Alarm analysis method and device

Abstract

The present invention provides an alarm analysis method and device, the method comprising: determining the call chain corresponding to the transaction alarm when a transaction alarm is detected in the system; analyzing the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is the call chain abnormal root cause alarm; if so, sending the alarm information corresponding to the transaction alarm to the operation and maintenance personnel; if not, determining whether the alarm number of consecutive transaction alarms in the system is greater than or equal to the alarm threshold, and sending the alarm information corresponding to the transaction alarm to the operation and maintenance personnel when it is greater than or equal to the alarm threshold. By analyzing the transaction alarm, when the alarm type of the transaction alarm is a preset alarm type, or the alarm number of consecutive transaction alarms in the system is greater than or equal to the alarm threshold, sending the alarm information to the operation and maintenance personnel, reducing the number of system alarms, reducing the attention and workload of the operation and maintenance personnel to the system, and improving the work efficiency of the operation and maintenance personnel.

Description

Technical Field

[0001] The present invention relates to the field of alarm technology, and in particular to an alarm analysis method and device. Background Art

[0002] With the widespread application of distributed architecture, the monitoring technology of call chain during online transactions has been widely used. The call chain means that in a distributed system, a user's online transaction request will be processed in sequence by different service nodes, and then returned to the user after processing. These sequential calling processes constitute the call chain.

[0003] Monitoring the call chain can timely understand the transaction status. Usually, an alarm will be issued when an abnormality occurs in the transaction, but some abnormalities do not need to be issued as soon as they occur. The method of immediately issuing an alarm when an abnormality occurs will increase the number of system alarms, requiring operation and maintenance personnel to pay a lot of attention to the system, increasing their workload and reducing their work efficiency. Summary of the invention

[0004] In view of this, the present invention provides an alarm analysis method and device, which can effectively reduce the number of system alarms, avoid false alarms from the system, reduce the attention and work continuity of operation and maintenance personnel, and reduce the work efficiency of operation and maintenance personnel.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] The first aspect of the present application discloses an alarm analysis method, comprising:

[0007] In the case where a transaction alarm is detected in the system, determining a call chain corresponding to the transaction alarm;

[0008] Analyze the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm;

[0009] When it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, an alarm prompt information corresponding to the transaction alarm is sent to the operation and maintenance personnel;

[0010] When it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, it is determined whether the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to the alarm threshold, an alarm prompt message corresponding to the transaction alarm is sent to the operation and maintenance personnel.

[0011] In the above method, optionally, the determining the call chain corresponding to the transaction alarm includes:

[0012] Parsing the transaction alert to obtain a transaction identifier in the transaction alert;

[0013] Determining in the system a business corresponding to the transaction identifier;

[0014] The call chain of the business is determined as the call chain corresponding to the transaction alarm.

[0015] The above method, optionally, analyzing the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm, includes:

[0016] Based on the abnormal indicator information, determine each monitoring indicator of the call chain;

[0017] Obtaining the warning information in the transaction warning;

[0018] Compare the alarm information with each of the monitoring indicators to determine whether there is a monitoring indicator corresponding to the alarm information among the monitoring indicators;

[0019] If there is a monitoring indicator corresponding to the alarm information among the monitoring indicators, determining that the alarm type of the transaction alarm is a call chain abnormality root cause alarm;

[0020] If there is no monitoring indicator corresponding to the alarm information among the monitoring indicators, it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm.

[0021] In the above method, optionally, determining whether the number of consecutive transaction alarms generated by the system is greater than or equal to a preset alarm threshold includes:

[0022] Determine an alarm record in the system, and determine the number of consecutive alarms of the transaction alarm in the system based on the alarm record;

[0023] The alarm number is compared with the alarm threshold to determine whether the alarm number is greater than or equal to the alarm threshold.

[0024] The above method may optionally further include:

[0025] When the alarm number is not greater than or equal to the alarm threshold, the operation and maintenance personnel are prohibited from sending alarm information corresponding to the transaction alarm.

[0026] The second aspect of the present application discloses an alarm analysis device, comprising:

[0027] A determination unit, configured to determine a call chain corresponding to a transaction alarm when a transaction alarm is detected in the system;

[0028] An analyzing unit, configured to analyze the transaction alarm based on the abnormal indicator information of the call chain, and determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm;

[0029] A first sending unit is used to send an alarm prompt information corresponding to the transaction alarm to an operation and maintenance personnel when determining that the alarm type of the transaction alarm is a call chain abnormality root cause alarm;

[0030] The second sending unit is used to determine whether the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to a preset alarm threshold when it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, and to send an alarm prompt information corresponding to the transaction alarm to the operation and maintenance personnel when it is determined that the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to the alarm threshold.

[0031] In the above device, optionally, the determining unit includes:

[0032] A parsing subunit, used to parse the transaction alarm and obtain a transaction identifier in the transaction alarm;

[0033] A first determining subunit, configured to determine a service corresponding to the transaction identifier in the system;

[0034] The second determining subunit is used to determine the call chain of the business as the call chain corresponding to the transaction alarm.

[0035] In the above device, optionally, the analysis unit comprises:

[0036] A third determining subunit, configured to determine each monitoring indicator of the call chain based on the abnormal indicator information;

[0037] An acquisition subunit, used for acquiring the alarm information in the transaction alarm;

[0038] A comparison subunit, used to compare the alarm information with each of the monitoring indicators to determine whether there is a monitoring indicator corresponding to the alarm information among the monitoring indicators;

[0039] A fourth determining subunit is configured to determine that the alarm type of the transaction alarm is a call chain abnormality root cause alarm if there is a monitoring indicator corresponding to the alarm information among the monitoring indicators;

[0040] The fifth determining subunit is used to determine that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm if there is no monitoring indicator corresponding to the alarm information among the monitoring indicators.

[0041] In the above device, optionally, the second sending unit includes:

[0042] a sixth determining subunit, configured to determine an alarm record in the system, and determine the number of consecutive alarms of the transaction alarm occurring in the system based on the alarm record;

[0043] The judging subunit is used to compare the alarm number with the alarm threshold to judge whether the alarm number is greater than or equal to the alarm threshold.

[0044] The above device may optionally further include:

[0045] The prohibition unit is used to prohibit the operation and maintenance personnel from sending the alarm information corresponding to the transaction alarm when the alarm number is not greater than or equal to the alarm threshold.

[0046] Compared with the prior art, the present invention has the following advantages:

[0047] The present invention provides an alarm analysis method and device, the method comprising: in the case of monitoring a transaction alarm of a system, determining a call chain corresponding to the transaction alarm; analyzing the transaction alarm based on abnormal indicator information of the call chain, and determining whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm; when it is determined that the alarm type of the transaction alarm is a call chain abnormal root cause alarm, sending alarm information corresponding to the transaction alarm to operation and maintenance personnel; when it is determined that the alarm type of the transaction alarm is not a call chain abnormal root cause alarm, determining whether the number of alarms of transaction alarms occurring continuously in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of alarms of transaction alarms occurring continuously in the system is greater than or equal to the alarm threshold, sending alarm information corresponding to the transaction alarm to the operation and maintenance personnel. The present invention analyzes the transaction alarm, and when the alarm type of the transaction alarm is a preset alarm type, sends an alarm message to the operation and maintenance personnel; when the alarm type of the transaction alarm is not the corresponding alarm type, and the number of consecutive transaction alarms in the system is greater than or equal to the preset alarm threshold, sends an alarm message to the operation and maintenance personnel, thereby effectively reducing the number of times the system alarms the operation and maintenance personnel, thereby reducing the operation and maintenance personnel's attention to the system, reducing the operation and maintenance personnel's workload, and improving the operation and maintenance personnel's work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0049] Figure 1 A method flow chart of an alarm analysis method provided by an embodiment of the present invention;

[0050] Figure 2 Another method flow chart of an alarm analysis method provided by an embodiment of the present invention;

[0051] Figure 3 Another method flow chart of an alarm analysis method provided by an embodiment of the present invention;

[0052] Figure 4 A flowchart of another method of an alarm analysis method provided by an embodiment of the present invention;

[0053] Figure 5 A schematic diagram of the structure of an alarm analysis device provided by an embodiment of the present invention;

[0054] Figure 6 A schematic diagram of the structure of an electronic medium provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0057] The present invention can be used in many general or special computing device environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor devices, distributed computing environments including any of the above devices or devices, etc. The execution subject of the present invention can be a processor or a server in a distributed system. Specifically, the distributed system in the present invention is specifically a banking system.

[0058] Reference Figure 1 , is a method flow chart of an alarm analysis method provided by an embodiment of the present invention, and is specifically described as follows:

[0059] S101. When a transaction alarm is detected in the system, a call chain corresponding to the transaction alarm is determined.

[0060] A monitoring module for monitoring the occurrence of transaction alarms in the monitoring system is provided in the distributed system. The module monitors the system in real time whether a transaction alarm occurs.

[0061] The system provides multiple services, and different services correspond to different call chains. Therefore, the system contains multiple call chains. When a transaction alarm is detected in the system, it is necessary to determine the call chain corresponding to the transaction alarm.

[0062] Reference Figure 2 , is a flow chart of a method for determining a call corresponding to a transaction alert provided by another embodiment of the present invention, and is specifically described as follows:

[0063] S201. Analyze the transaction alarm and obtain the transaction identifier in the transaction alarm.

[0064] The transaction ID is unique. In addition to the transaction ID, the transaction alarm also includes the alarm time, transaction duration, transaction request time, transaction response time, etc. The transaction ID is used to determine the specific business to which the transaction alarm belongs.

[0065] S202: Determine the business corresponding to the transaction identifier in the system.

[0066] Determine the business ID of each business in the system, compare each business ID with the transaction ID, and determine the business to which the business ID consistent with the transaction ID belongs as the business corresponding to the transaction ID. In other words, the business to which the business ID consistent with the transaction ID belongs is the business corresponding to the transaction alarm.

[0067] S203: Determine the call chain of the business as the call chain corresponding to the transaction alarm.

[0068] Each business has a corresponding call chain, and the call chain of the business is determined as the call chain corresponding to the transaction alarm.

[0069] In the method provided by the embodiment of the present invention, the business corresponding to the transaction alarm is determined by using the transaction identifier, and the call chain of the business is used as the call chain corresponding to the transaction alarm; by using the transaction identifier, the call chain where the alarm occurs can be accurately determined among the massive call chains in the system, which provides a convenient and fast way for the system to determine the call chain leading to the alarm, thereby improving the work efficiency of the system.

[0070] S102. Analyze the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormality root cause alarm; if it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, execute S103; if it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, execute S104.

[0071] It should be noted that transaction alarms can be divided into two types, one is the call chain abnormality root cause alarm, and the other is the non-call chain abnormality root cause alarm. Among them, the alarm caused by the call chain abnormality root cause can be called the call chain abnormality root cause alarm. Furthermore, the root cause of the call chain abnormality is called the call chain abnormality root cause.

[0072] The content of the abnormal indicator information of different call chains is different, and the abnormal indicator information includes the information of the abnormal root cause of the call chain.

[0073] Reference Figure 3 , which is a flowchart of a method for analyzing a transaction alarm based on abnormal indicator information to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm, provided by another embodiment of the present invention, and is specifically described as follows:

[0074] S301. Determine various monitoring indicators of the call chain based on abnormal indicator information.

[0075] The abnormal indicator information is parsed to obtain various monitoring indicators of the call chain. Each monitoring indicator is an indicator of the call chain abnormal root cause of the call chain. The monitoring indicator can be used to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm.

[0076] Monitoring indicators include but are not limited to system service indicators, business logic indicators, etc., wherein the system service indicators include indicators of transaction errors caused by abnormalities in the system service itself, and the business logic indicators include indicators of transaction errors caused by business logic errors. Preferably, the system success rate and business success rate, etc. can also be determined based on the system service indicators, wherein when a transaction error caused by abnormalities in the system service itself occurs, the system power will be reduced; when a transaction is unsuccessful due to business logic, the business success rate will be reduced. Furthermore, the transaction unsuccessful due to business logic is specifically such as the transaction failure caused by insufficient balance when performing payment services.

[0077] The monitoring indicators are composed of information about the root causes of call chain anomalies. The monitoring indicators and the root causes of call chain anomalies correspond one to one. Each monitoring indicator contains information about the corresponding root cause of the call chain anomaly.

[0078] S302: Obtain alarm information in the transaction alarm.

[0079] Analyze the transaction alarm to obtain the alarm information in the transaction alarm, where the alarm information includes the reason for the transaction alarm, such as transaction response time timeout, transaction processing time timeout, transaction logic error, etc. The alarm information in the transaction alarm generates specific exception information based on the transaction when an exception occurs.

[0080] S303, compare the alarm information with each monitoring indicator to determine whether there is a monitoring indicator corresponding to the alarm information among the monitoring indicators; if there is a monitoring indicator corresponding to the alarm information among the monitoring indicators, execute S304; if there is no monitoring indicator corresponding to the alarm information among the monitoring indicators, execute S305.

[0081] The alarm information is compared with each monitoring indicator to determine whether there is a monitoring indicator corresponding to the alarm information in each monitoring indicator. Furthermore, when there is a monitoring indicator corresponding to the alarm information in each monitoring indicator, it is characterized that the alarm information contains information on the root cause of the abnormal call chain corresponding to the monitoring indicator, thereby determining that the transaction alarm is an abnormal alarm caused by the root cause of the call chain.

[0082] S304: Determine that the alarm type of the transaction alarm is a call chain abnormality root cause alarm.

[0083] S305: Determine that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm.

[0084] In the method provided by the embodiment of the present invention, based on the various monitoring indicators of the call chain, the alarm type of the transaction alarm can be accurately determined, and the corresponding operation can be performed based on the alarm type.

[0085] S103. Send an alarm prompt message corresponding to the transaction alarm to the operation and maintenance personnel.

[0086] When it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, the alarm prompt information corresponding to the transaction alarm can be directly sent to the operation and maintenance personnel so as to warn the operation and maintenance personnel.

[0087] Furthermore, when the alarm type of the transaction alarm is a call chain abnormality root cause alarm, it means that an abnormality has occurred in the fundamental service of the call chain, and the operation and maintenance personnel are required to perform corresponding maintenance. Therefore, once a call chain abnormality root cause alarm occurs, an alarm must be immediately sent to the operation and maintenance personnel.

[0088] S104, determining whether the number of consecutive transaction alarms of the system is greater than or equal to a preset alarm threshold; when it is determined that the number of consecutive transaction alarms of the system is greater than or equal to the alarm threshold, executing S103; when it is determined that the number of consecutive transaction alarms of the system is not greater than or equal to the alarm threshold, executing S105.

[0089] When it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, it means that there is no abnormality in the fundamental service of the call chain, and the abnormality is caused by other environmental factors, such as alarms caused by network interruptions. In order to improve the fault tolerance of the system, when a non-call chain abnormality root cause alarm occurs, it is necessary to determine whether the number of consecutive transaction alarms in the system is greater than or equal to the preset alarm threshold. When it is determined that the number of consecutive transaction alarms in the system is greater than or equal to the alarm threshold, the corresponding alarm prompt information is sent to the operation and maintenance personnel so that the operation and maintenance personnel can be alerted.

[0090] Furthermore, the purpose of alerting the operation and maintenance personnel only when the number of consecutive transaction alarms in the system is greater than or equal to the alarm threshold is to suppress the alarm. By suppressing the alarm, false alarms caused by instantaneous abnormal fluctuations in the system can be effectively reduced, thereby reducing the number of alarms.

[0091] Reference Figure 4 , is a flow chart of a method for determining whether the number of consecutive transaction alarms generated by the system is greater than or equal to a preset alarm threshold provided by another embodiment of the present invention, and is specifically described as follows:

[0092] S401. Determine an alarm record in the system, and determine the number of consecutive transaction alarms in the system based on the alarm record.

[0093] The alarm record in the system records the global alarm record of the system. The alarm record contains multiple logs. Each time an alarm occurs in the system, a corresponding log will be generated. The logs in the alarm record are arranged in chronological order according to the time when the alarm occurs. When determining the number of consecutive transaction alarms in the system through the alarm record, based on the current transaction alarm, a log queue corresponding to the current transaction alarm is determined in the alarm record, wherein the log queue contains at least one log, and the log queue contains the log of the current transaction alarm. The logs in the log queue are arranged consecutively in the alarm record, and the identifier of the alarm to which each log in the log queue belongs is the same as the identifier of the current transaction alarm; the number of logs in the log queue is the number of consecutive transaction alarms in the system; illustratively,

[0094] S402: Compare the alarm number with the alarm threshold to determine whether the alarm number is greater than or equal to the alarm threshold.

[0095] By comparing the number of alarms with the alarm threshold, it can be determined whether the number of alarms is greater than or equal to the alarm threshold. Specifically, the alarm threshold can be set according to actual needs, such as setting the alarm threshold to N, where N can be set to any positive integer.

[0096] The present invention can determine the number of consecutive alarms of the system through the alarm records of the system, and further determine whether it is necessary to send alarm prompt information to the operation and maintenance personnel based on the number of alarms.

[0097] S105. Operation and maintenance personnel are prohibited from sending alarm prompt information corresponding to transaction alarms.

[0098] In the method provided by the embodiment of the present invention, when a transaction alarm is monitored in the system, a call chain corresponding to the transaction alarm is determined; the transaction alarm is analyzed based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormality root cause alarm; when it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, alarm information corresponding to the transaction alarm is sent to operation and maintenance personnel; when it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, it is determined whether the number of consecutive transaction alarms in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of consecutive transaction alarms in the system is greater than or equal to the alarm threshold, alarm information corresponding to the transaction alarm is sent to the operation and maintenance personnel. The present invention analyzes the transaction alarm, and when the alarm type of the transaction alarm is a preset alarm type, sends an alarm message to the operation and maintenance personnel; when the alarm type of the transaction alarm is not the corresponding alarm type, and the number of consecutive transaction alarms in the system is greater than or equal to the preset alarm threshold, sends an alarm message to the operation and maintenance personnel, thereby effectively reducing the number of times the system alarms the operation and maintenance personnel, thereby reducing the operation and maintenance personnel's attention to the system, reducing the operation and maintenance personnel's workload, and improving the operation and maintenance personnel's work efficiency.

[0099] The present invention is based on the call chain root cause method. In the case of a non-call chain abnormal root cause alarm, an alarm can be issued to the operation and maintenance personnel when the number of alarms reaches a preset threshold, thereby effectively reducing the number of alarms, and there is no need to issue alarms on both the front end and the back end of the call chain, thereby solving the problem of repeated alarms caused by both the front end and the back end in the traditional alarm method, effectively reducing the manual attention of the operation and maintenance personnel, reducing the workload of the operation and maintenance personnel, and improving the work efficiency of the operation and maintenance personnel.

[0100] and Figure 1 Corresponding to the method shown in the figure, an embodiment of the present invention provides an alarm analysis device, which can be applied to a system of a distributed architecture to support Figure 1 The practical application of the method shown in Figure 5 , is a schematic diagram of the structure of the alarm analysis device provided by an embodiment of the present invention, and is specifically described as follows:

[0101] The determination unit 501 is used to determine the call chain corresponding to the transaction alarm when a transaction alarm is detected in the system;

[0102] An analyzing unit 502 is used to analyze the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm;

[0103] The first sending unit 503 is used to send an alarm prompt information corresponding to the transaction alarm to the operation and maintenance personnel when determining that the alarm type of the transaction alarm is a call chain abnormality root cause alarm;

[0104] The second sending unit 504 is used to determine whether the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to a preset alarm threshold when it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, and to send an alarm prompt information corresponding to the transaction alarm to the operation and maintenance personnel when it is determined that the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to the alarm threshold.

[0105] In the device provided by the embodiment of the present invention, when a transaction alarm is monitored in the system, a call chain corresponding to the transaction alarm is determined; the transaction alarm is analyzed based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormality root cause alarm; when it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, alarm information corresponding to the transaction alarm is sent to operation and maintenance personnel; when it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, it is determined whether the number of consecutive transaction alarms in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of consecutive transaction alarms in the system is greater than or equal to the alarm threshold, alarm information corresponding to the transaction alarm is sent to the operation and maintenance personnel. The present invention analyzes the transaction alarm, and when the alarm type of the transaction alarm is a preset alarm type, sends an alarm message to the operation and maintenance personnel; when the alarm type of the transaction alarm is not the corresponding alarm type, and the number of consecutive transaction alarms in the system is greater than or equal to the preset alarm threshold, sends an alarm message to the operation and maintenance personnel, thereby effectively reducing the number of times the system alarms the operation and maintenance personnel, thereby reducing the operation and maintenance personnel's attention to the system, reducing the operation and maintenance personnel's workload, and improving the operation and maintenance personnel's work efficiency.

[0106] In the device provided by the embodiment of the present invention, the determining unit 501 may be configured as follows:

[0107] A parsing subunit, used to parse the transaction alarm and obtain a transaction identifier in the transaction alarm;

[0108] A first determining subunit, configured to determine a service corresponding to the transaction identifier in the system;

[0109] The second determining subunit is used to determine the call chain of the business as the call chain corresponding to the transaction alarm.

[0110] In the device provided in the embodiment of the present invention, the analysis unit 502 may be configured as follows:

[0111] A third determining subunit, configured to determine each monitoring indicator of the call chain based on the abnormal indicator information;

[0112] An acquisition subunit, used for acquiring the alarm information in the transaction alarm;

[0113] A comparison subunit, used to compare the alarm information with each of the monitoring indicators to determine whether there is a monitoring indicator corresponding to the alarm information among the monitoring indicators;

[0114] A fourth determining subunit is configured to determine that the alarm type of the transaction alarm is a call chain abnormality root cause alarm if there is a monitoring indicator corresponding to the alarm information among the monitoring indicators;

[0115] The fifth determining subunit is used to determine that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm if there is no monitoring indicator corresponding to the alarm information among the monitoring indicators.

[0116] In the device provided in the embodiment of the present invention, the second sending unit 504 may be configured as follows:

[0117] a sixth determining subunit, configured to determine an alarm record in the system, and determine the number of consecutive alarms of the transaction alarm occurring in the system based on the alarm record;

[0118] The judging subunit is used to compare the alarm number with the alarm threshold to judge whether the alarm number is greater than or equal to the alarm threshold.

[0119] The device provided in the embodiment of the present invention may also be configured as follows:

[0120] The prohibition unit is used to prohibit the operation and maintenance personnel from sending the alarm information corresponding to the transaction alarm when the alarm number is not greater than or equal to the alarm threshold.

[0121] An embodiment of the present invention further provides a storage medium, wherein the storage medium includes stored instructions, wherein when the instructions are executed, a device where the storage medium is located is controlled to perform the following operations:

[0122] In the case where a transaction alarm is detected in the system, determining a call chain corresponding to the transaction alarm;

[0123] Analyze the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm;

[0124] When it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, an alarm prompt information corresponding to the transaction alarm is sent to the operation and maintenance personnel;

[0125] When it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, it is determined whether the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to the alarm threshold, an alarm prompt message corresponding to the transaction alarm is sent to the operation and maintenance personnel.

[0126] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 6 As shown, it specifically includes a memory 601 and one or more instructions 602, wherein the one or more instructions 602 are stored in the memory 601 and are configured to be executed by one or more processors 603 to perform the following operations:

[0127] In the case where a transaction alarm is detected in the system, determining a call chain corresponding to the transaction alarm;

[0128] Analyze the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm;

[0129] When it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, an alarm prompt information corresponding to the transaction alarm is sent to the operation and maintenance personnel;

[0130] When it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, it is determined whether the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to the alarm threshold, an alarm prompt message corresponding to the transaction alarm is sent to the operation and maintenance personnel.

[0131] The specific implementation processes and derivative methods of the above-mentioned embodiments are all within the protection scope of the present invention.

[0132] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0133] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0134] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An alarm analysis method, characterized in that: include: In the case where a transaction alarm is detected in the system, determining a call chain corresponding to the transaction alarm; Analyze the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm; When it is determined that the alarm type of the transaction alarm is a call chain abnormality root cause alarm, an alarm prompt information corresponding to the transaction alarm is sent to an operation and maintenance personnel; When it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, determining whether the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to the alarm threshold, sending an alarm prompt message corresponding to the transaction alarm to the operation and maintenance personnel; The analyzing the transaction alarm based on the abnormal indicator information of the call chain to determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm includes: Based on the abnormal indicator information, determine each monitoring indicator of the call chain; the monitoring indicator is an indicator of the call chain abnormal root cause of the call chain; the content of the abnormal indicator information of different call chains is different, and the abnormal indicator information of the call chain contains the information of the call chain abnormal root cause of the call chain; Obtaining the warning information in the transaction warning; Compare the alarm information with each of the monitoring indicators to determine whether there is a monitoring indicator corresponding to the alarm information among the monitoring indicators; If there is a monitoring indicator corresponding to the alarm information among the monitoring indicators, determining that the alarm type of the transaction alarm is a call chain abnormality root cause alarm; If there is no monitoring indicator corresponding to the alarm information among the monitoring indicators, it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm.

2. The method according to claim 1, characterized in that The determining of the call chain corresponding to the transaction alarm includes: Parsing the transaction alert to obtain a transaction identifier in the transaction alert; Determining in the system a business corresponding to the transaction identifier; The call chain of the business is determined as the call chain corresponding to the transaction alarm.

3. The method according to claim 1, characterized in that The determining whether the number of consecutive transaction alarms generated by the system is greater than or equal to a preset alarm threshold comprises: Determine an alarm record in the system, and determine the number of consecutive alarms of the transaction alarm in the system based on the alarm record; The alarm number is compared with the alarm threshold to determine whether the alarm number is greater than or equal to the alarm threshold.

4. The method according to claim 3, characterized in that Also includes: When the alarm number is not greater than or equal to the alarm threshold, it is prohibited to send the alarm information corresponding to the transaction alarm to the operation and maintenance personnel.

5. An alarm analysis device, characterized in that: include: A determination unit, configured to determine a call chain corresponding to a transaction alarm when a transaction alarm is detected in the system; An analyzing unit, configured to analyze the transaction alarm based on the abnormal indicator information of the call chain, and determine whether the alarm type of the transaction alarm is a call chain abnormal root cause alarm; A first sending unit is used to send an alarm prompt information corresponding to the transaction alarm to an operation and maintenance personnel when determining that the alarm type of the transaction alarm is a call chain abnormality root cause alarm; a second sending unit, configured to, when it is determined that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm, determine whether the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to a preset alarm threshold, and when it is determined that the number of consecutive alarms of the transaction alarm occurring in the system is greater than or equal to the alarm threshold, send an alarm prompt message corresponding to the transaction alarm to the operation and maintenance personnel; The analysis unit comprises: A third determination subunit is used to determine each monitoring indicator of the call chain based on the abnormal indicator information; the monitoring indicator is an indicator of the call chain abnormal root cause of the call chain; the content of the abnormal indicator information of different call chains is different, and the abnormal indicator information of the call chain contains the information of the call chain abnormal root cause of the call chain; An acquisition subunit, used for acquiring the alarm information in the transaction alarm; A comparison subunit, used to compare the alarm information with each of the monitoring indicators to determine whether there is a monitoring indicator corresponding to the alarm information among the monitoring indicators; A fourth determining subunit is configured to determine that the alarm type of the transaction alarm is a call chain abnormality root cause alarm if there is a monitoring indicator corresponding to the alarm information among the monitoring indicators; The fifth determining subunit is used to determine that the alarm type of the transaction alarm is not a call chain abnormality root cause alarm if there is no monitoring indicator corresponding to the alarm information among the monitoring indicators.

6. The device according to claim 5, characterized in that The determining unit comprises: A parsing subunit, used to parse the transaction alarm and obtain a transaction identifier in the transaction alarm; A first determining subunit, configured to determine a service corresponding to the transaction identifier in the system; The second determining subunit is used to determine the call chain of the business as the call chain corresponding to the transaction alarm.

7. The device according to claim 5, characterized in that The second sending unit includes: a sixth determining subunit, configured to determine an alarm record in the system, and determine the number of consecutive alarms of the transaction alarm occurring in the system based on the alarm record; The judging subunit is used to compare the alarm number with the alarm threshold to judge whether the alarm number is greater than or equal to the alarm threshold.

8. The device according to claim 7, characterized in that Also includes: A prohibition unit is used to prohibit sending the alarm information corresponding to the transaction alarm to the operation and maintenance personnel when the alarm number is not greater than or equal to the alarm threshold.

Images