A method, device, equipment and readable storage medium for generating alarm information

Abstract

The embodiments of the present application provide a method, device, equipment and readable storage medium for generating alarm information. In response to receiving a log, the number of exceptions is updated. If the number of exceptions is not equal to 0 when the first timing time reaches the first preset time, the waiting recovery time is obtained at least based on the historical log. When the second timing time reaches the waiting recovery time, the logs received within the time period indicated by the second timing time are all abnormal logs, and an alarm message is generated. The number of exceptions is the number of times the abnormal logs are received continuously. The first timing time indicates the length of time for which the abnormal logs are received continuously. The second timing time indicates the time from the moment when the first timing time reaches the first preset time, indicating that after receiving at least one abnormal log within the first timing time, the fault that caused the abnormal log was not restored within the time indicated by the waiting recovery time. It can be seen that the alarm information generated by this method has high accuracy.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, equipment and readable storage medium for generating alarm information. Background Art

[0002] A web crawler (also known as a web spider or web robot) is a program or script that automatically captures Internet information according to certain rules. The use of web crawlers greatly improves the efficiency of website information collection. At present, in the process of crawling information by a web crawler, if an information error occurs, the error information is written into a log file as a network alarm, and an alarm message of abnormal operation of the web crawler is generated for query by operation and maintenance personnel. However, there are many reasons for information errors, such as temporary network failures (such as packet loss, slow network speed, etc.) or web pages executing preset events (such as web page updates). Temporary network failures usually recover automatically, and information errors caused by web pages executing preset events will also recover automatically after the event execution is completed. Obviously, information errors caused by these two reasons do not belong to abnormal operation of the web crawler. Therefore, if an alarm message is generated every time an information error occurs, the alarm message cannot accurately warn the abnormal operation of the web crawler, and the operation and maintenance personnel need to determine whether the abnormal operation of the web crawler is caused by log analysis. It can be seen that the accuracy of the alarm message generated by the prior art is low, resulting in a high false alarm rate. Summary of the invention

[0003] The present application provides a method, device, equipment and readable storage medium for generating alarm information, the purpose of which is to improve the accuracy of the alarm information, as follows:

[0004] A method for generating alarm information, comprising:

[0005] In response to receiving the log, updating the number of exceptions, where the number of exceptions is the number of times the exception logs are received consecutively;

[0006] If the number of exceptions is not equal to 0 when the first timing time reaches the first preset time, the waiting recovery time is obtained at least according to the historical log; the first timing time indicates the length of time for continuously receiving the exception logs, and the first preset time indicates the shortest length of time required for the webpage to execute the preset event;

[0007] If the second timing time reaches the waiting recovery time, and within the time period indicated by the second timing time, all the logs received are abnormal logs, an alarm message is generated; the second timing time indicates the length of time until the target time, and the target time is the time when the first timing time reaches the first preset time.

[0008] Optionally, the update exception times include:

[0009] Determine whether the log is an abnormal log;

[0010] If yes, add 1 to the number of abnormalities;

[0011] If not, the number of abnormalities is cleared.

[0012] Optionally, the event includes a webpage update, and the process of obtaining the first preset time includes:

[0013] Determining an initial value of the first preset time according to an update frequency of the webpage update;

[0014] In response to the log being not an abnormal log, shortening the first preset time;

[0015] In response to the first timing time reaching the first preset time and the number of abnormalities being equal to 1, the first preset time is extended.

[0016] Optionally, the waiting recovery time is obtained based on at least the historical logs, including:

[0017] According to a preset fault type probability distribution, a current fault type is obtained, wherein the fault type probability distribution includes a preset fault type and an occurrence probability of the fault type, wherein the current fault type is a fault type to which an abnormal log received within a time period indicated by the first timing time belongs, and the fault type probability distribution is determined at least according to the historical log;

[0018] According to a preset time correspondence, the fault recovery time of the historical exception log belonging to the target fault type is obtained as the waiting recovery time, and the time correspondence includes the correspondence between the historical fault type and the fault recovery time of the historical exception log belonging to the historical fault type; the time correspondence is determined at least based on the historical log.

[0019] Optionally, it also includes:

[0020] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the fault recovery time of the historical abnormal log belonging to the target fault type in the time correspondence is shortened.

[0021] Optionally, it also includes:

[0022] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the number of abnormal times is cleared;

[0023] If the number of abnormalities is not less than 2 when the first timing time reaches the first preset time, the number of abnormalities is cleared.

[0024] A device for generating alarm information, comprising:

[0025] A times acquisition module, used for updating the number of exceptions in response to receiving a log, wherein the number of exceptions is the number of times the exception log is received continuously, and the exception log includes empty data and / or error data;

[0026] A recovery time acquisition module, configured to acquire the waiting recovery time at least based on the historical log if the number of exceptions is not equal to 0 when the first timing time reaches the first preset time; the first timing time indicates the length of time for continuously receiving the exception logs, and the first preset time indicates the shortest length of time required for the webpage to execute the preset event;

[0027] An alarm module is used to generate an alarm message if the second timing time reaches the waiting recovery time and all the logs received within the time period indicated by the second timing time are abnormal logs; the second timing time indicates the length of time from the target time, and the target time is the time when the first timing time reaches the first preset time.

[0028] Optionally, the number acquisition module is used to update the number of exceptions in response to receiving the log, including: the number acquisition module is specifically used to:

[0029] Determine whether the log is an abnormal log;

[0030] If yes, add 1 to the number of abnormalities;

[0031] If not, the number of abnormalities is cleared.

[0032] A device for generating alarm information, comprising: a memory and a processor;

[0033] The memory is used to store programs;

[0034] The processor is used to execute the program to implement the various steps of the method for generating alarm information as described above.

[0035] A readable storage medium stores a computer program, and when the computer program is executed by a processor, each step of the method for generating alarm information as described above is implemented.

[0036] It can be seen from the above technical scheme that the generation method, device, equipment and readable storage medium of the alarm information provided by the embodiment of the present application, in response to receiving the log, update the number of abnormalities, if the first timing time reaches the first preset time, the number of abnormalities is not equal to 0, at least according to the historical log, the waiting recovery time is obtained, and further when the second timing time reaches the waiting recovery time, the received logs are all abnormal logs in the time period indicated by the second timing time, and the alarm information is generated. Since the number of abnormalities is the number of times the abnormal logs are received continuously, the first timing time indicates the duration of the continuous reception of the abnormal logs, and the first preset time indicates the shortest duration required for the web page to execute the preset event, so if the first timing time reaches the first preset time, and the number of abnormalities is not equal to 0, the log abnormality caused by the web page update is excluded. In addition, since the second timing time indicates the duration from the moment when the first timing time reaches the first preset time, it means that after the abnormal log is received within the first timing time, the fault that causes the abnormal log is not restored within the time indicated by the waiting recovery time. It can be seen that the alarm information generated by this method has high accuracy, avoiding the abnormal log caused by the execution of the preset event by the web page and the abnormal log caused by the temporary network failure, resulting in the false alarm phenomenon. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A schematic diagram of an application scenario of generating information of an alarm information provided in an embodiment of the present application;

[0039] Figure 2 A flowchart of a specific implementation method of a method for generating alarm information provided in an embodiment of the present application;

[0040] Figure 3 A flowchart of a method for generating alarm information provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of the structure of a device for generating alarm information provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of the structure of a device for generating alarm information provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0044] The method for generating alarm information provided in the embodiment of the present application is applied to but not limited to when the information collection device collects information, by monitoring the operating status of the information collection device, when the operating status of the information collection device is abnormal, generating alarm information for query by operation and maintenance personnel.

[0045] Optionally, an optional application scenario of a method for generating alarm information provided by an embodiment of the present application is as follows: Figure 1 As shown, including:

[0046] The web crawler crawls web page information on the web page, and stores the web page information as logs in a log file in real time. This method is applied to a monitoring device, which obtains the logs collected by the web crawler and determines whether the logs are abnormal, thereby determining whether the running state of the web crawler is abnormal, and generates an alarm message when the running state of the web crawler is abnormal, and stores the alarm message in the log. It should be noted that the web crawler crawls web page information on the web page at a certain frequency. For example, the web crawler crawls the web page information of xx web page every 3 hours. It should be further noted that in Figure 1 In the application scenario shown, the monitoring device can obtain the web page information crawled by the web crawler each time as a log by communicating with the web crawler, or the monitoring device can obtain the log written by the web crawler to the log file from the log file, which is not limited in this embodiment.

[0047] It should be noted that this embodiment only Figure 1 The scenario shown is taken as an example. The present application can also be applied to other scenarios, and alarm information can be generated by determining whether the operating status of the information collection device is abnormal.

[0048] Figure 2 A flowchart of a method for generating alarm information provided by an embodiment of the present application is shown in FIG. Figure 2 As shown, it may specifically include the following S201 to S206.

[0049] S201: In response to receiving a log, updating the number of abnormalities and the first timing time.

[0050] In this embodiment, the first timing time is the timing time of the first timer, indicating the duration of continuously receiving abnormal logs, and the number of log abnormalities is the total number of continuously receiving abnormal logs.

[0051] In this embodiment, the method for updating the number of abnormalities and the first timing time includes:

[0052] 1. In response to the log being an abnormal log and the number of abnormalities being 0, the number of abnormalities is increased by 1 and a first timer is started to count from 0.

[0053] 2. In response to the log being an abnormal log and the number of abnormalities being not 0, the number of abnormalities is increased by 1.

[0054] 3. In response to the log not being an abnormal log, the number of abnormalities is cleared to zero, the first timing time is cleared to zero, and the first timer is stopped.

[0055] In this embodiment, there are multiple methods for determining whether a log is an abnormal log. Optionally, when the log is empty data, the log is determined to be a first-type abnormal log, or, when the data format of the log does not meet the preset format, the log is determined to be a second-type abnormal log, wherein the preset format is determined at least based on the web page type and the historical log.

[0056] It should be noted that when the first timing time does not reach the first preset time, S201 is iteratively executed, that is, each time a log is received, the number of exceptions and / or the first timing time is updated according to whether the log is an exception log and whether the number of exceptions is 0.

[0057] S202: In response to the first timing time reaching the first preset time and the number of abnormalities being not less than 2, determine the fault type of the abnormality log according to the fault type probability distribution as the current fault type.

[0058] In this embodiment, the first preset time indicates the shortest time required for a web page to execute a preset event, wherein the preset event includes a web page update. It should be noted that the first preset time is determined based on the update frequency of the web page update and the collection frequency of the web crawler, wherein the first preset time is greater than the time required for the web page update indicated by the web page update frequency, and the first preset time is greater than the time difference between two adjacent crawling of web page information by the web crawler indicated by the collection frequency. The fault type probability distribution includes the corresponding relationship between the preset fault type and the probability of occurrence of the fault type.

[0059] It should be noted that the probability of the fault type is determined based on the frequency of abnormal logs in the historical logs of the web page. For example, in the historical logs, the number of abnormal logs crawled by the web crawler is 20 times, of which the number of abnormal logs caused by network interruption is 20 times, the number of abnormal logs caused by website topology change is 2 times, the number of abnormal logs caused by website architecture change is 5 times, and the number of abnormal logs caused by crawler process stop is 3 times. Therefore, the probability distribution of fault types includes fault types and the probability of occurrence of fault types, respectively: network interruption: 0.5, website topology change: 0.1, website architecture change: 0.25, crawler process stop: 0.15.

[0060] An optional method for determining the fault type of the abnormal log is: taking the fault type with the highest probability in the fault type probability distribution as the fault type of the abnormal log, and recording it as the current fault type.

[0061] S203: Determine the waiting recovery time according to the preset time correspondence and the current fault type.

[0062] In this embodiment, the time correspondence is obtained based on historical logs. The time correspondence includes the correspondence between historical fault types and fault recovery times of historical exception logs belonging to the historical fault types. The recovery time corresponding to the historical fault type indicates the average time required for fault recovery after a fault belonging to the historical fault type occurs.

[0063] In this embodiment, the recovery time corresponding to the current fault type is used as the waiting recovery time.

[0064] It should be noted that the time correspondence is determined at least based on historical logs, and the specific method can be found in the prior art.

[0065] S204, in response to the first timing time reaching the first preset time and the number of abnormalities being not less than 2, the number of abnormalities is reset to zero, the first timing time is reset to zero, the first timer is stopped, and the second timer is started to count from 0.

[0066] It should be noted that this embodiment does not limit the execution order of S202 and S204.

[0067] It should be noted that when the first timing time reaches the first preset time and the number of exceptions is equal to 1, it means that only one log is received within the time period indicated by the first timing time, and the log is an abnormal log. At this time, S202 to S204 are executed and the first preset time is updated.

[0068] S205: In response to the second timing time not reaching the waiting recovery time, and the log received within the time period indicated by the second timing time is not an abnormal log, the second timing time is cleared and the second timer is stopped.

[0069] In this embodiment, the second timing time is the timing time of the second timer, indicating the time until the target time, wherein the target time is the time when the first timing time reaches the first preset time.

[0070] It should be noted that after the second timing time is reset, the process returns to S201.

[0071] S206: In response to the second timing time reaching the waiting recovery time, and the logs received within the time period indicated by the second timing time are all abnormal logs, generate alarm information, and store the alarm information in the log.

[0072] It should be noted that after the alarm information is generated, the process returns to execute S201.

[0073] It can be seen from the above technical scheme that the method for generating alarm information provided by the embodiment of the present application, in response to receiving a log, updates the number of abnormalities, if the first timing time reaches the first preset time, the number of abnormalities is not less than 2, at least according to the historical log, obtains the waiting recovery time, and further when the second timing time reaches the waiting recovery time, the received logs are all abnormal logs in the time period indicated by the second timing time, and the alarm information is generated. Since the number of abnormalities is the number of times the abnormal logs are received continuously, the first timing time indicates the time when the abnormal logs are received continuously, and the first preset time indicates the time threshold required for the web page update, so if the first timing time reaches the first preset time, and the number of abnormalities is not less than 2, the log abnormality caused by the web page update is excluded. In addition, since the second timing time indicates the time from the moment when the first timing time reaches the first preset time, it means that after receiving at least two abnormal logs in the first timing time, the fault that caused the abnormal log is not restored within the time indicated by the waiting recovery time. It can be seen that the alarm information generated by this method has high accuracy, avoiding the abnormal log caused by the web page update and the abnormal log caused by the temporary network failure, resulting in the false alarm phenomenon.

[0074] It should be noted that Figure 2 The process shown is only an optional specific implementation of a method for generating alarm information provided in an embodiment of the present application, and the present application also includes other specific implementations.

[0075] For example, it should be noted that S202 is only an optional method for obtaining the current fault type, and the present application also includes other methods for obtaining the current fault type. For example: obtaining the current fault type based on the number of exceptions and / or the error type of the exception log, and a preset fault correspondence. Among them, the fault correspondence is pre-configured based on the historical log, and the fault correspondence includes a combination of the number of exceptions and the error type of the exception log and the correspondence between the fault type.

[0076] For another example, S203 is only an optional method for obtaining the waiting recovery time. The present application also includes other methods for obtaining the waiting recovery time, such as using the occurrence probability of each fault type in the fault type probability distribution as a weight, and weightedly adding the fault recovery time of each fault type in the time correspondence as the waiting recovery time.

[0077] For another example, the present application also includes a method for obtaining a first preset time and a method for obtaining a time correspondence.

[0078] Optionally, the method for obtaining the first preset time includes:

[0079] An initial value of the first preset time is determined according to the webpage update frequency.

[0080] In response to the first timing time being reset to zero, the first preset time is shortened.

[0081] In response to the first timing time reaching the first preset time and the number of abnormalities being equal to 1, the first preset time is extended.

[0082] It should be noted that during the web page update process, the web page information crawled by the web crawler is an abnormal log, so in this embodiment, the first preset time is greater than the web page update duration indicated by the web page update frequency, eliminating the log abnormality caused by the web page update. Further, the first timing time is cleared to indicate that the received log is not an abnormal log, indicating that the web page update is completed or the fault is restored within the first preset time, so the first preset time is shortened. Further, when the first timing time reaches the first preset time, the number of abnormalities is equal to 1, indicating that no log is received within the first preset time, that is, the web crawler has not crawled the web page information, indicating that the first preset time is less than the interval time for the web crawler to crawl the web page information, so the first preset time is extended. In summary, in this method, the first preset time is determined based on the web page update frequency and the web crawler collection frequency, and is updated in real time, which can avoid the low accuracy of error information caused by abnormal logs caused by web page updates.

[0083] Optionally, the method for acquiring the time correspondence includes:

[0084] Obtain the average recovery time of the historical fault type to which the abnormal log in the historical log belongs as the recovery time corresponding to the historical fault type;

[0085] In response to the second timing time not reaching the waiting recovery time and the received log is not the abnormal log, the fault recovery time of the historical abnormal log belonging to the target fault type in the time correspondence is shortened.

[0086] It should be noted that the time correspondence obtains an initial value based on the historical log, and is adaptively updated based on the log received during the alarm information generation method, so the time correspondence has high accuracy, further improving the accuracy of the waiting recovery time.

[0087] In summary, the method for generating alarm information provided in the embodiment of the present application can be summarized as follows: Figure 3 A flow chart of a method for generating alarm information is shown in FIG. Figure 3 As shown, the method may include S301 to S303.

[0088] S301: In response to receiving a log, update the number of exceptions.

[0089] In this embodiment, the number of exceptions is the number of times the exception logs are received continuously. Optionally, the method for updating the number of exceptions includes: when the received log is an exception log, the number of exceptions is increased by 1, and when the received log is not an exception log, the number of exceptions is cleared.

[0090] It should be noted that the abnormal log includes empty data and / or erroneous data. There are multiple methods for determining whether a log is an abnormal log. For details, please refer to S201.

[0091] S302: If the first timing time reaches the first preset time and the number of abnormalities is not equal to 0, the waiting recovery time is obtained at least based on the historical log.

[0092] In this embodiment, the first timing time indicates the length of time for which abnormal logs are continuously received, and the first preset time indicates the shortest length of time required for a web page to execute a preset event. It should be noted that the pre-events include events that may cause log abnormalities, which are specifically set according to actual application settings, for example, the event is a web page update.

[0093] Optionally, at least based on the historical logs, there are multiple methods for obtaining the waiting recovery time, and the details can be referred to the above embodiments.

[0094] S303: If the second timing time reaches the waiting recovery time, and all the received logs in the time period indicated by the second timing time are abnormal logs, an alarm message is generated.

[0095] In this embodiment, the second timing time indicates the time length to the target time, and the target time is the time when the first timing time reaches the first preset time.

[0096] It can be seen from the above technical scheme that the method for generating alarm information provided by the embodiment of the present application, in response to receiving a log, updates the number of abnormalities, if the first timing time reaches the first preset time, the number of abnormalities is not equal to 0, at least according to the historical log, obtains the waiting recovery time, and further when the second timing time reaches the waiting recovery time, the received logs are all abnormal logs in the time period indicated by the second timing time, and the alarm information is generated. Since the number of abnormalities is the number of times the abnormal logs are received continuously, the first timing time indicates the duration of continuously receiving the abnormal logs, and the first preset time indicates the shortest duration required for the web page to execute the preset event, so if the first timing time reaches the first preset time, and the number of abnormalities is not equal to 0, the log abnormality caused by the web page update is excluded. In addition, since the second timing time indicates the duration from the moment when the first timing time reaches the first preset time, it means that after the abnormal log is received within the first timing time, the fault that causes the abnormal log is not restored within the time indicated by the waiting recovery time. It can be seen that the alarm information generated by this method has high accuracy, avoiding the abnormal log caused by the execution of the preset event by the web page and the abnormal log caused by the temporary network failure, resulting in the false alarm phenomenon.

[0097] Figure 4 A schematic diagram of the structure of a device for generating alarm information provided by an embodiment of the present application is shown. Figure 4 As shown, the device may include:

[0098] The number acquisition module 401 is used to update the number of exceptions in response to receiving a log, where the number of exceptions is the number of consecutive times the exception log is received, and the exception log includes empty data and / or error data;

[0099] A recovery time acquisition module 402 is used to acquire the waiting recovery time at least based on the historical log if the number of exceptions is not equal to 0 when the first timing time reaches the first preset time; the first timing time indicates the length of time for continuously receiving the exception logs, and the first preset time indicates the shortest length of time required for the webpage to execute the preset event;

[0100] The alarm module 403 is used to generate an alarm message if the second timing time reaches the waiting recovery time and all the logs received within the time period indicated by the second timing time are abnormal logs; the second timing time indicates the length of time to the target moment, and the target moment is the moment when the first timing time reaches the first preset time.

[0101] Optionally, a times acquisition module is used to update the number of exceptions in response to receiving a log, including: the times acquisition module is specifically used to:

[0102] Determine whether the log is the abnormal log;

[0103] If yes, add 1 to the number of abnormalities;

[0104] If not, the number of abnormalities is cleared.

[0105] Optionally, the method further includes: a time acquisition unit, configured to acquire a first preset time, wherein the time acquisition unit is specifically configured to:

[0106] Determining an initial value of the first preset time according to an update frequency of the webpage update;

[0107] In response to the log being not an abnormal log, shortening the first preset time;

[0108] In response to the first timing time reaching the first preset time and the number of abnormalities being equal to 1, the first preset time is extended.

[0109] Optionally, the recovery time acquisition module is used to obtain the waiting recovery time at least based on the historical log, including: the recovery time acquisition module is specifically used to:

[0110] According to a preset fault type probability distribution, a current fault type is obtained, wherein the fault type probability distribution includes a preset fault type and an occurrence probability of the fault type, wherein the current fault type is a fault type to which an abnormal log received within a time period indicated by the first timing time belongs, and the fault type probability distribution is determined at least according to the historical log;

[0111] According to a preset time correspondence, the fault recovery time of the historical exception log belonging to the target fault type is obtained as the waiting recovery time, and the time correspondence includes the correspondence between the historical fault type and the fault recovery time of the historical exception log belonging to the historical fault type; the time correspondence is determined at least based on the historical log.

[0112] Optionally, a time update module is also included, for:

[0113] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the fault recovery time of the historical abnormal log belonging to the target fault type in the time correspondence is shortened.

[0114] Optionally, the number acquisition module is also used to:

[0115] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the number of abnormal times is cleared;

[0116] If the number of abnormalities is not less than 2 when the first timing time reaches the first preset time, the number of abnormalities is cleared.

[0117] Figure 5 A schematic diagram showing the structure of the alarm information generating device is shown, and the device may include: at least one processor 501, at least one communication interface 502, at least one memory 503 and at least one communication bus 504;

[0118] In the embodiment of the present application, the number of the processor 501, the communication interface 502, the memory 503, and the communication bus 504 is at least one, and the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504;

[0119] The processor 501 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention;

[0120] The memory 503 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory;

[0121] The memory stores a program, and the processor can execute the program stored in the memory to implement the steps of a method for generating alarm information provided in an embodiment of the present application, as follows:

[0122] A method for generating alarm information, comprising:

[0123] In response to receiving the log, updating the number of exceptions, where the number of exceptions is the number of times the exception logs are received consecutively;

[0124] If the number of exceptions is not equal to 0 when the first timing time reaches the first preset time, the waiting recovery time is obtained at least according to the historical log; the first timing time indicates the length of time for continuously receiving the exception logs, and the first preset time indicates the shortest length of time required for the webpage to execute the preset event;

[0125] If the second timing time reaches the waiting recovery time, and within the time period indicated by the second timing time, all the logs received are abnormal logs, an alarm message is generated; the second timing time indicates the length of time until the target time, and the target time is the time when the first timing time reaches the first preset time.

[0126] Optionally, the update exception times include:

[0127] Determine whether the log is an abnormal log;

[0128] If yes, add 1 to the number of abnormalities;

[0129] If not, the number of abnormalities is cleared.

[0130] Optionally, the event includes a webpage update, and the process of obtaining the first preset time includes:

[0131] Determining an initial value of the first preset time according to an update frequency of the webpage update;

[0132] In response to the log being not an abnormal log, shortening the first preset time;

[0133] In response to the first timing time reaching the first preset time and the number of abnormalities being equal to 1, the first preset time is extended.

[0134] Optionally, the waiting recovery time is obtained based on at least the historical logs, including:

[0135] According to a preset fault type probability distribution, a current fault type is obtained, wherein the fault type probability distribution includes a preset fault type and an occurrence probability of the fault type, wherein the current fault type is a fault type to which an abnormal log received within a time period indicated by the first timing time belongs, and the fault type probability distribution is determined at least according to the historical log;

[0136] According to a preset time correspondence, the fault recovery time of the historical exception log belonging to the target fault type is obtained as the waiting recovery time, and the time correspondence includes the correspondence between the historical fault type and the fault recovery time of the historical exception log belonging to the historical fault type; the time correspondence is determined at least based on the historical log.

[0137] Optionally, it also includes:

[0138] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the fault recovery time of the historical abnormal log belonging to the target fault type in the time correspondence is shortened.

[0139] Optionally, it also includes:

[0140] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the number of abnormal times is cleared;

[0141] If the number of abnormalities is not less than 2 when the first timing time reaches the first preset time, the number of abnormalities is cleared.

[0142] The embodiment of the present application further provides a readable storage medium, which can store a computer program suitable for execution by a processor. When the computer program is executed by the processor, the steps of a method for generating alarm information provided by the embodiment of the present application are implemented as follows:

[0143] A method for generating alarm information, comprising:

[0144] In response to receiving the log, updating the number of exceptions, where the number of exceptions is the number of times the exception logs are received consecutively;

[0145] If the number of exceptions is not equal to 0 when the first timing time reaches the first preset time, the waiting recovery time is obtained at least according to the historical log; the first timing time indicates the length of time for continuously receiving the exception logs, and the first preset time indicates the shortest length of time required for the webpage to execute the preset event;

[0146] If the second timing time reaches the waiting recovery time, and within the time period indicated by the second timing time, all the logs received are abnormal logs, an alarm message is generated; the second timing time indicates the length of time until the target time, and the target time is the time when the first timing time reaches the first preset time.

[0147] Optionally, the update exception times include:

[0148] Determine whether the log is an abnormal log;

[0149] If yes, add 1 to the number of abnormalities;

[0150] If not, the number of abnormalities is cleared.

[0151] Optionally, the event includes a webpage update, and the process of obtaining the first preset time includes:

[0152] Determining an initial value of the first preset time according to an update frequency of the webpage update;

[0153] In response to the log being not an abnormal log, shortening the first preset time;

[0154] In response to the first timing time reaching the first preset time and the number of abnormalities being equal to 1, the first preset time is extended.

[0155] Optionally, the waiting recovery time is obtained based on at least the historical logs, including:

[0156] According to a preset fault type probability distribution, a current fault type is obtained, wherein the fault type probability distribution includes a preset fault type and an occurrence probability of the fault type, wherein the current fault type is a fault type to which an abnormal log received within a time period indicated by the first timing time belongs, and the fault type probability distribution is determined at least according to the historical log;

[0157] According to a preset time correspondence, the fault recovery time of the historical exception log belonging to the target fault type is obtained as the waiting recovery time, and the time correspondence includes the correspondence between the historical fault type and the fault recovery time of the historical exception log belonging to the historical fault type; the time correspondence is determined at least based on the historical log.

[0158] Optionally, it also includes:

[0159] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the fault recovery time of the historical abnormal log belonging to the target fault type in the time correspondence is shortened.

[0160] Optionally, it also includes:

[0161] If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the number of abnormal times is cleared;

[0162] If the number of abnormalities is not less than 2 when the first timing time reaches the first preset time, the number of abnormalities is cleared.

[0163] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0164] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0165] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating alarm information, characterized in that: include: In response to receiving the log, updating the number of exceptions, where the number of exceptions is the number of times the exception logs are received consecutively; If the number of exceptions is not equal to 0 when the first timing time reaches the first preset time, the waiting recovery time is obtained at least according to the historical log; the first timing time indicates the length of time for continuously receiving the exception logs, and the first preset time indicates the shortest length of time required for the webpage to execute the preset event; If the second timing time reaches the waiting recovery time, all the logs received in the time period indicated by the second timing time are abnormal logs, and an alarm message is generated; the second timing time indicates the time from the target time, and the target time is the time when the first timing time reaches the first preset time; The abnormal update times include: Determine whether the log is an abnormal log; If yes, add 1 to the number of abnormalities; If not, clear the number of abnormalities; The event includes a webpage update, and the process of obtaining the first preset time includes: Determining an initial value of the first preset time according to an update frequency of the webpage update; In response to the log being not an abnormal log, shortening the first preset time; In response to the first timing time reaching the first preset time and the number of abnormalities being equal to 1, extending the first preset time; The step of obtaining the waiting recovery time at least based on the historical logs includes: According to a preset fault type probability distribution, a current fault type is obtained, wherein the fault type probability distribution includes a preset fault type and an occurrence probability of the fault type, wherein the current fault type is a fault type to which an abnormal log received within a time period indicated by the first timing time belongs, and the fault type probability distribution is determined at least according to the historical log; According to a preset time correspondence, the fault recovery time of the historical exception log belonging to the target fault type is obtained as the waiting recovery time, and the time correspondence includes the correspondence between the historical fault type and the fault recovery time of the historical exception log belonging to the historical fault type; the time correspondence is determined at least based on the historical log.

2. The method according to claim 1, characterized in that Also includes: If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the fault recovery time of the historical abnormal log belonging to the target fault type in the time correspondence is shortened.

3. The method according to claim 1, characterized in that Also includes: If the second timing time does not reach the waiting recovery time, the received log is not an abnormal log, and the number of abnormal times is cleared; If the number of abnormalities is not less than 2 when the first timing time reaches the first preset time, the number of abnormalities is cleared.

4. A device for generating alarm information, characterized in that: include: A times acquisition module, used for updating the number of exceptions in response to receiving a log, wherein the number of exceptions is the number of times the exception log is received continuously, and the exception log includes empty data and / or error data; A recovery time acquisition module, configured to acquire the waiting recovery time at least based on the historical log if the number of exceptions is not equal to 0 when the first timing time reaches the first preset time; the first timing time indicates the duration of continuously receiving the exception logs, and the first preset time indicates the shortest duration required for the webpage to execute the preset event; An alarm module, for generating an alarm message if the second timing time reaches the waiting recovery time and the logs received in the time period indicated by the second timing time are all abnormal logs; the second timing time indicates the time from the target time, and the target time is the time when the first timing time reaches the first preset time; The number acquisition module is used to update the number of exceptions in response to receiving the log, including: the number acquisition module is specifically used to: Determine whether the log is an abnormal log; If yes, add 1 to the number of abnormalities; If not, clear the number of abnormalities; The event includes a webpage update, and the process of obtaining the first preset time includes: Determining an initial value of the first preset time according to an update frequency of the webpage update; In response to the log being not an abnormal log, shortening the first preset time; In response to the first timing time reaching the first preset time and the number of abnormalities being equal to 1, extending the first preset time; The recovery time acquisition module acquires the waiting recovery time at least based on the historical log, including: According to a preset fault type probability distribution, a current fault type is obtained, wherein the fault type probability distribution includes a preset fault type and an occurrence probability of the fault type, wherein the current fault type is a fault type to which an abnormal log received within a time period indicated by the first timing time belongs, and the fault type probability distribution is determined at least according to the historical log; According to a preset time correspondence, the fault recovery time of the historical exception log belonging to the target fault type is obtained as the waiting recovery time, and the time correspondence includes the correspondence between the historical fault type and the fault recovery time of the historical exception log belonging to the historical fault type; the time correspondence is determined at least based on the historical log.

5. A device for generating alarm information, characterized in that: include: Memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the method for generating alarm information according to any one of claims 1 to 3.

6. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, each step of the method for generating alarm information according to any one of claims 1 to 3 is implemented.

Images