A server alarm propagation knowledge graph construction method, device and storage medium

Abstract

The present invention discloses a method, device and storage medium for constructing a server alarm propagation knowledge graph, wherein the method searches for the causal relationship of alarm information of the same alarm business entity to obtain the candidate causal relationship structure of the alarm in the alarm business entity; searches for the alarm causal relationship between each alarm business entity to obtain the alarm causal relationship structure between the alarm business entities; and calculates the information transfer entropy under the alarm causal relationship structure between the alarm business entities according to the information transfer entropy under the candidate causal relationship structure of the alarm in each alarm business entity; determines the causal relationship between the alarm information according to the causal relationship structure corresponding to the maximum value of the information transfer entropy under the alarm causal relationship structure between the alarm business entities, thereby forming a server alarm propagation knowledge graph. The knowledge graph can be used to quickly retrieve and filter the relevant alarm information for the relevant business of the alarm information.

Description

Technical Field

[0001] The present invention relates to a method, device and storage medium for constructing a server alarm propagation knowledge graph, and belongs to the technical field of cloud data processing. Background Art

[0002] The operation and maintenance layers of cloud data centers are complex, including the host device layer, information platform layer, and service call layer. The operation and maintenance scenarios are strongly related to the business. The network relationships in cloud data centers are complex, there are many application call relationships, the amount of text data is large, and the method constructed by domain experts is inefficient. Various types of text data in cloud data centers, such as alarm logs and fault logs, are updated quickly and have a wide range of data sources. The existing static alarm knowledge graphs are difficult to solve multiple task problems. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art and to provide a method, device and storage medium for constructing a server alarm propagation knowledge graph. By mining the causal relationship of alarm information, the construction of an alarm propagation knowledge graph is realized. When a large number of related alarms occur in a cloud data center, the related businesses of the alarm information can be quickly retrieved and the related alarm information can be screened.

[0004] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0005] In a first aspect, the present invention provides a method for constructing a server alarm propagation knowledge graph, comprising:

[0006] According to the server business knowledge constraints, search and determine the alarm business entity of the alarm information;

[0007] Search the causal relationship of alarm information of the same alarm business entity to obtain the candidate causal relationship structure of alarms in the alarm business entity; and calculate the information transfer entropy under the candidate causal relationship structure of alarms in the alarm business entity based on the alarm log information;

[0008] Search the alarm causal relationship between each alarm business entity to obtain the alarm causal relationship structure between the alarm business entities; and calculate the information transfer entropy under the alarm causal relationship structure between the alarm business entities according to the information transfer entropy under the alarm candidate causal relationship structure in each alarm business entity;

[0009] Determine the causal relationship between alarm information according to the causal relationship structure corresponding to the maximum value of the information transfer entropy under the alarm causal relationship structure between alarm business entities;

[0010] The alarm business entity, alarm information and the causal relationship between the alarm information are entered into the knowledge graph to form a server alarm propagation knowledge graph.

[0011] In combination with the first aspect, further, according to the server business knowledge constraint condition, the method for searching and determining the alarm business entity of the alarm information includes:

[0012] Alarm information belonging to only one alarm business entity is directly assigned to the alarm business entity;

[0013] For the remaining alarm information, the alarm information that has a parent alarm information in the previous alarm business entity is classified into the previous alarm business entity; the alarm information that has a child alarm information in the next alarm business entity is classified into the next alarm business entity.

[0014] In combination with the first aspect, further, alarm information that has both parent alarm information in the previous alarm business entity and child alarm information in the subsequent alarm business entity is determined to be associated alarm information; the associated alarm information is used for alarm business entity division of other alarm information and is not included in any alarm business entity.

[0015] In combination with the first aspect, further, for alarm information in which both the alarm information itself and the associated alarm information are irrelevant to the current alarm service entity, an alarm transfer relationship is set for them.

[0016] In combination with the first aspect, further, the information transfer entropy under the alarm candidate causal relationship structure in the alarm service entity is calculated and obtained using formula (1):

[0017]

[0018] in, For the sth alarm business entity in the causal relationship structure G s The alarm information X at the next time t s Information transfer entropy; They are respectively the alarm information X at time t+1 and time t in the alarm log information s The alarm status, 0 means no alarm, 1 means alarm; is the alarm information X of the sth alarm service entity s possible permutations and combinations of ; For alarm log information Joint probability of alarm combinations; express exist Conditional probability under alarm information, express exist Conditional probability under alarm state.

[0019] In combination with the first aspect, further, the information transfer entropy under the alarm causal relationship structure between the alarm business entities is calculated and obtained using formula (2):

[0020]

[0021] Where: TE(G W ) is the alarm causal relationship structure G between alarm business entities W Information transfer entropy under G W is the alarm causal relationship structure with W alarm business entities; For the yth alarm business entity in the alarm causal relationship structure G y The alarm information X at the next time t y Information transfer entropy; is the associated alarm information X of the yth alarm business entity y possible permutations and combinations of ; X at time t y The actual alarm status.

[0022] In a second aspect, the present invention provides a server alarm propagation knowledge graph construction device, comprising:

[0023] The first search module is used to search and determine the alarm business entity of the alarm information according to the server business knowledge constraint condition;

[0024] The second search module is used to search for the causal relationship of the alarm information of the same alarm business entity, and obtain the candidate causal relationship structure of the alarm in the alarm business entity;

[0025] The first calculation module is used to calculate the information transfer entropy under the alarm candidate causal relationship structure in the alarm business entity based on the alarm log information;

[0026] The third search module is used to search the alarm causal relationship between each alarm business entity and obtain the alarm causal relationship structure between the alarm business entities;

[0027] The second calculation module is used to calculate the information transfer entropy under the alarm causal relationship structure between alarm business entities according to the information transfer entropy under the alarm candidate causal relationship structure in each alarm business entity;

[0028] Determination module: used to determine the causal relationship between alarm information according to the causal relationship structure corresponding to the maximum value of the information transfer entropy under the alarm causal relationship structure between alarm business entities;

[0029] Input module: used to enter the alarm business entity, alarm information and the causal relationship between the alarm information into the knowledge graph to form a server alarm propagation knowledge graph.

[0030] In combination with the second aspect, further, the first search module is specifically used to directly classify the alarm information that belongs only to a certain alarm business entity into the alarm business entity; and for the remaining alarm information, classify the alarm information that has parent alarm information in the previous alarm business entity into the previous alarm business entity; and classify the alarm information that has child alarm information in the subsequent alarm business entity into the subsequent alarm business entity.

[0031] In a third aspect, the present invention provides a terminal, including a processor and a storage medium;

[0032] The storage medium is used to store instructions;

[0033] The processor is used to operate according to the instructions to execute the steps of any method described in the first aspect.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] The present invention mines and analyzes the causal relationship between alarm information by calculating the information transfer entropy under the alarm causal relationship structure between alarm business entities, thereby obtaining a queryable server alarm propagation knowledge graph. When a large number of related alarms occur in the cloud data center, the server alarm propagation knowledge graph can be used to quickly retrieve and filter related alarm information for related businesses, providing a basis for fault tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of a method for constructing a server alarm propagation knowledge graph provided by an embodiment of the present invention;

[0038] Figure 2 It is a server alarm propagation knowledge graph constructed according to the server alarm propagation knowledge graph construction method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The present invention provides a method, device and storage medium for constructing a server alarm propagation knowledge graph. The knowledge graph construction method realizes structural learning of server alarm information on the basis of segmenting multiple business modules of the server, mines the causal relationship between alarm information from massive server monitoring data by calculating the information transfer entropy under the alarm causal relationship structure between alarm business entities, and constructs an alarm propagation knowledge graph that can be used for tracing the server alarm information.

[0040] The technical solution of the present invention is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0041] Embodiment 1:

[0042] Figure 1 This is a flow chart of a method for constructing a server alarm propagation knowledge graph in the first embodiment of the present invention. The method for constructing a server alarm propagation knowledge graph provided in this embodiment can be applied to a terminal and can be executed by a server alarm propagation knowledge graph construction device, which can be implemented by software and / or hardware, and the device can be integrated in a terminal. Figure 1 The method of this implementation specifically includes the following steps:

[0043] Step 1: Search and determine the alarm business entity of the alarm information according to the server business knowledge constraint condition;

[0044] It should be noted that, in the embodiment of the present invention, the so-called alarm service entity is an entity definition of the services of the server's host device layer, information system layer and service scheduling layer based on the server's service knowledge.

[0045] Step 2: Search the causal relationship of the alarm information of the same alarm business entity to obtain the candidate causal relationship structure of the alarm in the alarm business entity; and calculate the information transfer entropy under the candidate causal relationship structure of the alarm in the alarm business entity based on the alarm log information;

[0046] Step 3: Search the alarm causal relationship between each alarm business entity to obtain the alarm causal relationship structure between the alarm business entities; and calculate the information transfer entropy under the alarm causal relationship structure between the alarm business entities according to the information transfer entropy under the alarm candidate causal relationship structure in each alarm business entity;

[0047] Step 4: Determine the causal relationship between alarm information according to the causal relationship structure corresponding to the maximum value of the information transfer entropy under the alarm causal relationship structure between alarm business entities;

[0048] Step 5: Enter the alarm business entity, alarm information and the causal relationship between the alarm information into the knowledge graph to form a server alarm propagation knowledge graph.

[0049] The overall alarm information of the server business may include server alarm information, memory alarm information, application alarm information, and network hardware alarm information, etc. The alarm business entity to which each category of alarm information belongs may be determined according to the server business knowledge constraint condition. As an embodiment of the present invention, the method of searching and determining the alarm business entity of the alarm information according to the server business knowledge constraint condition described in step 1 includes:

[0050] Alarm information belonging to only one alarm business entity is directly assigned to the alarm business entity;

[0051] For the remaining alarm information, secondary classification can be continued, and the alarm information with parent alarm information in the previous alarm business entity can be classified into the previous alarm business entity; the alarm information with child alarm information in the subsequent alarm business entity can be classified into the subsequent alarm business entity.

[0052] Alarm information having both parent alarm information in the previous alarm service entity and child alarm information in the next alarm service entity is determined as associated alarm information; the associated alarm information is used for alarm service entity division of other alarm information and is not classified into any alarm service entity.

[0053] For alarm information that is not related to the current alarm business entity, both the alarm information itself and the associated alarm information can be screened out separately, and after structural integration, an alarm transfer relationship can be artificially added according to process knowledge constraints.

[0054] As an embodiment of the present invention, the candidate causal relationship structure of the alarm in the alarm service entity is determined by calculating the information transfer entropy under the alarm causal relationship structure within each service and between services. The information transfer entropy can be calculated and obtained using formula (1):

[0055]

[0056] in, For the sth alarm business entity in the causal relationship structure G s The alarm information X at the next time t s Information transfer entropy; They are respectively the alarm information X at time t+1 and time t in the alarm log information s The alarm status, 0 means no alarm, 1 means alarm; is the alarm information X of the sth alarm service entity s possible permutations and combinations of ; For alarm log information Joint probability of alarm combinations; express exist Conditional probability under alarm information, express exist Conditional probability under alarm state.

[0057] Let C s,c is all the alarm information in the cth business entity except the alarm information associated with the sth business entity. s,c There is no cause alarm information in the s business entity, so Through derivation, we can know that the causal relationship topology network G between multiple business entities W The transfer entropy calculation formula is the causal relationship network G of the internal alarm information of each business entity s Therefore, the information transfer entropy under the alarm causal relationship structure between the alarm business entities can be calculated and obtained using formula (2):

[0058]

[0059] Where: TE(G W ) is the alarm causal relationship structure G between alarm business entities W Information transfer entropy under G W is the alarm causal relationship structure with W alarm business entities; For the yth alarm business entity in the alarm causal relationship structure G y The alarm information X at the next time t y Information transfer entropy; is the associated alarm information X of the yth alarm business entity y possible permutations and combinations of ; X at time t y The actual alarm status.

[0060] In the embodiment of the present invention, various possible alarm information propagation topology structures G={G 1 ,G 2 ,.....}, and then calculate the causal relationship network G of each alarm information I ∈G,I=1,2,3.... Information transfer entropy TE(G I ).

[0061] The following is an analysis based on specific examples:

[0062] According to business knowledge constraints, business and alarm entities include: servers, switches, services, alarms, etc.

[0063] The alarm_id of the server-related alarm set is: 112, 113, 114, 115;

[0064] The alarm_id of the switch-related alarm set is: 216, 217;

[0065] The alarm_id of the service-related alarm set is: 311, 313, 315, 316;

[0066] By calculating the transfer information entropy of the alarm log, the most likely alarm causal relationship structure is: 217→114→311; 112→115; 311→315→316. Figure 2 As shown, it is an alarm propagation knowledge graph constructed according to the method provided in an embodiment of the present invention.

[0067] To summarize, the embodiment of the present invention mines and analyzes the causal relationship between alarm information by calculating the information transfer entropy under the alarm causal relationship structure between alarm business entities, thereby obtaining a queryable server alarm propagation knowledge graph. When a large number of related alarms occur in the cloud data center, the server alarm propagation knowledge graph can be used to quickly retrieve and filter related alarm information for related businesses, providing a basis for fault tracing.

[0068] Embodiment 2:

[0069] The embodiment of the present invention provides a server alarm propagation knowledge graph construction device, which can be used to implement the method described in the first embodiment, specifically including:

[0070] The first search module is used to search and determine the alarm business entity of the alarm information according to the server business knowledge constraint condition;

[0071] The second search module is used to search for the causal relationship of the alarm information of the same alarm business entity, and obtain the candidate causal relationship structure of the alarm in the alarm business entity;

[0072] The first calculation module is used to calculate the information transfer entropy under the alarm candidate causal relationship structure in the alarm business entity based on the alarm log information;

[0073] The third search module is used to search the alarm causal relationship between each alarm business entity and obtain the alarm causal relationship structure between the alarm business entities;

[0074] The second calculation module is used to calculate the information transfer entropy under the alarm causal relationship structure between alarm business entities according to the information transfer entropy under the alarm candidate causal relationship structure in each alarm business entity;

[0075] Determination module: used to determine the causal relationship between alarm information according to the causal relationship structure corresponding to the maximum value of the information transfer entropy under the alarm causal relationship structure between alarm business entities;

[0076] Input module: used to enter the alarm business entity, alarm information and the causal relationship between the alarm information into the knowledge graph to form a server alarm propagation knowledge graph.

[0077] Among them, the first search module is specifically used to directly classify the alarm information that belongs to only a certain alarm business entity into the alarm business entity; and for the remaining alarm information, the alarm information that has parent alarm information in the previous alarm business entity is classified into the previous alarm business entity; and the alarm information that has child alarm information in the subsequent alarm business entity is classified into the subsequent alarm business entity.

[0078] For other technical solutions not covered in the embodiments of the present invention, please refer to Embodiment 1. Since this embodiment and Embodiment 1 adopt the same technical concept, have functional modules corresponding to the method described in Embodiment 1, and can produce the same beneficial effects as Embodiment 1, they will not be described in detail here.

[0079] Embodiment three:

[0080] An embodiment of the present invention provides a terminal, including a processor and a storage medium;

[0081] The storage medium is used to store instructions;

[0082] The processor is used to operate according to the instructions to execute the steps of the method described in embodiment 1.

[0083] Embodiment 4:

[0084] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the method described in the first embodiment are implemented.

[0085] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0086] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0089] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for constructing a knowledge graph for server alarm propagation, It is characterized in that include: According to the server business knowledge constraints, search and determine the alarm business entity of the alarm information; Search the causal relationship of alarm information of the same alarm business entity to obtain the candidate causal relationship structure of alarms in the alarm business entity; and calculate the information transfer entropy under the candidate causal relationship structure of alarms in the alarm business entity based on the alarm log information; Search the alarm causal relationship between each alarm business entity to obtain the alarm causal relationship structure between the alarm business entities; and calculate the information transfer entropy under the alarm causal relationship structure between the alarm business entities according to the information transfer entropy under the alarm candidate causal relationship structure in each alarm business entity; Determine the causal relationship between alarm information according to the causal relationship structure corresponding to the maximum value of the information transfer entropy under the alarm causal relationship structure between alarm business entities; Entering the alarm business entity, alarm information and the causal relationship between the alarm information into a knowledge graph to form a server alarm propagation knowledge graph; The information transfer entropy under the alarm candidate causal relationship structure in the alarm business entity is calculated and obtained using formula (1): （1） in, For the sth alarm business entity in the causal relationship structure Down Alarm information at all times Information transfer entropy; In the alarm log information Moment and Alarm information at all times The alarm status, 0 means no alarm, 1 means alarm; The alarm information of the sth alarm business entity possible permutations and combinations of ; For alarm log information Joint probability of alarm combinations; express exist Conditional probability under alarm information, express exist Conditional probability under alarm state; The information transfer entropy under the alarm causal relationship structure between the alarm service entities is the sum of the information transfer entropies under the alarm candidate causal relationship structures within each alarm service entity.

2. According to the server alarm propagation knowledge graph construction method of claim 1, It is characterized in that The method for searching and determining the alarm business entity of the alarm information according to the server business knowledge constraint condition includes: Alarm information belonging to only one alarm business entity is directly assigned to the alarm business entity; For the remaining alarm information, the alarm information that has a parent alarm information in the previous alarm business entity is classified into the previous alarm business entity; the alarm information that has a child alarm information in the next alarm business entity is classified into the next alarm business entity.

3. According to the server alarm propagation knowledge graph construction method of claim 2, It is characterized in that Alarm information having both parent alarm information in the previous alarm service entity and child alarm information in the next alarm service entity is determined as associated alarm information; the associated alarm information is used for alarm service entity division of other alarm information and is not classified into any alarm service entity.

4. The server alarm propagation knowledge graph construction method according to claim 2 or 3, It is characterized in that For alarm information whose alarm information itself and associated alarm information are not related to the current alarm business entity, an alarm transfer relationship is set for them.

5. The server alarm propagation knowledge graph construction method according to claim 1, It is characterized in that The information transfer entropy under the alarm causal relationship structure between the alarm business entities is calculated using formula (2): （2） Where: The alarm causal relationship structure between alarm business entities Information transfer entropy under is the alarm causal relationship structure with W alarm business entities; For the yth alarm business entity in the alarm causal relationship structure Down Alarm information at all times Information transfer entropy; The associated alarm information of the yth alarm business entity possible permutations and combinations of ; is time t The actual alarm status.

6. A server alarm propagation knowledge graph construction device, It is characterized in that include: The first search module is used to search and determine the alarm business entity of the alarm information according to the server business knowledge constraint condition; The second search module is used to search for the causal relationship of the alarm information of the same alarm business entity, and obtain the candidate causal relationship structure of the alarm in the alarm business entity; The first calculation module is used to calculate the information transfer entropy under the alarm candidate causal relationship structure in the alarm business entity based on the alarm log information; The third search module is used to search the alarm causal relationship between each alarm business entity and obtain the alarm causal relationship structure between the alarm business entities; The second calculation module is used to calculate the information transfer entropy under the alarm causal relationship structure between alarm business entities according to the information transfer entropy under the alarm candidate causal relationship structure in each alarm business entity; Determination module: used to determine the causal relationship between alarm information according to the causal relationship structure corresponding to the maximum value of the information transfer entropy under the alarm causal relationship structure between alarm business entities; Input module: used to input the alarm business entity, alarm information and the causal relationship between the alarm information into the knowledge graph to form a server alarm propagation knowledge graph; The information transfer entropy under the alarm candidate causal relationship structure in the alarm business entity is calculated and obtained using formula (1): （1） in, For the sth alarm business entity in the causal relationship structure Down Alarm information at all times Information transfer entropy; In the alarm log information Moment and Alarm information at all times The alarm status, 0 means no alarm, 1 means alarm; The alarm information of the sth alarm business entity possible permutations and combinations of ; For alarm log information Joint probability of alarm combinations; express exist Conditional probability under alarm information, express exist Conditional probability under alarm state; The information transfer entropy under the alarm causal relationship structure between the alarm service entities is the sum of the information transfer entropies under the alarm candidate causal relationship structures within each alarm service entity.

7. The server alarm propagation knowledge graph construction device according to claim 6, It is characterized in that The first search module is specifically used to directly classify the alarm information that belongs to only a certain alarm business entity into the alarm business entity; and for the remaining alarm information, classify the alarm information that has parent alarm information in the previous alarm business entity into the previous alarm business entity; and classify the alarm information that has child alarm information in the subsequent alarm business entity into the subsequent alarm business entity.

8. A terminal, It is characterized in that including processor and storage medium; The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the program is executed by a processor, the steps of the method described in any one of claims 1 to 5 are implemented.

Images