Troubleshooting methods, devices, equipment and storage media

Abstract

This disclosure provides a fault handling method, apparatus, device, and storage medium, which can be applied to the fields of computer technology or financial technology. The method includes: in response to a fault handling request, acquiring an alarm dataset; determining first historical fault data matching each alarm data in the alarm dataset according to preset matching conditions, thus obtaining a first historical fault dataset; determining target historical fault data from the second historical fault dataset based on the similarity relationship between each first historical fault data in the first historical fault dataset and each second historical fault data in the second historical fault dataset, wherein the similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data; and determining a target processing scheme associated with the fault handling request based on the target historical fault data.

Description

Technical Field

[0001] This disclosure relates to the fields of computer technology or financial technology, and more particularly to a fault handling method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the rapid development of computer technologies such as virtualization and cloud computing, there is an increasing number of devices, software, and systems using these technologies. During the process of using these devices, software, or systems to conduct business, malfunctions are inevitable, thus affecting business processing efficiency. To improve business processing efficiency, it is necessary to improve the efficiency of fault detection and diagnosis, and to restore business processing in a timely manner.

[0003] In the process of realizing the inventive concept disclosed herein, the inventors discovered at least the following technical problems in the related technologies: In the process of detecting and diagnosing faults, related technologies generally pre-edit preset processing scripts and perform fault detection and diagnosis according to these scripts. However, this method has a relatively limited processing scenario. If an unknown fault occurs, the lack of a corresponding preset processing script prevents fault detection and diagnosis, thus reducing the flexibility and efficiency of fault handling. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a fault handling method, apparatus, equipment, medium and program product that improves the flexibility and efficiency of fault handling.

[0005] One aspect of this disclosure provides a fault handling method, comprising: in response to a fault handling request, acquiring an alarm dataset, wherein the alarm dataset includes at least one alarm data; determining first historical fault data matching each alarm data in the alarm dataset according to preset matching conditions, thereby obtaining a first historical fault dataset; determining target historical fault data from the second historical fault dataset based on the similarity relationship between each first historical fault data in the first historical fault dataset and each second historical fault data in the second historical fault dataset, thereby obtaining a target historical fault dataset, wherein the similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data; and determining at least one target processing scheme associated with the fault handling request based on the target historical fault data in the target historical fault dataset.

[0006] According to embodiments of this disclosure, the aforementioned similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data. This includes: for each first historical fault data in the first historical fault dataset, and for each second historical fault data in the second historical fault dataset, determining a target alarm set based on the intersection of the first and second historical alarm sets, wherein the first historical alarm set is associated with the first historical fault data, and the second historical alarm set is associated with the second historical fault data; selecting first and second historical alarm data from the target alarm set; determining a target historical fault data set based on the intersection of a third and fourth historical fault data set, wherein the third historical fault data set is associated with the first historical alarm data, and the fourth historical fault data set is associated with the second historical alarm data; and determining a similarity relationship between the first and second historical fault data based on the target historical alarm set and the target historical fault data set.

[0007] According to embodiments of this disclosure, the similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data. This further includes: constructing at least one relationship graph structure based on each first historical fault data in the first fault dataset, each second historical fault data in the second fault dataset, the first historical alarm data, and the second historical alarm data. Each relationship graph structure includes four nodes, each node being the first historical fault data, the second historical fault data, the first historical alarm data, and the second historical alarm data. The first historical alarm data is connected to both the first historical fault data and the second historical fault data, and the second historical alarm data is also connected to both the first and second historical fault data. The similarity relationship between the first historical fault data and the second historical fault data is determined based on the weights of the relationship graph structure.

[0008] According to an embodiment of this disclosure, determining the similarity relationship between the first historical fault data and the second historical fault data based on the weights of the relation graph structure includes: determining the weights of the relation graph structure based on the intersection of the third historical fault data set and the fourth historical fault data set; counting the number of relation graph structures; and summing the weights of the relation graph structures based on the number of relation graph structures to determine the similarity relationship between the first historical fault data and the second historical fault data.

[0009] According to an embodiment of this disclosure, determining at least one target processing scheme associated with the fault handling request based on the target historical fault data in the target historical fault dataset includes: determining a target fault identifier based on the target historical fault data in the target historical fault dataset; extracting at least one initial processing scheme from the database based on the target fault identifier; and using the at least one initial processing scheme as at least one target processing scheme associated with the fault handling request.

[0010] According to an embodiment of this disclosure, the method further includes: preprocessing each alarm data in the alarm dataset to obtain each target alarm data; and determining the first historical fault data that matches each target alarm data according to the preset matching conditions to obtain the first historical fault dataset.

[0011] Another aspect of this disclosure provides a fault handling apparatus, comprising: an acquisition module, configured to acquire an alarm dataset in response to a fault handling request, wherein the alarm dataset includes at least one alarm data; a first determination module, configured to determine first historical fault data matching each alarm data in the alarm dataset according to preset matching conditions, thereby obtaining a first historical fault dataset; a second determination module, configured to determine target historical fault data from the second historical fault dataset based on the similarity relationship between each first historical fault data in the first historical fault dataset and each second historical fault data in the second historical fault dataset, thereby obtaining a target historical fault dataset, wherein the similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data; and a third determination module, configured to determine at least one target processing scheme associated with the fault handling request based on the target historical fault data in the target historical fault dataset.

[0012] Another aspect of this disclosure provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the aforementioned fault handling method.

[0013] Another aspect of this disclosure provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the aforementioned fault handling method.

[0014] Another aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned fault handling method.

[0015] According to the fault handling method, apparatus, device, medium, and program product provided in the embodiments of this disclosure, alarm data is obtained in response to a fault handling request; first historical fault data is obtained based on the alarm data; a similarity relationship between the first historical fault data and the second historical fault data is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data; target historical fault data is determined from the second historical fault data set based on the similarity relationship; and a handling scheme is determined based on the target historical fault data. Since the similarity relationship between faults is determined based on the first historical fault data, the second historical fault data, and the historical alarm data, more faults can be recommended based on the similarity when encountering unknown faults. Therefore, this at least partially solves the technical problem of not being able to detect and diagnose unknown faults in related technologies, thereby achieving the technical effect of improving the flexibility and efficiency of fault handling. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The diagram schematically illustrates a system architecture of a fault handling method, apparatus, device, medium, and program product according to embodiments of the present disclosure.

[0018] Figure 2 A flowchart illustrating a fault handling method according to an embodiment of the present disclosure is shown schematically.

[0019] Figure 3 This diagram illustrates a data operation and maintenance scenario according to an embodiment of the present disclosure.

[0020] Figure 4 This schematically illustrates an architecture diagram for acquiring alarm data according to an embodiment of the present disclosure;

[0021] Figure 5 A relational graph structure according to an embodiment of the present disclosure is illustrated schematically;

[0022] Figure 6 A relational graph structure diagram according to another embodiment of the present disclosure is illustrated schematically;

[0023] Figure 7 A schematic block diagram of a fault handling apparatus according to an embodiment of the present disclosure is shown; and

[0024] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a fault handling method according to an embodiment of the present disclosure. Detailed Implementation

[0025] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0029] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0030] With the widespread application of new technologies such as virtualization and cloud computing, the scale of servers in large enterprises is gradually increasing. In addition, with the diversification of business models and the cloud migration of IT (Information Technology) architecture, IT operations and maintenance are facing increasing challenges. Conventional operation and maintenance systems and experience need to be constantly iterated and updated.

[0031] Current fault detection and diagnosis processes primarily rely on alarm logs and metrics, as well as the operational experience of maintenance personnel to define faults and provide corresponding handling methods. Since fault data is not necessarily distributed across the same server and files, it needs to be obtained through various channels, which is time-consuming and costly. Furthermore, maintenance personnel are prone to misjudgment and operational errors. Moreover, different experienced maintenance personnel may provide different handling methods for the same type of fault.

[0032] Based on this, existing technologies can pre-define faults according to preset processing scripts. Upon detecting a fault, the corresponding processing script will run to detect and diagnose it. However, this method has a limited scope of application, low coverage of fault scenarios, and inaccurate fault identification. Furthermore, the configuration is cumbersome, and it cannot detect or diagnose unknown faults or faults without preset processing scripts, resulting in low applicability. Preset processing scripts also sometimes require manual maintenance, reducing the flexibility and efficiency of fault handling. In addition, using preset processing scripts has the following problems: applications using logs and other data tend to be low-code and cannot be included in the overall fault scenario; user permission management is not rigorous, posing a risk of lax fault handling; it cannot utilize changed data, resulting in wasted data resources and an inability to identify fault scenarios caused by changes; the number of systems supporting fault data access formats is limited, making fault data access inconvenient; querying fault data via interfaces lacks real-time performance, hindering timely processing of fault scenarios; and the utilization of various other fault data is low, failing to generate business value from all fault data.

[0033] In view of the above, embodiments of this disclosure provide a fault handling method, apparatus, device, medium, and program product, aiming to at least partially solve the above-mentioned problems and improve the flexibility and efficiency of fault handling. Specifically, the method may include: in response to a fault handling request, acquiring an alarm dataset, wherein the alarm dataset includes at least one alarm data; determining first historical fault data matching each alarm data in the alarm dataset according to preset matching conditions, thereby obtaining a first historical fault dataset; determining target historical fault data from the second historical fault dataset according to the similarity relationship between each first historical fault data in the first historical fault dataset and each second historical fault data in the second historical fault dataset, thereby obtaining a target historical fault dataset, wherein the similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data; and determining at least one target processing scheme associated with the fault handling request based on the target historical fault data in the target historical fault dataset.

[0034] Figure 1The diagram schematically illustrates a system architecture of a fault handling method, apparatus, device, medium, and program product according to embodiments of the present disclosure.

[0035] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0036] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (only examples). In one embodiment, these applications can also be configured with components capable of sending fault handling requests to the server, so that a fault handling request can be generated and sent when a client application malfunctions.

[0037] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0038] Server 105 can be a server that provides various services, such as responding to a fault handling request sent by a user using a first terminal device 101, a second terminal device 102, and a third terminal device 103, obtaining an alarm dataset; determining first historical fault data that matches each alarm data in the alarm dataset according to preset matching conditions, thus obtaining a first historical fault dataset; determining target historical fault data from the second historical fault dataset based on the similarity relationship between each first historical fault data in the first historical fault dataset and each second historical fault data in the second historical fault dataset; and determining at least one target handling scheme associated with the fault handling request based on the target historical fault data in the target historical fault dataset.

[0039] It should be noted that the fault handling method provided in this embodiment can generally be executed by server 105. Correspondingly, the fault handling device provided in this embodiment can generally be located in server 105. The fault handling method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the fault handling device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0040] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0041] The following will be based on Figure 1 The described scene, through Figures 2-6 The fault handling method of the disclosed embodiments will be described in detail.

[0042] Figure 2 A flowchart illustrating a fault handling method according to an embodiment of the present disclosure is shown schematically.

[0043] like Figure 2 As shown, the fault handling method in this embodiment includes operations S201 to S204.

[0044] In operation S201, in response to a fault handling request, an alarm dataset is obtained, wherein the alarm dataset includes at least one alarm data.

[0045] In operation S202, based on preset matching conditions, the first historical fault data that matches each alarm data in the alarm dataset is determined, and the first historical fault dataset is obtained.

[0046] In operation S203, based on the similarity relationship between each first historical fault data in the first historical fault dataset and each second historical fault data in the second historical fault dataset, target historical fault data is determined from the second historical fault dataset to obtain the target historical fault dataset. The similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data that are associated with both the first and second historical fault data.

[0047] In operation S204, based on the target historical fault data in the target historical fault dataset, at least one target processing scheme associated with the fault processing request is determined.

[0048] According to embodiments of this disclosure, fault handling requests can be generated based on faults that occur during the use of various software devices, software, or systems.

[0049] Figure 3 The diagram illustrates a data operation and maintenance scenario according to an embodiment of the present disclosure.

[0050] like Figure 3 As shown, data operation and maintenance scenarios can include four layers: front-end system, data type, access method, and back-end database. The front-end system can include application monitoring, alarm system, configuration system, change system, event system, and permission system. Application monitoring can monitor metrics, attributes, and performance parameters of target objects through APIs (Application Programming Interfaces), such as network connectivity, CPU utilization, and memory utilization. Target objects can be devices, software, or systems. When these parameters exceed pre-set alarm conditions, the alarm system will generate alarms and alarm data, which can be stored in the alarm database via a real-time interface. The configuration system can configure various attributes, performance parameters, and alarm conditions of template objects, as well as process models, processing instances, and process relationships. This data can be accessed into the distributed file storage database through scheduled access tasks on the operation and maintenance management platform. The change system can generate change orders, such as fault change orders, for fault tracing after a fault occurs. Change orders can also be accessed into the distributed file storage database through scheduled change order access tasks. The event system can generate event tickets, such as fault event tickets, for recording faults. Event tickets can be accessed by scheduled tasks to the event ticket management database. The permission system can include basic user permissions and operational permissions. This permission data can be accessed by scheduled user tasks to the user center database.

[0051] According to embodiments of this disclosure, alarm data can be generated by the server responding to a fault handling request, identifying the target object among multiple objects based on the target object identifier carried in the fault handling request, and extracting performance parameters associated with the fault request from the target object. It is understood that when the monitored performance parameters are greater than, less than, or do not meet pre-defined alarm conditions, the target object can be considered to have failed, and the performance parameters at the time of the failure are used as alarm data. Optionally, there can be one or more alarm data points leading to a fault. For example, a fault is considered to have occurred only when multiple performance parameters simultaneously fail to meet pre-defined conditions. Therefore, the alarm dataset can contain one or more alarm data points.

[0052] According to embodiments of this disclosure, preset matching conditions include, for example, preset fields and preset data. Operation S202 can also be understood as the server matching and searching the historical fault database based on alarm data, i.e., performance fields and specific parameter values ​​contained in performance parameters, to find historical faults that match the performance fields and specific parameter values, and the corresponding historical fault data. This historical fault data is then used as the first historical fault data, which may include fault identifiers, performance parameters, etc. The historical fault database may store faults that have occurred to the target object and corresponding fault data, as well as performance parameters, change data, alarm data, configuration data, etc. It is understood that after obtaining the alarm dataset, at least one alarm data in the alarm dataset will match at least one historical fault data. Therefore, the first historical fault data can be the matched historical fault data or known historical fault data, and the first historical fault dataset can be the matched historical fault dataset or a known historical fault dataset.

[0053] According to embodiments of this disclosure, the second historical fault dataset can be any historical fault dataset in the historical fault database other than the first historical fault dataset. The second historical fault data can be any fault data entry in the second historical fault dataset. The target historical fault data can be historical fault data in the second historical fault dataset that is similar to the first historical fault data. This similar historical fault data can be one or more entries, so the target historical fault dataset can contain one or more target historical fault data entries.

[0054] According to embodiments of this disclosure, it is understood that an alarm dataset may contain multiple alarm data entries. The cause of the alarm data or alarm dataset may not be solely the first historical fault data or the first historical fault dataset, but may also be historical fault data similar to the first historical fault data or the first historical fault dataset. This similar historical fault data can be obtained from a second historical fault dataset.

[0055] According to embodiments of this disclosure, since the faults are historical, corresponding processing solutions exist. After finding the target historical fault data, the corresponding processing solution is matched based on the fault identifier. It is understood that at least one target processing solution includes at least one processing solution for the first historical fault data.

[0056] According to embodiments of this disclosure, the fault handling method, apparatus, device, medium, and program product provided in these embodiments obtain alarm data in response to a fault handling request; first historical fault data is obtained based on the alarm data; a similarity relationship between the first historical fault data and the second historical fault data is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data; a target historical fault data is determined from the second historical fault data set based on the similarity relationship; and a handling scheme is determined based on the target historical fault data. Since the similarity relationship between faults is determined based on the first historical fault data, the second historical fault data, and the historical alarm data, more faults can be recommended based on the similarity when encountering unknown faults. Therefore, this at least partially solves the technical problem of not being able to detect and diagnose unknown faults in related technologies, thereby achieving the technical effect of improving the flexibility and efficiency of fault handling.

[0057] Figure 4 An architectural diagram illustrating the acquisition of alarm data according to an embodiment of this disclosure is shown.

[0058] like Figure 4 As shown, operation S201 may also include the following operation: obtaining alarm data through a distributed messaging system. Specifically, alarm data generated by various devices, software, systems, etc., can be accessed to the server through multiple interfaces or channels. This distributed messaging system is a distributed messaging system that supports partitioning, multiple replicas, and is based on distributed application coordination service software. By using this distributed messaging system to access alarm data, a large amount of alarm data can be processed in real time to meet various fault handling scenarios.

[0059] According to embodiments of this disclosure, before performing operation S202 or after performing operation S201, the following operations may also be performed: preprocessing each alarm data in the alarm dataset to obtain each target alarm data; determining the first historical fault data that matches each target alarm data according to preset matching conditions to obtain the first historical fault dataset.

[0060] According to embodiments of this disclosure, preprocessing may include transforming and aggregating each alarm data entry, removing duplicate parts of the alarm data, standardizing the alarm data format, etc., to normalize the alarm data. The target alarm data can be the normalized alarm data. Preprocessing the alarm dataset facilitates the matching of the target alarm data to obtain the first historical fault dataset, improving the efficiency of obtaining the first historical fault dataset.

[0061] According to embodiments of this disclosure, a distributed processing engine can be used to preprocess alarm data. This distributed processing engine can be a streaming engine, which simulates batch processing, reducing response time for alarm data preprocessing, improving preprocessing efficiency, and providing a sub-second semantic real-time processing solution.

[0062] According to embodiments of this disclosure, the process of determining similarity relationships in operation S203 may include the following operations: for each first historical fault data in the first historical fault dataset and for each second historical fault data in the second historical fault dataset, a target alarm set is determined based on the intersection of the first historical alarm set and the second historical alarm set, wherein the first historical alarm set is associated with the first historical fault data and the second historical alarm set is associated with the second historical fault data; first historical alarm data and second historical alarm data are selected from the target alarm set; a target historical fault data set is determined based on the intersection of the third historical fault data set and the fourth historical fault data set, wherein the third historical fault data set is associated with the first historical alarm data and the fourth historical fault data set is associated with the second historical alarm data; and a similarity relationship between the first historical fault data and the second historical fault data is determined based on the target historical alarm set and the target historical fault data set.

[0063] According to embodiments of this disclosure, taking a first historical fault data (hereinafter referred to as fault i) and a second fault data (hereinafter referred to as fault j) as examples, in order to measure the similarity between fault i and fault j, we examine the first historical alarm data (hereinafter referred to as alarm u) and the second historical alarm data (hereinafter referred to as alarm v) that both hit fault i and fault j. The fewer faults hit by these two alarms, the higher the similarity between fault i and fault j. For example, if both alarm u and alarm v hit fault i, it can be understood that alarm u and alarm v are similar. If alarm u and alarm v hit fault i and also hit fault j, since hitting fault i simultaneously indicates that alarm u and alarm v are similar, and similar alarms also hit fault j, it can be directly or indirectly understood that fault i and fault j are similar.

[0064] According to embodiments of this disclosure, in extreme cases, both alarms may hit some faults, and among all the faults that the two alarms can hit, only faults i and j are hit by both alarms u and v. This indicates that alarms u and v are quite different, but they simultaneously hit faults i and j, suggesting that faults i and j are highly similar. Specifically, the process for determining similarity can be as shown in formula (1).

[0065]

[0066] Among them, Ui It can represent the first historical alarm set, U j U can represent the second historical alarm set. i ∩U j It can represent a target alarm set. u It can represent the third historical fault data set, I v It can represent the fourth historical fault data set, and α can represent the smoothing factor.

[0067] According to embodiments of this disclosure, the first historical alarm set may be all alarm data that can hit fault i. The second historical alarm set may be all alarm data that can hit fault j. The target alarm set may represent alarm data that can hit both fault i and fault j. The third historical fault dataset may be a set of historical fault data that has been hit by alarm u. The fourth historical fault dataset may be a set of historical fault data that has been hit by alarm v, and the target historical fault dataset may be a set of fault data that has been hit by both alarm u and alarm v. It is understood that the third and fourth historical fault datasets are different from the first and second historical fault datasets, and the scope or the historical fault data included in the second historical fault dataset is greater than the historical fault data included in the third or fourth historical fault datasets.

[0068] According to embodiments of this disclosure, historical alarm data is also taken into account when calculating the similarity between faults. The similarity relationship between faults is determined based on the first historical fault data, the second historical fault data, and the historical alarm data, which can improve the accuracy of determining the similarity relationship between faults.

[0069] According to embodiments of this disclosure, similar fault data can also be recommended based on the similarity between alarm data. Formula (1) can also be used to determine the similarity between alarm data. When calculating the similarity between alarm data, i and j can represent the first historical alarm data and the second historical alarm data, respectively, and u and v can represent the first historical fault data and the second historical fault data, respectively. U i It can represent the set of faults associated with alarm i, U j I can represent the set of faults associated with alarm j. u I can represent the set of alarms associated with fault u. v It can represent the set of alarms associated with fault v.

[0070] According to embodiments of this disclosure, the process of determining similarity relationships may further include the following operations: constructing at least one relationship graph structure based on each first historical fault data in the first fault dataset, each second historical fault data in the second fault dataset, the first historical alarm data, and the second historical alarm data, wherein each relationship graph structure includes four nodes, each node being the first historical fault data, the second historical fault data, the first historical alarm data, and the second historical alarm data, the first historical alarm data being connected to the first historical fault data and the second historical fault data respectively, and the second historical alarm data being connected to the first historical fault data and the second historical fault data respectively; determining the similarity relationship between the first historical fault data and the second historical fault data based on the weights of the relationship graph structure.

[0071] Figure 5 The diagram illustrates a relational graph structure according to an embodiment of the present disclosure.

[0072] like Figure 5 As shown, fault i, fault j, alarm u, and alarm v can be connected to form a relational graph structure. In this graph structure, the two nodes adjacent to alarm u can be fault i and fault j, and the two nodes adjacent to alarm v can also be fault i and fault j. Connecting lines are used between alarm u and fault i and fault j, and between alarm v and fault i and fault j. There are no connecting lines between fault i and fault j, or between alarm u and alarm v. The connecting lines are used to indicate that a relationship exists between alarms and faults.

[0073] According to embodiments of this disclosure, the similarity relationship between the first historical fault data and the second historical fault data can be determined based on the weights of the relational graph structure, i.e., the similarity relationship between fault i and fault j can be determined. Specifically, the weights of the relational graph structure are determined based on the intersection of the third and fourth historical fault data sets; the number of relational graph structures is counted, and the weights of the relational graph structures are summed based on the number of relational graph structures to determine the similarity relationship between the first historical fault data and the second historical fault data.

[0074] According to embodiments of this disclosure, the process of determining the number of relational graph structures can be as shown in formula (2).

[0075]

[0076] Where N can represent the number of relational graph structures. m can represent the number of alarms, for example, faults i and j have been hit by m alarms.

[0077] According to embodiments of this disclosure, the process of determining the weights of the relation graph structure can be as shown in formula (3).

[0078]

[0079] Where, ω i I represents the weights of the relation graph structure. u ∩I v This represents the intersection of the third and fourth historical fault data sets.

[0080] According to an embodiment of this disclosure, the weights of the relation graph structures are summed based on the number of relation graph structures to determine the similarity relationship between the first historical fault data and the second historical fault data. This determination process can be as shown in formula (4).

[0081] sim(i,j)=∑ N ω i (4)

[0082] Where sim(i,j) represents the similarity relationship between fault i and fault j, N can represent the number of relation graph structures, and ω i Represents the weights of the relation graph structure.

[0083] According to the embodiments of this disclosure, if the above data is represented in the form of matrix M, and alarm u (alarm_u) and alarm v (alarm_v) have simultaneously hit fault i (fault_i) and fault j (fault_j), then the process of calculating the number of relation graph structures can be as shown in formula (5), and the process of calculating the weight of the relation graph structures can be as shown in formula (6).

[0084] M.group_by(alarm_u, alarm_v).count() (5)

[0085] M.group_by(fault_i, fault_j).count() (6)

[0086] The matrix M can be as shown in Table 1.

[0087] Table 1 shows the alarm data in matrix M form.

[0088] fault_i fault_j alarm_u alarm_v 1 2 A B …… …… …… …… 100 1 X A

[0089] The serial numbers in the table represent the number of alarm data entries.

[0090] Figure 6 A relational graph structure diagram according to another embodiment of the present disclosure is illustrated schematically.

[0091] like Figure 6As shown, in another embodiment, there may also be alarms u, v, w, x, and faults i and j, wherein alarms u and v simultaneously trigger faults i and j, and alarms w and x simultaneously trigger faults i and j. In this case, two relational graph structures will appear, each with a different weight. The more alarms shared by two faults in each relational graph structure, the smaller the weight of that relational graph structure will be.

[0092] According to an embodiment of this disclosure, operation S204 may further include the following operations: determining a target fault identifier based on target historical fault data in the target historical fault dataset; extracting at least one initial processing scheme from the database based on the target fault identifier; and using the at least one initial processing scheme as at least one target processing scheme associated with the fault processing request.

[0093] According to embodiments of this disclosure, the target fault representation may be a device identifier (e.g., device serial number), software identifier (e.g., software serial number), system identifier (e.g., system serial number), or a fault data number carried in the target historical fault data. The database can be used to store processing schemes. An initial processing scheme is one capable of processing the target historical fault data. Because the target historical fault dataset is quite similar to the first historical fault dataset, at least one initial processing scheme can be used as a processing scheme for the first historical fault dataset, providing more processing schemes for fault detection and diagnosis.

[0094] The fault handling method provided by the embodiments of this disclosure can save a lot of manpower costs; it can discover and diagnose alarm data in seconds, preventing losses; it is flexible and fast, and can also diagnose and handle unknown alarm data; it can effectively utilize historical alarm and fault data to discover more fault data value.

[0095] It should be noted that, unless it is explicitly stated that there is a sequential order of execution between different operations, or that there is a sequential order of execution between different operations in terms of technical implementation, the execution order between multiple operations may not be significant, and multiple operations may be executed simultaneously.

[0096] Based on the above-described fault handling method, this disclosure also provides a fault handling apparatus. The following will be combined with... Figure 7 The device is described in detail.

[0097] Figure 7 A schematic block diagram of a fault handling apparatus according to an embodiment of the present disclosure is shown.

[0098] like Figure 7As shown, the fault handling device 700 of this embodiment includes an acquisition module 710, a first determination module 720, a second determination module 730, and a third determination module 740.

[0099] The acquisition module 710 is used to acquire an alarm dataset in response to a fault handling request, wherein the alarm dataset includes at least one alarm data.

[0100] The first determining module 720 is used to determine the first historical fault data that matches each alarm data in the alarm dataset according to preset matching conditions, so as to obtain the first historical fault dataset.

[0101] The second determining module 730 is used to determine target historical fault data from the second historical fault dataset based on the similarity relationship between each first historical fault data in the first historical fault dataset and each second historical fault data in the second historical fault dataset, thereby obtaining a target historical fault dataset. The similarity relationship is determined based on the first historical fault data, the second historical fault data, and historical alarm data that are associated with both the first historical fault data and the second historical fault data.

[0102] The third determining module 740 is used to determine at least one target processing scheme associated with the fault processing request based on the target historical fault data in the target historical fault dataset.

[0103] According to the fault handling method, apparatus, device, medium, and program product provided in the embodiments of this disclosure, alarm data is obtained in response to a fault handling request; first historical fault data is obtained based on the alarm data; a similarity relationship between the first historical fault data and the second historical fault data is determined based on the first historical fault data, the second historical fault data, and historical alarm data associated with both the first and second historical fault data; target historical fault data is determined from the second historical fault data set based on the similarity relationship; and a handling scheme is determined based on the target historical fault data. Since the similarity relationship between faults is determined based on the first historical fault data, the second historical fault data, and the historical alarm data, more faults can be recommended based on the similarity when encountering unknown faults. Therefore, this at least partially solves the technical problem of not being able to detect and diagnose unknown faults in related technologies, thereby achieving the technical effect of improving the flexibility and efficiency of fault handling.

[0104] According to embodiments of this disclosure, the second determining module further includes a first determining unit, a selection unit, a second determining unit, and a third determining unit.

[0105] The first determining unit is configured to determine a target alarm set based on the intersection of a first historical alarm set and a second historical alarm set, wherein the first historical alarm set is associated with the first historical fault data, and the second historical alarm set is associated with the second historical fault data.

[0106] The selection unit is used to select first historical alarm data and second historical alarm data from the target alarm set.

[0107] The second determining unit is used to determine a target historical fault data set based on the intersection of a third historical fault data set and a fourth historical fault data set, wherein the third historical fault data set is associated with the first historical alarm data set, and the fourth historical fault data set is associated with the second historical alarm data set.

[0108] The third determining unit is used to determine the similarity relationship between the first historical fault data and the second historical fault data based on the target historical alarm set and the target historical fault data set.

[0109] According to embodiments of this disclosure, the second determining module further includes a construction unit and a fourth determining unit.

[0110] The construction unit is configured to construct at least one relational graph structure based on each first historical fault data in the first fault dataset, each second historical fault data in the second fault dataset, the first historical alarm data, and the second historical alarm data. Each relational graph structure includes four nodes, each node being the first historical fault data, the second historical fault data, the first historical alarm data, and the second historical alarm data. The first historical alarm data is connected to the first historical fault data and the second historical fault data respectively, and the second historical alarm data is connected to the first historical fault data and the second historical fault data respectively.

[0111] The fourth determining unit is used to determine the similarity relationship between the first historical fault data and the second historical fault data based on the weights of the relationship graph structure.

[0112] According to embodiments of this disclosure, the fourth determining unit may further include a first determining subunit and a statistical subunit.

[0113] The first determining subunit is used to determine the weights of the relationship graph structure based on the intersection of the third historical fault data set and the fourth historical fault data set.

[0114] The statistics subunit is used to count the number of the relationship graph structures and sum the weights of the relationship graph structures based on the number of the relationship graph structures to determine the similarity relationship between the first historical fault data and the second historical fault data.

[0115] According to embodiments of this disclosure, the third determining module may further include a fifth determining unit, an extraction unit, and a sixth determining unit.

[0116] The fifth determining unit is used to determine the target fault identifier based on the target historical fault data in the target historical fault dataset.

[0117] The extraction unit is used to extract at least one initial processing scheme from the database based on the target fault identifier.

[0118] The sixth determining unit is used to determine the at least one initial processing scheme as at least one target processing scheme associated with the fault handling request.

[0119] According to embodiments of this disclosure, the fault handling apparatus may further include a processing module and a fourth determining module.

[0120] The processing module is used to preprocess each alarm data in the alarm dataset to obtain each target alarm data.

[0121] The fourth determining module is used to determine the first historical fault data that matches each target alarm data according to the preset matching conditions, so as to obtain the first historical fault dataset.

[0122] According to embodiments of this disclosure, any plurality of modules among the acquisition module 710, the first determining module 720, the second determining module 730, and the third determining module 740 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the acquisition module 710, the first determining module 720, the second determining module 730, and the third determining module 740 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the acquisition module 710, the first determination module 720, the second determination module 730, and the third determination module 740 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0123] It should be noted that the fault handling device part in the embodiments of this disclosure corresponds to the fault handling method part in the embodiments of this disclosure. The specific description of the fault handling device part is referred to in the fault handling method part, and will not be repeated here.

[0124] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a fault handling method according to an embodiment of the present disclosure.

[0125] like Figure 8 As shown, an electronic device 800 according to an embodiment of this disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage portion 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this disclosure.

[0126] RAM 803 stores various programs and data required for the operation of electronic device 800. Processor 801, ROM 802, and RAM 803 are interconnected via bus 804. Processor 801 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 802 and / or RAM 803. It should be noted that the programs may also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0127] According to embodiments of this disclosure, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to a bus 804. The electronic device 800 may also include one or more of the following components connected to the I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 810 as needed so that computer programs read from it can be installed into the storage section 808 as needed.

[0128] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0129] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 802 and / or RAM 803 and / or one or more memories other than ROM 802 and RAM 803 described above.

[0130] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the fault handling methods provided in the embodiments of this disclosure.

[0131] When the computer program is executed by the processor 801, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0132] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 809, and / or installed from a removable medium 811. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0133] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by processor 801, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0134] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0135] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0136] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0137] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A fault processing method, comprising: obtaining an alarm data set in response to a fault processing request, wherein the alarm data set comprises at least one piece of alarm data; determining first historical fault data matched with each piece of alarm data in the alarm data set according to a preset matching condition, to obtain a first historical fault data set; determining target historical fault data from a second historical fault data set according to a similarity relationship between each piece of the first historical fault data in the first historical fault data set and each piece of second historical fault data in the second historical fault data set, to obtain a target historical fault data set, wherein the similarity relationship is determined according to the first historical fault data, the second historical fault data, and historical alarm data associated with both the first historical fault data and the second historical fault data; determining at least one target processing scheme associated with the fault processing request according to the target historical fault data in the target historical fault data set.

2. The method of claim 1, wherein, The similarity relationship determined according to the first historical fault data, the second historical fault data, and historical alarm data associated with both the first historical fault data and the second historical fault data comprises: for each piece of first historical fault data in the first historical fault data set, for each piece of second historical fault data in the second historical fault data set, determining a target alarm set according to an intersection of a first historical alarm set and a second historical alarm set, wherein the first historical alarm set is associated with the first historical fault data, and the second historical alarm set is associated with the second historical fault data; selecting first historical alarm data and second historical alarm data from the target alarm set; determining a target historical fault data set according to an intersection of a third historical fault data set and a fourth historical fault data set, wherein the third historical fault data set is associated with the first historical alarm data, and the fourth historical fault data set is associated with the second historical alarm data; determining the similarity relationship between the first historical fault data and the second historical fault data according to the target alarm set and the target historical fault data set.

3. The method of claim 2, wherein, The similarity relationship determined according to the first historical fault data, the second historical fault data, and historical alarm data associated with both the first historical fault data and the second historical fault data further comprises: construct at least one relationship graph structure according to each first historical fault data in the first historical fault data set, each second historical fault data in the second historical fault data set, the first historical alarm data, and the second historical alarm data, wherein each of the relationship graph structures comprises four nodes, each of which is the first historical fault data, the second historical fault data, the first historical alarm data, and the second historical alarm data, the first historical alarm data is connected with the first historical fault data and the second historical fault data in line respectively, and the second historical alarm data is connected with the first historical fault data and the second historical fault data in line respectively; determine the similarity relationship between the first historical fault data and the second historical fault data according to the weight of the relationship graph structure.

4. The method of claim 3, wherein, The determining the similarity relationship between the first historical fault data and the second historical fault data according to the weight of the relationship graph structure comprises: determining the weight of the relationship graph structure according to the intersection of the third historical fault data set and the fourth historical fault data set; counting the number of the relationship graph structures, summing the weight of the relationship graph structure based on the number of the relationship graph structures, and determining the similarity relationship between the first historical fault data and the second historical fault data.

5. The method of claim 1, wherein, The determining at least one target processing scheme associated with the fault processing request according to the target historical fault data in the target historical fault data set comprises: determining a target fault identifier according to the target historical fault data in the target historical fault data set; extracting at least one initial processing scheme from a database according to the target fault identifier; taking the at least one initial processing scheme as at least one target processing scheme associated with the fault processing request.

6. The method of claim 1, further comprising: preprocessing each alarm data in the alarm data set to obtain each target alarm data; determining the first historical fault data matched with each target alarm data according to the preset matching condition to obtain the first historical fault data set.

7. A fault processing apparatus, comprising: an acquisition module configured to acquire an alarm data set in response to a fault processing request, wherein the alarm data set comprises at least one alarm data; a first determination module configured to determine first historical fault data matched with each alarm data in the alarm data set according to a preset matching condition to obtain a first historical fault data set; and a second determination module configured to determine target historical fault data from a second historical fault data set according to a similarity relationship between each first historical fault data in the first historical fault data set and each second historical fault data in the second historical fault data set to obtain a target historical fault data set, wherein the similarity relationship is determined according to the first historical fault data, the second historical fault data, and historical alarm data associated with both the first historical fault data and the second historical fault data. A third determining module is configured to determine at least one target processing scheme associated with the fault processing request according to the target historical fault data in the target historical fault data set. 8.An electronic device, comprising: one or more processors; a memory device for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, implement the method of any one of claims 1-6. 9.A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, perform the method of any one of claims 1-6. 10.A computer program product comprising a computer program which, when executed by a processor, performs the method of any one of claims 1-6.

Images