Alarm method, device, electronic device and storage medium applied to business system

Abstract

The present disclosure provides an alarm method, device, electronic device and storage medium for use in a business system, which relates to the field of artificial intelligence, and in particular to the field of big data and data analysis. The specific implementation scheme is as follows: reading N performance indicators within a previous predetermined period from a target memory, where N ≥ 1; using a target processor to perform the following operations: determining at least one evaluation parameter corresponding to each of the N performance indicators based on the values ​​of the N performance indicators, and obtaining an evaluation parameter set; determining whether the evaluation parameter set meets a predetermined alarm condition based on at least one of a first subset and a second subset in the evaluation parameter set; and executing an alarm operation if it is determined that the evaluation parameter set meets the predetermined alarm condition; the first subset includes at least two evaluation parameters corresponding to the same performance indicator among the N performance indicators, and the second subset includes evaluation parameters corresponding to M performance indicators associated with the N performance indicators, where M ≥ 2.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, in particular to the fields of big data and data analysis. More specifically, the present disclosure provides an alarm method, device, electronic device, storage medium, and computer program product applied to a business system. Background Art

[0002] In some operations and maintenance scenarios, it's possible to monitor the performance indicators involved. For example, in the financial industry, performance indicators such as response rate and transaction volume can be monitored. Another example is in the internet data center industry, where performance indicators such as server CPU (central processing unit) utilization and memory remaining can be monitored. Alarms can then be issued if the detected performance indicators meet pre-set alarm conditions. Summary of the Invention

[0003] The present disclosure provides an alarm method, apparatus, electronic device, storage medium, and computer program product applied to a business system.

[0004] According to one aspect of the present disclosure, there is provided an alarm method applied to a business system, comprising: reading N performance indicators generated by the business system within a previous predetermined time period from a target memory, where N is an integer greater than or equal to 1; utilizing a target processor to perform the following operations: determining, based on the values ​​of the N performance indicators, at least one evaluation parameter corresponding to each of the N performance indicators to obtain an evaluation parameter set; determining, based on at least one of a first subset and a second subset in the evaluation parameter set, whether the evaluation parameter set satisfies a predetermined alarm condition; and executing an alarm operation if it is determined that the evaluation parameter set satisfies the predetermined alarm condition; wherein the first subset includes at least two evaluation parameters corresponding to the same performance indicator among the N performance indicators, and the second subset includes evaluation parameters corresponding to M performance indicators associated with the N performance indicators, respectively, where M is an integer greater than or equal to 2.

[0005] According to another aspect of the present disclosure, an alarm device for use in a business system is provided, comprising: a reading module, a first determination module, a second determination module, and an alarm module. The reading module is configured to read N performance indicators generated by the business system within a previous predetermined period from a target memory, where N is an integer greater than or equal to 1; the first determination module is configured to use a target processor to determine, based on the values ​​of the N performance indicators, at least one evaluation parameter corresponding to each of the N performance indicators, to obtain an evaluation parameter set; the second determination module is configured to use the target processor to determine, based on at least one of a first subset and a second subset in the evaluation parameter set, whether the evaluation parameter set meets a predetermined alarm condition; and the alarm module is configured to use the target processor to perform an alarm operation if it is determined that the evaluation parameter set meets the predetermined alarm condition. The first subset includes at least two evaluation parameters corresponding to the same performance indicator among the N performance indicators, and the second subset includes evaluation parameters corresponding to M performance indicators associated with the N performance indicators, where M is an integer greater than or equal to 2. The alarm module is configured to perform an alarm operation if it is determined that the evaluation parameter set meets the predetermined alarm condition.

[0006] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method provided by the present disclosure.

[0007] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute the method provided by the present disclosure.

[0008] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements the method provided in the present disclosure when executed by a processor.

[0009] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0011] Figure 1 is a schematic diagram of an application scenario of the alarm method and device according to an embodiment of the present disclosure;

[0012] Figure 2 is a schematic flow chart of an alarm method according to an embodiment of the present disclosure;

[0013] Figure 3 is a schematic flow chart of performing an alarm operation according to an embodiment of the present disclosure;

[0014] Figure 4 is a schematic diagram of an alarm page according to an embodiment of the present disclosure;

[0015] Figure 5 is a schematic diagram of a details viewing page according to an embodiment of the present disclosure;

[0016] Figure 6 is a schematic diagram of an alarm method according to an embodiment of the present disclosure;

[0017] Figure 7 is a schematic structural block diagram of an alarm device according to an embodiment of the present disclosure; and

[0018] Figure 8 It is a structural block diagram of an electronic device used to implement the alarm method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0019] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0020] In some technical solutions, the operation and maintenance scenarios may involve multiple performance indicators, each performance indicator corresponds to at least one evaluation parameter, and an alarm threshold can be set in advance for each evaluation parameter corresponding to the performance indicator. Then, each evaluation parameter can be individually detected to see whether it reaches the corresponding alarm threshold. If so, an alarm prompt will be issued.

[0021] Taking the financial industry's operations and maintenance scenario as an example, the performance indicators involved may include response rate and transaction volume. The evaluation parameters for each performance indicator may include abnormal duration. An alarm can be issued if one of the following conditions is met: the duration of the abnormal response rate is greater than or equal to the abnormal duration threshold, or the duration of the abnormal transaction volume is greater than or equal to the abnormal duration threshold.

[0022] It should be noted that determining whether an alarm is needed based solely on a single evaluation parameter is prone to omissions, false alarms, and untimely alarms.

[0023] The embodiment of the present disclosure aims to propose an alarm method, which can determine whether to issue an alarm based on at least two evaluation parameters corresponding to the same performance indicator and / or evaluation parameters corresponding to at least two associated performance indicators, thereby improving the accuracy and timeliness of the alarm.

[0024] The technical solutions provided by the present disclosure will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] Figure 1 Schematic diagram of an application scenario of the alarm method and device according to an embodiment of the present disclosure.

[0026] It should be noted that Figure 1 The examples shown are merely examples of system architectures to which the embodiments of the present disclosure may be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure may not be used in other devices, systems, environments or scenarios.

[0027] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium for providing communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0028] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Terminal devices 101, 102, and 103 can be various electronic devices with display screens and support web browsing, including but not limited to smartphones, tablet computers, laptop computers, and desktop computers, etc.

[0029] Server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using terminal devices 101, 102, and 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., evaluation parameters determined based on N performance indicators within a previously predetermined period, alarm information, etc.) to the terminal device.

[0030] It should be noted that the alarm method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the alarm device provided in the embodiment of the present disclosure can generally be set in the server 105. The alarm method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the alarm device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0031] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0032] Figure 2 It is a schematic flow chart of an alarm method according to an embodiment of the present disclosure.

[0033] like Figure 2 As shown, the alarm method 200 can be applied to a business system, and the alarm method 200 can include operations S210 to S240.

[0034] In operation S210 , N performance indicators generated by the business system within a previous predetermined period are read from a target memory, where N is an integer greater than or equal to 1.

[0035] For example, the business system may be monitored to obtain performance indicators generated by the business system, and then the performance indicators may be stored in the target memory.

[0036] The previous scheduled time period may represent a past scheduled time period, such as the past 10 minutes, 1 day, 2 weeks, 1 month, and the like.

[0037] The performance indicator may be historical data of a predetermined period of time in the past. The performance indicator is used to evaluate the performance of the business system, and the category of the performance indicator is related to the business system.

[0038] For example, for a server cluster system in the Internet industry, performance indicators may include CPU usage, hard disk space, etc.

[0039] For another example, for a business system in the financial industry, performance indicators may include transaction volume, response time, response rate, success rate, etc. Transaction volume can be calculated by identifying transactions from data packets. Response time can be calculated by the delay between request initiation time and feedback time. Response rate can be determined by determining whether there is feedback time. Success rate can be determined by whether the feedback data packet includes a business return code. The following description uses a business system in the financial industry as an example. It should be understood that the embodiments of the present disclosure can also be applied to business systems in other industries, such as business systems in the internet data center industry, business systems of e-commerce platforms, etc.

[0040] In operation S220 , at least one evaluation parameter corresponding to each of the N performance indicators is determined according to the values ​​of the N performance indicators to obtain an evaluation parameter set.

[0041] For example, the same performance indicator can correspond to multiple evaluation parameters, which may include the abnormal time point, abnormal duration, change rate, change trend, etc.

[0042] Performance indicators can be time series data, meaning each performance indicator has a corresponding timestamp. The following uses trading volume as an example to illustrate how to determine evaluation parameters. The same principles apply to other performance indicators, and are not detailed here.

[0043] For example, the transaction volume can be read from the target memory, and the target processor can be used to detect whether the value of the transaction volume exceeds the corresponding predetermined range. If it exceeds, the timestamp corresponding to the value is determined as the abnormal time point.

[0044] For another example, the target processor detects whether the transaction volume exceeds a predetermined range, records the start and end times of the value exceeding the predetermined range, and determines the duration of the abnormality based on the start and end times. It can be seen that the time between the start and end times is the abnormal time point.

[0045] For another example, multiple values ​​of the trading volume in the first predetermined period of the above-mentioned previous predetermined period can be read, and then the maximum value, minimum value, average value and other values ​​can be selected or calculated from the multiple values. Then, these values ​​can be used to calculate the rate of change of the trading volume in the first predetermined period based on the predetermined volatility calculation formula. The embodiment of the present disclosure does not limit the predetermined volatility calculation formula.

[0046] For another example, the target processor can be used to determine multiple second predetermined time periods from the previous predetermined time period based on chronological order, for example, dividing each hour of the same day into a second predetermined time period. The average value of the trading volume in each of the multiple second predetermined time periods can then be calculated using the read values ​​to obtain multiple average values. If the multiple average values ​​increase sequentially based on chronological order, the trend of the trading volume change can be determined to be an upward trend; if the multiple average values ​​decrease sequentially based on chronological order, the trend of the trading volume change can be determined to be a downward trend. In other embodiments, the trend of the trading volume change can also be determined by other methods, which are not limited in the present embodiment.

[0047] In operation S230, based on at least one of the first subset and the second subset in the evaluation parameter set, it is determined whether the evaluation parameter set meets a predetermined alarm condition. If so, operation S240 is performed.

[0048] The first subset includes at least two evaluation parameters corresponding to the same performance indicator among the N performance indicators. For example, the first subset includes the duration of abnormal trading volume and the rate of change of trading volume. In another example, the first subset includes multiple time information, each time information representing the time when the response rate abnormality occurred. In another example, the first subset includes the trend of change in trading volume and the duration of abnormal trading volume.

[0049] The second subset includes evaluation parameters corresponding to M performance indicators associated with the N performance indicators, where M is an integer greater than or equal to 2.

[0050] For example, any two performance indicators among transaction volume, response time, response rate, and success rate can be correlated.

[0051] For example, the second subset includes the duration of abnormal transaction volume and the duration of abnormal response time. For another example, the second subset includes the trend of change in transaction volume and the trend of change in response rate. For another example, the second subset includes the trend of change in response time and the trend of change in response rate. For another example, the second subset includes the trend of change in transaction volume and the duration of abnormal response time.

[0052] The predetermined alarm condition is related to at least two evaluation parameters. It can be seen from the first subset and the second subset that the at least two evaluation parameters can be evaluation parameters for the same performance indicator or evaluation parameters for different performance indicators.

[0053] In operation S240 , an alarm operation is performed.

[0054] For example, an alarm message may be generated by the target processor and sent via email, text message, phone call, etc., thereby notifying maintenance personnel.

[0055] It should be noted that the above operations S220 to S240 may be performed by using a target processor.

[0056] In some embodiments, when the evaluation parameter set does not satisfy a predetermined alarm condition, the alarm method 200 may further include: in operation S250 , for example, not performing an alarm operation.

[0057] According to the technical solution provided by the embodiment of the present disclosure, since whether to issue an alarm is determined based on at least two evaluation parameters corresponding to the same performance indicator or different performance indicators, the accuracy and timeliness of the alarm are improved.

[0058] According to another embodiment of the present disclosure, the first alarm condition includes: the first subset includes at least two time information representing the time when the same performance indicator becomes abnormal, and at least two time information conform to a predetermined periodic rule.

[0059] For example, a numerical range of an indicator is set for a performance indicator in advance, and the correspondence between the performance indicator and the numerical range can be stored in the target memory, and the numerical range can be stored in the target memory, and read from the target memory when needed. The numerical value of the performance indicator exceeds the numerical range of the indicator, indicating that the performance indicator is abnormal. For example, the predetermined periodic rule can be a periodic rule based on the day, for example, a certain performance indicator fails from 8:00 to 8:05 every day, and returns to normal after 8:05. If the performance indicator is only detected for a certain day, it is easy to judge the abnormality as a fluctuation rather than a fault. By associating historical data, it is found that the performance indicator is abnormal at the same time on multiple days, which indicates a fault. In actual applications, the time when the performance indicator is abnormal can be recorded, and then it can be determined whether the time information shows periodic changes.

[0060] It should be noted that the reason why at least two pieces of time information conform to the predetermined periodic rule may be that there is an error in the program code, and the erroneous program code only works in a certain time period.

[0061] In some technical solutions, no alarm operation may be performed when the value of a performance indicator exceeds the indicator value range. For example, a performance indicator is abnormal, but the duration of the abnormality does not reach the duration threshold.

[0062] Compared with the above technical solutions, the embodiment of the present disclosure uses historical data correlation to determine whether a fault exists, which can alleviate the problem of missed fault reports and improve the accuracy of alarms.

[0063] According to another embodiment of the present disclosure, the second alarm condition includes: the second subset includes M indicator change trends corresponding to the M performance indicators respectively, and each of the M indicator change trends meets a predetermined trend.

[0064] For example, an increase in response time and a decrease in success rate could be due to increased traffic during peak hours, slower system processing efficiency, and longer response times. However, under normal circumstances, the success rate shouldn't decrease. A decrease in success rate indicates that traffic wasn't processed in a timely manner and an error code was returned, indicating a high probability of a business system failure. Another example is an increase in response time accompanied by a decrease in transaction volume. Another example is a decrease in transaction volume and a decrease in success rate. In practical applications, rules can be pre-set and stored in a target memory. These rules define which performance indicators are associated and how these associated performance indicators change. Then, when determining whether an alarm condition is met, the rules are read from the target memory, and a determination is made as to whether the performance indicators meet the read rules to determine whether the second alarm condition is met.

[0065] The embodiment of the present disclosure uses a method of linking multiple performance indicators to determine whether a fault exists, which can improve the accuracy of the alarm.

[0066] According to another embodiment of the present disclosure, the third alarm condition includes: the second subset includes M abnormal durations corresponding to M performance indicators, and the M abnormal durations include the target duration and other durations except the target duration; the other durations reach the first duration threshold and the target duration reaches the second duration threshold, the other durations do not reach the first duration threshold and the target duration reaches the third duration threshold, and the second duration threshold is less than the third duration threshold.

[0067] For example, the threshold corresponding to the linkage of multiple performance indicators is stricter than the threshold corresponding to the abnormality of a single performance indicator. For example, taking M as 2, the first indicator and the second indicator are associated. If the first indicator does not have an abnormality or the abnormality lasts for less than 3 minutes, and the abnormality of the second indicator lasts for more than or equal to 10 minutes, an alarm is issued. If the first indicator has an abnormality and the abnormality lasts for more than or equal to 3 minutes, an alarm can be issued if the abnormality of the second indicator lasts for more than or equal to 5 minutes. By linking multiple performance indicators, faults can be discovered more accurately and quickly, thereby improving the accuracy of alarms.

[0068] In practical applications, data related to the linked performance indicators can be pre-stored in a target memory. The data can include identifiers of multiple performance indicators to be linked, a first duration threshold, a second duration threshold, and a third duration threshold. When determining whether the third alarm condition is met, the data can be read and compared with the duration of the abnormality determined based on the performance indicators to determine whether the third alarm condition is met.

[0069] According to another embodiment of the present disclosure, the fourth alarm condition includes: the evaluation parameter set includes a change rate, the change rate is greater than or equal to the fluctuation threshold of the corresponding time period, wherein the fluctuation threshold of the peak period is less than the fluctuation threshold of the off-peak period.

[0070] For example, a fluctuation threshold value may be stored in the target memory, and each fluctuation threshold value may correspond to a specific time period. After determining the rate of change of the trading volume or other performance indicator, the fluctuation threshold value corresponding to the time period of the change rate may be read, and then the rate of change may be compared with the fluctuation threshold value to determine whether the fourth alarm condition is met.

[0071] In some technical solutions, the same fluctuation threshold is set for peak hours (such as daytime) and off-peak hours (such as nighttime). Since the banking business volume is less during off-peak hours, the fluctuation is larger, so false alarms are prone to occur during off-peak hours, and missed reports are prone to occur during peak hours.

[0072] Compared with the above technical solutions, the embodiment of the present disclosure sets different fluctuation thresholds for peak periods and off-peak periods. For example, the fluctuation threshold for peak periods is 20%, and the fluctuation threshold for off-peak periods is 30% to 40%, thereby improving the accuracy of alarms.

[0073] According to another embodiment of the present disclosure, the fifth alarm condition includes: the evaluation parameter set includes the duration of the abnormality, the duration of the abnormality is greater than or equal to the duration threshold of the corresponding time period, wherein the duration threshold of the peak period is greater than the duration threshold of the off-peak period.

[0074] For example, similar to the fluctuation threshold, an abnormality duration threshold can be stored in the target memory, and the abnormality duration threshold corresponds to a specific time period. After determining the change rate of each performance indicator, the abnormality duration threshold corresponding to the time period of the change rate can be read, and then the change rate can be compared with the abnormality duration threshold to determine whether the fifth alarm condition is met.

[0075] The embodiment of the present disclosure sets different abnormal duration thresholds for peak hours and off-peak hours, thereby improving the accuracy of alarms.

[0076] It should be noted that the alarm operation can be performed when any one of the first alarm condition, the second alarm condition, the third alarm condition, the fourth alarm condition, and the fifth alarm condition is met. In addition, the above five alarm conditions can be combined. For example, the alarm operation can be performed when at least two of the above five alarm conditions are met.

[0077] Figure 3 is a schematic flowchart of performing an alarm operation according to an embodiment of the present disclosure.

[0078] According to another embodiment of the present disclosure, the alarm operation 340 may include operations S341 to S347.

[0079] In operation S341 , a target evaluation parameter in the evaluation parameter set that meets a predetermined alarm condition is determined.

[0080] For example, the target processor is used to compare the abnormal duration of the transaction volume with the duration threshold, and when the abnormal duration of the transaction volume is greater than the duration threshold, the abnormal duration is determined as the target evaluation parameter.

[0081] In operation S342 , a current alarm level corresponding to the target evaluation parameter is determined based on the numerical range corresponding to the target evaluation parameter and the corresponding relationship between the numerical range and the alarm level.

[0082] For example, at least two thresholds can be set for the evaluation parameters. For example, the abnormal duration thresholds of a certain performance indicator include 3 minutes, 7 minutes, and 10 minutes. Four numerical ranges can be obtained through these thresholds. The four numerical ranges are represented in the form of a set, namely (0, 3], (3, 7], (7, 10], and (10, positive infinity). When the abnormal duration of a certain performance indicator is 6 minutes, the corresponding numerical range is (3, 7].

[0083] In addition, a correspondence between a numerical range and an alarm level can be established in advance, and the correspondence can be stored in a target memory. The numerical range corresponding to the evaluation parameter can reflect the severity of the fault, and the severity is positively correlated with the alarm level. For example, the above numerical ranges (0, 3], (3, 7], (7, 10], (10, positive infinity) correspond to low alarm level, medium alarm level, high alarm level, and highest alarm level, respectively. When the abnormality of a certain performance indicator lasts for 6 minutes, the corresponding current alarm level is a medium alarm level.

[0084] In operation S343, an alarm is issued using an alarm method corresponding to the current alarm level.

[0085] For example, a correspondence between alarm levels and alarm methods can be pre-established and stored in the target memory. The alarm level and the timeliness of the alarm method can be positively correlated. For example, the alarm methods can include system messages, emails, text messages, and phone notifications, with the timeliness of these four alarm methods increasing in order.

[0086] According to the technical solution provided by the embodiment of the present disclosure, different alarm modes are used for alarm prompts according to the severity of the fault, so that alarms with high severity can be responded to more quickly.

[0087] In operation S344, it is determined whether the alarm has been responded to. If so, operation S345 may be performed. If not, operation S346 may be performed.

[0088] For example, the target processor can be used to determine whether the alarm is responded to within a predetermined time period, which can be 3 minutes, 5 minutes, etc. If the alarm is responded to, it means that the fault has been processed, which can include two situations: completed processing and temporarily incomplete processing.

[0089] In operation S345, for example, the alarm may be stopped.

[0090] In operation S346, it is determined whether the current alarm level is greater than or equal to the first predetermined level and less than or equal to the second predetermined level. It can be seen that the first predetermined level is lower than the second predetermined level, and the second predetermined level may be the highest level. If so, operation S347 can be executed. If not, the process returns to operation S343.

[0091] In operation S347, the current alarm level is increased, and the process returns to operation S343.

[0092] For example, the alarm level is increased by one level, and then an alarm is issued according to the alarm method corresponding to the increased alarm level.

[0093] According to the technical solution provided by the embodiments of the present disclosure, for alarms with a level lower than the first predetermined level, the alarm level does not need to be escalated due to the low severity of the fault, allowing maintenance personnel to address the fault at their leisure time rather than immediately. For alarms with a higher level (which can be greater than or equal to the first predetermined level and less than or equal to the second predetermined level), the alarm level can be upgraded if the alarm is not responded to, thereby using a more timely alarm method to provide an alarm prompt, allowing maintenance personnel to handle the fault more promptly.

[0094] It should be noted that, in other embodiments, the above operations S344 to S347 may be omitted.

[0095] Figure 4 2 is a schematic diagram of an alarm page according to an embodiment of the present disclosure.

[0096] According to another embodiment of the present disclosure, the method may further include the following operations: generating alarm event information using a target processor so as to mark the accuracy result of the alarm event information on a display page; then, in response to receiving the accuracy result, determining the accuracy rate of the alarm event information using the target processor, and then outputting the accuracy rate of the alarm event information using the target processor.

[0097] like Figure 4As shown, query conditions can be displayed on the device's webpage, making it easier for maintenance personnel to filter alarm event information that meets the query conditions. Furthermore, the device can use the target processor to generate alarm event information, which is then transmitted to the webpage using the target processor. The webpage then displays the alarm event information. Alarm event information can include items such as the alarm ID, alarm time, product line, application, indicator name, abnormality, abnormal value, upper limit, lower limit, detailed information, and accuracy. Product lines can include mobile banking and online banking, for example. A single product line can correspond to multiple applications. For example, mobile banking applications can include deposits and withdrawals, while online banking applications can include loans. The abnormal value indicates the value of a performance indicator when an abnormality occurs, while the upper and lower limits define the range of values ​​within which the performance indicator does not exhibit an abnormality. The accuracy option provides "True" and "False" options. Maintenance personnel can use these options to indicate whether the alarm event information is accurate on the webpage. The device then receives the accuracy result selected by the user, and the target processor in the device can calculate the accuracy rate based on this result. Next, the target processor may also be used to output the accuracy of the alarm event information. For example, the target processor may transmit the accuracy to a page or a voice broadcast device, and the accuracy may be displayed on the page or played by a voice broadcast device.

[0098] According to the technical solution provided by the embodiments of the present disclosure, since alarm event information can be displayed, it is convenient to mark whether the alarm event information is accurate, and then calculate and display the accuracy rate. Therefore, maintenance personnel can adjust the alarm conditions based on this accuracy rate, such as adjusting the threshold in the alarm condition, thereby optimizing the alarm strategy.

[0099] Figure 5 2 is a schematic diagram of a detail viewing page according to an embodiment of the present disclosure.

[0100] According to another embodiment of the present disclosure, a detail viewing option can be displayed on the page. By selecting this option, the fault details can be displayed on the page. For example, with time as the horizontal axis and the value of the performance indicator as the vertical axis, the indicator value curve 503 showing the change of the value of the performance indicator over time can be displayed on the page. At the same time, the upper limit value curve 501 and the lower limit value curve 502 corresponding to the performance indicator can also be displayed. The area 504 where the value of the performance indicator is abnormal can also be displayed through a mask. Through this page, the time when the value of the performance indicator exceeds the upper limit or lower limit can be known, so that maintenance personnel can accurately locate the time period when the fault occurred. According to the time period when the fault occurred, the operation information of the system in that time period can be searched, and the operation information can be used to assist maintenance personnel in maintenance.

[0101] Figure 6 It is a schematic diagram of the alarm method according to an embodiment of the present disclosure.

[0102] like Figure 6 As shown, in this embodiment, N performance indicators 601 within a previous predetermined time period can be read from the target memory first, where N is an integer greater than or equal to 1, and then the target processor is used to determine at least one evaluation parameter corresponding to each of the N performance indicators 601 to obtain an evaluation parameter set 602.

[0103] Next, the target processor is used to determine whether an alarm operation is required in combination with the predetermined alarm condition 603. The predetermined alarm condition 603 may include at least one of the first alarm condition, the second alarm condition, the third alarm condition, the fourth alarm condition, and the fifth alarm condition described above.

[0104] If the alarm conditions are determined to be met, the target processor can be used to determine the current alarm level 604 corresponding to the evaluation parameters. Next, an alarm notification 605 can be issued using an alarm method corresponding to the current alarm level 604. Alarm methods can include, for example, email 6051, text message 6052, and phone call 6053. Furthermore, an alarm page 606 can be displayed to inform maintenance personnel of the alarm event.

[0105] Figure 7 It is a schematic structural block diagram of an alarm device according to an embodiment of the present disclosure.

[0106] like Figure 7 As shown, the alarm device 700 may include a reading module 710 , a first determination module 720 , a second determination module 730 and an alarm module 740 .

[0107] The reading module 710 is used to read N performance indicators generated by the business system within a previous predetermined period from the target memory, where N is an integer greater than or equal to 1.

[0108] The first determination module 720 is configured to use the target processor to determine at least one evaluation parameter corresponding to each of the N performance indicators according to the values ​​of the N performance indicators, and obtain an evaluation parameter set.

[0109] The second determination module 730 is configured to determine, using the target processor, whether the evaluation parameter set satisfies a predetermined alarm condition based on at least one of a first subset and a second subset of the evaluation parameter set. The first subset includes at least two evaluation parameters corresponding to the same performance indicator among the N performance indicators, and the second subset includes evaluation parameters corresponding to M performance indicators associated with the N performance indicators, where M is an integer greater than or equal to 2.

[0110] The alarm module 740 is configured to utilize the target processor to execute an alarm operation when it is determined that the evaluation parameter set meets a predetermined alarm condition.

[0111] According to another embodiment of the present disclosure, an alarm module includes a first determination submodule, a second determination submodule, and an alarm submodule. The first determination submodule is configured to determine a target evaluation parameter in a set of evaluation parameters that satisfies a predetermined alarm condition. The second determination submodule is configured to determine a current alarm level corresponding to the target evaluation parameter based on a numerical range corresponding to the target evaluation parameter and a correspondence between the numerical range and the alarm level. The alarm submodule is configured to issue an alarm using an alarm method corresponding to the current alarm level.

[0112] According to another embodiment of the present disclosure, the alarm module also includes a level change sub-module, which is used to increase the current alarm level and return to the operation of issuing an alarm through the alarm method corresponding to the current alarm level when it is determined that the current alarm level is greater than or equal to the first predetermined level and less than or equal to the second predetermined level and the alarm is not responded to. Until the current alarm level is greater than the second predetermined level or the alarm is responded to.

[0113] According to another embodiment of the present disclosure, the alarm device further includes a generation module, an accuracy determination module, and an output module. The generation module is configured to generate alarm event information using a target processor, so that the accuracy result of the alarm event information is annotated on a display page. The accuracy determination module is configured to determine the accuracy of the alarm event information using the target processor in response to receiving the accuracy result. The output module is configured to output the accuracy of the alarm event information using the target processor.

[0114] According to another embodiment of the present disclosure, the predetermined alarm condition includes at least one of the following: the first subset includes at least two time information characterizing the time when the same performance indicator becomes abnormal, and the at least two time information conform to a predetermined periodic law. The second subset includes M indicator change trends corresponding to the M performance indicators, and each of the M indicator change trends conforms to a predetermined trend. The second subset includes M abnormality durations corresponding to the M performance indicators, and the M abnormality durations include target durations and other durations other than the target duration; the other durations reach the first duration threshold and the target duration reaches the second duration threshold, the other durations do not reach the first duration threshold and the target duration reaches the third duration threshold, and the second duration threshold is less than the third duration threshold.

[0115] According to another embodiment of the present disclosure, the above-mentioned alarm device also includes an execution module, which is used to use the target processor to execute an alarm operation when it is determined that at least one of the following conditions is met: the evaluation parameter set includes a change rate, the change rate is greater than or equal to the fluctuation threshold of the corresponding time period, wherein the fluctuation threshold of the peak period is less than the fluctuation threshold of the off-peak period; and the evaluation parameter set includes an abnormality duration, the abnormality duration is greater than or equal to the duration threshold of the corresponding time period, wherein the duration threshold of the peak period is greater than the duration threshold of the off-peak period.

[0116] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0117] In the technical solution disclosed herein, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0118] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, including at least one processor; and a memory communicatively connected to the at least one processor; the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the above-mentioned alarm method.

[0119] According to an embodiment of the present disclosure, the present disclosure further provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the above-mentioned alarm method.

[0120] According to an embodiment of the present disclosure, the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned alarm method when executed by a processor.

[0121] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided as examples only and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0122] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. Various programs and data required for the operation of the device 800 can also be stored in the RAM 803. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0123] Various components in device 800 are connected to I / O interface 805, including an input unit 806, such as a keyboard, mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, optical disk, etc.; and a communication unit 809, such as a network card, modem, wireless communication transceiver, etc. The communication unit 809 allows device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0124] The computing unit 801 can be a variety of general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as the alarm method. For example, in some embodiments, the alarm method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the alarm method described above can be performed. Alternatively, in other embodiments, the computing unit 801 can be configured to perform the alarm method by any other suitable means (e.g., by means of firmware).

[0125] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0126] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0127] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0128] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0129] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0130] Computer systems may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The client and server relationship arises through computer programs running on the respective computers and having a client-server relationship to each other.

[0131] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not a limitation herein.

[0132] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. An alarm method applied to a business system, comprising: Reading N performance indicators generated by the business system within a previous predetermined period from the target memory, where N is an integer greater than or equal to 1; Utilize the target processor to: Determining, based on the values ​​of the N performance indicators, at least one evaluation parameter corresponding to each of the N performance indicators to obtain an evaluation parameter set; determining, based on at least one of a first subset and a second subset of the set of evaluation parameters, whether the set of evaluation parameters satisfies a predetermined alarm condition; as well as If it is determined that the evaluation parameter set meets the predetermined alarm condition, performing an alarm operation; The first subset includes at least two evaluation parameters corresponding to the same performance indicator among the N performance indicators, and the second subset includes evaluation parameters corresponding to M performance indicators associated with the N performance indicators, where M is an integer greater than or equal to 2.

2. The method according to claim 1, wherein The alarm operation includes: Determining a target evaluation parameter in the evaluation parameter set that meets the predetermined alarm condition; Determining a current alarm level corresponding to the target evaluation parameter based on a numerical range corresponding to the target evaluation parameter and a correspondence between the numerical range and the alarm level; and An alarm is issued using the alarm method corresponding to the current alarm level.

3. The method according to claim 2, wherein: The alarm operation also includes: When it is determined that the current alarm level is greater than or equal to the first predetermined level and less than or equal to the second predetermined level and the alarm is not responded, the current alarm level is increased and the operation of issuing an alarm using the alarm method corresponding to the current alarm level is returned to until the current alarm level is greater than the second predetermined level or the alarm is responded.

4. The method according to claim 1, further comprising: generating alarm event information by using the target processor so as to mark the accuracy result of the alarm event information on a display page; In response to receiving the accuracy result, determining, using the target processor, an accuracy rate of the alarm event information; as well as The target processor is used to output the accuracy of the alarm event information.

5. The method according to any one of claims 1 to 4, wherein: The predetermined alarm condition includes at least one of the following: The first subset includes at least two pieces of time information representing the time when an abnormality occurs in the same performance indicator, and the at least two pieces of time information conform to a predetermined periodic rule; The second subset includes M indicator change trends corresponding to the M performance indicators, respectively, and each of the M indicator change trends conforms to a predetermined trend; and The second subset includes M abnormal durations corresponding to the M performance indicators respectively, and the M abnormal durations include target duration and other durations except the target duration; the other durations reach a first duration threshold and the target duration reaches a second duration threshold, the other durations do not reach the first duration threshold and the target duration reaches a third duration threshold, and the second duration threshold is less than the third duration threshold.

6. The method according to claim 1, further comprising: When it is determined that at least one of the following conditions is met, the alarm operation is performed using the target processor: The evaluation parameter set includes a change rate, the change rate being greater than or equal to a fluctuation threshold of a corresponding time period, wherein the fluctuation threshold of a peak time period is less than the fluctuation threshold of a low-peak time period; and The evaluation parameter set includes an abnormal duration, and the abnormal duration is greater than or equal to a duration threshold of a corresponding time period, wherein the duration threshold of a peak time period is greater than the duration threshold of a low-peak time period.

7. An alarm device applied to a business system, comprising: a reading module, configured to read N performance indicators generated by the business system within a previous predetermined period from a target memory, where N is an integer greater than or equal to 1; A first determining module is configured to determine, using a target processor, at least one evaluation parameter corresponding to each of the N performance indicators according to the values ​​of the N performance indicators, to obtain an evaluation parameter set; a second determining module, configured to determine, using the target processor, whether the evaluation parameter set satisfies a predetermined alarm condition based on at least one of the first subset and the second subset of the evaluation parameter set; as well as an alarm module, configured to utilize the target processor to execute an alarm operation when it is determined that the set of evaluation parameters meets the predetermined alarm condition; The first subset includes at least two evaluation parameters corresponding to the same performance indicator among the N performance indicators, and the second subset includes evaluation parameters corresponding to M performance indicators associated with the N performance indicators, where M is an integer greater than or equal to 2.

8. The device according to claim 7, wherein The alarm module includes: A first determining submodule is configured to determine a target evaluation parameter in the evaluation parameter set that satisfies the predetermined alarm condition; a second determining submodule, configured to determine a current alarm level corresponding to the target evaluation parameter based on a numerical range corresponding to the target evaluation parameter and a correspondence between the numerical range and the alarm level; and The alarm submodule is used to issue an alarm using an alarm method corresponding to the current alarm level.

9. The device according to claim 8, wherein The alarm module also includes: The level change submodule is used to increase the current alarm level and return to the operation of issuing an alarm using the alarm method corresponding to the current alarm level when it is determined that the current alarm level is greater than or equal to the first predetermined level and less than or equal to the second predetermined level and the alarm has not been responded to, until the current alarm level is greater than the second predetermined level or the alarm is responded to.

10. The apparatus according to claim 7, further comprising: A generating module, configured to generate alarm event information using the target processor so as to mark the accuracy result of the alarm event information on a display page; an accuracy determination module, configured to determine the accuracy of the alarm event information using the target processor in response to receiving the accuracy result; as well as An output module is used to output the accuracy of the alarm event information using the target processor.

11. The device according to any one of claims 7 to 10, wherein: The predetermined alarm condition includes at least one of the following: The first subset includes at least two pieces of time information representing the time when an abnormality occurs in the same performance indicator, and the at least two pieces of time information conform to a predetermined periodic rule; The second subset includes M indicator change trends corresponding to the M performance indicators, respectively, and each of the M indicator change trends conforms to a predetermined trend; and The second subset includes M abnormal durations corresponding to the M performance indicators respectively, and the M abnormal durations include target duration and other durations except the target duration; the other durations reach a first duration threshold and the target duration reaches a second duration threshold, the other durations do not reach the first duration threshold and the target duration reaches a third duration threshold, and the second duration threshold is less than the third duration threshold.

12. The apparatus according to claim 7, further comprising: An execution module is configured to execute the alarm operation using the target processor when it is determined that at least one of the following conditions is met: The evaluation parameter set includes a change rate, the change rate being greater than or equal to a fluctuation threshold of a corresponding time period, wherein the fluctuation threshold of a peak time period is less than the fluctuation threshold of a low-peak time period; and The evaluation parameter set includes an abnormal duration, and the abnormal duration is greater than or equal to a duration threshold of a corresponding time period, wherein the duration threshold of a peak time period is greater than the duration threshold of a low-peak time period.

13. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 6.

15. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images