embodiment of the present invention, after the step of receiving alarm data and detecting whether the alarm data is a single indicator alarm, and includes:

[0123] Step m: if the alarm data is a composite indicator, determining whether the abnormal indicator value carried by the composite indicator is greater than a preset threshold;

[0124] In this embodiment, when it is found that the alarm data is a composite indicator, it is necessary to determine whether the value carried by the composite indicator is greater than a preset threshold, and perform different operations according to different determination results. Specifically, composite indicator monitoring is achieved by modifying the single indicator alarm and configuring it to support multiple monitoring indicators. That is, when multiple indicators on a server are abnormal within a preset time (such as 30 seconds, which can be set), a composite indicator alarm can be directly issued. Specifically, the monitoring system will install an agent (computer system) on each server to collect various monitoring indicators. When multiple indicators are collected at the same time and there are problems (i.e., abnormal indicators), an abstract, combined new indicator (i.e., composite indicator) is directly reported to the server. At this time, the composite indicator contains these abnormal indicators. Then, the original monitoring system issues an alarm based on the threshold, that is, determining whether the number of different types of abnormal indicators is greater than the preset threshold. If so, an alarm is issued; if not, no alarm is issued. For example, modify the current agent's indicator collection logic and add a new indicator disk.failure (disk physical failure). If at a certain moment the agent collects three indicators cpu.iowait>0, disk.io.util>100, disk.io.write_request=0, then report the monitoring indicator disk.failure=1 to the monitoring system; if at a certain moment the indicators collected do not meet the conditions: cpu.iowait>0, disk.io.util>100, disk.io.write_request=0, then report disk.failure=0.

[0125] This allows us to abstract the original three metrics into a new, more accurate one. This new metric is a composite of the three. When the monitoring system receives an alert indicating disk.failure = 1 for a server, it's more likely that the server has experienced a disk failure. A composite metric is formed by combining multiple individual metrics.

[0126] Step n: If the abnormal indicator value carried by the composite indicator is greater than a preset threshold, an alarm message is output.

[0127] When it is found through judgment that the abnormal indicator value carried by the composite indicator is greater than the preset threshold, the alarm information can be directly output. However, if it is less than or equal to the preset threshold, no alarm is output and the next alarm data is received.

[0128] In this embodiment, the efficiency of alarming is improved by outputting alarm information when it is determined that the alarm data is a composite indicator and the abnormal indicator value carried by the composite indicator is greater than a preset threshold.

[0129] In addition, refer to Figure 3The embodiment of the present invention further provides a monitoring and alarming device, the monitoring and alarming device comprising:

[0130] The receiving module A10 is used to receive alarm data and detect whether the alarm data is a single indicator alarm;

[0131] The detection module A20 is configured to detect whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data if the alarm data is a single indicator alarm;

[0132] The storage module A30 is configured to adjust the matching data based on the single indicator alarm if the matching data exists, use the adjusted matching data as new cache data, and detect whether the new cache data meets the alarm triggering condition;

[0133] The output module A40 is used to output a new alarm if the alarm triggering condition is met.

[0134] Optionally, the detection module A20 is further configured to:

[0135] If not, the alarm type of the single indicator alarm is determined, and a target policy is generated according to a preset policy setting rule and the alarm type, and the target policy is cached.

[0136] Optionally, the adjustment includes updating, and the storage module A30 is further configured to:

[0137] Calculate the difference between the historical alarm time of the matching data and the current alarm time of the single indicator alarm, and detect whether the difference is greater than a preset time limit;

[0138] If it is greater, the historical alarm time and historical alarm type in the matching data are updated according to the single indicator alarm.

[0139] Optionally, the adjustment includes adding: the storage module A30 is further configured to:

[0140] If it is less than or equal to, the historical alarm time and historical alarm type in the matching data are kept unchanged, and the alarm type of the single indicator alarm is added to the matching data.

[0141] Optionally, the storage module A30 is further configured to:

[0142] Obtain all alarm types included in the policy corresponding to the single indicator alarm, and detect whether the new cache data includes all alarm types;

[0143] If the new cached data includes all alarm types, it is determined that the new cached data meets the alarm triggering condition.

[0144] Optionally, the storage module A30 is further configured to:

[0145] If the new cache data does not include all alarm types, it is determined that the new cache data does not meet the alarm triggering condition, and the steps of receiving the alarm data and detecting whether the alarm data is a single indicator alarm are continued.

[0146] Optionally, the receiving module A10 is further configured to:

[0147] If the alarm data is a composite indicator, determining whether the abnormal indicator value carried by the composite indicator is greater than a preset threshold;

[0148] If the abnormal indicator value carried by the composite indicator is greater than the preset threshold, an alarm message is output.

[0149] Among them, the steps implemented by each functional module of the monitoring and alarm device can refer to the various embodiments of the monitoring and alarm method of the present invention, and will not be repeated here.

[0150] The present invention also provides a monitoring alarm device, wherein the terminal includes: a memory, a processor, a communication bus, and a monitoring alarm program stored in the memory:

[0151] The communication bus is used to realize the connection and communication between the processor and the memory;

[0152] The processor is used to execute the monitoring alarm program to implement the steps of each embodiment of the above-mentioned monitoring alarm method.

[0153] The present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can also be executed by one or more processors to implement the steps of each embodiment of the above-mentioned monitoring and alarm method.

[0154] The specific implementation of the computer-readable storage medium of the present invention is basically the same as the above-mentioned embodiments of the monitoring alarm method, and will not be repeated here.

[0155] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0156] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0157] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0158] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A monitoring alarm method, characterized in that: The monitoring alarm method is applied to the server monitoring industry and includes the following steps: Receive alarm data, place the received alarm data into a channel system, start a preset processing program to extract and detect whether the alarm data is a single indicator alarm from the channel system, and delete the alarm data from the channel system after extracting the alarm data; wherein the channel system is used to implement communication between different programs, and the single indicator alarm includes the following three elements: a unique identifier of the server, the alarm time, and the alarm type; If the alarm data is a single indicator alarm, detecting whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data; If the matching data exists, the matching data is adjusted based on the single indicator alarm, and the adjusted matching data is used as new cache data, and the new cache data is detected to determine whether it meets the alarm triggering condition; If the alarm triggering conditions are met, a new alarm is output.

2. The monitoring alarm method according to claim 1, wherein: After the step of detecting whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data, the method includes: If not, the alarm type of the single indicator alarm is determined, and a target policy is generated according to a preset policy setting rule and the alarm type, and the target policy is cached.

3. The monitoring alarm method according to claim 1, wherein: The adjustment includes updating, and the step of adjusting the matching data based on the single indicator alarm includes: Calculate the difference between the historical alarm time of the matching data and the current alarm time of the single indicator alarm, and detect whether the difference is greater than a preset time limit; If it is greater, the historical alarm time and historical alarm type in the matching data are updated according to the single indicator alarm.

4. The monitoring alarm method according to claim 3, wherein: The adjusting includes adding, after the step of detecting whether the difference is greater than a preset time limit, the following steps: If it is less than or equal to, the historical alarm time and historical alarm type in the matching data are kept unchanged, and the alarm type of the single indicator alarm is added to the matching data.

5. The monitoring alarm method according to claim 1, wherein: The step of detecting whether the new cached data meets the alarm triggering condition includes: Obtain all alarm types included in the policy corresponding to the single indicator alarm, and detect whether the new cache data includes all alarm types; If the new cached data includes all alarm types, it is determined that the new cached data meets the alarm triggering condition.

6. The monitoring alarm method according to claim 5, characterized in that: After the step of detecting whether the new cache data contains all alarm types, the method further includes: If the new cache data does not include all alarm types, it is determined that the new cache data does not meet the alarm triggering condition, and the steps of receiving the alarm data and detecting whether the alarm data is a single indicator alarm are continued.

7. The monitoring alarm method according to any one of claims 1 to 6, characterized in that: After the step of receiving the alarm data and detecting whether the alarm data is a single indicator alarm, the following steps are included: If the alarm data is a composite indicator, determining whether the abnormal indicator value carried by the composite indicator is greater than a preset threshold; If the abnormal indicator value carried by the composite indicator is greater than the preset threshold, an alarm message is output.

8. A monitoring alarm device, characterized in that: The monitoring alarm device is applied to the server monitoring industry, including: A receiving module is configured to receive alarm data, place the received alarm data into a channel system, initiate a preset processing program to extract and detect whether the alarm data is a single indicator alarm from the channel system, and delete the alarm data from the channel system after extracting the alarm data; wherein the channel system is used to implement communication between different programs, and the single indicator alarm includes the following three elements: a unique identifier of the server, an alarm time, and an alarm type; A detection module, configured to detect, if the alarm data is a single indicator alarm, whether there is matching data that matches the single indicator alarm in the cache data corresponding to the alarm data; a storage module configured to adjust the matching data based on the single indicator alarm if the matching data exists, and use the adjusted matching data as new cache data, and detect whether the new cache data meets the alarm triggering condition; The output module is used to output a new alarm if the alarm triggering conditions are met.

9. A monitoring alarm device, characterized in that: The monitoring alarm device includes: a memory, a processor, and a monitoring alarm program stored in the memory and executable on the processor. When the monitoring alarm program is executed by the processor, the steps of the monitoring alarm method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a monitoring alarm program, which, when executed by a processor, implements the steps of the monitoring alarm method according to any one of claims 1 to 7.

Images