Monitoring and alarm method, system, device and storage medium for server cluster

Abstract

The present invention relates to the field of software monitoring. The present invention discloses a monitoring and alarm method for a server cluster, comprising: monitoring the operation status of the server cluster and obtaining a plurality of alarm messages provided by the server cluster; recording the plurality of alarm messages, and recording them in units of monitoring nodes associated with each alarm message; determining a plurality of normal alarm messages from the plurality of alarm messages based on actual fault information of the server cluster; determining a plurality of false alarm messages from the plurality of alarm messages based on the plurality of normal alarm messages; analyzing the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes; and adjusting the number of alarm messages for each of the target monitoring nodes. The technical solution provided by the present invention can automatically filter false alarm messages.

Description

Technical Field

[0001] The present invention relates to the field of software monitoring technology, and in particular to a monitoring alarm method, system, computer equipment and computer-readable storage medium for a server cluster. Background Art

[0002] With the development of computer science and technology, the storage and processing of big data has become a hot topic. For example, more and more companies and users are migrating various files and computing power to server clusters, thus realizing cloud storage and cloud computing.

[0003] The stability of server clusters, cloud storage, and cloud computing are crucial. For example, serious server cluster failures, such as database downtime, link disconnection, service anomalies, and production line failures, require immediate identification and prompt repair by IT system administrators, developers, and monitoring personnel to minimize the impact on normal operations. Therefore, after deploying a server cluster, a built-in monitoring system is typically included to detect abnormal events and send alerts to designated individuals or groups via email or text message.

[0004] Existing monitoring and alarm systems configure alarms based on pre-defined business requirements, providing alarm monitoring for production line operations. Alarm configurations vary, such as a percentage drop in business for several consecutive minutes, a percentage drop below a baseline, or even zero business. As mentioned above, alarms are typically sent via email or text message.

[0005] Although the above monitoring and alarm system has a notification function, when there are many servers, the problems faced by the servers are diverse, so the number and types of alarms triggered are numerous, which can easily lead to alarm flooding or even false alarms. Summary of the Invention

[0006] In view of this, an object of the embodiments of the present invention is to provide a monitoring and alarm method, system, computer device and computer-readable storage medium for a server cluster, which can solve the above-mentioned problems.

[0007] One aspect of an embodiment of the present invention provides a monitoring and alarm method for a server cluster, comprising:

[0008] Monitor the operation of the server cluster and obtain multiple alarm messages provided by the server cluster;

[0009] Recording the plurality of alarm messages, and recording the alarm messages in units of monitoring nodes associated with each alarm message;

[0010] Based on actual fault information of the server cluster, determining a plurality of normal alarm messages from the plurality of alarm messages;

[0011] Determining, according to the plurality of normal alarm messages, a plurality of false alarm messages among the plurality of alarm messages;

[0012] Analyze the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes; and

[0013] Adjust the number of alarm messages for each target monitoring node.

[0014] Preferably, the determining of a plurality of normal alarm messages from a plurality of alarm messages based on actual fault information of the server cluster includes:

[0015] Obtaining actual fault information based on the fault report, the actual fault information including a fault time period and a monitoring node associated with the fault;

[0016] Based on the fault time period and the monitoring node associated with the fault, a plurality of normal alarm messages are determined from the plurality of alarm messages. The normal alarm messages are generated within the fault time period and carry the monitoring node associated with the fault.

[0017] Preferably, analyzing the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes includes:

[0018] Performing target dimension analysis on multiple records corresponding to the multiple false alarm messages, where the target dimension includes a time dimension;

[0019] Determining each target record that meets the target law based on the time dimension;

[0020] A first label is added to the false alarm message corresponding to each target record, where the first label indicates that it is a regular false alarm message;

[0021] The monitoring node associated with each false alarm message carrying the first label is determined as the target monitoring node.

[0022] Preferably, the adjusting the number of alarm messages of each target monitoring node includes:

[0023] Adjusting the alarm message quantity threshold of the target monitoring node;

[0024] Monitoring the number of alarm messages associated with the target monitoring node;

[0025] When the number of monitored alarms is greater than a preset threshold, subsequent alarm messages associated with the target monitoring node are respectively marked with a second tag, wherein the second tag is used to indicate that the monitoring node has been adjusted;

[0026] Recording a plurality of subsequent alarm messages marked with the second label to obtain a plurality of subsequent records;

[0027] Determining whether the plurality of subsequent records conform to a target rule based on the time dimension;

[0028] If the plurality of subsequent records conform to the target rule based on the time dimension, a third label is added to the plurality of subsequent alarm messages corresponding to the plurality of subsequent records, where the third label is used to indicate that the alarm message is not to be sent.

[0029] Preferably, the target rule includes generating alarm messages exceeding a preset threshold value in a target period of each day on a daily basis;

[0030] The determining whether the plurality of subsequent records conform to the target rule based on the time dimension includes:

[0031] Performing similarity comparison on each subsequent alarm message generated within a target time period on the same day to obtain a plurality of first similarities;

[0032] Performing similarity comparison on multiple subsequent alarm messages generated within a target period of each day to obtain multiple second similarities;

[0033] If each of the first similarities and each of the second similarities is greater than the similarity threshold, it is determined that the plurality of subsequent records conform to the target rule based on the time dimension.

[0034] Preferably, the performing similarity comparison on a plurality of subsequent alarm messages generated within a target period of each day to obtain a plurality of second similarities includes:

[0035] Segment each subsequent alarm message within the target period of each day into multiple segmented word sets with days as the unit;

[0036] Sort the words in each word set from high to low according to their frequency of occurrence, so as to obtain a word sequence that corresponds one to one with each word set;

[0037] Calculating similarities for different word segmentation sequences to obtain multiple second similarities;

[0038] Each second similarity is a result calculated based on a similarity algorithm for one of the word segmentation sequences or the other word segmentation sequence.

[0039] Preferably, the method further comprises: marking each subsequent alarm message generated within the target time period with the third label respectively.

[0040] One aspect of an embodiment of the present invention further provides a monitoring and alarm system for a server cluster, comprising:

[0041] An acquisition module is used to monitor the operation of the server cluster and obtain multiple alarm messages provided by the server cluster;

[0042] A recording module, configured to record the plurality of alarm messages, and record the alarm messages in units of monitoring nodes associated with each alarm message;

[0043] A first determining module is configured to determine a plurality of normal alarm messages from the plurality of alarm messages based on actual fault information of the server cluster;

[0044] A second determining module is used to determine a plurality of false alarm messages among the plurality of alarm messages according to the plurality of normal alarm messages;

[0045] A third determination module is configured to analyze the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes; and

[0046] The adjustment module is used to adjust the number of alarm messages of each target monitoring node.

[0047] An aspect of an embodiment of the present invention further provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it is used to implement the steps of the monitoring and alarm method for a server cluster as described above.

[0048] One aspect of an embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program. The computer program can be executed by at least one processor to enable the at least one processor to perform the steps of the monitoring and alarm method for a server cluster as described above.

[0049] The server cluster monitoring and alarm method, system, device, and computer-readable storage medium provided by the embodiments of the present invention have the following technical advantages:

[0050] When a large number of monitoring nodes (e.g., monitoring nodes based on business domains, business indicators, and alarm identifiers) generate a massive amount of alarm messages, the system can identify target monitoring nodes that may be generating false alarms and automatically reduce the number of alarm messages for these target monitoring nodes. This automatically filters out false alarm messages, allowing for more automated adjustments to target monitoring nodes, thus reducing the number of false alarm messages.

[0051] By automatically adjusting the number of false alarm messages sent, IT administrators or developers can focus more on the sensitivity of alarm messages. That is, when they receive an alarm message, they can confirm whether there is really a problem on the production line. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 The following schematically shows a flow chart of a monitoring and alarm method for a server cluster according to the first embodiment of the present invention;

[0053] Figure 2 A block diagram schematically shows a monitoring and alarm system for a server cluster according to a second embodiment of the present invention; and

[0054] Figure 3 The following schematically shows a hardware architecture diagram of a computer device suitable for implementing a monitoring and alarm method for a server cluster according to a third embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0056] It should be noted that the descriptions of "first", "second", etc. in the embodiments of the present invention are for descriptive purposes only and should not be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" or "second" may explicitly or implicitly include at least one of such features. In addition, the technical solutions between the various embodiments can be combined with each other, but this must be based on the fact that they can be implemented by ordinary technicians in this field. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0057] In the description of the present invention, it should be understood that the numerical labels before the steps do not identify the order in which the steps are executed, but are only used to facilitate the description of the present invention and to distinguish each step, and therefore should not be understood as a limitation of the present invention.

[0058] Example 1

[0059] Figure 1 The flowchart of the monitoring and alarm method for a server cluster according to the first embodiment of the present invention is schematically shown.

[0060] like Figure 1 As shown, the monitoring and alarm method for a server cluster may include steps S100 to S105, wherein:

[0061] S100: Monitor the operation status of a server cluster and obtain multiple alarm messages provided by the server cluster.

[0062] In this embodiment, the server cluster can be a distributed cluster, consisting of a large number of servers for mass storage and massive computing. The servers can be connected via routers, repeaters, hubs, and switches. This server cluster can be used to process a wide range of services, such as life insurance, wealth management, and production line services. It should be noted that the aforementioned services are merely exemplary and are not intended to limit the scope of protection of this invention.

[0063] Faced with a large number of different business types, it is necessary to monitor alarms to understand the current status of each monitoring node. In particular, for some serious faults such as database downtime, link disconnection, business anomalies, production line failures, etc., it is necessary to notify relevant personnel to understand the abnormalities immediately and repair them as soon as possible to minimize the impact on the normal business of the production line.

[0064] Therefore, it is necessary to monitor the data in the server cluster in real time and receive an alarm message when an abnormality is found.

[0065] S101 , recording a plurality of alarm messages, and recording in units of monitoring nodes associated with each alarm message.

[0066] Since server clusters usually have to process massive amounts of business, they may generate massive amounts of alarm messages.

[0067] Massive alert messages can lead to an overflow of alerts, increasing the pressure on monitoring systems and reducing the sensitivity of relevant personnel to important alerts. This prevents them from promptly addressing urgent server cluster issues. Alert messages are typically sent to relevant personnel's clients via email or text messages. For example, a large number of emails can increase the burden on monitoring systems and the workload of relevant personnel.

[0068] The inventors discovered that among the numerous alarm messages, some are often false alarms. For example, normal declines in production line business, baseline changes caused by production line stress testing, production line code releases, system changes and maintenance, etc., can all trigger the generation of alarm messages. If these alarm messages do not require processing, they are considered false alarms.

[0069] Therefore, in this embodiment, a large number of acquired alarm messages (ie, a plurality of the alarm messages) are recorded, and based on the records over a period of time, it is further analyzed whether the server cluster is currently generating false alarm messages.

[0070] Monitoring nodes can be business domains, business indicators, and alarm indicators.

[0071] In this embodiment, each alarm message is recorded with the service domain, service indicator, and alarm indicator as the smallest unit. The possibility of false alarm messages is analyzed based on the service domain, service indicator, and alarm indicator dimensions.

[0072] S102: Determine a plurality of normal alarm messages from the plurality of alarm messages based on actual fault information of the server cluster.

[0073] In this embodiment, a normal alarm message, ie, a non-false alarm message, is first determined.

[0074] Furthermore, in order to effectively determine normal alarm messages and thus learn possible false alarm messages, S103 may be implemented through the following steps:

[0075] S102A, obtaining actual fault information based on the fault report, the actual fault information including the fault time period and the monitoring node associated with the fault;

[0076] S102B, based on the fault time period and the monitoring node associated with the fault, determine multiple normal alarm messages from the multiple alarm messages, where the normal alarm messages are generated within the fault time period and carry the monitoring node associated with the fault.

[0077] Take the alarm message of a production line failure as an example: the previously recorded alarm messages are marked as normal alarm messages based on the time period, business domain, business indicators, and alarm indicators of the production line failure report, and the remaining ones are false alarm messages.

[0078] S103: Determine, according to the plurality of normal alarm messages, a plurality of false alarm messages among the plurality of alarm messages.

[0079] In this embodiment, the multiple alarm messages include: multiple normal alarm messages and multiple false alarm messages.

[0080] S104: Analyze the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes.

[0081] Based on the multiple false alarm messages, target monitoring nodes that may still generate false alarm messages in the future can be analyzed.

[0082] Furthermore, in order to effectively and accurately detect the target monitoring node that still generates false alarm messages in the future, S104 can be implemented by the following steps:

[0083] S104A, performing target dimension analysis on multiple records corresponding to the multiple false alarm messages, where the target dimension includes a time dimension;

[0084] S104B, determining each target record that meets the target rule based on the time dimension;

[0085] S104C, adding a first label to the false alarm message corresponding to each target record, where the first label indicates that the false alarm message is regular;

[0086] S104D: Determine the monitoring node associated with each false alarm message carrying the first tag as the target monitoring node.

[0087] For example, records of false alarm messages accumulate over a period of time (e.g., one week). The number of alarms generated each day is determined by hour based on the alarm time period. If multiple records are made within the same time period on different dates, the alarm message is automatically labeled as a regular false alarm message.

[0088] S105: Adjust the number of alarm messages of each target monitoring node.

[0089] After the target monitoring node is determined, the number of alarm messages for the target monitoring node can be automatically reduced. Therefore, false alarm messages are automatically filtered out, and the alarm index is adjusted more automatically, reducing a large number of false alarm messages.

[0090] Therefore, by automatically adjusting the number of false alarm messages sent, IT administrators or developers can focus more on the sensitivity of alarm messages, that is, when they receive an alarm message, they can confirm whether a problem has really occurred.

[0091] Furthermore, S105 can be implemented through the following steps:

[0092] S105A, adjusting the alarm message quantity threshold of the target monitoring node;

[0093] S105B, monitoring the alarm quantity of alarm messages associated with the target monitoring node;

[0094] S105C, when the number of monitored alarms is greater than a preset threshold, marking subsequent alarm messages associated with the target monitoring node with a second tag, wherein the second tag is used to indicate that the monitoring node has been adjusted;

[0095] S105D, recording multiple subsequent alarm messages marked with the second label to obtain multiple subsequent records;

[0096] S105E, determining whether the plurality of subsequent records conform to the target rule based on the time dimension;

[0097] S105F: If the plurality of subsequent records conform to the target rule based on the time dimension, a third label is added to the plurality of subsequent alarm messages corresponding to the plurality of subsequent records, where the third label is used to indicate that the alarm message is not to be sent.

[0098] In the above scheme: (1) The target monitoring node marked as a regular false alarm message will adjust the alarm message data threshold to reduce the number of false alarm messages. At the same time, the alarm messages that exceed the alarm message number threshold will be marked with a label indicating that the alarm indicator has been adjusted. (2) These alarm indicators marked as adjusted will record an alarm message again. If it is shown that regular alarm messages are still generated in the future, they will be marked with a label indicating that no more alarms will be generated (i.e., the third label). No more alarms will be generated in the future, further reducing false alarm messages.

[0099] Furthermore, the target rule includes generating alarm messages exceeding a preset threshold value in a target period of each day on a daily basis;

[0100] To improve the accuracy of target pattern determination and prevent misjudgment as "false alarm messages," the S105E can implement the following steps:

[0101] S105E1, performing similarity comparison on each subsequent alarm message generated within a target period of the same day to obtain a plurality of first similarities;

[0102] S105E2, performing similarity comparison on multiple subsequent alarm messages generated within the target time period of each day to obtain multiple second similarities;

[0103] S105E3: If each of the first similarities and each of the second similarities is greater than the similarity threshold, it is determined that the plurality of subsequent records conform to the target rule based on the time dimension.

[0104] Furthermore, to further improve the determination accuracy, step S105E2 can be implemented by the following steps:

[0105] Segment each subsequent alarm message within the target period of each day into multiple segmented word sets with days as the unit;

[0106] Sort the words in each word set from high to low according to their frequency of occurrence, so as to obtain a word sequence that corresponds one to one with each word set;

[0107] Calculating similarities for different word segmentation sequences to obtain multiple second similarities;

[0108] Each second similarity is a result calculated based on a similarity algorithm for one of the word segmentation sequences or the other word segmentation sequence.

[0109] Furthermore, the method may further include: tagging each subsequent alarm message generated within the target time period with the third tag. In this embodiment, the same target monitoring node (using business domain, business indicator, and alarm indicator as the minimum unit) may generate false alarm messages in a certain time period, while generating normal alarm messages in other time periods. To prevent the blocking of normal alarm messages, only alarm messages within the target time period are blocked.

[0110] The monitoring and alarm method for a server cluster according to an embodiment of the present invention:

[0111] (1) When a large number of monitoring nodes (e.g., monitoring nodes with business domains, business indicators, and alarm identifiers as the smallest units) generate a large number of alarm messages, the target monitoring nodes that may generate false alarms can be identified from the large number of monitoring nodes, and the number of alarm messages for the target monitoring nodes can be automatically reduced. In other words, false alarm messages can be automatically filtered out, and the adjustment of target monitoring nodes can be more automatically performed, thereby reducing a large number of false alarm messages.

[0112] By automatically adjusting the number of false alarm messages sent, IT administrators or developers can focus more on the sensitivity of alarm messages. That is, when they receive an alarm message, they can confirm whether there is really a problem on the production line.

[0113] Taking production line operations as an example, this can more accurately reflect the actual needs of production line monitoring. While many factors can cause business fluctuations in practice, production line issues are still a minority. False alarms caused by business fluctuations are also common, seriously affecting the sensitivity of IT administrators and developers to production line issues. This embodiment significantly mitigates the problem of false alarms and provides valid and reliable feedback to monitoring personnel, allowing them to more effectively resolve and address these production line issues.

[0114] (2) There is no need to develop a large number of new plug-ins (or manually set them up) to update the processing of different alarm messages, which provides good flexibility.

[0115] Example 2

[0116] Figure 2 The following schematically illustrates a block diagram of a server cluster monitoring and alarm system according to a second embodiment of the present invention. This server cluster monitoring and alarm system can be divided into one or more program modules, each of which is stored in a storage medium and executed by one or more processors to implement the embodiment of the present invention. A program module, as used in the embodiments of the present invention, refers to a series of computer program instruction segments that can perform specific functions. The following description will specifically describe the functions of each program module in this embodiment.

[0117] like Figure 2 As shown, the monitoring and alarm system 200 for a server cluster may include an acquisition module 210, a recording module 220, a first determination module 230, a second determination module 240, a third determination module 250, and an adjustment module 260, wherein:

[0118] An acquisition module 210 is configured to monitor the operation of the server cluster and obtain multiple alarm messages provided by the server cluster;

[0119] The recording module 220 is used to record the plurality of alarm messages, and record the alarm messages in units of monitoring nodes associated with each alarm message;

[0120] A first determining module 230 is configured to determine a plurality of normal alarm messages from the plurality of alarm messages based on actual fault information of the server cluster;

[0121] A second determining module 240 is configured to determine, based on the plurality of normal alarm messages, a plurality of false alarm messages among the plurality of alarm messages;

[0122] A third determining module 250 is configured to analyze the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes; and

[0123] The adjustment module 260 is configured to adjust the number of alarm messages of each target monitoring node.

[0124] Preferably, the first determining module 230 is further configured to:

[0125] Obtaining actual fault information based on the fault report, the actual fault information including a fault time period and a monitoring node associated with the fault;

[0126] Based on the fault time period and the monitoring node associated with the fault, a plurality of normal alarm messages are determined from the plurality of alarm messages. The normal alarm messages are generated within the fault time period and carry the monitoring node associated with the fault.

[0127] Preferably, the third determining module 250 is further configured to:

[0128] Performing target dimension analysis on multiple records corresponding to the multiple false alarm messages, where the target dimension includes a time dimension;

[0129] Determining each target record that meets the target law based on the time dimension;

[0130] A first label is added to the false alarm message corresponding to each target record, where the first label indicates that it is a regular false alarm message;

[0131] The monitoring node associated with each false alarm message carrying the first label is determined as the target monitoring node.

[0132] Preferably, the adjustment module 260 is further configured to:

[0133] Adjusting the alarm message quantity threshold of the target monitoring node;

[0134] Monitoring the number of alarm messages associated with the target monitoring node;

[0135] When the number of monitored alarms is greater than a preset threshold, subsequent alarm messages associated with the target monitoring node are respectively marked with a second tag, wherein the second tag is used to indicate that the monitoring node has been adjusted;

[0136] Recording a plurality of subsequent alarm messages marked with the second label to obtain a plurality of subsequent records;

[0137] Determining whether the plurality of subsequent records conform to a target rule based on the time dimension;

[0138] If the plurality of subsequent records conform to the target rule based on the time dimension, a third label is added to the plurality of subsequent alarm messages corresponding to the plurality of subsequent records, where the third label is used to indicate that the alarm message is not to be sent.

[0139] Preferably, the target rule includes generating alarm messages exceeding a preset threshold value in a target period of each day on a daily basis;

[0140] The adjustment module 260 is further configured to:

[0141] Performing similarity comparison on each subsequent alarm message generated within a target time period on the same day to obtain a plurality of first similarities;

[0142] Performing similarity comparison on multiple subsequent alarm messages generated within a target period of each day to obtain multiple second similarities;

[0143] If each of the first similarities and each of the second similarities is greater than the similarity threshold, it is determined that the plurality of subsequent records conform to the target rule based on the time dimension.

[0144] Preferably, the adjustment module 260 is further configured to:

[0145] Segment each subsequent alarm message within the target period of each day into multiple segmented word sets with days as the unit;

[0146] Sort the words in each word set from high to low according to their frequency of occurrence, so as to obtain a word sequence that corresponds one to one with each word set;

[0147] Calculating similarities for different word segmentation sequences to obtain multiple second similarities;

[0148] Each second similarity is a result calculated based on a similarity algorithm for one of the word segmentation sequences or the other word segmentation sequence.

[0149] Preferably, the adjustment module 260 is further configured to: add the third label to each subsequent alarm message generated within the target time period.

[0150] Example 3

[0151] Figure 3 The following schematically illustrates the hardware architecture of a computer device suitable for implementing a monitoring and alarm method for a server cluster according to the third embodiment of the present invention. In this embodiment, the computer device 10000 is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions. For example, it can be a rack server, blade server, tower server, or cabinet server (including an independent server or a server cluster composed of multiple servers). Figure 3 As shown, the computer device 10000 includes at least but is not limited to: a memory 10010, a processor 10020, and a network interface 10030 that can communicate with each other via a system bus.

[0152] Memory 10010 includes at least one type of computer-readable storage medium, including flash memory, a hard disk, a multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, a magnetic disk, an optical disk, and the like. In some embodiments, memory 10010 may be an internal storage module of computer device 10000, such as a hard disk or internal memory of computer device 10000. In other embodiments, memory 10010 may also be an external storage device of computer device 10000, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, and the like equipped on computer device 10000. Of course, memory 10010 may also include both internal storage modules and external storage devices of computer device 10000. In this embodiment, the memory 10010 is generally used to store the operating system and various application software installed on the computer device 10000, such as program code for a monitoring and alarm method for a server cluster. In addition, the memory 10010 can also be used to temporarily store various data that has been output or is about to be output.

[0153] In some embodiments, processor 10020 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. Processor 10020 is typically used to control the overall operation of computer device 10000, such as performing control and processing related to data exchange or communication with computer device 10000. In this embodiment, processor 10020 is used to execute program code stored in memory 10010 or process data.

[0154] Network interface 10030 may include a wireless network interface or a wired network interface. Network interface 10030 is typically used to establish a communication link between computer device 10000 and other computer devices. For example, network interface 10030 is used to connect computer device 10000 to an external terminal via a network, establishing a data transmission channel and a communication link between computer device 10000 and the external terminal. The network may be a wireless or wired network such as an intranet, the Internet, the Global System of Mobile Communications (GSM), Wideband Code Division Multiple Access (WCDMA), a 4G network, a 5G network, Bluetooth, or Wi-Fi.

[0155] It should be pointed out that Figure 3 Only a computer device having components 10010 - 10030 is shown, but it should be understood that implementation of all of the shown components is not a requirement, and greater or fewer components may alternatively be implemented.

[0156] In this embodiment, the monitoring and alarm method for a server cluster stored in the memory 10010 can also be divided into one or more program modules and executed by one or more processors (processor 10020 in this embodiment) to complete the present invention.

[0157] Example 4

[0158] This embodiment further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the monitoring and alarm method for a server cluster in the embodiment are implemented.

[0159] In this embodiment, computer-readable storage media include flash memory, hard disks, multimedia cards, card-type memories (e.g., SD or DX memories), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, magnetic disks, optical disks, and the like. In some embodiments, the computer-readable storage medium may be an internal storage unit of a computer device, such as the computer device's hard disk or memory. In other embodiments, the computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, and the like. Of course, the computer-readable storage medium may also include both the internal storage unit and external storage devices of the computer device. In this embodiment, the computer-readable storage medium is typically used to store the operating system and various application software installed on the computer device, such as the program code of the server cluster monitoring and alarm method described in the embodiment. In addition, the computer-readable storage medium may also be used to temporarily store various types of data that has been output or is about to be output.

[0160] Obviously, those skilled in the art should understand that the various modules or steps of the above-mentioned embodiments of the present invention can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices. Alternatively, they can be implemented using program code executable by the computing device, so that they can be stored in a storage device and executed by the computing device. In some cases, the steps shown or described can be performed in a different order than herein, or they can be made into separate integrated circuit modules, or multiple modules or steps can be made into a single integrated circuit module for implementation. Thus, the embodiments of the present invention are not limited to any specific combination of hardware and software.

[0161] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A monitoring and alarm method for a server cluster, characterized in that: include: Monitor the operation of the server cluster and obtain multiple alarm messages provided by the server cluster; Recording the plurality of alarm messages, and recording the alarm messages in units of monitoring nodes associated with each alarm message; Based on actual fault information of the server cluster, determining a plurality of normal alarm messages from the plurality of alarm messages; Determining, according to the plurality of normal alarm messages, a plurality of false alarm messages among the plurality of alarm messages; Analyze the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes; and Adjusting the number of alarm messages for each target monitoring node; The determining, based on the actual fault information of the server cluster, a plurality of normal alarm messages from the plurality of alarm messages comprises: Obtaining actual fault information based on the fault report, the actual fault information including a fault time period and a monitoring node associated with the fault; Determining a plurality of normal alarm messages from the plurality of alarm messages based on the fault time period and the monitoring node associated with the fault, wherein the normal alarm messages are generated within the fault time period and carry the monitoring node associated with the fault; The analyzing the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes includes: Performing target dimension analysis on multiple records corresponding to the multiple false alarm messages, where the target dimension includes a time dimension; Determining each target record that meets the target law based on the time dimension; A first label is added to the false alarm message corresponding to each target record, where the first label indicates that it is a regular false alarm message; Determining a monitoring node associated with each false alarm message carrying the first label as a target monitoring node; The adjusting the number of alarm messages of each target monitoring node includes: Adjusting the alarm message quantity threshold of the target monitoring node; Monitoring the number of alarm messages associated with the target monitoring node; When the number of monitored alarms is greater than a preset threshold, subsequent alarm messages associated with the target monitoring node are respectively marked with a second label, wherein the second label is used to indicate that the monitoring node has been adjusted; Recording a plurality of subsequent alarm messages marked with the second label to obtain a plurality of subsequent records; Determining whether the plurality of subsequent records conform to a target rule based on the time dimension; If the plurality of subsequent records conform to the target rule based on the time dimension, a third label is added to the plurality of subsequent alarm messages corresponding to the plurality of subsequent records, where the third label is used to indicate that the alarm message is not to be sent.

2. The monitoring and alarm method for a server cluster according to claim 1, characterized in that: The target rule includes generating alarm messages exceeding a preset threshold value during a target period of each day on a daily basis; The determining whether the plurality of subsequent records conform to the target rule based on the time dimension includes: Performing similarity comparison on each subsequent alarm message generated within a target time period on the same day to obtain a plurality of first similarities; Performing similarity comparison on multiple subsequent alarm messages generated within a target period of each day to obtain multiple second similarities; If each of the first similarities and each of the second similarities is greater than the similarity threshold, it is determined that the plurality of subsequent records conform to the target rule based on the time dimension.

3. The monitoring and alarm method for a server cluster according to claim 2, characterized in that: The similarity comparison of the multiple subsequent alarm messages generated within the target time period of each day to obtain multiple second similarities includes: Segment each subsequent alarm message within the target period of each day into multiple segmented word sets with days as the unit; Sort the words in each word set from high to low according to their frequency of occurrence, so as to obtain a word sequence that corresponds one to one with each word set; Calculating similarities for different word segmentation sequences to obtain multiple second similarities; Each second similarity is a result calculated based on a similarity algorithm for one of the word segmentation sequences or the other word segmentation sequence.

4. The monitoring and alarm method for a server cluster according to claim 2, characterized in that: The method further includes: marking each subsequent alarm message generated within the target time period with the third label.

5. A monitoring and alarm system for a server cluster, characterized in that: include: An acquisition module is used to monitor the operation of the server cluster and obtain multiple alarm messages provided by the server cluster; A recording module, configured to record the plurality of alarm messages, and record the alarm messages in units of monitoring nodes associated with each alarm message; A first determining module is configured to determine a plurality of normal alarm messages from the plurality of alarm messages based on actual fault information of the server cluster; A second determining module is used to determine a plurality of false alarm messages among the plurality of alarm messages according to the plurality of normal alarm messages; A third determination module is used to analyze the records corresponding to each of the false alarm messages and determine one or more target monitoring nodes; and An adjustment module, configured to adjust the number of alarm messages of each target monitoring node; The determining of a plurality of normal alarm messages from the plurality of alarm messages based on the actual fault information of the server cluster includes: Obtaining actual fault information based on the fault report, the actual fault information including a fault time period and a monitoring node associated with the fault; Determining a plurality of normal alarm messages from the plurality of alarm messages based on the fault time period and the monitoring node associated with the fault, wherein the normal alarm messages are generated within the fault time period and carry the monitoring node associated with the fault; The analyzing the records corresponding to each of the false alarm messages to determine one or more target monitoring nodes includes: Performing target dimension analysis on multiple records corresponding to the multiple false alarm messages, where the target dimension includes a time dimension; Determining each target record that meets the target law based on the time dimension; A first label is added to the false alarm message corresponding to each target record, where the first label indicates that it is a regular false alarm message; Determining a monitoring node associated with each false alarm message carrying the first label as a target monitoring node; The adjusting the number of alarm messages of each target monitoring node includes: Adjusting the alarm message quantity threshold of the target monitoring node; Monitoring the number of alarm messages associated with the target monitoring node; When the number of monitored alarms is greater than a preset threshold, subsequent alarm messages associated with the target monitoring node are respectively marked with a second label, wherein the second label is used to indicate that the monitoring node has been adjusted; Recording a plurality of subsequent alarm messages marked with the second label to obtain a plurality of subsequent records; Determining whether the plurality of subsequent records conform to a target rule based on the time dimension; If the plurality of subsequent records conform to the target rule based on the time dimension, a third label is added to the plurality of subsequent alarm messages corresponding to the plurality of subsequent records, where the third label is used to indicate that the alarm message is not to be sent.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, it is used to implement the steps of the monitoring and alarm method for a server cluster as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which can be executed by at least one processor to enable the at least one processor to perform the steps of the monitoring and alarm method for a server cluster as described in any one of claims 1 to 4.

Images