Monitoring alarm method, device, storage medium and electronic equipment

Abstract

The embodiments of the present disclosure provide a monitoring and alarm method, device, medium and electronic device, which relate to the field of computer technology. The method includes: obtaining the indicator to be monitored; the indicator to be monitored includes a preprocessing indicator, and the preprocessing indicator is obtained by performing expression generation processing on the original indicator; performing data prediction processing on the indicator to be monitored to generate a corresponding prediction indicator value; obtaining the historical indicator value corresponding to the indicator to be monitored; generating an alarm judgment indicator based on the prediction indicator value and the historical indicator value, so as to perform an abnormal alarm based on the alarm judgment indicator. The present disclosure can dynamically update the alarm threshold according to the historical data of the indicator to be monitored, so that it is more in line with the actual changes in the indicator; in addition, generating an alarm judgment indicator based on the prediction indicator value and the historical indicator value can be conducive to the visualization of abnormal alarms and further confirm the accuracy of the alarm.

Description

Background Art

[0002] This section is intended to provide a background or context to the embodiments of the disclosure that are recited in the claims. No description herein is admitted to be prior art by inclusion in this section.

[0003] The Prometheus system is a cloud-native monitoring system that stores and warns about time series indicators. It is suitable for machine-centric monitoring as well as for monitoring highly dynamic service-oriented architectures. When a failure occurs, the Prometheus system can quickly diagnose the problem.

[0004] Currently, the industry mainly uses Prometheus monitoring to use the alarm component (Alert Manager) to issue alarms based on alarm strategies. Alarm strategies consist of expressions and fixed thresholds. Fixed thresholds are suitable for intuitive operation and maintenance indicators such as CPU and disk. Experience values ​​can be used as fixed thresholds. For example, an alarm will be issued when the CPU usage exceeds 70% and the disk usage reaches 80%. In addition, the built-in prediction model of Prometheus can be used to predict indicators, and the alarm indicators can be used as reference for the predicted values. Summary of the invention

[0005] However, using only fixed thresholds for monitoring may result in a large number of missed alerts and false alerts, and the built-in prediction model is difficult to apply to the alarm needs of various indicators, resulting in low alarm accuracy.

[0006] To this end, the present disclosure proposes an improved monitoring and alarming method, which can dynamically update the alarm threshold according to the historical data of the monitored indicator to make it more consistent with the actual change of the indicator; in addition, an alarm judgment indicator is generated according to the predicted indicator value and the historical indicator value to further confirm the accuracy of the alarm.

[0007] In this context, embodiments of the present disclosure are intended to provide a monitoring alarm method, a monitoring alarm device, a computer-readable storage medium, and an electronic device.

[0008] In the first aspect of the embodiments of the present disclosure, a monitoring and alarm method is provided, including: obtaining an indicator to be monitored; the indicator to be monitored includes a preprocessing indicator, and the preprocessing indicator is obtained by performing expression generation processing on the original indicator; performing data prediction processing on the indicator to be monitored to generate a corresponding prediction indicator value; obtaining a historical indicator value corresponding to the indicator to be monitored; generating an alarm judgment indicator based on the prediction indicator value and the historical indicator value, so as to issue an abnormal alarm based on the alarm judgment indicator.

[0009] In one embodiment of the present disclosure, the above method also includes: determining the abnormal monitoring requirements, and determining the corresponding original indicators according to the abnormal monitoring requirements; performing expression generation processing on the original indicators to generate corresponding preprocessing indicator expressions; determining the preprocessing indicator name corresponding to the preprocessing indicator expression; pushing the preprocessing indicator name or the preprocessing indicator expression to the indicator queue to generate the indicator to be monitored.

[0010] In one embodiment of the present disclosure, obtaining the indicator to be monitored includes: determining the interface parameters corresponding to the indicator queue; obtaining the indicator to be monitored according to the interface parameters and the preprocessing indicator name; and / or obtaining the indicator to be monitored according to the interface parameters and the preprocessing indicator expression; and / or obtaining the indicator label mapping relationship to obtain the indicator to be monitored according to the indicator label mapping relationship; the indicator label mapping relationship includes the mapping relationship between the indicator to be monitored and the monitoring label.

[0011] In one embodiment of the present disclosure, data prediction processing is performed on the monitored indicator to generate a corresponding predicted indicator value, including: obtaining the full amount of historical data corresponding to the data prediction processing, and determining the time series information corresponding to the full amount of historical data; obtaining a data prediction model, and inputting the full amount of historical data into the data prediction model; the data prediction model includes a custom time series prediction algorithm; and the data prediction model performs data prediction processing on the full amount of historical data according to the time series information to determine the predicted indicator value and confidence interval of the monitored indicator.

[0012] In one embodiment of the present disclosure, obtaining the full amount of historical data corresponding to data prediction processing includes: determining the data volume of the full amount of historical data; determining the data volume of the full amount of historical data according to the data acquisition time; determining the data block size, and determining the start mark and end mark corresponding to each data block according to the data block size, so as to obtain the full amount of historical data in batches.

[0013] In one embodiment of the present disclosure, an alarm determination index is generated based on a predicted index value and a historical index value, including: determining a dynamic index threshold range based on the historical index value; obtaining an actual monitoring value corresponding to the index to be monitored, and determining an index difference between the predicted index value and the actual monitoring value; if the index difference is within the dynamic index threshold range, determining the alarm determination index as normal; if the index difference is not within the dynamic index threshold range, determining an alarm abnormality category corresponding to the alarm determination index, so as to issue an abnormal alarm according to the alarm abnormality category.

[0014] In one embodiment of the present disclosure, determining the alarm abnormality category corresponding to the alarm judgment index includes: obtaining the upper limit maximum value and the lower limit minimum value of the confidence interval of the predicted index value; if the index difference is not within the dynamic index threshold range, and is between the upper limit maximum value and the lower limit minimum value, determining the alarm abnormality category as the first abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is greater than the upper limit maximum value, determining the alarm abnormality category as the second abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is less than the lower limit minimum value, determining the alarm abnormality category as the third abnormality category.

[0015] In the second aspect of the embodiment of the present disclosure, a monitoring and alarm device is provided, including: an indicator acquisition module, used to obtain the indicator to be monitored; the indicator to be monitored includes a preprocessing indicator, and the preprocessing indicator is obtained by performing expression generation processing on the original indicator; an indicator prediction module, used to perform data prediction processing on the indicator to be monitored, and generate a corresponding predicted indicator value; a historical value acquisition module, used to obtain the historical indicator value corresponding to the indicator to be monitored; an alarm module, used to generate an alarm judgment indicator according to the predicted indicator value and the historical indicator value, so as to issue an abnormal alarm according to the alarm judgment indicator.

[0016] In one embodiment of the present disclosure, the monitoring and alarm device also includes an indicator generation module, which is used to determine the abnormal monitoring requirements, determine the corresponding original indicators according to the abnormal monitoring requirements; perform expression generation processing on the original indicators to generate corresponding preprocessing indicator expressions; determine the preprocessing indicator name corresponding to the preprocessing indicator expression; push the preprocessing indicator name or the preprocessing indicator expression to the indicator queue to generate the indicator to be monitored.

[0017] In one embodiment of the present disclosure, the indicator acquisition module includes an indicator acquisition unit, which is used to determine the interface parameters corresponding to the indicator queue; obtain the indicator to be monitored according to the interface parameters and the preprocessing indicator name; and / or obtain the indicator to be monitored according to the interface parameters and the preprocessing indicator expression; and / or obtain the indicator label mapping relationship to obtain the indicator to be monitored according to the indicator label mapping relationship; the indicator label mapping relationship includes the mapping relationship between the indicator to be monitored and the monitoring label.

[0018] In one embodiment of the present disclosure, the indicator prediction module includes an indicator prediction unit, which is used to obtain the full amount of historical data corresponding to the data prediction processing and determine the time series information corresponding to the full amount of historical data; obtain a data prediction model and input the full amount of historical data into the data prediction model; the data prediction model includes a custom time series prediction algorithm; the data prediction model performs data prediction processing on the full amount of historical data according to the time series information to determine the predicted indicator value and confidence interval of the indicator to be monitored.

[0019] In one embodiment of the present disclosure, the indicator prediction unit includes a data acquisition subunit, which is used to determine the data volume of the full historical data; the data volume of the full historical data is determined according to the data acquisition time; the data block size is determined, and the start mark and end mark corresponding to each data block are determined according to the data block size, so as to acquire the full historical data in batches.

[0020] In one embodiment of the present disclosure, the alarm module includes an alarm unit, which is used to determine the dynamic indicator threshold range based on the historical indicator value; obtain the actual monitoring value corresponding to the indicator to be monitored, and determine the indicator difference between the predicted indicator value and the actual monitoring value; if the indicator difference is within the dynamic indicator threshold range, the alarm judgment indicator is determined to be normal; if the indicator difference is not within the dynamic indicator threshold range, the alarm abnormality category corresponding to the alarm judgment indicator is determined, so as to issue an abnormal alarm according to the alarm abnormality category.

[0021] In one embodiment of the present disclosure, the alarm unit includes an abnormality category determination unit, which is used to obtain the upper limit maximum value and the lower limit minimum value of the confidence interval of the predicted index value; if the index difference is not within the dynamic index threshold range, and is between the upper limit maximum value and the lower limit minimum value, the alarm abnormality category is determined as the first abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is greater than the upper limit maximum value, the alarm abnormality category is determined as the second abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is less than the lower limit minimum value, the alarm abnormality category is determined as the third abnormality category.

[0022] In a third aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the monitoring and alarm method as described above is implemented.

[0023] In a fourth aspect of the embodiments of the present disclosure, an electronic device is provided, comprising: a processor; and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the monitoring and alarm method as described above is implemented.

[0024] According to the technical solution of the embodiment of the present disclosure, the indicators to be monitored are obtained; the indicators to be monitored include preprocessing indicators, which are obtained by performing expression generation processing on the original indicators; data prediction processing is performed on the indicators to be monitored to generate corresponding prediction indicator values; the historical indicator values ​​corresponding to the indicators to be monitored are obtained; an alarm judgment indicator is generated based on the prediction indicator values ​​and the historical indicator values, so as to perform abnormal alarms based on the alarm judgment indicators. On the one hand, when the alarm judgment indicator is generated based on the historical indicator values, the alarm threshold can be dynamically updated to make it more consistent with the actual changes in the indicators, effectively improving the accuracy and true positive rate of the alarm; on the other hand, the alarm judgment indicator is generated based on the prediction indicator values ​​and the historical indicator values, which can be conducive to the visualization of abnormal alarms and further confirm the accuracy of the alarms. On the other hand, since the indicators to be monitored can be generated based on the original indicators, it can further meet the monitoring needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0026] Figure 1 A schematic block diagram schematically illustrates a system architecture of an exemplary application scenario according to some embodiments of the present disclosure;

[0027] Figure 2 The following schematically shows a flow chart of a monitoring and alarming method according to some embodiments of the present disclosure;

[0028] Figure 3 The following schematically shows a process sequence diagram of a Prometheus indicator alarm system according to some embodiments of the present disclosure;

[0029] Figure 4 A schematic diagram schematically shows data blocks of the full amount of historical data of an indicator according to some embodiments of the present disclosure;

[0030] Figure 5 The following schematically shows a schematic diagram of acquiring the full amount of historical data in batches according to some embodiments of the present disclosure;

[0031] Figure 6 The following schematically shows a component diagram of a Prometheus indicator alarm system according to some embodiments of the present disclosure;

[0032] Figure 7 A schematic diagram of an indicator alarm system according to some embodiments of the present disclosure is schematically shown;

[0033] Figure 8A schematic diagram schematically illustrates data conversion according to some embodiments of the present disclosure;

[0034] Fig. 9 A schematic block diagram of a monitoring and alarm device according to some embodiments of the present disclosure is schematically shown;

[0035] Fig.10 A schematic diagram schematically illustrates a storage medium according to an example embodiment of the present disclosure; and

[0036] Fig.11 A block diagram of an electronic device according to an exemplary embodiment of the invention is schematically shown.

[0037] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0038] The principles and spirit of the present disclosure will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present disclosure, and are not intended to limit the scope of the present disclosure in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0039] Those skilled in the art will appreciate that the embodiments of the present disclosure may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0040] According to an embodiment of the present disclosure, a monitoring alarm method, a monitoring alarm device, a medium and an electronic device are proposed.

[0041] In addition, any number of elements in the drawings is for illustration and not limitation, and any naming is only for distinction and does not have any limiting meaning.

[0042] The principle and spirit of the present disclosure are explained in detail below with reference to several representative embodiments of the present disclosure. SUMMARY OF THE INVENTION

[0044] Currently, the industry mainly uses Prometheus monitoring to generate alarms based on alarm strategies using alarm components. Alarm strategies consist of expressions and fixed thresholds. Fixed thresholds are suitable for intuitive operation and maintenance indicators such as CPU and disk. Experience values ​​can be used as fixed thresholds. For example, an alarm will be generated when the CPU usage exceeds 70% or the disk usage reaches 80%. In addition, the built-in prediction model of Prometheus can be used to predict indicators, and the alarm indicators can be generated based on the predicted values.

[0045] However, for slightly complex application monitoring indicators or those closely related to actual events, using fixed thresholds to monitor them is likely to cause a large number of missed reports and false reports. In addition, the built-in prediction model is limited and it is difficult to apply it to various trend indicators and meet the alarm requirements of various indicators. The accuracy of alarming through predicting indicator values ​​is low.

[0046] Based on the above content, the basic idea of ​​the present disclosure is to obtain the indicators to be monitored; the indicators to be monitored include preprocessing indicators, which are obtained by performing expression generation processing on the original indicators; performing data prediction processing on the indicators to be monitored to generate corresponding prediction indicator values; obtaining the historical indicator values ​​corresponding to the indicators to be monitored; generating alarm judgment indicators based on the prediction indicator values ​​and the historical indicator values, so as to issue abnormal alarms based on the alarm judgment indicators. The present disclosure can dynamically update the alarm threshold according to the historical data of the indicators to be monitored, so that it is more in line with the actual changes in the indicators; in addition, generating alarm judgment indicators based on the prediction indicator values ​​and the historical indicator values ​​can be conducive to the visualization of abnormal alarms and further confirm the accuracy of the alarms.

[0047] After introducing the basic principles of the present disclosure, various non-limiting embodiments of the present disclosure are described in detail below.

[0048] Application Scenario Overview

[0049] First reference Figure 1 , Figure 1 A schematic block diagram of a system architecture showing an exemplary application scenario in which a monitoring alarm method and device according to an embodiment of the present disclosure can be applied.

[0050] like Figure 1 As shown, the system architecture 100 may include one or more of terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc. The terminal devices 101, 102, 103 may be various electronic devices with display screens, including but not limited to desktop computers, portable computers, smart phones, tablet computers, etc. It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 105 may be a server cluster composed of multiple servers.

[0051] The monitoring and alarm method provided in the embodiment of the present disclosure is generally executed by the server 105, and accordingly, the monitoring and alarm device is generally arranged in the server 105. However, it is easy for a person skilled in the art to understand that the monitoring and alarm method provided in the embodiment of the present disclosure can also be executed by the terminal devices 101, 102, and 103, and accordingly, the monitoring and alarm device can also be arranged in the terminal devices 101, 102, and 103, and this is not particularly limited in the present exemplary embodiment. For example, in an exemplary embodiment, a staff member can upload the indicators to be monitored generated according to the original indicators to the server 105 through the terminal devices 101, 102, and 103, and the server obtains the indicators to be monitored through the monitoring and alarm method provided in the embodiment of the present disclosure, generates an alarm judgment indicator according to the predicted indicator value and the historical indicator value of the indicators to be monitored, performs an abnormal alarm according to the alarm judgment indicator, and transmits the abnormal alarm result to the terminal devices 101, 102, and 103.

[0052] It should be understood that Figure 1 The application scenario shown is only an example in which the embodiments of the present disclosure can be implemented. The scope of application of the embodiments of the present disclosure is not limited in any aspect by the application scenario.

[0053] Exemplary Methods

[0054] Combine the following Figure 1 For application scenarios, refer to Figure 2 To describe the monitoring alarm method according to the exemplary embodiment of the present disclosure. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present disclosure, and the embodiments of the present disclosure are not limited in this respect. On the contrary, the embodiments of the present disclosure can be applied to any applicable scenario.

[0055] The present disclosure first provides a monitoring alarm method. The execution subject of the method can be a terminal device or a server. The present disclosure does not make any special limitation on this. In this exemplary embodiment, the execution of the method by a server is taken as an example for explanation.

[0056] Reference Figure 2 As shown, the monitoring alarm method may include the following steps S210 to S240:

[0057] Step S210, obtaining the indicators to be monitored; the indicators to be monitored include preprocessing indicators, and the preprocessing indicators are obtained by performing expression generation processing on the original indicators.

[0058] In some example embodiments, the indicator to be monitored may be a monitoring indicator to be monitored by the monitoring system. The original indicator may be an original machine indicator captured by the monitoring system. The preprocessed indicator may be a monitoring indicator obtained after a preprocessing operation is performed on the original indicator. For example, the preprocessing operation may be an expression generation process. The expression generation process may be a process of generating a new preprocessed indicator by performing an expression generation process based on the original indicator.

[0059] For example, the monitoring system takes the Prometheus system as an example to explain the monitoring alarm method in detail. When the Prometheus system performs monitoring alarms, it can first obtain the indicators to be monitored, which can include the original indicators monitored by the Prometheus system and the preprocessed indicators generated based on the original indicators. When the Prometheus system has monitoring requirements for certain indicators, it can perform preprocessing operations such as expression generation processing on some original indicators to generate preprocessed indicators, and jointly determine the original indicators and preprocessed indicators as indicators to be monitored.

[0060] Step S220: performing data prediction processing on the indicator to be monitored to generate a corresponding predicted indicator value.

[0061] In some example embodiments, data prediction processing may be a process of predicting an indicator value based on relevant historical data of the indicator to be monitored (such as original indicator data). The predicted indicator value may be an indicator value obtained after data prediction processing is performed on the indicator to be monitored.

[0062] After determining the indicator to be monitored, data prediction processing can be performed on the indicator to be monitored based on the full amount of historical data corresponding to the indicator to be monitored, and the predicted indicator value corresponding to the indicator to be monitored can be determined. Taking the Prometheus system as an example, the Prometheus system can obtain three months of original indicator data corresponding to the indicator to be monitored as the full amount of historical data, perform data prediction processing on the indicator to be monitored, and generate the corresponding predicted indicator value.

[0063] Step S230, obtaining the historical indicator value corresponding to the indicator to be monitored.

[0064] In some example embodiments, the historical indicator value may be a historical real data value obtained by the monitoring system monitoring the indicator to be monitored.

[0065] When there is a monitoring demand, the monitoring system can continuously monitor the indicators to be monitored and store the monitored historical indicator values. The monitoring system can obtain the historical indicator values ​​corresponding to the indicators to be monitored to generate alarm judgment indicators.

[0066] Step S240, generating an alarm determination index according to the predicted index value and the historical index value, so as to issue an abnormal alarm according to the alarm determination index.

[0067] In some example embodiments, the alarm determination index may be a determination index based on which the monitoring system performs abnormal alarms. The abnormal alarm may be an alarm operation performed when an abnormal situation occurs in an indicator to be monitored in the system.

[0068] After obtaining the historical indicator values, the monitoring system can set dynamic thresholds based on the historical indicator values, and generate alarm judgment indicators based on the predicted indicator values ​​and the dynamic thresholds. After obtaining the generated alarm judgment indicators, the monitoring system can monitor the indicators to be monitored and issue abnormal alarms according to the corresponding alarm rules. Specifically, users can set alarm rules in advance. For example, the alarm rules can be set to issue abnormal alarms when the monitoring results of the indicators to be monitored meet a certain specific alarm judgment indicator.

[0069] In the monitoring and alarm method provided in this example implementation, on the one hand, when generating alarm judgment indicators based on historical indicator values, the alarm threshold can be dynamically updated to make it more consistent with the actual changes in the indicators, effectively improving the accuracy and true positive rate of alarms; on the other hand, generating alarm judgment indicators based on predicted indicator values ​​and historical indicator values ​​can facilitate the visualization of abnormal alarms and further confirm the accuracy of alarms. On the other hand, since the indicators to be monitored can be generated based on the original indicators, it can further meet the monitoring needs.

[0070] Next, the above steps of this exemplary embodiment are described in more detail.

[0071] In one embodiment of the present disclosure, the abnormal monitoring requirements are determined, and the corresponding original indicators are determined according to the abnormal monitoring requirements; expression generation processing is performed on the original indicators to generate corresponding preprocessing indicator expressions; the preprocessing indicator name corresponding to the preprocessing indicator expression is determined; the preprocessing indicator name or the preprocessing indicator expression is pushed to the indicator queue to generate the indicator to be monitored.

[0072] Among them, the abnormal monitoring requirement can be the monitoring requirement determined by the monitoring system according to the execution task of the system. For example, the monitoring system currently needs to monitor the relevant indicators of the CPU, then the abnormal monitoring requirement can be to monitor the relevant indicators of the CPU to determine whether there is an abnormality. The original indicator can be a monitoring indicator that can be directly captured by the monitoring system. The preprocessing indicator expression can be a calculation expression used to express a certain preprocessing indicator. The preprocessing indicator name can be the indicator name corresponding to a certain preprocessing indicator. The indicator queue can be a storage queue for storing indicators to be monitored.

[0073] After determining the abnormal monitoring requirements, the monitoring system can determine the corresponding original indicators according to the abnormal monitoring requirements, and perform expression generation processing on the original indicators, such as performing binary operations, aggregation operations on the original indicators, or performing multi-indicator connection (join) operations on multiple original indicators, and generate pre-processed indicator expressions. Taking the Prometheus system as an example, the Prometheus system provides a self-developed Prometheus data query statement (Prometheus Query Language, PromQL), which is a domain-specific language (Domain Specific Language, DSL).

[0074] refer to Figure 3 , Figure 3 The process sequence diagram of the Prometheus indicator alarm system according to some embodiments of the present disclosure is schematically shown. In step S310, the monitoring indicator expression and indicator name are defined. The Prometheus system can configure a recording rule (recoding rule) to predefine the preprocessing indicator expression and preprocessing indicator name of the preprocessing indicator.

[0075] For example, the Prometheus system monitors the rate of change of Hypertext Transfer Protocol (http) requests per second, obtains the corresponding original indicator http_requests_total, and performs expression generation processing on the original indicator. The expression can be set to rate(http_requests_total[5m]), which means the rate of change of http requests every 5 seconds. The corresponding recording rule of the indicator setting can be saved in the Prometheus server (Prometheus server); in addition, the preprocessing indicator name of the preprocessing indicator can be set to "job:http_requests_total:rate5m", and the preprocessing indicator name or preprocessing indicator expression can be pushed to the indicator queue of the Prometheus server to generate the preprocessing indicator. The Prometheus system can then query the indicator data of the preprocessing indicator through the indicator name job:http_requests_total:rate5m or the expression.

[0076] In some other embodiments, the original indicator can be calculated in real time through an expression. This situation is suitable for temporary monitoring needs. The indicator is not predefined in the Prometheus system and has no historical storage. In this case, you only need to define the indicator expression, such as expr = rate (http_requests_total [5m]), and then you can directly obtain the relevant data of the indicator to be monitored through the preprocessing indicator expression. The indicators to be monitored can all be stored in the Prometheus server.

[0077] In one embodiment of the present disclosure, an interface parameter corresponding to an indicator queue is determined; the indicator to be monitored is obtained according to the interface parameter and the preprocessing indicator name; and / or the indicator to be monitored is obtained according to the interface parameter and the preprocessing indicator expression; and / or the indicator label mapping relationship is obtained to obtain the indicator to be monitored according to the indicator label mapping relationship; the indicator label mapping relationship includes a mapping relationship between the indicator to be monitored and the monitoring label.

[0078] The interface parameters may be connection parameters of the interface between the monitoring system and the Prometheus server. The monitoring labels may be labels specified by the user for filtering indicators. The indicator label mapping relationship may be a mapping relationship between the preprocessing indicator and the monitoring label.

[0079] Continue to refer Figure 3 , in step S320, configure the connection information and obtain the indicators. The monitoring system can establish a connection with the Prometheus server and configure the connection information (such as interface parameters) to obtain the indicators to be monitored, which may include original indicators and preprocessed indicators. The interface parameters include, but are not limited to: Uniform Resource Locator (URL) address, header file with authorization (Authorization), indicator name, label name, total data size data_size, data block size chunk_size, start time, query expression, step, etc. The user can fill in the preprocessing indicator name or preprocessing indicator expression in the interface parameters to obtain the indicators to be monitored using the interface parameters and the preprocessing indicator name or preprocessing indicator expression.

[0080] For example, the original data can be obtained through the HTTP API (Application Programming Interface). For the preprocessing indicator job:http_requests_total:rate5m, the generated http request can be GET--header Authorization token url / api / vi / query? query=job:http_requests_total:rate5m&start=2021-01-14T15:22:25.479Z&end=2021-01-14T15:23:25.479Z. For another example, for the indicator expression expr of a preprocessing indicator, the corresponding http request is GET--headerAuthorization token url / api / vi / query? query=expr.

[0081] In addition, the monitoring label of the indicator to be monitored is also specified for filtering the indicator. For example, the http_requests_total indicator can be represented as including all labels. By configuring the label label=a, the above expression is equivalent to expr=http_requests_total{label=a}. After obtaining the monitoring label, the indicator label mapping relationship between the monitoring indicator and the indicator to be monitored can be determined. For example, label=a can represent a machine with a mapping label a, that is, obtaining the http requests of the machine with label a.

[0082] In one embodiment of the present disclosure, the full amount of historical data corresponding to the data prediction processing is obtained, and the time series information corresponding to the full amount of historical data is determined; a data prediction model is obtained, and the full amount of historical data is input into the data prediction model; the data prediction model includes a custom time series prediction algorithm; the data prediction model performs data prediction processing on the full amount of historical data according to the time series information to determine the predicted indicator value and confidence interval of the indicator to be monitored.

[0083] Among them, the full amount of historical data can be the full amount of historical data used for predicting the monitored indicator. The time series information can be the associated time series information between all the data in the full amount of historical data. The data prediction model can be the model used for data prediction of the monitored indicator. The custom time series prediction algorithm can be a data time series prediction algorithm used to adapt to the alarm requirements of indicators with various changing trends. The confidence interval of the indicator to be monitored can be the estimated interval of the overall parameter constructed by the indicator sample statistic of the indicator to be monitored.

[0084] Before performing data forecasting on the monitored indicator, the corresponding full historical data can be determined first. For example, when performing data forecasting on a certain monitored indicator, the corresponding 6-month historical data is required, and the data of the first 6 months before the current time can be obtained as the full historical data. After obtaining the full historical data, the time series information contained in the full historical data can be determined.

[0085] In step S330, predict the indicator value. Obtain a data prediction model, input the full amount of historical data into the data prediction model, and use the data prediction model to perform data prediction processing on the indicator to be monitored to calculate the predicted indicator value and confidence interval of the indicator to be monitored. Specifically, the data prediction model library may include but is not limited to various time series prediction models, such as linear regression models, moving average models, exponential smoothing (holt-winter) models, Arima models, Prophet models, and statistical-based prediction models, etc.; users can also customize various time series prediction algorithms according to the indicator change trend of the indicator to be monitored to meet the indicator prediction needs.

[0086] According to the historical trend of the full historical data, you can select a suitable prediction model from the model library to predict a certain range of the monitored indicators. For example, for the indicator job:http_requests_total:rate5m, you can use the Prophet model to predict the value of the next 10 minutes (minutes, mins) with a granularity of 15 seconds (second, s).

[0087] In one embodiment of the present disclosure, the data volume of the full historical data is determined; the data volume of the full historical data is determined according to the data acquisition time; the data block size is determined, and the start mark and end mark corresponding to each data block are determined according to the data block size, so as to acquire the full historical data in batches.

[0088] The data volume of the full historical data may be the data size corresponding to the full historical data. The data acquisition time may be the start time and end time used to acquire the full historical data. The data block size may be the size of the data block obtained after data segmentation processing is performed on the full historical data when the data volume of the full historical data is large. The start mark may be the start time mark corresponding to each data block. The end mark may be the end mark corresponding to each data block.

[0089] After determining the full amount of historical data, you can obtain the full amount of historical data. Since the amount of data of different full amounts of historical data is different, and the amount of data of some full amounts of historical data may be very large, in order to solve the API query load problem caused by the large amount of data of the full amount of historical data, you can obtain the full amount of data in batches by setting the data block size (chunk_size). Figure 4 , Figure 4 A schematic diagram schematically shows data blocks for the full amount of data of an indicator according to some embodiments of the present disclosure.

[0090] refer to Figure 4 , Figure 4 The following schematic diagram shows the data block of the full amount of historical data of an indicator according to some embodiments of the present disclosure. The data volume of the full amount of historical data can be represented by data_size, and the data block size can be represented by chunk_size. Figure 5 In the example, the current time can be recorded as now to determine the start time (start time) for obtaining the full amount of historical data. The amount of the full amount of historical data can be determined based on the start time, and then the full amount of historical data can be obtained in blocks based on the data block size.

[0091] refer to Figure 5 , Figure 5 The schematic diagram of obtaining the full amount of historical data in batches according to some embodiments of the present disclosure is schematically shown. The number of data blocks can be marked as chunk_num, then chunk_num = data_size / chunk_size. Taking the data of the first 6 hours (hour, h) corresponding to the current time point of the monitored data as an example, data_size = 6h, when chunk_size = 1h, chunk_num = 6, therefore, the data is obtained in 6 batches, each batch of data with a time size of 1h. Furthermore, in order to avoid data acquisition errors that may occur during the data acquisition process, the maximum number of request retries can be set to avoid errors in obtaining indicators.

[0092] The pseudo code for extracting the full amount of historical data corresponding to the preprocessing indicators in this disclosure is as follows:

[0093]

[0094]

[0095] The code shows that each data block is looped through. Before the maximum number of retries is reached, the data of each chunk is obtained by controlling the start and end of each chunk, and the current batch of data is appended to the previous batch of data. This disclosure obtains the original index data in batches by setting the data chunk size, solving the problem of timeout caused by too much full data, and improving the success rate of obtaining the original index data.

[0096] In one embodiment of the present disclosure, a dynamic indicator threshold range is determined based on historical indicator values; the actual monitoring value corresponding to the indicator to be monitored is obtained, and the indicator difference between the predicted indicator value and the actual monitoring value is determined; if the indicator difference is within the dynamic indicator threshold range, the alarm judgment indicator is determined to be normal; if the indicator difference is not within the dynamic indicator threshold range, the alarm abnormality category corresponding to the alarm judgment indicator is determined, so as to issue an abnormal alarm according to the alarm abnormality category.

[0097] The dynamic indicator threshold range may be a threshold range dynamically determined based on the historical indicator value. The actual monitoring value may be the actual data value corresponding to the indicator to be monitored. The indicator difference may be the difference between the predicted indicator value and the historical indicator value. The alarm abnormality category may be the specific category corresponding to the abnormality that occurred.

[0098] Continue to refer Figure 3 In step S340, after the predicted index value is determined, the predicted index value is exposed. A dynamic index threshold range is set according to the acquired historical index value of the index to be monitored to generate an alarm determination index. For example, the dynamic index threshold range can be set according to actual monitoring requirements, for example, the dynamic index threshold range can be 3 times the variance of the historical index value actually monitored.

[0099] In step S350, the predicted index value is compared with the actual monitoring value to obtain the alarm judgment index, and the alarm judgment index is exposed. If the index difference is within the dynamic index threshold range, the alarm judgment index is determined to be normal, and its alarm judgment value can be determined to be 0. If the index difference is not within the dynamic index threshold range, the alarm abnormality category corresponding to the alarm judgment index is further determined. Since some data prediction models fail to determine the confidence interval of the indicator to be monitored after data prediction processing, when determining the alarm abnormality category corresponding to the alarm judgment index, two corresponding determination methods can be used: (1) When the data prediction model is performing data prediction processing and the confidence interval of the indicator to be monitored is not determined, if the index difference is within the dynamic index threshold range, the alarm judgment index is determined to be normal; if the index difference is not within the dynamic index threshold range, the alarm abnormality category is determined to be the first abnormality category. (2) When the data prediction model is performing data prediction processing and obtains the confidence interval of the indicator to be monitored, if the indicator difference is within the dynamic indicator threshold range, the alarm judgment indicator is determined to be normal; if the indicator difference is not within the dynamic indicator threshold range, the specific alarm abnormality category is further determined in combination with the confidence interval.

[0100] For example, the generated new indicators are unified into an alarm judgment indicator target. The new indicators include predicted indicator values, confidence intervals, and alarm judgment values. The HTTP interface is used to expose Prometheus data type indicators to form a unified target. For example: predicted_metric_name = "predicted_" + metric_name, the prediction indicator uses the Gauge type, PREDICTED_VALUES_PROPHET = Gauge (predicted_metric_name + '_prophet', illustration); the confidence interval indicator PREDICTED_VALUES_PROPHET_UPPER = Gauge (predicted_metric_name + '_prophet_yhat_upper', illustration) and PREDICTED_VAL UES_PROPHET_LOWER = Gauge (predicted_metric_name + '_prophet_yhat_lower', illustration); the alarm judgment indicator PREDICTED_ANOMALY_PROPHET = Gauge (predicted_metric_name + '_prophet_anomaly', illustration).

[0101] In step S360, the alarm rules (i.e., alarm indicators) are obtained. For example, the alarm strategy can be configured as follows: when PREDICTED_ANOMALY_PROPHET == 1, the Alert Manager is triggered to issue an alarm notification. In step S370, the alarm management component can issue an abnormal alarm according to the set alarm rules. In step S380, the user can also tune the existing model or expand the model library according to actual needs, and perform data prediction processing on the monitored indicators based on the tuned or expanded model library.

[0102] In one embodiment of the present disclosure, the maximum value of the upper bound and the minimum value of the lower bound of the confidence interval of the predicted index value are obtained; if the index difference is not within the dynamic index threshold range, and is between the maximum value of the upper bound and the minimum value of the lower bound, the alarm abnormality category is determined as the first abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is greater than the maximum value of the upper bound, the alarm abnormality category is determined as the second abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is less than the minimum value of the lower bound, the alarm abnormality category is determined as the third abnormality category.

[0103] Among them, the maximum value of the upper limit of the interval can be the maximum value of the upper limit of the interval in the confidence interval corresponding to the predicted index value. The minimum value of the lower limit of the interval can be the minimum value of the lower limit of the interval in the confidence interval corresponding to the predicted index value. The first abnormal category can be an abnormal category in which an abnormal value is generated in the indicator to be monitored, but the abnormal value does not exceed the peak of the confidence interval. The second abnormal category can be an abnormal situation in which the indicator abnormal value of the indicator to be monitored exceeds the peak of the confidence interval. The third abnormal category can be an abnormal situation in which the indicator abnormal value of the indicator to be monitored is lower than the trough of the confidence interval.

[0104] If the indicator difference is not within the dynamic indicator threshold range, and the actual monitoring value is between the maximum value of the upper limit of the interval and the minimum value of the lower limit of the interval, the alarm abnormality category is determined to be the first abnormality category, that is, the alarm judgment value is determined to be 1. If the indicator difference is not within the dynamic indicator threshold range, and the actual monitoring value is greater than the maximum value of the upper limit of the interval, the value is likely to be a pulse spike, the alarm abnormality category is determined to be the second abnormality category, and the alarm judgment value is determined to be 2. If the indicator difference is not within the dynamic indicator threshold range, and the actual monitoring value is less than the minimum value of the lower limit of the interval, the value is likely to be a trough, the alarm abnormality category is determined to be the third abnormality category, and the alarm judgment value is determined to be 3.

[0105] refer to Figure 6 , Figure 6 The component diagram of the Prometheus indicator alarm system according to some embodiments of the present disclosure is schematically shown. Figure 6In the example, the Prometheus server stores the original indicators. The original indicators can be pre-processed to generate pre-processed indicator expressions. The generated pre-processed indicator expressions and connection parameters can be stored in the Prometheus server. Next, the Prometheus server can push the indicators to be monitored to the monitoring indicator sequence. The monitoring system can obtain the indicators to be monitored from the Prometheus server through the HTTP interface, and input the indicators to be monitored into the prediction model to obtain the prediction indicator sequence corresponding to the indicators to be monitored. The difference between the obtained prediction indicator sequence and the monitoring indicator sequence is compared to obtain the indicator difference. If the indicator difference is greater than the dynamic alarm threshold, an alarm is processed.

[0106] In summary, the monitoring and alarm method disclosed in the present invention obtains the indicators to be monitored; the indicators to be monitored include preprocessing indicators, which are obtained by performing expression generation processing on the original indicators; data prediction processing is performed on the indicators to be monitored to generate corresponding predicted indicator values; the historical indicator values ​​corresponding to the indicators to be monitored are obtained; the alarm judgment indicators are generated according to the predicted indicator values ​​and the historical indicator values, so as to perform abnormal alarms according to the alarm judgment indicators. On the one hand, when the alarm judgment indicators are generated according to the historical indicator values, the alarm threshold can be dynamically updated to make it more consistent with the actual changes of the indicators, effectively improving the accuracy and true positive rate of the alarms; on the other hand, the alarm judgment indicators are generated according to the predicted indicator values ​​and the historical indicator values, which can be conducive to the visualization of abnormal alarms and further confirm the accuracy of the alarms. On the other hand, since the indicators to be monitored can be generated according to the original indicators, the monitoring needs can be further met. On the other hand, by personalizing the extended time prediction model, the accuracy of the indicator prediction value can be improved, the problems of missed and false alarms can be reduced, and the monitoring and alarm needs of indicators of different types, trends and distributions can be better met.

[0107] Exemplary Systems

[0108] Furthermore, the present disclosure also provides a monitoring alarm system, referring to Figure 7 , Figure 7 The schematic diagram of the indicator alarm system according to some embodiments of the present disclosure is schematically shown. The indicator alarm system may include a server 710, a parsing module 720, an indicator collection module 730, a prediction module 740, an indicator alarm module 750, a data conversion module 760 and a storage module 770.

[0109] Specifically, taking the Prometheus indicator alarm system as an example, the indicator alarm system 700 may include a Prometheus server 710, and the Prometheus server 710 includes a preprocessing module 701. Specifically, the preprocessing module 701 can be used to preprocess the original indicator to generate a preprocessed indicator, for example, perform expression generation processing on the original indicator, predefine a new preprocessing indicator name and a preprocessing indicator expression, and obtain a preprocessing indicator.

[0110] The parsing module 720 can be used to check the validity of the expression syntax of the preprocessed indicator expression. For example, the expression syntax needs to conform to the PromQL syntax; it can reduce PromQL syntax errors in complex indicator operations, thereby ensuring the correctness of the monitoring indicators. The indicator collection module 730 can be used to set connection parameters and connect to the Prometheus server to extract preprocessed monitoring indicator data. For example, the HTTP API interface of Prometheus can be used to obtain the indicators to be monitored. The storage module 770 can be used to store data generated by the prediction module 740 and the indicator alarm module 750. The storage medium may include but is not limited to local storage, cloud storage, distributed storage, etc.

[0111] The data conversion module 760 can be used to convert the data format generated by the prediction module 740 and the indicator alarm module 750. Figure 8 , Figure 8 The following schematically shows a schematic diagram of data conversion according to some embodiments of the present disclosure. Figure 8 In the example, the predicted index value and the actual index value output by the prediction module are converted into a data format suitable for storage by the storage module according to a certain size, and the corresponding file is generated for storage. Furthermore, this module is also used to uniformly convert the prediction module and alarm module data into the Prometheus data format.

[0112] The prediction module 740 has a built-in time series prediction method, which can be used to predict the monitoring index value; the algorithm library is maintained and expanded through parameter tuning and new prediction methods. The index alarm module 750 can be used to analyze the index difference between the actual index value and the predicted index value, and generate an alarm judgment based on the dynamic threshold to issue an alarm. The alarm module mainly implements alarm notifications through the alarm component (Alert Manager).

[0113] Exemplary Devices

[0114] After introducing the method of the exemplary embodiment of the present disclosure, next, refer to Fig. 9 A monitoring and alarm device according to an exemplary embodiment of the present disclosure is described.

[0115] exist Fig. 9In the embodiment, the monitoring and alarming device 900 may include: an indicator acquisition module 910, an indicator prediction module 920, a historical value acquisition module 930 and an alarm module 940. Among them:

[0116] The indicator acquisition module 910 is used to obtain the indicator to be monitored; the indicator to be monitored includes a preprocessing indicator, which is obtained by performing expression generation processing on the original indicator; the indicator prediction module 920 is used to perform data prediction processing on the indicator to be monitored and generate corresponding predicted indicator values; the historical value acquisition module 930 is used to obtain the historical indicator values ​​corresponding to the indicator to be monitored; the alarm module 940 is used to generate an alarm judgment indicator based on the predicted indicator value and the historical indicator value, so as to issue an abnormal alarm based on the alarm judgment indicator.

[0117] In one embodiment of the present disclosure, the monitoring and alarm device also includes an indicator generation module, which is used to determine the abnormal monitoring requirements, determine the corresponding original indicators according to the abnormal monitoring requirements; perform expression generation processing on the original indicators to generate corresponding preprocessing indicator expressions; determine the preprocessing indicator name corresponding to the preprocessing indicator expression; push the preprocessing indicator name or the preprocessing indicator expression to the indicator queue to generate the indicator to be monitored.

[0118] In one embodiment of the present disclosure, the indicator acquisition module includes an indicator acquisition unit, which is used to determine the interface parameters corresponding to the indicator queue; obtain the indicator to be monitored according to the interface parameters and the preprocessing indicator name; and / or obtain the indicator to be monitored according to the interface parameters and the preprocessing indicator expression; and / or obtain the indicator label mapping relationship to obtain the indicator to be monitored according to the indicator label mapping relationship; the indicator label mapping relationship includes the mapping relationship between the indicator to be monitored and the monitoring label.

[0119] In one embodiment of the present disclosure, the indicator prediction module includes an indicator prediction unit, which is used to obtain the full amount of historical data corresponding to the data prediction processing and determine the time series information corresponding to the full amount of historical data; obtain a data prediction model and input the full amount of historical data into the data prediction model; the data prediction model includes a custom time series prediction algorithm; the data prediction model performs data prediction processing on the full amount of historical data according to the time series information to determine the predicted indicator value and confidence interval of the indicator to be monitored.

[0120] In one embodiment of the present disclosure, the indicator prediction unit includes a data acquisition subunit, which is used to determine the data volume of the full historical data; the data volume of the full historical data is determined according to the data acquisition time; the data block size is determined, and the start mark and end mark corresponding to each data block are determined according to the data block size, so as to acquire the full historical data in batches.

[0121] In one embodiment of the present disclosure, the alarm module includes an alarm unit, which is used to determine the dynamic indicator threshold range based on the historical indicator value; obtain the actual monitoring value corresponding to the indicator to be monitored, and determine the indicator difference between the predicted indicator value and the actual monitoring value; if the indicator difference is within the dynamic indicator threshold range, the alarm judgment indicator is determined to be normal; if the indicator difference is not within the dynamic indicator threshold range, the alarm abnormality category corresponding to the alarm judgment indicator is determined, so as to issue an abnormal alarm according to the alarm abnormality category.

[0122] In one embodiment of the present disclosure, the alarm unit includes an abnormality category determination unit, which is used to obtain the upper limit maximum value and the lower limit minimum value of the confidence interval of the predicted index value; if the index difference is not within the dynamic index threshold range, and is between the upper limit maximum value and the lower limit minimum value, the alarm abnormality category is determined as the first abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is greater than the upper limit maximum value, the alarm abnormality category is determined as the second abnormality category; if the index difference is not within the dynamic index threshold range, and the actual monitoring value is less than the lower limit minimum value, the alarm abnormality category is determined as the third abnormality category.

[0123] Since the various functional modules of the monitoring and alarm device of the example embodiment of the present disclosure correspond to the steps of the example embodiment of the monitoring and alarm method mentioned above, for details not disclosed in the embodiment of the device of the present disclosure, please refer to the embodiment of the monitoring and alarm method of the present disclosure mentioned above, and no further details will be given here.

[0124] It should be noted that, although several modules or units of the monitoring alarm device are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0125] In one aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the monitoring and alarm method as described in the first aspect above is implemented.

[0126] Exemplary Media

[0127] After introducing the device of the exemplary embodiment of the present disclosure, next, refer to Fig.10 A storage medium according to an exemplary embodiment of the present disclosure is described.

[0128] In some embodiments, various aspects of the present disclosure may also be implemented as a medium on which program code is stored, which, when executed by a processor of a device, is used to implement the steps of the monitoring and alarm method according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification.

[0129] For example, when the processor of the device executes the program code, the following may be implemented: Figure 2 Step S210 described in the above is to obtain the indicator to be monitored; the indicator to be monitored includes a preprocessing indicator, which is obtained by performing expression generation processing on the original indicator; step S220 is to perform data prediction processing on the indicator to be monitored to generate a corresponding prediction indicator value; step S230 is to obtain the historical indicator value corresponding to the indicator to be monitored; step S240 is to generate an alarm judgment indicator based on the prediction indicator value and the historical indicator value, so as to issue an abnormal alarm based on the alarm judgment indicator.

[0130] refer to Fig.10 As shown, a program product 1000 for implementing the above monitoring alarm method or implementing the above monitoring alarm method according to an embodiment of the present disclosure is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto.

[0131] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0132] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Readable signal media may also be any readable medium other than a readable storage medium.

[0133] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN).

[0134] Exemplary Computing Devices

[0135] After introducing the monitoring alarm method, monitoring alarm system, monitoring alarm device and storage medium of the exemplary embodiment of the present disclosure, next, refer to Fig.11 An electronic device according to an exemplary embodiment of the present disclosure is described.

[0136] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware embodiments, complete software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0137] In some possible embodiments, the electronic device according to the present disclosure may include at least one processing unit and at least one storage unit. The storage unit stores program code, and when the program code is executed by the processing unit, the processing unit executes the steps of the monitoring and alarm method according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of this specification. For example, the processing unit may execute the following steps: Figure 2 In step S210 shown in the figure, the indicator to be monitored is obtained; the indicator to be monitored includes a preprocessing indicator, which is obtained by performing expression generation processing on the original indicator; in step S220, data prediction processing is performed on the indicator to be monitored to generate a corresponding prediction indicator value; in step S230, the historical indicator value corresponding to the indicator to be monitored is obtained; in step S240, an alarm judgment indicator is generated according to the prediction indicator value and the historical indicator value, so as to issue an abnormal alarm according to the alarm judgment indicator.

[0138] Refer to the following Fig.11 1100 according to an exemplary embodiment of the present disclosure is described. Fig.11The electronic device 1100 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0139] like Fig.11 As shown, the electronic device 1100 is in the form of a general computing device. The components of the electronic device 1100 may include but are not limited to: at least one processing unit 1101, at least one storage unit 1102, a bus 1103 connecting different system components (including the storage unit 1102 and the processing unit 1101), and a display unit 1107.

[0140] Bus 1103 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0141] The storage unit 1102 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1121 and / or a cache memory 1122 , and may further include a read-only memory (ROM) 1123 .

[0142] The storage unit 1102 may also include a program / utility 1125 having a set (at least one) of program modules 1124, such program modules 1124 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0143] The electronic device 1100 may also communicate with one or more external devices 1104 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1100, and / or communicate with any device that enables the electronic device 1100 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1105. Furthermore, the electronic device 1100 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1106. As shown, the network adapter 1106 communicates with other modules of the electronic device 1100 via a bus 1103. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0144] It should be noted that, although several units / modules or subunits / modules of the monitoring alarm device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided into multiple units / modules to be embodied.

[0145] In addition, although the operations of the disclosed method are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0146] Although the spirit and principle of the present disclosure have been described with reference to several specific embodiments, it should be understood that the present disclosure is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present disclosure is intended to cover various modifications and equivalent arrangements included in the spirit and scope of the attached claims.

Claims

1. A monitoring and alarm method, characterized in that: include: Obtaining the indicator to be monitored; the indicator to be monitored includes a preprocessing indicator, the preprocessing indicator is obtained by performing expression generation processing on the original indicator, and the indicator to be monitored is generated by pushing the preprocessing indicator name or the preprocessing indicator expression to the indicator queue; Performing data prediction processing on the indicator to be monitored to generate corresponding prediction indicator values; Obtaining the historical indicator value corresponding to the indicator to be monitored; Generating an alarm determination index according to the predicted index value and the historical index value, so as to issue an abnormal alarm according to the alarm determination index; The obtaining of the indicator to be monitored includes: determining an interface parameter corresponding to the indicator queue; Acquire the indicator to be monitored according to the interface parameter and the preprocessing indicator name; and / or Acquire the indicator to be monitored according to the interface parameter and the preprocessing indicator expression; and / or Obtain an indicator label mapping relationship to obtain the indicator to be monitored according to the indicator label mapping relationship; the indicator label mapping relationship includes a mapping relationship between the indicator to be monitored and a monitoring label.

2. The method according to claim 1, characterized in that The method further comprises: Determine the abnormal monitoring requirements, and determine the corresponding original indicators according to the abnormal monitoring requirements; Performing expression generation processing on the original indicator to generate a corresponding preprocessing indicator expression; Determine the preprocessing indicator name corresponding to the preprocessing indicator expression; The preprocessing indicator name or the preprocessing indicator expression is pushed to the indicator queue to generate the indicator to be monitored.

3. The method according to claim 1, characterized in that Performing data prediction processing on the indicator to be monitored to generate corresponding prediction indicator values ​​includes: Acquire the full amount of historical data corresponding to the data prediction process, and determine the time series information corresponding to the full amount of historical data; Obtaining a data prediction model, and inputting the full amount of historical data into the data prediction model; the data prediction model includes a custom time series prediction algorithm; The data prediction model performs data prediction processing on the full amount of historical data according to the time series information to determine the predicted indicator value and confidence interval of the indicator to be monitored.

4. The method according to claim 3, characterized in that Obtaining the full amount of historical data corresponding to the data prediction process, including: Determine the data volume of the full historical data; the data volume of the full historical data is determined according to the data acquisition time; Determine the data block size, and determine the start mark and end mark corresponding to each data block according to the data block size, so as to obtain the full amount of historical data in batches.

5. The method according to claim 1, characterized in that Generating an alarm determination index according to the predicted index value and the historical index value includes: Determine a dynamic indicator threshold range based on the historical indicator value; Obtaining an actual monitoring value corresponding to the indicator to be monitored, and determining an indicator difference between the predicted indicator value and the actual monitoring value; If the indicator difference is within the dynamic indicator threshold range, the alarm determination indicator is determined to be normal; If the indicator difference is not within the dynamic indicator threshold range, the alarm abnormality category corresponding to the alarm determination indicator is determined to perform the abnormal alarm according to the alarm abnormality category.

6. The method according to claim 5, characterized in that Determining the alarm abnormality category corresponding to the alarm determination indicator includes: Obtaining the maximum upper bound and the minimum lower bound of the confidence interval of the prediction index value; If the indicator difference is not within the dynamic indicator threshold range and is between the maximum value of the upper bound of the interval and the minimum value of the lower bound of the interval, the alarm abnormality category is determined as the first abnormality category; If the indicator difference is not within the dynamic indicator threshold range, and the actual monitoring value is greater than the maximum value of the upper limit of the interval, the alarm abnormality category is determined as the second abnormality category; If the indicator difference is not within the dynamic indicator threshold range, and the actual monitoring value is less than the minimum value of the lower bound of the interval, the alarm abnormality category is determined as the third abnormality category.

7. A monitoring and alarm device, characterized in that: include: An indicator acquisition module is used to acquire the indicator to be monitored; the indicator to be monitored includes a pre-processed indicator, the pre-processed indicator is obtained by performing expression generation processing on the original indicator, and the indicator to be monitored is generated by pushing the pre-processed indicator name or the pre-processed indicator expression to the indicator queue; An indicator prediction module is used to perform data prediction processing on the indicator to be monitored and generate a corresponding predicted indicator value; A historical value acquisition module, used to obtain the historical indicator value corresponding to the indicator to be monitored; An alarm module, used to generate an alarm determination index according to the predicted index value and the historical index value, so as to issue an abnormal alarm according to the alarm determination index; The indicator acquisition module is further used to determine the interface parameters corresponding to the indicator queue; Acquire the indicator to be monitored according to the interface parameter and the preprocessing indicator name; and / or Acquire the indicator to be monitored according to the interface parameter and the preprocessing indicator expression; and / or Obtain an indicator label mapping relationship to obtain the indicator to be monitored according to the indicator label mapping relationship; the indicator label mapping relationship includes a mapping relationship between the indicator to be monitored and a monitoring label.

8. An electronic device, characterized in that: include: processor; as well as A memory having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by the processor, implement the monitoring and alarm method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the monitoring and alarm method according to any one of claims 1 to 6.

Images