Fault stop loss method and device

Abstract

The present application discloses a fault stop-loss method and device. The stop-loss model can provide stop-loss measures adapted to the newly discovered fault based on the input newly discovered fault and the aforementioned mapping relationship, and form a list of candidate stop-loss measures. In the present application, the stop-loss measures in the candidate stop-loss measures list are sorted based on the business impact analysis results and the collected fault context features to obtain a sorted stop-loss measures list. The sorted new list provides preferred stop-loss measures for the current newly discovered fault. Calling the execution strategy corresponding to the stop-loss measures recommended in the sorted stop-loss measures list to stop the newly discovered fault can effectively reduce the impact of the fault on the business. The stop-loss for newly discovered faults has certain flexibility and versatility. The rich mapping relationships provided by the stop-loss model provide a variety of candidate stop-loss measures for newly discovered faults. The fault stop-loss coverage is strong, and it can achieve more timely and rapid stop-loss, thereby preventing the business impact from further aggravating.

Description

Technical Field

[0001] The present application relates to the field of fault detection and operation and maintenance technology, and in particular to a fault loss prevention method and device. Background Art

[0002] With the popularization of microservices and distributed architecture, the cloudification of information technology (IT) infrastructure, and the rapid iterative development of business scenarios, IT architecture and IT environment have undergone profound changes. Various emerging technologies have greatly increased the complexity of IT systems while promoting business development, and emergency response to faults is facing increasing pressure.

[0003] At present, Internet, finance, electricity, communications and other related enterprises are deploying intelligent operation and maintenance (AIOps) and site reliability engineering (SRE) related technologies in order to quickly discover and handle faults. AIOps uses artificial intelligence technology to solve problems in operation and maintenance based on the operation and maintenance data generated by the operation of IT systems, such as transaction monitoring data, logs, configurations, etc., and further improve the availability of the system. At present, common application scenarios include anomaly detection, alarm convergence, fault diagnosis, fault prediction, fault self-healing, capacity planning, etc. Whether it is traditional operation and maintenance or intelligent operation and maintenance, fault self-healing is one of the core issues that are being addressed. At present, mainstream fault self-healing generally includes three steps, namely fault discovery (timely and accurate fault discovery), fault diagnosis (timely and accurate diagnosis of the root cause of the fault), and fault handling (automatic handling and recovery based on the fault phenomenon or inferred root cause). The core is that the root cause of the current fault must be clarified first, and then the self-healing solution is accurately matched one-to-one from the fault library.

[0004] In today's increasingly complex IT environment, the root causes of failures are endless and innumerable, and new root causes of failures continue to emerge, making it almost impossible to establish a complete matching model between the root cause of failure and the self-healing solution. In addition, the current self-healing solution has the following problems:

[0005] First, they only solve specific fault scenarios, such as distributed systems and databases, and are less effective for complex fault scenarios. Second, they can only solve known fault scenarios, either by building an expert system based on expert experience or by doing data mining based on previous event tickets. Fault self-healing basically involves matching stop-loss plans from the fault library. Third, the stop-loss plans that can be implemented are relatively simple and rely on the analysis of the root cause of the fault. They cannot be flexibly adapted to the characteristics of the fault site, nor do they have the ability to draw inferences from one example to deal with unknown scenarios that have certain similarities to existing scenarios.

[0006] Therefore, it is not only difficult to achieve fault self-healing based on the root cause of the fault, but also has poor universality. Therefore, in many scenarios, it is difficult to curb the impact of the fault on the business. Summary of the invention

[0007] Based on the above problems, the present application provides a fault loss prevention method and device to effectively reduce the impact of faults on business.

[0008] The embodiments of the present application disclose the following technical solutions:

[0009] In a first aspect, the present application provides a fault stop loss method, comprising:

[0010] Collect the fault symptoms of newly discovered faults;

[0011] Inputting the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault; the stop-loss model includes: a mapping relationship between known fault phenomena and stop-loss measures, wherein one known fault phenomenon corresponds to at least one stop-loss measure; and the list of candidate stop-loss measures includes at least one stop-loss measure;

[0012] The stop-loss measures in the candidate stop-loss measures list are sorted according to the business impact analysis results and the collected fault context features to obtain a sorted stop-loss measures list; the business impact analysis results include: the impact factor of the newly discovered fault on the business, and the potential impact factor of executing each stop-loss measure in the candidate stop-loss measures list on the business; the fault context features include: information on the impact on the execution of the stop-loss measures in the scenario of the newly discovered fault;

[0013] The execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list is called to perform stop-loss on the newly discovered fault.

[0014] Optionally, the collecting of fault phenomena of newly discovered faults includes:

[0015] Removing minor contents from all alarms in the current time window, and identifying alarms related to the newly discovered fault;

[0016] Generating an alarm summary of the newly discovered fault according to the related alarms of the newly discovered fault;

[0017] The fault phenomenon of the newly discovered fault is obtained according to the alarm summary; the fault phenomenon includes a set of normal and abnormal indicators that describe the scenario of the newly discovered fault.

[0018] Optionally, removing minor contents from all alarms in the current time window and identifying alarms related to the newly discovered fault includes:

[0019] Match all alarms in the current time window with the important alarm list, the high-frequency alarm list and the low-frequency alarm list respectively; the important alarm list is an alarm list maintained based on the experience of manual fault alarms; the high-frequency alarm list and the low-frequency alarm list are generated after analyzing the attributes and features of alarms extracted based on historical alarms, and the occurrence frequency of alarms in the high-frequency alarm list is higher than the occurrence frequency of alarms in the low-frequency alarm list;

[0020] For the alarms that successfully match the high-frequency alarm list among all the alarms, treat them as secondary content; and the alarms that successfully match the important alarm list or the low-frequency alarm list among all the alarms are treated as alarms that need attention;

[0021] The alarms requiring attention are clustered, and each formed cluster corresponds to a newly discovered fault.

[0022] Optionally, the mapping relationship between the known fault phenomenon and the stop-loss measure includes a weight function, and the value of the weight function represents the probability of implementing the stop-loss measure with the mapping relationship to restore the fault when the known fault phenomenon occurs;

[0023] The step of inputting the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault includes:

[0024] Obtaining the similarity between the fault phenomenon of the newly discovered fault and the known fault phenomenon in the stop-loss model;

[0025] Determine the known fault phenomenon in the stop-loss model that is most similar to the fault phenomenon of the newly discovered fault;

[0026] The stop-loss measures that have a mapping relationship with the known fault phenomenon with the highest similarity are included in the candidate stop-loss measures list, and the similarity corresponding to the known fault phenomenon with the highest similarity is multiplied by the weight function to obtain new weight values ​​corresponding to each stop-loss measure in the candidate stop-loss measures list.

[0027] Optionally, when calling the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list, the method further includes:

[0028] The fault site of the newly discovered fault is collected so that the root cause of the newly discovered fault can be analyzed according to the collected fault site after the fault is restored.

[0029] Optionally, each execution strategy is configured with an emergency stop strategy, which is used to start to suspend the stop loss operation or roll back the stop loss when the execution of the execution strategy causes the fault to continue to deteriorate.

[0030] Optionally, when stopping loss on the newly discovered fault, the method further includes:

[0031] Detecting the recovery status of the alarm set of the newly discovered fault to detect the recovery status of the newly discovered fault.

[0032] Optionally, the stop-loss model is a model that obtains a mapping relationship between the known fault phenomena and stop-loss measures based on expert experience and historical work order learning.

[0033] Optionally, the method further comprises:

[0034] Obtaining the user's selection result of the stop-loss measure in the sorted stop-loss measure list;

[0035] The calling of the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list specifically includes:

[0036] Call the execution strategy corresponding to the stop loss measure pointed to by the selection result.

[0037] Optionally, the method further comprises:

[0038] According to the ranking value of the stop-loss measure pointed to by the selection result in the sorted stop-loss measure list and the execution effect of the execution strategy corresponding to the stop-loss measure pointed to by the selection result, at least one of the following operations is performed:

[0039] Incrementally update the stop-loss model, or optimize the sorting algorithm of the stop-loss measures in the candidate stop-loss measures list.

[0040] A second aspect of the present application provides a fault loss prevention device, comprising:

[0041] A fault phenomenon collection module is used to collect the fault phenomena of newly discovered faults;

[0042] A list acquisition module, used for inputting the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault; the stop-loss model includes: a mapping relationship between known fault phenomena and stop-loss measures, wherein one known fault phenomenon corresponds to at least one stop-loss measure; the list of candidate stop-loss measures includes at least one stop-loss measure;

[0043] A sorting module is used to sort the stop-loss measures in the candidate stop-loss measures list according to the business impact analysis results and the collected fault context features to obtain a sorted stop-loss measures list; the business impact analysis results include: the impact factor of the newly discovered fault on the business, and the potential impact factor of executing each stop-loss measure in the candidate stop-loss measures list on the business; the fault context features include: information on the impact on the execution of the stop-loss measures in the scenario of the newly discovered fault;

[0044] The fault stop-loss module is used to call the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list to stop the loss of the newly discovered fault.

[0045] Optionally, the fault phenomenon collection module includes:

[0046] A screening unit, used to remove minor contents from all alarms in the current time window and identify alarms related to the newly discovered fault;

[0047] An alarm summary generating unit, configured to generate an alarm summary of the newly discovered fault according to the alarm related to the newly discovered fault;

[0048] A fault phenomenon collection unit is used to obtain the fault phenomenon of the newly discovered fault according to the alarm summary; the fault phenomenon includes a set of normal and abnormal indicators that describe the scenario of the newly discovered fault.

[0049] Optionally, the screening unit comprises:

[0050] The alarm matching subunit is used to match all the alarms in the current time window with the important alarm list, the high-frequency alarm list and the low-frequency alarm list respectively; the important alarm list is an alarm list maintained based on the experience of manual fault alarms; the high-frequency alarm list and the low-frequency alarm list are generated after analyzing the attributes and characteristics of the alarms extracted based on historical alarms, and the occurrence frequency of the alarms in the high-frequency alarm list is higher than the occurrence frequency of the alarms in the low-frequency alarm list;

[0051] A secondary content identification subunit is used to identify the alarms that successfully match the high-frequency alarm list among all the alarms as secondary content;

[0052] A concern content identification subunit, used for taking the alarms that successfully match the important alarm list or the low-frequency alarm list among all the alarms as alarms that need attention;

[0053] The alarm clustering subunit is used to cluster the alarms that need attention, and each cluster formed corresponds to a newly discovered fault.

[0054] Optionally, the mapping relationship between the known fault phenomenon and the stop-loss measure includes a weight function, and the value of the weight function represents the probability of implementing the stop-loss measure with the mapping relationship to restore the fault when the known fault phenomenon occurs;

[0055] The list acquisition module includes:

[0056] A similarity acquisition unit, used to obtain the similarity between the fault phenomenon of the newly discovered fault and the known fault phenomenon in the stop loss model;

[0057] A known fault phenomenon determination unit, used to determine a known fault phenomenon in the stop-loss model that has the highest similarity to the fault phenomenon of the newly discovered fault;

[0058] A list generating unit, configured to include the stop-loss measures having a mapping relationship with the known fault phenomenon with the highest similarity into the candidate stop-loss measures list;

[0059] The weight value acquisition unit is used to multiply the similarity corresponding to the known fault phenomenon with the highest similarity by the weight function to obtain a new weight value corresponding to each stop-loss measure in the candidate stop-loss measure list.

[0060] Optionally, the device further comprises:

[0061] A fault site collection module is used to collect the fault site of the newly discovered fault when calling the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list, so as to analyze the root cause of the newly discovered fault based on the collected fault site after the fault is recovered.

[0062] Optionally, each execution strategy is configured with an emergency stop strategy, and the device further includes: an emergency stop control module, which is used to activate the emergency stop strategy to suspend the stop loss operation or roll back the stop loss when the execution of the execution strategy causes the fault to continue to deteriorate.

[0063] Optionally, the device further comprises:

[0064] The fault recovery detection module is used to detect the recovery status of the alarm set of the newly discovered fault when stopping the loss of the newly discovered fault, so as to detect the recovery status of the newly discovered fault.

[0065] Optionally, the stop-loss model is a model that obtains a mapping relationship between the known fault phenomena and stop-loss measures based on expert experience and historical work order learning.

[0066] Optionally, the device further comprises:

[0067] A selection result confirmation module is used to obtain the user's selection result of the stop-loss measure in the sorted stop-loss measure list;

[0068] The fault stop-loss module is specifically used to call the execution strategy corresponding to the stop-loss measure pointed to by the selection result.

[0069] Optionally, the device further comprises:

[0070] The feedback learning module is used to perform at least one of the following operations according to the ranking value of the stop-loss measure pointed to by the selection result in the sorted stop-loss measure list and the execution effect of the execution strategy corresponding to the stop-loss measure pointed to by the selection result:

[0071] Incrementally update the stop-loss model, or optimize the sorting algorithm of the stop-loss measures in the candidate stop-loss measures list.

[0072] Compared with the prior art, this application has the following beneficial effects:

[0073] In the stop loss method provided in the embodiment of the present application, since the stop loss model contains a mapping relationship between known fault phenomena and stop loss measures, the stop loss model can provide stop loss measures adapted to the newly discovered fault based on the input newly discovered fault and the aforementioned mapping relationship, and form a list of candidate stop loss measures. In the present application, the stop loss measures in the candidate stop loss measure list are sorted based on the business impact analysis results and the collected fault context features to obtain a sorted list of stop loss measures. Therefore, the basis for sorting includes: the impact factor of the newly discovered fault on the business, the potential impact factor of each stop loss measure in the candidate stop loss measure list on the business, and the information that affects the execution of the stop loss measure in the scenario of the newly discovered fault. In this way, the new list obtained by sorting provides the preferred stop loss measures for the current newly discovered fault. Therefore, the execution strategy corresponding to the stop loss measure recommended in the sorted stop loss measure list is called to stop the newly discovered fault, which can effectively reduce the impact of the fault on the business. In addition, the method has certain flexibility and versatility for stopping the loss of newly discovered faults, and the rich mapping relationship provided by the stop loss model can provide a variety of candidate stop loss measures for newly discovered faults, and the coverage of fault stop loss is relatively strong. Therefore, compared with the fault self-healing solution in the existing technology, it can also stop the loss more promptly and quickly, and prevent the business impact from further aggravating. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0075] Figure 1A flowchart of a fault loss prevention method provided in an embodiment of the present application;

[0076] Figure 2 A schematic diagram of the mapping relationship between known fault phenomena and stop-loss measures in the stop-loss model provided in an embodiment of the present application;

[0077] Figure 3A A flowchart of another fault loss prevention method provided in an embodiment of the present application;

[0078] Figure 3B A flowchart of another fault loss prevention method provided in an embodiment of the present application;

[0079] Figure 4 A schematic diagram of the structure of a fault-stopping device provided in an embodiment of the present application;

[0080] Figure 5 A schematic structural diagram of another fault loss prevention device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] As described above, in the field of operation and maintenance, it is usually necessary to identify the root cause of the current fault after a fault occurs, and then accurately match the self-healing solution from the fault library one-to-one. The self-healing solution has the following problems: First, it only solves specific fault scenarios, and has poor effects on complex fault scenarios; second, it can only solve known fault scenarios; third, the stop loss solution provided is relatively simple, relying on the analysis of the root cause of the fault, and cannot be flexibly adapted according to the characteristics of the fault context, nor does it have the ability to draw inferences to deal with unknown scenarios that have certain similarities with existing scenarios. Therefore, self-healing is not only difficult, but also has poor versatility. In many scenarios, it is difficult to curb the impact of faults on the business.

[0082] For the above problems, it is urgent to provide a solution that effectively reduces the impact of failures on the business. To this end, the inventors have provided a method and device for stopping failures after research. This solution focuses on the rapid loss prevention of failures rather than self-healing of failures. The purpose is to establish a universal IT failure loss prevention solution, which not only solves failures that have occurred in history or can be covered by human experience, but also has a certain reasoning ability and can solve unknown scenarios that have certain similarities with known scenarios. In order to facilitate the understanding of the technical solution of this application, several terminologies involved in this solution are first explained:

[0083] Stop-loss model: The mapping relationship between fault phenomena and stop-loss measures generated based on expert experience and historical work order learning.

[0084] Fault context features: information that can affect stop-loss measures in real fault scenarios.

[0085] Fault phenomenon: A set of observed normal and abnormal indicators that can fully describe the fault scenario. In a broad sense, fault phenomenon includes the root cause of the fault.

[0086] Stop-loss measures: executable strategies that can initially alleviate or fundamentally resolve the current failure.

[0087] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0088] Method Embodiment

[0089] See also Figure 1 , which is a flow chart of a method for preventing losses due to a fault provided by an embodiment of the present application. Figure 1 As shown, the fail-stop methods include:

[0090] Step 101: Collect the fault symptoms of the newly discovered fault.

[0091] In an optional implementation, collecting the fault phenomenon of the newly discovered fault may include:

[0092] Remove minor content from all alarms in the current time window and identify the related alarms of the newly discovered fault. Then, generate an alarm summary of the newly discovered fault based on the related alarms of the newly discovered fault. Finally, obtain the fault phenomenon of the newly discovered fault based on the alarm summary. The fault phenomenon includes a set of normal and abnormal indicators that describe the scenario of the newly discovered fault. A fault phenomenon generally corresponds to multiple alarms, and the summary extracted from multiple related alarms corresponds to the fault information.

[0093] Before the above operations are implemented, an important alarm list, a high-frequency alarm list, and a low-frequency alarm list can be obtained in advance. These alarm lists are all non-instantiated. Instantiated refers to the actual occurrence with specific values, such as the success rate alarm of a certain object. Since the present embodiment only focuses on the success rate of this type of object, but does not focus on which specific object it is and what the specific success rate is. Therefore, a layer of abstraction will be made to form a non-instantiated alarm list. The important alarm list, the high-frequency alarm list, and the low-frequency alarm list are mainly used to filter and identify alarms within the time window. Among them, the important alarm list is an alarm list maintained based on the experience of artificial fault alarms. The high-frequency alarm list and the low-frequency alarm list are generated after analyzing the attributes and characteristics of the alarms extracted based on historical alarms. The frequency of occurrence of alarms in the high-frequency alarm list is higher than the frequency of occurrence of alarms in the low-frequency alarm list.

[0094] Frequently occurring alarms are usually not related to faults. Therefore, when identifying faults, it is necessary to make a judgment based on the matching of the alarm content with the important alarm list and the low-frequency alarm list. The high-frequency alarm list can be used to exclude alarms that are not suspected of faults.

[0095] Remove minor content from all alarms in the current time window and identify alarms related to the newly discovered fault, including:

[0096] All alarms in the current time window are matched with the important alarm list, the high-frequency alarm list, and the low-frequency alarm list. Among all the alarms, the alarms that successfully match the high-frequency alarm list are treated as secondary content. Among all the alarms, the alarms that successfully match the important alarm list or the low-frequency alarm list are treated as alarms that need attention. After the alarms that need attention are determined, the alarms that need attention are clustered, and each cluster formed corresponds to a newly discovered fault.

[0097] In an optional implementation, the similarity measurement of alarm clustering takes into account two factors: one is to mine the frequent patterns hidden in the alarm sequence through historical alarms and association rule analysis algorithm (FP-Growth), and the other is to perform similarity analysis on alarms based on semantics and association relationships (such as configuration relationships and call chains). Alarm clustering based on the above two factors improves the accuracy of clustering.

[0098] Step 102: Input the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault.

[0099] In an embodiment of the present application, the stop-loss model is obtained by pre-training before the execution of step 102. Specifically, it is a model that obtains the mapping relationship between known fault phenomena and stop-loss measures based on expert experience and historical work orders. In this solution, the work order refers to the record of the handling of the fault, including: the time of occurrence, the handling process, the cause of the fault, the stop-loss plan, the business impact, etc. The stop-loss model includes: the mapping relationship between known fault phenomena and stop-loss measures, wherein one known fault phenomenon corresponds to at least one stop-loss measure. In addition, different known fault phenomena may also correspond to the same stop-loss measures. Figure 2 The mapping relationship between known fault phenomena and stop-loss measures in the stop-loss model is exemplarily shown.

[0100] like Figure 2 As shown in the figure, fault phenomenon A corresponds to stop loss measure 1, fault phenomenon B corresponds to stop loss measure 1 and stop loss measure 2, fault phenomenon C corresponds to stop loss measure 2, and fault phenomenon D corresponds to stop loss measure 3. Of course, Figure 2 This is only an example, and the specific contents of the known fault phenomena and stop-loss measures in the stop-loss model are not limited here.

[0101] Fault phenomena are a set of observed normal and abnormal indicators that can fully describe the fault scenario, with abnormal indicators being the majority, and can include the root cause of the fault. Stop-loss measures are executable operations summarized by operation and maintenance personnel that can initially alleviate or fundamentally solve common faults, such as service restart, fault isolation, service switching, version rollback, backup and recovery, parameter modification, flow control, cluster expansion, service circuit breaking, and service degradation. In the stop-loss model, known fault phenomena and corresponding stop-loss measures are non-instantiated.

[0102] Figure 2 f(x) represents the mapping relationship between known fault phenomena and stop-loss measures, including a weight function. The value of the weight function represents the probability of implementing the stop-loss measures with the mapping relationship to restore the fault when the known fault phenomenon occurs. In other words, the higher the value of the weight function, the higher the probability that the stop-loss measures associated with the weight function can stop the corresponding fault; on the contrary, if the value of the weight function is lower, the lower the probability that the stop-loss measures associated with the weight function can stop the corresponding fault.

[0103] For example, the probability of fault phenomenon B in stop loss measure 1 is 0.8, and the probability in stop loss measure 2 is 0.5, which means that stop loss measure 1 has a higher probability of stopping loss for fault phenomenon B than stop loss measure 2.

[0104] It should be noted that the fault phenomenon of the newly discovered fault input into the stop-loss model in the embodiment of the present application does not need to completely match the known fault phenomenon in the stop-loss model, but the similarity between the two is calculated, and finally the similarity is multiplied into the aforementioned weight function. In this way, the stop-loss measures in the stop-loss model in the embodiment of the present application can solve unknown faults to a certain extent. The versatility and flexibility of this method are improved.

[0105] In specific implementation, as a possible implementation method, the fault phenomenon of the newly discovered fault is input into the stop loss model to obtain a list of candidate stop loss measures for the newly discovered fault, which may include:

[0106] Obtain the similarity between the fault phenomenon of the newly discovered fault and the known fault phenomenon in the stop-loss model. Determine the known fault phenomenon in the stop-loss model that has the highest similarity to the fault phenomenon of the newly discovered fault. Include the stop-loss measures that have a mapping relationship with the known fault phenomenon with the highest similarity in the list of candidate stop-loss measures, and multiply the similarity corresponding to the known fault phenomenon with the highest similarity by the weight function to obtain the new weight value corresponding to each stop-loss measure in the list of candidate stop-loss measures.

[0107] In the above example implementation, only the known fault phenomenon with the highest similarity to the fault phenomenon of the newly discovered fault in the stop-loss model is considered. Of course, in other implementations, multiple known fault phenomena with high similarity to the fault phenomenon of the newly discovered fault can also be referred to, and the similarity is multiplied by the weight function in a similar manner to the above, and several stop-loss measures with high product results are included in the candidate stop-loss measure list. In practical applications, the candidate stop-loss measure list usually includes at least one stop-loss measure.

[0108] Step 103: Sort the stop-loss measures in the candidate stop-loss measure list according to the business impact analysis result and the collected fault context features to obtain a sorted stop-loss measure list.

[0109] In the list of candidate stop-loss measures, in order to present more recommended stop-loss measures to the user, each stop-loss measure may be ranked by performing business impact analysis and fault context feature analysis.

[0110] In the embodiment of the present application, the business impact analysis results include: the impact factor of the newly discovered fault on the business, and the potential impact factor of executing each stop-loss measure in the candidate stop-loss measure list on the business. When sorting, the greater the impact factor of the newly discovered fault on the business, the more inclined to prioritize the measures that can stop the loss the fastest. In addition, it is also inclined to prioritize the stop-loss measures with the smallest potential impact factors.

[0111] Fault context features are not fault features, but include information that affects the execution of stop-loss measures in the scenario of a newly discovered fault. For example, the current business volume and CPU usage of the cluster determine the maximum number of services that can be restarted in the cluster at a time.

[0112] In a possible implementation, the ranking needs to build a stop-loss effect evaluation mechanism. The factors of the evaluation mechanism include the weight of the stop-loss measure, the correlation between the stop-loss measure's action object and the affected business, the redundancy of the stop-loss measure's action object, the complexity of the stop-loss measure, the business impact of the stop-loss measure, etc. The calculation of these factors should use the fault context features. The list of candidate stop-loss measures is sorted through the stop-loss effect evaluation mechanism, and the sorted list is recommended to the user, making it more convenient for the user to select the stop-loss measure and providing a more friendly interaction method.

[0113] In addition, in order to provide more options for users, in the sorted list of stop-loss measures, each stop-loss measure can be clicked to view the corresponding different fault scenarios in history. In this way, users can also select stop-loss measures by referring to the presented fault scenarios and the fault scenarios of the current newly discovered faults.

[0114] Step 104: Call the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list to perform stop-loss on the newly discovered fault.

[0115] Combined with the introduction above, based on the analysis of business impact and applause context features, the sorted stop-loss measures list presents recommended stop-loss measures for users to stop newly discovered faults. The stop-loss measures with higher ranking values ​​are recommended to users. Users can also make choices in the sorted stop-loss measures list based on the needs of the actual fault site and their own judgment of the fault.

[0116] Therefore, before executing this step, the user's selection result of the stop loss measure in the sorted stop loss measure list can also be obtained. In the embodiment of the present application, each stop loss measure corresponds to a specific execution strategy of the automation platform or cloud platform, so after determining the stop loss measure, the corresponding operation can be executed by passing parameters. For example, specifically restarting the corresponding service.

[0117] This step calls the execution strategy corresponding to the stop loss measure recommended in the sorted stop loss measure list, which may specifically include: calling the execution strategy corresponding to the stop loss measure pointed to by the selection result, and then realizing the stop loss of the newly discovered fault by calling the execution strategy.

[0118] In the fault stop loss method provided by the embodiment of the present application, since the stop loss model contains a mapping relationship between known fault phenomena and stop loss measures, the stop loss model can provide stop loss measures adapted to the newly discovered fault based on the input newly discovered fault and the aforementioned mapping relationship, and form a list of candidate stop loss measures. In the present application, the stop loss measures in the candidate stop loss measures list are also sorted based on the business impact analysis results and the collected fault context features to obtain a sorted list of stop loss measures. Therefore, the basis for sorting includes: the impact factor of the newly discovered fault on the business, the potential impact factor of executing each stop loss measure in the candidate stop loss measures list on the business, and the information that affects the execution of the stop loss measures in the scenario of the newly discovered fault. In this way, the new list obtained by sorting provides the preferred stop loss measures for the current newly discovered fault. Therefore, the execution strategy corresponding to the stop loss measures recommended in the sorted stop loss measures list is called to stop the newly discovered fault, which can effectively reduce the impact of the fault on the business.

[0119] In addition, this method has certain flexibility and versatility in stopping losses for newly discovered faults. The rich mapping relationships provided by the stop-loss model can provide a variety of candidate stop-loss measures for newly discovered faults, and the coverage of fault stop-loss is relatively strong. Therefore, compared with the fault self-healing solution in the existing technology, it can also stop losses more promptly and quickly, preventing the business impact from further aggravating.

[0120] The present application also provides another fault loss prevention method, and the implementation of this method is introduced below in conjunction with embodiments and drawings.

[0121] See also Figure 3A , which is a flow chart of another fault loss prevention method provided by an embodiment of the present application. Figure 3A The fail-stop methods shown include:

[0122] Step 301: Collect the fault symptoms of the newly discovered fault.

[0123] Step 302: Input the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault.

[0124] Step 303: Sort the stop-loss measures in the candidate stop-loss measure list according to the business impact analysis result and the collected fault context features to obtain a sorted stop-loss measure list.

[0125] Step 304: Call the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list to perform stop-loss on the newly discovered fault.

[0126] The implementation of the above steps 301 to 304 is substantially the same as the implementation of steps 101 to 104 in the aforementioned embodiment, so the relevant description may refer to the aforementioned embodiment and will not be repeated here.

[0127] In addition, while, before or after step 304 is executed, the following operation of step 305 may also be executed.

[0128] Step 305: Collect the fault site of the newly discovered fault so that the root cause of the newly discovered fault can be analyzed based on the collected fault site after the fault is restored.

[0129] The main purpose of collecting fault phenomena is to obtain as much information about the fault as possible. Alarm information can be considered as part of collecting the fault scene. Other operations for collecting the fault scene can also include some customized standard operations, such as the current capacity of the system, the CPU of the server, the stack information of Java, the error log, etc., which are executed by standard scripts.

[0130] In order to observe the recovery of the fault, confirm the stop-loss effect of the stop-loss measure on the newly discovered fault, and avoid the stop-loss measure from further worsening the impact of the fault on the business, when stopping the loss of the newly discovered fault, the following step 306 needs to be executed simultaneously.

[0131] Step 306: Detect the recovery status of the alarm set of the newly discovered fault to detect the recovery status of the newly discovered fault.

[0132] When the fault is gradually recovered, the corresponding alarm set can be reflected in the number and content of the alarms therein. Therefore, by detecting the recovery of the alarm set, it can be determined whether the newly discovered fault is effectively stopped by the stop-loss measures.

[0133] In the embodiment of the present application, the detection in step 306 may be continuous and uninterrupted, or may be performed at a fixed frequency or a variable frequency.

[0134] It should be noted that in the embodiment of the present application, each execution strategy corresponding to the stop loss measure is configured with an emergency stop strategy. Therefore, when the fault stop loss method provided in the embodiment of the present application is specifically executed, if the execution strategy corresponding to the stop loss measure is called to execute the stop loss, and it is found through detection that the executed strategy causes the fault to continue to deteriorate, the configured emergency stop strategy can be activated to suspend the stop loss operation or roll back the stop loss. In this way, the impact of the fault on the business continues to increase, causing unnecessary business losses.

[0135] In practical applications, each time a fault stop loss is performed using the method provided in the embodiment of the present application, the stop loss model can be learned and the sorting algorithm can be optimized based on the data generated during the period. The content of the sorting of the stop loss list has been introduced in the aforementioned embodiment and will not be repeated here. The sorting process can be specifically implemented by an algorithm.

[0136] In a possible embodiment, the following step 307 is performed.

[0137] Step 307: Based on the ranking value of the stop-loss measure pointed to by the user's selection result in the sorted stop-loss measure list, and the execution effect of the execution strategy corresponding to the stop-loss measure pointed to by the selection result, perform at least one of the following operations: incrementally update the stop-loss model, or optimize the sorting algorithm of the stop-loss measures in the candidate stop-loss measure list.

[0138] The ranking value of the stop-loss measure pointed to by the user's selection result in the sorted stop-loss measure list, and the execution effect of the execution strategy corresponding to the stop-loss measure pointed to by the selection result are both important feedback for the stop-loss of this fault. Through the execution of step 307, learning and summarizing based on user feedback are realized, and the stop-loss model and the sorting algorithm are continuously optimized, so that the stop-loss method of this embodiment can achieve better stop-loss effect when a new fault is discovered again in the future.

[0139] It should be noted that Figure 3A The illustrated example is only an exemplary sequence of steps 304 to 306. In practical applications, there is no limitation on the sequence of steps 304 to 306. For example, steps 304 to 306 may be executed simultaneously, or step 306 may be executed before step 305, or step 305 may be executed before step 304, etc.

[0140] Figure 3B A flowchart of another method of stopping loss due to failure is shown in FIG. Figure 3B In the stop loss method shown, alarm data is first obtained, and faults are discovered based on the alarm data. A list of candidate stop loss measures is obtained based on the fault phenomenon of the newly discovered fault using the stop loss model, which includes a variety of candidate stop loss measures provided for the newly discovered fault. Afterwards, a pre-written sorting function can be called, and multiple candidate stop loss measures can be sorted in combination with the collected fault context features and business impact analysis results to obtain a sorted list of stop loss measures.

[0141] Then, according to the sorted stop-loss measures list, the fault scene collection and stop-loss are performed. After the operation is performed, the fault recovery status (business impact elimination status or business recovery status) can be continuously detected. If the fault has not been recovered, the stop-loss operation will be continued. If it has been recovered, the on-site collection and stop-loss operation can be stopped. Finally, based on the handling results of the fault stop-loss, the stop-loss model and sorting algorithm can be updated.

[0142] Based on the fault loss prevention method described in the above embodiment, the present application also provides a fault loss prevention device. The specific implementation of the device is described below in conjunction with the embodiment.

[0143] Device Embodiment

[0144] See also Figure 4 , which is a schematic diagram of the structure of a fault loss prevention device provided in an embodiment of the present application. Figure 4 The fault stop device 40 shown includes:

[0145] The fault phenomenon collection module 401 is used to collect the fault phenomenon of the newly discovered fault;

[0146] The list acquisition module 402 is used to input the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault; the stop-loss model includes: a mapping relationship between known fault phenomena and stop-loss measures, wherein one known fault phenomenon corresponds to at least one stop-loss measure; and the list of candidate stop-loss measures includes at least one stop-loss measure;

[0147] The sorting module 403 is used to sort the stop-loss measures in the candidate stop-loss measures list according to the business impact analysis results and the collected fault context features to obtain a sorted stop-loss measures list; the business impact analysis results include: the impact factor of the newly discovered fault on the business, and the potential impact factor of executing each stop-loss measure in the candidate stop-loss measures list on the business; the fault context features include: information on the impact on the execution of the stop-loss measures in the scenario of the newly discovered fault;

[0148] The fault stop-loss module 404 is used to call the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list to stop the loss of the newly discovered fault.

[0149] Since the stop-loss model contains a mapping relationship between known fault phenomena and stop-loss measures, the stop-loss model can provide stop-loss measures adapted to the newly discovered faults based on the input newly discovered faults and the aforementioned mapping relationship, and form a list of candidate stop-loss measures. In the present application, the stop-loss measures in the candidate stop-loss measures list are sorted based on the business impact analysis results and the collected fault context features to obtain a sorted list of stop-loss measures. Therefore, the basis for sorting includes: the impact factor of the newly discovered fault on the business, the potential impact factor of each stop-loss measure in the candidate stop-loss measures list on the business, and the information that affects the execution of the stop-loss measures in the scenario of the newly discovered fault. In this way, the new list obtained by sorting provides the preferred stop-loss measures for the current newly discovered fault. Therefore, the execution strategy corresponding to the stop-loss measures recommended in the sorted stop-loss measures list is called to stop the newly discovered fault, which can effectively reduce the impact of the fault on the business. In addition, the device has certain flexibility and versatility for stopping the newly discovered fault, and the rich mapping relationship provided by the stop-loss model can provide a variety of candidate stop-loss measures for the newly discovered fault, and the coverage of the fault stop-loss is strong. Therefore, compared with the fault self-healing solution in the existing technology, it can also stop the loss more promptly and quickly, and prevent the business impact from further aggravating.

[0150] Optionally, the fault phenomenon collection module 401 includes:

[0151] A screening unit is used to remove minor contents from all alarms in the current time window and identify alarms related to newly discovered faults;

[0152] An alarm summary generating unit, used to generate an alarm summary of a newly discovered fault according to the related alarms of the newly discovered fault;

[0153] The fault phenomenon collection unit is used to obtain the fault phenomenon of the newly discovered fault according to the alarm summary; the fault phenomenon includes a set of normal and abnormal indicators that describe the scenario of the newly discovered fault.

[0154] Optionally, the screening unit comprises:

[0155] The alarm matching subunit is used to match all alarms in the current time window with the important alarm list, the high-frequency alarm list and the low-frequency alarm list respectively; the important alarm list is an alarm list maintained based on the experience of manual fault alarms; the high-frequency alarm list and the low-frequency alarm list are generated after analyzing the attributes and characteristics of alarms extracted from historical alarms, and the occurrence frequency of alarms in the high-frequency alarm list is higher than the occurrence frequency of alarms in the low-frequency alarm list;

[0156] The secondary content identification subunit is used to identify the alarms that successfully match the high-frequency alarm list among all the alarms as secondary content;

[0157] The attention content identification subunit is used to identify the alarms that successfully match the important alarm list or the low-frequency alarm list among all the alarms as the alarms that need attention;

[0158] The alarm clustering subunit is used to cluster alarms that require attention, and each cluster formed corresponds to a newly discovered fault.

[0159] Optionally, the mapping relationship between the known fault phenomenon and the stop-loss measure includes a weight function, and the value of the weight function represents the probability of implementing the stop-loss measure with the mapping relationship to restore the fault when the known fault phenomenon occurs;

[0160] The list acquisition module 402 includes:

[0161] A similarity acquisition unit, used to obtain the similarity between the fault phenomenon of the newly discovered fault and the known fault phenomenon in the stop loss model;

[0162] A known fault phenomenon determination unit, used to determine the known fault phenomenon in the stop loss model that has the highest similarity to the fault phenomenon of the newly discovered fault;

[0163] A list generating unit, used for listing the stop loss measures having a mapping relationship with the known fault phenomenon with the highest similarity into the candidate stop loss measures list;

[0164] The weight value acquisition unit is used to multiply the similarity corresponding to the known fault phenomenon with the highest similarity by the weight function to obtain a new weight value corresponding to each stop-loss measure in the candidate stop-loss measure list.

[0165] The present application also provides another fault-prevention device 50, see Figure 5 The fault loss prevention device 50 includes not only the modules in the fault loss prevention device 40, but also further includes:

[0166] The fault scene collection module 501 is used to collect the fault scene of the newly discovered fault when calling the execution strategy corresponding to the stop loss measure recommended in the sorted stop loss measure list, so as to analyze the root cause of the newly discovered fault according to the collected fault scene after the fault is recovered.

[0167] Optionally, each execution strategy is configured with an emergency stop strategy, and the fault stop loss device 50 further includes: an emergency stop control module 502, which is used to activate the emergency stop strategy to suspend the stop loss operation or roll back the stop loss when the fault continues to deteriorate after the execution of the execution strategy.

[0168] Optionally, the fault loss prevention device 50 further includes:

[0169] The fault recovery detection module 503 is used to detect the recovery status of the alarm set of the newly discovered fault when stopping the loss of the newly discovered fault, so as to detect the recovery status of the newly discovered fault.

[0170] Optionally, the fault loss prevention device 50 further includes: a model training module 504, which is used to obtain a model of the mapping relationship between known fault phenomena and loss prevention measures as a fault loss prevention model based on expert experience and historical work order learning.

[0171] Optionally, the fault loss prevention device 50 further includes:

[0172] A selection result confirmation module 505 is used to obtain the user's selection result of the stop-loss measure in the sorted stop-loss measure list;

[0173] The fault stop-loss module 404 is specifically used to call the execution strategy corresponding to the stop-loss measure pointed to by the selection result.

[0174] Optionally, the fault loss prevention device 50 further includes:

[0175] The feedback learning module 506 is used to perform at least one of the following operations according to the ranking value of the stop-loss measure pointed to by the selection result in the sorted stop-loss measure list and the execution effect of the execution strategy corresponding to the stop-loss measure pointed to by the selection result:

[0176] Incrementally update the stop-loss model, or optimize the sorting algorithm of stop-loss measures in the list of candidate stop-loss measures.

[0177] The fault loss prevention device described in the above embodiment focuses on the rapid loss prevention of faults rather than self-healing of faults, and establishes a universal IT fault loss prevention solution, which not only solves faults that have occurred in history or can be covered by human experience, but also has a certain reasoning ability, and can solve unknown scenarios that have certain similarities with existing scenarios. In addition, through the setting of the feedback learning module 506, it is also possible to continuously learn and summarize according to user feedback to optimize the effect of fault loss prevention.

[0178] It should be noted that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0179] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for stopping loss due to a fault, characterized in that: include: Collect the fault symptoms of newly discovered faults; Inputting the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault; The stop-loss model includes: a mapping relationship between known fault phenomena and stop-loss measures, wherein one known fault phenomenon corresponds to at least one stop-loss measure; the candidate stop-loss measure list includes at least one stop-loss measure; The stop-loss measures in the candidate stop-loss measures list are sorted according to the business impact analysis results and the collected fault context features to obtain a sorted stop-loss measures list; the business impact analysis results include: the impact factor of the newly discovered fault on the business, and the potential impact factor of executing each stop-loss measure in the candidate stop-loss measures list on the business; the fault context features include: information on the impact on the execution of the stop-loss measures in the scenario of the newly discovered fault; Calling the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list to stop the loss of the newly discovered fault; The collection of the fault phenomenon of the newly discovered fault includes: Removing minor contents from all alarms in the current time window, and identifying alarms related to the newly discovered fault; Generating an alarm summary of the newly discovered fault according to the related alarms of the newly discovered fault; Obtaining the fault phenomenon of the newly discovered fault according to the alarm summary; the fault phenomenon includes a set of normal and abnormal indicators that describe the scenario of the newly discovered fault; The removing of minor contents from all alarms in the current time window and identifying alarms related to the newly discovered fault include: Match all alarms in the current time window with the important alarm list, the high-frequency alarm list and the low-frequency alarm list respectively; the important alarm list is an alarm list maintained based on the experience of manual fault alarms; the high-frequency alarm list and the low-frequency alarm list are generated after analyzing the attributes and features of alarms extracted based on historical alarms, and the occurrence frequency of alarms in the high-frequency alarm list is higher than the occurrence frequency of alarms in the low-frequency alarm list; For the alarms that successfully match the high-frequency alarm list among all the alarms, treat them as secondary content; and the alarms that successfully match the important alarm list or the low-frequency alarm list among all the alarms are treated as alarms that need attention; The alarms requiring attention are clustered, and each formed cluster corresponds to a newly discovered fault.

2. The method according to claim 1, characterized in that The mapping relationship between the known fault phenomenon and the stop-loss measure includes a weight function, the value of which represents the probability of implementing the stop-loss measure with the mapping relationship to restore the fault when the known fault phenomenon occurs; The step of inputting the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault includes: Obtaining the similarity between the fault phenomenon of the newly discovered fault and the known fault phenomenon in the stop-loss model; Determine the known fault phenomenon in the stop-loss model that is most similar to the fault phenomenon of the newly discovered fault; The stop-loss measures that have a mapping relationship with the known fault phenomenon with the highest similarity are included in the candidate stop-loss measures list, and the similarity corresponding to the known fault phenomenon with the highest similarity is multiplied by the weight function to obtain new weight values ​​corresponding to each stop-loss measure in the candidate stop-loss measures list.

3. The method according to claim 1, characterized in that When calling the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list, the method further includes: The fault site of the newly discovered fault is collected so that the root cause of the newly discovered fault can be analyzed according to the collected fault site after the fault is restored.

4. The method according to claim 1, characterized in that: Each execution strategy is configured with an emergency stop strategy, which is used to start to suspend the stop loss operation or roll back the stop loss when the execution of the execution strategy causes the fault to continue to deteriorate.

5. The method according to claim 1, characterized in that When stopping loss on the newly discovered fault, the method further includes: Detecting the recovery status of the alarm set of the newly discovered fault to detect the recovery status of the newly discovered fault.

6. The method according to claim 1, characterized in that The stop-loss model is a model that obtains the mapping relationship between the known fault phenomena and the stop-loss measures based on expert experience and historical work order learning.

7. The method according to claim 1, characterized in that Also includes: Obtaining the user's selection result of the stop-loss measure in the sorted stop-loss measure list; The calling of the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list specifically includes: Call the execution strategy corresponding to the stop loss measure pointed to by the selection result.

8. The method according to claim 7, characterized in that Also includes: According to the ranking value of the stop-loss measure pointed to by the selection result in the sorted stop-loss measure list and the execution effect of the execution strategy corresponding to the stop-loss measure pointed to by the selection result, at least one of the following operations is performed: Incrementally update the stop-loss model, or optimize the sorting algorithm of the stop-loss measures in the candidate stop-loss measures list.

9. A fault stop loss device, characterized in that: include: A fault phenomenon collection module is used to collect the fault phenomena of newly discovered faults; A list acquisition module, used for inputting the fault phenomenon of the newly discovered fault into the stop-loss model to obtain a list of candidate stop-loss measures for the newly discovered fault; The stop-loss model includes: a mapping relationship between known fault phenomena and stop-loss measures, wherein one known fault phenomenon corresponds to at least one stop-loss measure; the candidate stop-loss measure list includes at least one stop-loss measure; A sorting module is used to sort the stop-loss measures in the candidate stop-loss measures list according to the business impact analysis results and the collected fault context features to obtain a sorted stop-loss measures list; the business impact analysis results include: the impact factor of the newly discovered fault on the business, and the potential impact factor of executing each stop-loss measure in the candidate stop-loss measures list on the business; the fault context features include: information on the impact on the execution of the stop-loss measures in the scenario of the newly discovered fault; A fault stop-loss module is used to call the execution strategy corresponding to the stop-loss measure recommended in the sorted stop-loss measure list to stop the loss of the newly discovered fault; The fault phenomenon collection module includes: A screening unit is used to remove minor contents from all alarms in the current time window and identify alarms related to newly discovered faults; An alarm summary generating unit, used to generate an alarm summary of a newly discovered fault according to the related alarms of the newly discovered fault; A fault phenomenon collection unit is used to obtain the fault phenomenon of the newly discovered fault according to the alarm summary; the fault phenomenon includes a set of normal and abnormal indicators that describe the scenario of the newly discovered fault; The screening unit comprises: The alarm matching subunit is used to match all alarms in the current time window with the important alarm list, the high-frequency alarm list and the low-frequency alarm list respectively; the important alarm list is an alarm list maintained based on the experience of manual fault alarms; the high-frequency alarm list and the low-frequency alarm list are generated after analyzing the attributes and characteristics of alarms extracted from historical alarms, and the occurrence frequency of alarms in the high-frequency alarm list is higher than the occurrence frequency of alarms in the low-frequency alarm list; The secondary content identification subunit is used to identify the alarms that successfully match the high-frequency alarm list among all the alarms as secondary content; The attention content identification subunit is used to identify the alarms that successfully match the important alarm list or the low-frequency alarm list among all the alarms as the alarms that need attention; The alarm clustering subunit is used to cluster alarms that require attention, and each cluster formed corresponds to a newly discovered fault.

Images