A method and device for handling exceptions

Abstract

The present invention provides an exception handling method and device. When an exception is detected, the root cause of the exception is analyzed to obtain the root cause of the exception, so as to merge the sliding window exceptions based on the root cause of the exception, and determine whether a new fault has occurred based on the root cause of the exception and the time when the exception occurred, so as to avoid merging exceptions of different faults together and not merging exceptions of the same fault, thereby improving the efficiency of exception handling.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more specifically, to an exception handling method and device. Background Art

[0002] If a system fails during operation, it is often accompanied by multiple abnormal phenomena, such as the value range of some operating indicators not meeting expectations. When handling anomalies, in order to improve processing efficiency, the anomalies are generally combined and classified into a certain fault for processing to avoid unnecessary invalid processing and repeated processing.

[0003] At present, anomalies are mainly monitored based on system and time dimensions. All anomalies of a system within a fixed time, such as 5 minutes, are merged into one fault. There are problems such as merging anomalies of different faults together and not merging anomalies of the same fault. Summary of the invention

[0004] In view of this, the present invention provides an exception handling method and device to avoid the problem of merging exceptions of different faults and not merging exceptions of the same fault, thereby improving the exception handling efficiency.

[0005] In order to achieve the above-mentioned invention object, the specific technical solution provided by the present invention is as follows:

[0006] An exception handling method, comprising:

[0007] When an abnormality is detected, a root cause analysis is performed on the abnormality to obtain the root cause of the abnormality;

[0008] Determine whether a historical anomaly with the same root cause as the anomaly has occurred within a preset time before the current moment;

[0009] If yes, merge the exception into the fault merging class corresponding to the historical exception;

[0010] If not, it is determined that a new fault has occurred.

[0011] Optionally, a root cause analysis is performed on the anomaly, including:

[0012] Acquiring the abnormal operation data;

[0013] Inputting the abnormal operation data into a pre-built root cause analysis model for processing to obtain the root cause of the abnormality;

[0014] The root cause analysis model is obtained by training a preset machine learning model using training samples with labeled root cause types.

[0015] Optionally, a root cause analysis is performed on the anomaly, including:

[0016] Obtaining the abnormal warning information;

[0017] Parsing the abnormal alarm information to obtain the abnormal alarm object;

[0018] Determine the physical device information and / or business information of the alarm according to the abnormal alarm object;

[0019] The root cause of the abnormality is determined based on the physical device information and / or business information where the alarm occurs.

[0020] Optionally, after determining that a new fault has occurred, the method further includes:

[0021] The new fault is processed according to the root cause of the abnormality.

[0022] Optionally, after processing the new fault, the method further includes:

[0023] Determine whether an exception having the same root cause as the exception occurs within a preset time after the current moment;

[0024] If so, determining that the new fault has not been restored;

[0025] If not, it is determined that the new fault has been recovered.

[0026] An exception handling device, comprising:

[0027] A root cause analysis unit, configured to, when an abnormality is detected, analyze the root cause of the abnormality to obtain the root cause of the abnormality;

[0028] A first judgment unit is used to judge whether a historical anomaly with the same root cause as the anomaly occurs within a preset time before the current moment, and if so, trigger the anomaly merging unit; if not, trigger the fault determination unit;

[0029] The exception merging unit is used to merge the exception into the fault merging class corresponding to the historical exception;

[0030] The fault determination unit is used to determine the occurrence of a new fault.

[0031] Optionally, the root cause analysis unit is specifically used to:

[0032] Acquiring the abnormal operation data;

[0033] Inputting the abnormal operation data into a pre-built root cause analysis model for processing to obtain the root cause of the abnormality;

[0034] The root cause analysis model is obtained by training a preset machine learning model using training samples with labeled root cause types.

[0035] Optionally, the root cause analysis unit is specifically used to:

[0036] Obtaining the abnormal warning information;

[0037] Parsing the abnormal alarm information to obtain the abnormal alarm object;

[0038] Determine the physical device information and / or business information of the alarm according to the abnormal alarm object;

[0039] The root cause of the abnormality is determined based on the physical device information and / or business information where the alarm occurs.

[0040] Optionally, the device further comprises:

[0041] The fault processing unit is used to process the new fault according to the root cause of the abnormality.

[0042] Optionally, the device further includes a second judgment unit, specifically configured to:

[0043] After processing the new fault, determining whether an abnormality having the same root cause as the abnormality occurs within a preset time after the current moment;

[0044] If so, determining that the new fault has not been restored;

[0045] If not, it is determined that the new fault has been recovered.

[0046] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0047] The present invention discloses an exception handling method. When an exception is detected, the root cause of the exception is analyzed to obtain the root cause of the exception, and then sliding window exceptions are merged based on the root cause of the exception, and whether a new fault has occurred is determined based on the root cause of the exception and the time when the exception occurred, thereby avoiding the problem of merging exceptions of different faults together and not merging exceptions of the same fault, thereby improving the efficiency of exception handling. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0049] Figure 1 A flowchart of an exception handling method disclosed in an embodiment of the present invention;

[0050] Figure 2 A partial method flow diagram of an exception handling method disclosed in an embodiment of the present invention;

[0051] Figure 3 A partial method flow diagram of an exception handling method disclosed in an embodiment of the present invention;

[0052] Figure 4 A flowchart of another exception handling method disclosed in an embodiment of the present invention;

[0053] Figure 5 The present invention is a schematic diagram of the structure of an exception handling device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0056] After research, the inventor found that in complex systems, failures are a common problem, and there is also a phenomenon that multiple failures occur in the same period of time. If the anomalies are monitored based on the system and time dimensions, all anomalies of a system within a fixed time are merged into one failure, and then the failure is processed, it is likely that the anomalies of different failures will be merged together, and the anomalies of the same failure will not be merged. As a result, it is impossible to accurately locate the failure and to quickly and accurately handle the anomalies and failures.

[0057] In order to solve the above technical problems, the present invention provides an exception handling method. When an exception is detected, the root cause of the exception is analyzed to obtain the root cause of the exception, and then sliding window exceptions are merged based on the root cause of the exception, and whether a new fault has occurred is determined based on the root cause of the exception and the time when the exception occurred, thereby avoiding the problem of merging exceptions of different faults together and not merging exceptions of the same fault, thereby improving the efficiency of exception handling.

[0058] For details, please refer to Figure 1 , an exception handling method disclosed in an embodiment of the present invention comprises the following steps:

[0059] S101: When an abnormality is detected, a root cause analysis is performed on the abnormality to obtain the root cause of the abnormality;

[0060] During the operation of the system, various operating indicators of the system are monitored in real time. When the values ​​of the operating indicators do not meet expectations, it is determined that the system is abnormal.

[0061] In addition, some systems also have an abnormal warning mechanism, which will issue an alarm message after an abnormality occurs in the system. When an abnormal alarm message is detected, it is determined that an abnormality has occurred in the system.

[0062] Of course, in practical applications, there may be other ways to detect the occurrence of anomalies, which are not specifically limited in the embodiments of the present invention.

[0063] After the abnormality is detected, the time when the abnormality occurs and the operation data of the abnormality need to be recorded.

[0064] There are many ways to perform root cause analysis on exceptions, which are described below using several specific examples.

[0065] Example 1

[0066] Leverage machine learning models to perform root cause analysis of anomalies.

[0067] See also Figure 2 ,The root cause analysis of anomalies using machine learning models includes the following steps:

[0068] S201: Acquire abnormal operation data;

[0069] Abnormal operation data includes: data such as the subsystem or equipment where the abnormality occurs, abnormal indicators, and abnormal indicator values.

[0070] S202: The abnormal operation data is input into a pre-built root cause analysis model for processing to obtain the root cause of the abnormality. The root cause analysis model is obtained by training a preset machine learning model using training samples with labeled root cause types.

[0071] The above machine learning model can be any classification model.

[0072] The training process of the machine learning model can adopt existing machine learning technology, and the embodiments of the present invention do not specifically limit this.

[0073] The training goal of the machine learning model is to make the model prediction results close to the labeled results of the training samples so as to accurately predict the root cause of the anomaly.

[0074] Example 2

[0075] When the system has an abnormal warning mechanism, the abnormal alarm information can be used to analyze the root cause of the abnormality.

[0076] See also Figure 3 ,Using abnormal alarm information to analyze the root cause of the abnormality includes the following steps:

[0077] S301: Obtain abnormal alarm information;

[0078] S302: Analyze the abnormal alarm information to obtain the abnormal alarm object;

[0079] The abnormal alarm object can be a physical object or a virtual object, such as a physical subsystem or a business application.

[0080] S303: Determine the physical device information and / or service information where the alarm occurs according to the abnormal alarm object;

[0081] S304: Determine the root cause of the abnormality based on the physical device information and / or business information where the alarm occurs.

[0082] According to the abnormal alarm object, the physical device information and / or business information where the alarm occurs is determined, wherein the physical device information may include the identifier of the physical subsystem where the alarm occurs, and the business information may include the identifier of the business application where the alarm occurs.

[0083] The physical device information and / or business information where the alarm occurs is combined with the specific operating indicators of the abnormality to determine the root cause of the abnormality.

[0084] It should be noted that the above are only a few examples of abnormal root cause analysis. Currently, in practical applications, other root cause analysis methods can also be used in combination with application scenarios, and the embodiments of the present invention do not make specific limitations on this.

[0085] S102: Determine whether a historical anomaly with the same root cause as the anomaly has occurred within a preset time before the current moment;

[0086] It should be noted that the preset time is pre-set.

[0087] Specifically, the preset time is greater than the longest time between two anomalies with the same root cause before the fault is not recovered, wherein the longest time between two anomalies with the same root cause before the fault is not recovered is obtained based on experiments.

[0088] If yes, execute S103: merge the exception into the fault merging class corresponding to the historical exception;

[0089] If not, execute S104: determine whether a new fault occurs.

[0090] After determining that a new fault has occurred, create a fault merging class for the new fault, and subsequent exceptions with the same root cause will be merged into the fault merging class.

[0091] Since the embodiment of the present invention performs sliding window anomaly merging based on the root cause of the anomaly, accurate merging of anomalies is achieved, and the problem of merging anomalies of different faults together and not merging anomalies of the same fault will not occur. On this basis, after determining that a new fault has occurred, the new fault can be accurately and promptly and effectively handled according to the root cause of the anomaly.

[0092] Among them, a method for handling new faults according to the root cause of the abnormality can be: pre-collecting the root causes of different abnormalities in the system and the effective handling methods corresponding to the root cause of each abnormality, so as to build a fault handling knowledge base, and the fault handling knowledge base stores the fault handling methods corresponding to the root causes of different abnormalities. After determining that a new fault has occurred, the fault handling method corresponding to the root cause in the new fault merge class is queried in the fault handling knowledge base, and then the fault is effectively handled using the fault handling method.

[0093] After the fault is handled, it is necessary to determine whether the fault has been restored. If the fault has not been restored, further measures should be taken, such as analyzing the reasons why the fault has not been restored and handling the fault again, to ensure that the fault can be handled and restored in a timely and effective manner.

[0094] On this basis, see Figure 4 , an exception handling method disclosed in an embodiment of the present invention specifically includes the following steps:

[0095] S401: When an abnormality is detected, a root cause analysis is performed on the abnormality to obtain the root cause of the abnormality;

[0096] S402: Determine whether a historical anomaly with the same root cause as the anomaly has occurred within a preset time before the current moment;

[0097] If yes, execute S403: merge the exception into the fault merging class corresponding to the historical exception;

[0098] If not, execute S404: determine that a new fault has occurred;

[0099] S405: Process the new fault according to the root cause of the abnormality;

[0100] S406: Determine whether an exception having the same root cause as the exception occurs within a preset time after the current moment;

[0101] If yes, execute S407: determine that the new fault has not been restored;

[0102] If not, execute S408: determine whether the new fault has been recovered.

[0103] It can be seen that an exception handling method disclosed in an embodiment of the present invention, when an exception is detected, obtains the root cause of the exception by performing root cause analysis on the exception, and then performs sliding window exception merging based on the root cause of the exception, and determines whether a new fault has occurred and whether the fault has been recovered based on the root cause of the exception and the time when the exception occurred, thereby avoiding the problem of merging exceptions of different faults together and not merging exceptions of the same fault, thereby improving the efficiency of exception handling.

[0104] Based on the above-mentioned embodiment, an exception handling method is disclosed. This embodiment discloses an exception handling device. Figure 5 , the device comprises:

[0105] A root cause analysis unit 501 is used to perform root cause analysis on the abnormality when an abnormality is detected, to obtain the root cause of the abnormality;

[0106] The first judgment unit 502 is used to judge whether a historical anomaly with the same root cause as the anomaly occurs within a preset time before the current moment, and if so, trigger the anomaly merging unit 503, and if not, trigger the fault determination unit 504;

[0107] The exception merging unit 503 is used to merge the exception into the fault merging class corresponding to the historical exception;

[0108] The fault determination unit 504 is used to determine the occurrence of a new fault.

[0109] Optionally, the root cause analysis unit 501 is specifically configured to:

[0110] Acquiring the abnormal operation data;

[0111] Inputting the abnormal operation data into a pre-built root cause analysis model for processing to obtain the root cause of the abnormality;

[0112] The root cause analysis model is obtained by training a preset machine learning model using training samples with labeled root cause types.

[0113] Optionally, the root cause analysis unit 501 is specifically configured to:

[0114] Obtaining the abnormal warning information;

[0115] Parsing the abnormal alarm information to obtain the abnormal alarm object;

[0116] Determine the physical device information and / or business information of the alarm according to the abnormal alarm object;

[0117] The root cause of the abnormality is determined based on the physical device information and / or business information where the alarm occurs.

[0118] Optionally, the device further comprises:

[0119] The fault processing unit is used to process the new fault according to the root cause of the abnormality.

[0120] Optionally, the device further includes a second judgment unit, specifically configured to:

[0121] After processing the new fault, determining whether an abnormality having the same root cause as the abnormality occurs within a preset time after the current moment;

[0122] If so, determining that the new fault has not been restored;

[0123] If not, it is determined that the new fault has been recovered.

[0124] An exception handling device disclosed in an embodiment of the present invention, when an exception is detected, obtains the root cause of the exception by performing root cause analysis on the exception, thereby merging sliding window exceptions based on the root cause of the exception, and determining whether a new fault has occurred and whether the fault has been recovered based on the root cause of the exception and the time when the exception occurred, thereby avoiding the problem of merging exceptions of different faults together and not merging exceptions of the same fault, thereby improving the exception handling efficiency.

[0125] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0126] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0127] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0128] The above-mentioned embodiments may be combined arbitrarily. For the above description of the disclosed embodiments, the features recorded in the embodiments in this specification may be replaced or combined with each other, so that professional and technical personnel in this field can implement or use the present application.

[0129] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An exception handling method, characterized in that: include: When an abnormality is detected, a root cause analysis is performed on the abnormality to obtain the root cause of the abnormality; Determine whether a historical anomaly with the same root cause as the anomaly has occurred within a preset time before the current moment; If yes, merge the exception into the fault merging class corresponding to the historical exception; wherein the exception is merged by sliding window based on the root cause of the exception; If not, it is determined that a new fault has occurred, and a fault merging class is created for the new fault, so that subsequent exceptions with the same root cause are merged into the fault merging class created for the new fault; After determining that a new fault has occurred, the method further includes: According to the root cause of the abnormality, handle the new fault; Determine whether an exception having the same root cause as the exception occurs within a preset time after the current moment; If so, determining that the new fault has not been restored; If not, it is determined that the new fault has been recovered.

2. The method according to claim 1, characterized in that Perform root cause analysis of the anomaly, including: Acquiring the abnormal operation data; Inputting the abnormal operation data into a pre-built root cause analysis model for processing to obtain the root cause of the abnormality; The root cause analysis model is obtained by training a preset machine learning model using training samples with labeled root cause types.

3. The method according to claim 1, characterized in that Perform root cause analysis of the anomaly, including: Obtaining the abnormal warning information; Parsing the abnormal alarm information to obtain the abnormal alarm object; Determine the physical device information and / or business information of the alarm according to the abnormal alarm object; The root cause of the abnormality is determined based on the physical device information and / or business information where the alarm occurs.

4. An exception handling device, characterized in that: include: A root cause analysis unit, configured to, when an abnormality is detected, analyze the root cause of the abnormality to obtain the root cause of the abnormality; A first judgment unit is used to judge whether a historical anomaly with the same root cause as the anomaly occurs within a preset time before the current moment, and if so, trigger the anomaly merging unit; if not, trigger the fault determination unit; The exception merging unit is used to merge the exception into the fault merging class corresponding to the historical exception; wherein the exception is merged by sliding window based on the root cause of the exception; The fault determination unit is used to determine that a new fault has occurred, and to create a fault merging class for the new fault, so as to merge subsequent exceptions with the same root cause into the fault merging class created for the new fault; The device also includes: A fault processing unit, used to process the new fault according to the root cause of the abnormality; The device further includes a second judgment unit, which is specifically configured to: After processing the new fault, determining whether an abnormality having the same root cause as the abnormality occurs within a preset time after the current moment; If so, determining that the new fault has not been restored; If not, it is determined that the new fault has been recovered.

5. The abnormality handling device according to claim 4, characterized in that: The root cause analysis unit is specifically used for: Acquiring the abnormal operation data; Inputting the abnormal operation data into a pre-built root cause analysis model for processing to obtain the root cause of the abnormality; The root cause analysis model is obtained by training a preset machine learning model using training samples with labeled root cause types.

6. The abnormality handling device according to claim 4, characterized in that: The root cause analysis unit is specifically used for: Obtaining the abnormal warning information; Parsing the abnormal alarm information to obtain the abnormal alarm object; Determine the physical device information and / or business information of the alarm according to the abnormal alarm object; The root cause of the abnormality is determined based on the physical device information and / or business information where the alarm occurs.

Images