Monitoring method, device, equipment and storage medium

Abstract

The present application discloses a monitoring method, apparatus, device and storage medium, including: receiving alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target business; the alarm configuration information is at least used to indicate a monitoring object and an alarm rule for the target business; constructing a target monitoring task flow based on the alarm configuration information and the monitoring task; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a streaming processing method; the monitoring granularity of the monitoring task includes: a business operation component in a workflow; inputting the operation log of the target business into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow; generating an alarm message based on the alarm content; thereby converting the business operation component into a monitoring granularity, monitoring the inside of the workflow of the business, and enriching the monitoring alarm function.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and is related to, but not limited to, a monitoring method, a device, and a storage medium. Background Art

[0002] The monitoring and alarm engine is a technology that abstracts task workflows into objects, observes, obtains and analyzes object data to initiate user notification behaviors. Through the monitoring and alarm engine, users do not need to pay real-time attention to the execution status of workflows. The monitoring and alarm engine automatically adds workflows to monitoring objects, analyzes the process of workflow execution data through configurable alarm configuration information such as alarm rules, types, parameters, and methods, and sends alarm messages to users, greatly simplifying the operation and maintenance monitoring method, saving user time costs, and reducing the impact of abnormal conditions on the business.

[0003] In today's internet big data era, as government, enterprises, and internet users expand their daily operations, business monitoring, management, alerting, and operations and maintenance are becoming increasingly important. Monitoring and alerting methods provided by monitoring and alerting engines provide systematic management of monitoring and alerting for business operations. These monitoring and alerting methods enable monitoring and alerting of business operations or workflows. However, in real-world business scenarios, workflows may involve multiple different types of business operation components. Therefore, related technologies cannot monitor the internal aspects of workflows. Summary of the Invention

[0004] The embodiments of the present application provide a monitoring method, apparatus, device, and storage medium, which can monitor the execution process of a business at the monitoring granularity of the business operation component in the business workflow, thereby enriching the monitoring alarm function.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] An embodiment of the present application provides a monitoring method, the method comprising:

[0007] Receive alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target service; the alarm configuration information is used to indicate at least a monitoring object and an alarm rule for the target service;

[0008] Based on the alarm configuration information and monitoring tasks, a target monitoring task flow is constructed; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a stream processing method; the monitoring granularity of the monitoring task includes: business operation components in the workflow;

[0009] Inputting the operation log of the target business into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow;

[0010] An alarm message is generated based on the alarm content.

[0011] An embodiment of the present application provides a monitoring device, the device comprising:

[0012] A receiving module, configured to receive alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target service; the alarm configuration information is used to indicate at least a monitoring object and an alarm rule for the target service;

[0013] A construction module is used to construct a target monitoring task flow based on the alarm configuration information and the monitoring task; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a stream processing method; the monitoring granularity of the monitoring task includes: business operation components in the workflow;

[0014] A processing module, configured to input the operation log of the business to which the target operation component belongs into the target monitoring task flow, and obtain the alarm content output by the target monitoring task flow;

[0015] A generating module is used to generate an alarm message based on the alarm content.

[0016] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned monitoring method when executing the computer program.

[0017] An embodiment of the present application further provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned monitoring method is implemented.

[0018] The monitoring method, apparatus, device and storage medium provided in the embodiment of the present application receive alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target business; the alarm configuration information is at least used to indicate a monitoring object and an alarm rule for the target business; a target monitoring task flow is constructed based on the alarm configuration information and the monitoring task; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a streaming processing method; the monitoring granularity of the monitoring task includes: a business operation component in a workflow; the operation log of the target business is input into the target monitoring task flow, and an alarm output by the target monitoring task flow is obtained content; an alarm message is generated based on the alarm content, and the operation log of the workflow to be monitored is analyzed through the target monitoring task flow to monitor the business operation components of the workflow to be monitored, thereby refining the monitoring granularity into business operation components, which greatly enriches the monitoring alarm function; at the same time, the business operation components are monitored by the target monitoring task flow using a streaming processing method, and the execution efficiency of the monitoring alarm task is improved through the asynchronous non-blocking back pressure stream processing method, while there is no need to worry about the increase of alarm rules and the expansion of corresponding analysis and processing operations, allowing the addition of analysis and processing components to the monitoring task without changing the original framework, thereby improving the scalability of the monitoring alarm task. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 An optional structural diagram of the monitoring and alarm system provided in an embodiment of the present application;

[0020] Figure 2 An optional structural diagram of the monitoring and alarm system provided in an embodiment of the present application;

[0021] Figure 3 An optional structural diagram of the monitoring and alarm system provided in an embodiment of the present application;

[0022] Figure 4 An optional flow chart of the monitoring method provided in the embodiment of the present application;

[0023] Figure 5 A schematic diagram of an optional logical structure of a monitoring task provided in an embodiment of the present application;

[0024] Figure 6 An optional logical structure diagram of a target monitoring task flow provided in an embodiment of the present application;

[0025] Figure 7 A schematic diagram of an optional logical structure of a target monitoring task flow provided in an embodiment of the present application;

[0026] Figure 8A schematic diagram of an optional logical structure of a distributed monitoring and alarm engine provided in an embodiment of the present application;

[0027] Figure 9 An optional flow chart of the monitoring method provided in the embodiment of the present application;

[0028] Figure 10 An optional schematic diagram of the alarm configuration information provided in the embodiment of the present application;

[0029] Figure 11 A schematic diagram of an optional logical structure of a monitoring task provided in an embodiment of the present application;

[0030] Figure 12 An optional structural diagram of a monitoring device provided in an embodiment of the present application;

[0031] Figure 13 This is a schematic diagram of an optional structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] To make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the specific technical solutions of the application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application but are not intended to limit the scope of the present application.

[0033] The embodiments of the present application can provide a monitoring method, device, and storage medium. In practical applications, the monitoring method can be implemented in electronic devices, and the functional entities in the electronic devices can be collaboratively implemented by the hardware resources of the electronic devices (such as terminal devices and servers), such as computing resources such as processors, and communication resources (such as those used to support various communication methods such as optical cables and cellular networks).

[0034] The monitoring method provided in the embodiment of the present application is applied to a monitoring alarm system.

[0035] As an example, the structure of the monitoring alarm system can be as follows: Figure 1 As shown, it includes: a client 101. The client can execute services and obtain the operation log of the services, and a monitoring and alarm engine runs in the client, which can analyze the operation log and obtain alarm messages.

[0036] As an example, the structure of the monitoring alarm system can be as follows: Figure 1 As shown, the system includes a client 101 and a server 102. The client 101 can execute services, obtain business operation logs, and send the operation logs to the server 102. The server runs a monitoring and alarm engine that can analyze the operation logs and obtain alarm messages. The client 101 and the server 102 communicate through the network 102.

[0037] The monitoring alarm engine can perform the following processing: receiving alarm configuration information of the monitoring alarm task; the monitoring alarm task is used to monitor the target business; the alarm configuration information is at least used to indicate the monitoring object and alarm rules for the target business; based on the alarm configuration information and the monitoring task, constructing a target monitoring task flow; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a streaming processing method; the monitoring granularity of the monitoring task includes: the business operation component in the workflow; the operation log of the target business is input into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow; and an alarm message is generated based on the alarm content.

[0038] In the embodiment of the present application, the monitoring alarm system also includes a configuration interface for receiving alarm configuration information input by the user, wherein the configuration interface can be presented as an interface for receiving user input in the alarm configuration page. The configuration interface can be set on the client, on the server, or on the Figure 3 Configuration terminal 104 is shown.

[0039] Combine Figure 1 、 Figure 2 or Figure 3 The monitoring and alarm system shown in this embodiment proposes a monitoring method, which uses the business operation components of the business monitored by the monitoring and alarm task as the monitoring granularity, monitors the internal workflow of the business, enriches the monitoring and alarm functions, and at the same time improves the execution efficiency of the monitoring and alarm task through asynchronous non-blocking back pressure stream processing.

[0040] Next, combine Figure 1 、 Figure 2 or Figure 3 The schematic diagram of the monitoring and alarm system shown illustrates various embodiments of the monitoring method, device, and storage medium provided in the embodiments of the present application.

[0041] This embodiment provides a monitoring method, which is applied to an electronic device. The functions implemented by the method can be implemented by a processor in the electronic device calling program code. Of course, the program code can be stored in a computer storage medium. Therefore, the electronic device includes at least a processor and a storage medium.

[0042] An electronic device can be any device with information processing capabilities. In one embodiment, the electronic device can be a smart terminal, such as a laptop or other electronic device with wireless communication capabilities, an AR / VR device, or a mobile terminal. In another embodiment, the electronic device can also be a terminal device with computing functions that is not easy to move, such as a desktop computer. In yet another embodiment, the electronic device can also be a server, such as a cloud server.

[0043] Of course, the embodiments of the present application are not limited to being provided as methods and hardware, and can also be implemented in various ways, such as being provided as a storage medium (storing instructions for executing the monitoring method provided by the embodiments of the present application).

[0044] Figure 4 This is a schematic diagram of the implementation flow of the monitoring method of the embodiment of the present application, such as Figure 4 As shown, the method includes the following steps:

[0045] S401. The server receives alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target service; the alarm configuration information is used to indicate at least a monitoring object and an alarm rule for the target service.

[0046] In the embodiment of the present application, the business monitored by the monitoring alarm task is called a target business, wherein one monitoring alarm task can monitor one or more target businesses.

[0047] In the embodiment of the present application, when executing the target business, the server abstracts the target business into a workflow, and a workflow includes multiple business operation components, and different business operation components perform different processing of the target business.

[0048] When setting up a monitoring and alarm task, users can monitor the monitoring objects and alarm rules for alarm information on their client devices. The client then sends the received monitoring objects and alarm information to the server. Monitoring objects can be represented as alarmObjects, and alarm rules can be represented as triggerRules. Monitoring objects can include business operation components in the workflow of the target business targeted by the monitoring and alarm task. In this case, the monitoring granularity of the monitoring and alarm task is the business operation component. The monitoring and alarm information includes the following: component information of the business operation component, which identifies the business operation component to be monitored. Component information includes information such as the business operation component ID and name.

[0049] In an embodiment of the present application, for a target business, when the monitoring object includes a business operation component, the business operation component included in the monitoring object is the business operation component that needs to be monitored, and the business operation component that needs to be monitored may be all or part of the business operation components in the workflow.

[0050] In one example, for a target business, its workflow includes business operation components: business operation component 1, business operation component 2, business operation component 3, and business operation component 4. The business operation components in the monitoring object include: business operation component 2. In this case, only business operation component 2 needs to be monitored.

[0051] In one example, for a target business, the business operation components included in its workflow include: business operation component 1, business operation component 2, business operation component 3, and business operation component 4. The business operation components in the monitoring target include: business operation component 1, business operation component 2, business operation component 3, and business operation component 4. In this case, the business operation components that need to be monitored include: business operation component 1, business operation component 2, business operation component 3, and business operation component 4.

[0052] In embodiments of the present application, the monitored objects may also include workflows. In this case, the monitoring granularity of the monitoring task may include both the workflow and the business operation components within the workflow. When the monitored objects include workflows, the monitoring alarm information includes the following: workflow flow information. This flow information includes information such as the workflow's ID, name, path, and type.

[0053] The alarm rules in the alarm configuration information can be set according to actual needs.

[0054] After receiving the alarm configuration information, the server can generate a unique alarm identifier for the alarm task. Here, the alarm identifier can be recorded as alarmUuid. After generating the alarm identifier, the server can send the alarm identifier and the alarm configuration information to the monitoring alarm engine to register the monitoring alarm task with the monitoring alarm engine and make the monitoring alarm task persistent.

[0055] S402. The server constructs a target monitoring task flow based on the alarm configuration information and monitoring tasks; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a streaming processing method; the monitoring granularity of the monitoring task includes: the business operation component in the workflow.

[0056] After obtaining the alarm configuration information, the server-side monitoring and alarm engine constructs a target monitoring task for the current monitoring and alarm task based on the alarm configuration information and the monitoring task. A monitoring task is a specification developed for the monitoring and alarm engine, not for a specific monitoring and alarm task. It includes general processing flows abstracted for different monitoring and alarm tasks. Objects, elements, and parameters within a monitoring task can each be abstracted as a response stream. One response stream can serve as the input to another, and multiple response streams can serve as the input to a single response stream, implementing a response stream-based streaming processing approach.

[0057] In this embodiment of the present application, when the monitored object includes a business operation component, the monitoring granularity of the target monitoring task is the business operation component. When the monitored object also includes a workflow, the monitoring granularity of the target monitoring task includes both the workflow and the business operation component. In this case, the monitoring and alarm engine on the server supports both workflow alarms and business operation component alarms.

[0058] S403: The server inputs the target business's operation log into the target monitoring task flow, and obtains the alarm content output by the target monitoring task flow;

[0059] After building the monitoring task execution component, the server executes the target business's workflow and generates a log for the target business. The server uses the log as input to the target monitoring task flow, which analyzes it to determine whether the workflow's business execution component has experienced an anomaly or failure. If so, it outputs an alarm. The alarm content may include the alarm identifier (alarmUuid), the workflow identifier (clientUuid), the alarm type (alarmType), and the alarm message. The workflow identifier (clientUuid) uniquely identifies the workflow.

[0060] S404: The server generates an alarm message based on the alarm content.

[0061] After receiving the alarm content, the server generates an alarm message that can be output to the alarm target. Among them, the alarm target or alarm method of different alarm contents can be different.

[0062] The monitoring method provided in the embodiment of the present application receives alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target business; the alarm configuration information is at least used to indicate a monitoring object and an alarm rule for the target business; based on the alarm configuration information and the monitoring task, a target monitoring task flow is constructed; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a streaming processing method; the monitoring granularity of the monitoring task includes: a business operation component in a workflow; inputting the operation log of the target business into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow; based on the The alarm content is described to generate an alarm message, and the operation log of the workflow to be monitored is analyzed through the target monitoring task flow to monitor the business operation components of the workflow to be monitored, thereby refining the monitoring granularity into business operation components, which greatly enriches the monitoring alarm function; at the same time, the business operation components are monitored by the target monitoring task flow using a streaming processing method, and the execution efficiency of the monitoring alarm task is improved through the asynchronous non-blocking back pressure stream processing method. There is no need to worry about the increase of alarm rules and the expansion of corresponding analysis and processing operations. It allows the addition of analysis and processing components to the monitoring task without changing the original framework, thereby improving the scalability of the monitoring alarm task.

[0063] In some embodiments, as Figure 5 As shown, the monitoring task 500 includes at least: a monitoring event source 501, a business operation event source 502, a first processing middleware 503 and a message receiver 504; wherein, the monitoring event source 501 and the business operation event source 502 are the sources of the flow, the monitoring event source 501 and the business operation event source 502 respectively have a data export, the first processing middleware 503 is an intermediate component of the flow, and has a data entry and a data exit; the message receiver 504 is the final destination of the flow and has a data entry.

[0064] In the embodiment of this application, Figure 6 As shown, the monitoring event source 501 and the business operation event source 502 are input to the first processing middleware 503 , and the output of the first processing middleware 503 is the input of the message receiver 504 , which is the final destination of the message receiver 504 flow.

[0065] based on Figure 5 The implementation of the monitoring task shown in S402 includes:

[0066] S4021: Using the monitoring object as the content of the monitoring event source to obtain a target monitoring event source;

[0067] S4022: Use the alarm rule as the processing logic of the first processing middleware to obtain a first target processing middleware;

[0068] S4023: Using the alarm rule as the message generation logic of the message receiver to obtain a target message receiver;

[0069] S4024: Construct the target monitoring task flow based on the target monitoring event source, the business operation event source, the first target processing middleware, and the message receiver.

[0070] based on Figure 5 The monitoring tasks shown are as follows Figure 6 As shown, the monitoring object 61 is sent to the monitoring event source 501 to obtain the target monitoring event source 601, the alarm rule 62 is sent to the processing middleware 503 to obtain the target processing middleware 603, and the alarm rule 62 is sent to the message receiver 504 to obtain the target message receiver 604. Based on the target monitoring event source 601, the business operation event source 602, i.e. 502, the target processing middleware 603 and the target message receiver 604, the target monitoring task flow 600 is obtained.

[0071] Here, the monitoring object is described as a target monitoring event source 601, and the operation event of the monitoring object is described as an operation event source 602. The first target processing middleware 603 is used to determine whether an alarm is required based on the alarm rules. The message receiver 604 is used to generate the content of the alarm message, i.e., the alarm content, based on the alarm rules when an alarm is required. In particular, if the monitoring object in the monitoring event source is a workflow, it can be represented by a workflow identifier. If the monitoring object in the monitoring event source is a business operation component, it can be represented by a component type (componentType). Here, different component types can represent different business operation components. Component types may include: extracting a relational database (MySQL), extracting a relational database management system (SQL Server), converting columns, converting rows, loading MySQL, loading SQL Server, etc.

[0072] In some embodiments, the implementation of S403 includes:

[0073] S4031. Input the operation log into the business operation event source to obtain a target business operation event source;

[0074] S4032: Input the target monitoring event source and the target business operation event source into the first target processing middleware, and obtain alarm indication information output by the first target processing middleware; the alarm indication information indicates that the target monitoring event source and the target business operation event source comply with the alarm rule;

[0075] S4033: Input the alarm indication signal to the target message receiver to obtain the alarm content output by the message receiver.

[0076] If the content of the target monitoring event source is the monitoring object, then the stream output by the target monitoring event source is the monitoring object. If the data in the target business operation event source is the operation log, then the stream output by the target business operation event source is the operation log. The stream output by the target monitoring event source and the stream output by the target business operation event source are input to the first processing middleware. The first processing middleware judges the operation logs that match the monitoring object through the alarm rules, and determines which operation logs in the operation logs need to issue an alarm. For operation logs that do not need to issue an alarm, no alarm is required. For operation logs that need to issue an alarm, it indicates that the operation log matches the alarm rule. At this time, the content of the generated stream is alarm indication information to indicate that the operation log needs to issue an alarm. For operation logs that do not need to issue an alarm, no alarm indication information is issued.

[0077] After receiving the stream including the alarm indication information, the target message receiver generates alarm content based on the alarm indication information and the alarm rule, wherein the alarm rule can be used to determine information such as the alarm type of the generated alarm content.

[0078] In one example, the alarm content may include: alarm information, alarm type, workflow identifier, alarm identifier and other information.

[0079] In one example, when the monitoring granularity is workflow, the alarm content may include:

[0080]

[0081]

[0082] Among them, message is used to identify the message, type is used to identify the type of message, clientUuid is the universally unique identifier (UUID) of the workflow; executionUuid is the execution UUID. For a workflow with periodic tasks, an execution UUID of the object is generated each time it is executed; alarmUuid is the UUID of the monitoring alarm task; dataTime is the data time of the workflow; flowAlarm indicates whether it is a workflow alarm. In one example, when the value of flowAlarm is true, it is a workflow alarm, and when the value of flowAlarm is false, it is not a workflow alarm.

[0083] In one example, when the monitoring granularity is the business operation component, the alarm content may include:

[0084]

[0085] componentName is the component name.

[0086] In some embodiments, as Figure 7 As shown, the target task monitoring flow also includes: a second target processing middleware 505; the input of the second target processing middleware 505 is the flow output by the first target processing middleware, and the flow output by the second target processing middleware is input to the target message receiver.

[0087] The second target processing middleware is used to evaluate the risk level of an alarm storm generated by the operation log that requires an alarm. When the risk level of an alarm storm generated by the business operation log is greater than the set risk level, it indicates that the current business log has the possibility of generating an alarm storm.

[0088] At this point, the implementation of S4033 includes:

[0089] The alarm indication information is input into the second target processing middleware; the risk level of the alarm indication message generating an alarm storm is evaluated by the second target processing middleware, and the alarm indication information with a risk level greater than the set risk level is merged to obtain a merged result; the merged result is input into the target message receiver.

[0090] In an embodiment of the present application, the alarm indication information can be merged based on the information of any dimension in the alarm indication information. The alarm indication information may include information such as alarmUuid, clientUuid, alarmType, and email. When the alarmUuid is the same, it indicates that the alarm indication information is under the same monitoring alarm task; when the clientUuid is the same, it indicates that the alarm indication information is under the same workflow; when the alarmType is the same, it indicates that the alarm type is the same; and when the email is the same, it indicates that the alarm receiver is the same.

[0091] In some embodiments, after S4033, the following steps are further included:

[0092] Outputting the alarm content output by the message receiver to an alarm message queue;

[0093] Periodically consume the alarm content in the alarm message queue.

[0094] In some embodiments, the alarm configuration is also used to indicate the alarm method and the monitoring object, and the generating of the alarm message based on the alarm content includes: generating an alarm message adapted to the alarm method based on the alarm content; the method also includes: sending the alarm message to the alarm object via the alarm method.

[0095] In some embodiments, the alarm configuration information also includes: a do not disturb time period; the method also includes: determining whether the current time is outside the do not disturb time period; wherein, when the current time is outside the do not disturb time period, the operation log of the target business is input into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow.

[0096] Below, the monitoring method provided in the embodiment of the present application is further explained through specific application scenarios.

[0097] An embodiment of the present application proposes a method for implementing a lightweight distributed monitoring and alarm engine, which includes: abstracting the workflow into an object, abstracting the business operation components involved in the workflow into sub-objects, defining a monitoring event source, a business operation event source, a processing middleware, and a message receiver, and using streaming processing to build a responsive workflow to implement a lightweight monitoring and alarm engine.

[0098] In the embodiment of this application, Figure 8 As shown, the distributed monitoring and alarm engine 800 is divided into a main monitoring engine 801 , an auxiliary monitoring engine 802 and an alarm engine 803 .

[0099] The main monitoring engine 801 is used to carry the monitoring and alarm tasks of the periodic workflow and send the generated alarm messages to the alarm engine 803.

[0100] The auxiliary monitoring engine 802 is used to track the message production frequency of the main monitoring engine 801, and evaluate the risk level of the alarm storm by analyzing the alarm message production frequency. For alarm messages whose risk level meets the set risk level, they are merged according to the alarm rules and monitoring objects to obtain a merged alarm message. The auxiliary monitoring engine 802 sends the merged alarm message to the alarm engine 803.

[0101] The alarm engine 803 is responsible for sending the alarm message or the combined alarm message to the user terminal. Among them, the alarm engine can provide alarm methods such as email and text messages, so that the alarm engine sends the alarm message to the user terminal via email or text messages.

[0102] This proposal builds a responsive workflow based on AkkaStream to implement business monitoring and alerting. AkkaStream is an asynchronous, non-blocking, back-pressured stream processing method, thereby realizing an asynchronous, non-blocking, and efficient business operation monitoring and alerting solution.

[0103] like Figure 9 As shown, including:

[0104] S901. Configure an interface to receive alarm configuration for a monitoring alarm task.

[0105] Here, the user initiates a new monitoring alarm task creation operation through the configuration interface to create a new monitoring alarm task. The user enters the alarm configuration of the new monitoring alarm task in the new monitoring alarm task creation operation. The alarm configuration includes: alarm name, alarm description, monitoring object, alarm rules, alarm method and alarm object.

[0106] S902: The configuration interface registers the monitoring alarm task in the monitoring alarm engine.

[0107] The configuration interface registers the newly created monitoring alarm task in the monitoring alarm engine according to the alarm configuration.

[0108] Here, the monitoring alarm engine generates a unique identifier for the current monitoring alarm task, and the unique identifier can be an alarm UUID, which can be identified as alarmUuid.

[0109] S903: The monitoring alarm engine stores the alarm configuration of the monitoring alarm task in the database.

[0110] Here, the monitoring alarm engine makes the alarm configuration of the monitoring alarm task persistent by storing the alarm configuration of the monitoring alarm task in the database.

[0111] S904: The monitoring alarm engine creates a monitoring task.

[0112] Monitoring tasks include: monitoring event sources, business operation event sources, processing middleware, and message receivers.

[0113] S905: The monitoring alarm engine sends the workflow or work component that the current monitoring alarm task needs to monitor to the monitoring task.

[0114] The monitoring alarm engine sends the workflow or business component that the current monitoring alarm task needs to monitor to the monitoring event source of the monitoring task.

[0115] Among them, a subtask in the business monitored by the monitoring alarm task corresponds to a workflow or business component.

[0116] S906. The monitoring alarm engine consumes the running logs in the Kafka queue and sends the running logs to the monitoring task.

[0117] Here, the operation log can be stored in the log message queue, and the monitoring alarm engine can periodically consume the operation log in the log message queue to the business operation event source of the monitoring task.

[0118] S907: The monitoring alarm engine triggers a stream processing operation based on the received workflow or work component and operation log to be monitored, and generates alarm information.

[0119] The monitoring event source of the monitoring task receives the workflow or work component that needs to be monitored, and the business operation event source receives the operation log. Based on the monitoring event source and the business operation event source as the input of the stream, the workflow or work component that needs to be monitored and the operation log are stream-processed according to the alarm rules to obtain the alarm information, and the monitoring task sends the alarm message to the alarm message queue.

[0120] S908: The monitoring alarm engine sends the alarm information to the alarm target.

[0121] Here, the monitoring alarm engine consumes the alarm messages in the alarm message queue, obtains the alarm configuration according to the unique identifier of the monitoring alarm task, obtains the alarm mode and alarm object in the alarm configuration, and sends the consumed alarm message to the alarm object in the corresponding alarm mode.

[0122] The alarm configuration received in the above S901 can be as follows Figure 10 As shown, it includes the following: monitoring alarm objects, alarm rules, advanced settings, and delivery settings. The monitoring alarm objects include workflow and running component parameters. Workflow parameters include ID, name, path, and type, while running component parameters include ID and name. Alarm rules send alarms when execution fails. Alarm rules may include type, message, and optional options, including retry interval and number of retries. Advanced settings include do not disturb time (do not disturb start time (quietTimeFrom) and do not disturb end time (quietTimeTo)), interval unit (interval unit), and interval (interval). Delivery settings include alarm method (whether email, SMS, or application BMP) and alarm object (receiver). Alarm object parameters include receiver ID (receiverID), receiver type (type), and receiver name (receiverName).

[0123] In the above S904, the monitoring alarm engine constructs a monitoring task, namely a monitoring task flow (StreamWork), based on Akka Stream, and sends the unique identifier of the monitoring alarm task and the alarm rules and alarm sender (resultSender) in the alarm configuration to the constructed monitoring task, thereby obtaining the monitoring task flow corresponding to the current monitoring alarm task.

[0124] The monitoring tasks in the embodiment of this application are as follows Figure 11 As shown, it includes: a monitoring event source 1101, a business operation event source 1102, a processing middleware 1103 and a message receiver (sink) 1104.

[0125] The content of monitoring event source 901 is the task flow to be monitored and the components to be monitored under the task flow to be monitored. The task flow to be monitored can be identified as FlowEventFilter, and the component to be monitored can be identified as ComponentEventFilter. The task flow to be monitored can include the task flows corresponding to all or part of the currently running business, and the components to be monitored can include all or part of the components in a task flow.

[0126] The business operation event source 1102 is composed of a task flow (FlowEvent) and its component operation events (ComponentEvent).

[0127] The processing middleware 1103 includes event source processing middleware 11031 and alarm message processing middleware 11032 .

[0128] The event source processing middleware 9031 is based on Akka Stream, which is built on GraphStage. GraphStage is a reusable graph stream processing component that consists of a [[Shape]] that describes its input and output ports and a factory function that builds a [[GraphStageLogic]] that implements the processing logic that binds the ports together.

[0129] Event source processing middleware 11031 includes two inputs and one output: monitoring events and business operation events; and alarm messages. The [[Shape]] of GraphStage can be specifically a graph FanInShape2 with two inputs and one output. Data processing operations have been added to [[GraphStageLogic]], providing general processing methods for task flow and business component monitoring data based on different alarm rules.

[0130] Alarm message processing middleware 11032 has only one input and one output: the alarm message before and after processing. Its processing logic incorporates operations for handling alarm messages, assessing the risk of an alarm storm and selecting a response based on the risk level. Messages meeting the risk level are collated and consolidated according to the alarm rules and monitored objects before being sent to the message receiver. Messages failing this level are forwarded directly to message receiver 1104 without further processing.

[0131] The message receiver 1104 defines an alarm message sender (AlarmSender). Alarmsender is mainly involved in the processing operation of alarm messages, receives parameters resultSender, alarmUuid, and message, generates message content according to different alarm rules, and sends the generated message content to the alarm message queue.

[0132] In S905 , the monitoring alarm engine sends the workflow and components that the current monitoring alarm task needs to monitor, namely, flowEventFilter and componentEventFilter, to the monitoring task.

[0133] In S906 , the monitoring alarm engine consumes the operation log of the business corresponding to the current monitoring task from the log message queue, and sends the state change event of the business operation, namely, flowEvent and componentEvent, to the monitoring task.

[0134] In S907 , after receiving the business operation status change event, the monitoring task triggers a stream processing operation, generates an alarm message, and sends it to the alarm message queue.

[0135] In S908, the monitoring alarm engine consumes the alarm message in the alarm message queue, obtains the alarm configuration information according to the alarm unique identifier, obtains the alarm mode and alarm object, and completes the alarm sending.

[0136] In the embodiment of the present application, the log message queue and the alarm information queue can adopt the Kafka message queue.

[0137] The monitoring method provided in the embodiments of the present application includes the following technical features:

[0138] (1) The addition of custom alarm rules provides configuration options for monitoring objects and triggering rules. Triggering rules support custom expressions, parameters, and message content, reflecting the flexibility of configuration modification and analysis processing, and enriching the expression and processing capabilities of monitoring alarm tasks;

[0139] (2) The monitoring and alarming tasks are abstracted into responsive stream processing operations, which not only provide monitoring and alarming for the task flow, but also provide monitoring and alarming for each business operation component involved in the task flow, greatly enriching the monitoring and alarming functions. At the same time, there is no need to worry about the increase of alarm rules and the expansion of corresponding analysis and processing operations. It allows the addition of analysis and processing components to the monitoring tasks without changing the original framework, thus improving the scalability of the system.

[0140] (3) Advanced alarm settings are added to provide alarm storm processing capabilities. In the scenario where large-scale periodic business operations are abnormal, a surge in alarm volume is avoided, and a series of alarm storm problems caused by user terminals continuously receiving alarm notifications in a short period of time are prevented. This not only provides traversal for operation and maintenance personnel, but also reduces the difficulty of problem troubleshooting.

[0141] The embodiment of the present application provides a monitoring device 1200, such as Figure 12 As shown, the monitoring device 1200 includes:

[0142] Receiving module 1201, configured to receive alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target service; the alarm configuration information is used to indicate at least a monitoring object and an alarm rule for the target service;

[0143] Construction module 1202 is used to construct a target monitoring task flow based on the alarm configuration information and the monitoring task; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a stream processing method; the monitoring granularity of the monitoring task includes: business operation components in the workflow;

[0144] The processing module 1203 is configured to input the operation log of the target business into the target monitoring task flow and obtain the alarm content output by the target monitoring task flow;

[0145] The generating module 1204 is configured to generate an alarm message based on the alarm content.

[0146] In some embodiments, the building block 1202 is further configured to:

[0147] Taking the monitoring object as the content of the monitoring event source, obtaining a target monitoring event source;

[0148] Using the alarm rule as the processing logic of the first processing middleware to obtain a first target processing middleware;

[0149] Using the alarm rule as the message generation logic of the message receiver to obtain a target message receiver;

[0150] The target monitoring task flow is constructed based on the target monitoring event source, the business operation event source, the first target processing middleware and the target message receiver.

[0151] In some embodiments, the processing module 1203 is further configured to:

[0152] Inputting the operation log into the business operation event source to obtain a target business operation event source;

[0153] Inputting the target monitoring event source and the target business operation event source into the first target processing middleware, and obtaining alarm indication information output by the first target processing middleware; the alarm indication information indicates that the target monitoring event source and the target business operation event source comply with the alarm rule;

[0154] The alarm indication signal is input into the target message receiver to obtain the alarm content output by the message receiver.

[0155] In some embodiments, the processing module 1203 is further configured to:

[0156] inputting the alarm indication information into the second processing middleware;

[0157] evaluating, by the second target processing middleware, the risk level of the alarm indication message generating an alarm storm, and merging the alarm indication messages having a risk level greater than a set risk level to obtain a merged result;

[0158] The combined result is input to the target message receiver.

[0159] In some embodiments, the monitoring device 1200 further includes:

[0160] An output module, configured to output the alarm content output by the message receiver to an alarm message queue;

[0161] The consumption module is used to periodically consume the alarm content in the alarm message queue.

[0162] In some embodiments, the generating module is further configured to generate an alarm message adapted to the alarm format in the alarm configuration information based on the alarm content;

[0163] The monitoring device 1200 further includes:

[0164] The sending module is used to send the alarm message to the alarm object in the alarm configuration information through the alarm method.

[0165] In some embodiments, the monitoring device 1200 further includes:

[0166] Determine whether the current time is outside the do-not-disturb time period in the alarm configuration information; wherein, when the current time is outside the do-not-disturb time period, the operation log of the target business is input into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow.

[0167] The description of the above device embodiment is similar to the description of the above method embodiment and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0168] It should be noted that, in the embodiment of the present application, if the above-mentioned monitoring method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0169] Correspondingly, an embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, the steps in the monitoring method provided in the above embodiment are implemented.

[0170] Correspondingly, an embodiment of the present application provides a storage medium, that is, a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the monitoring method provided in the above embodiment is implemented.

[0171] It should be noted that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0172] It should be noted that Figure 13 This is a hardware entity diagram of an electronic device according to an embodiment of the present application, such as Figure 13 As shown, the electronic device 1300 includes: a processor 1301, at least one communication bus 1302, a user interface 1303, at least one external communication interface 1304, and a memory 1305. The communication bus 1302 is configured to enable communication between these components. The user interface 1303 may include a display screen, and the external communication interface 1304 may include a standard wired interface and a wireless interface.

[0173] The memory 1305 is configured to store instructions and applications executable by the processor 1301, and can also cache data to be processed or processed by the processor 1301 and various modules in the electronic device (for example, image data, audio data, voice communication data and video communication data), which can be implemented through flash memory (FLASH) or random access memory (RAM).

[0174] It should be understood that “one embodiment” or “an embodiment” mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, “in one embodiment” or “in some embodiments” appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0175] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0176] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0177] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed across multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0178] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0179] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, and other media that can store program codes.

[0180] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0181] The above is merely an embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A monitoring method, characterized in that: The method comprises: Receive alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target service; the alarm configuration information is used to indicate at least a monitoring object and an alarm rule for the target service; Based on the alarm configuration information and monitoring tasks, a target monitoring task flow is constructed; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a stream processing method; the monitoring granularity of the monitoring task includes: business operation components in the workflow; Inputting the operation log of the target business into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow; generating an alarm message based on the alarm content; The monitoring task at least includes: a monitoring event source, a business operation event source, a first processing middleware, and a message receiver; and constructing a target monitoring task flow based on the alarm configuration information and the monitoring task includes: Taking the monitoring object as the content of the monitoring event source, obtaining a target monitoring event source; Using the alarm rule as the processing logic of the first processing middleware to obtain a first target processing middleware; Using the alarm rule as the message generation logic of the message receiver to obtain a target message receiver; Based on the target monitoring event source, the business operation event source, the first target processing middleware and the target message receiver, the target monitoring task flow is formed; The step of inputting the target business operation log into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow includes: Inputting the operation log into the business operation event source to obtain a target business operation event source; Inputting the target monitoring event source and the target business operation event source into the first target processing middleware, and obtaining alarm indication information output by the first target processing middleware; the alarm indication information indicates that the target monitoring event source and the target business operation event source comply with the alarm rule; The alarm indication information is input into the target message receiver to obtain the alarm content output by the message receiver.

2. The method according to claim 1, characterized in that The target monitoring task flow further includes: a second target processing middleware; and inputting the alarm indication information to the target message receiver includes: inputting the alarm indication information into the second target processing middleware; evaluating, by the second target processing middleware, a risk level of an alarm storm generated by the alarm indication information, and merging the alarm indication information having a risk level greater than a set risk level to obtain a merged result; The combined result is input to the target message receiver.

3. The method according to claim 1, characterized in that The method further comprises: Outputting the alarm content output by the message receiver to an alarm message queue; Periodically consume the alarm content in the alarm message queue.

4. The method according to any one of claims 1 to 3, characterized in that The alarm configuration information is further used to indicate an alarm mode and an alarm object. The generating of an alarm message based on the alarm content includes: generating an alarm message adapted to the alarm format based on the alarm content; The method further comprises: The alarm message is output to the alarm object through the alarm method.

5. The method according to any one of claims 1 to 3, characterized in that The alarm configuration information further includes: a do not disturb time period; the method further includes: Determine whether the current time is outside the do not disturb time period; wherein, if the current time is outside the do not disturb time period, input the operation log of the target business into the target monitoring task flow to obtain the alarm content output by the target monitoring task flow.

6. A monitoring device, characterized in that: The device comprises: A receiving module, configured to receive alarm configuration information of a monitoring alarm task; the monitoring alarm task is used to monitor a target service; the alarm configuration information is used to indicate at least a monitoring object and an alarm rule for the target service; A construction module is used to construct a target monitoring task flow based on the alarm configuration information and the monitoring task; the monitoring task includes a processing flow abstracted for at least two different monitoring alarm tasks; the monitoring task adopts a stream processing method; the monitoring granularity of the monitoring task includes: business operation components in the workflow; A processing module, configured to input the operation log of the target business into the target monitoring task flow and obtain the alarm content output by the target monitoring task flow; A generating module, configured to generate an alarm message based on the alarm content; Wherein, the monitoring task at least includes: a monitoring event source, a business operation event source, a first processing middleware and a message receiver; the construction module is further used to use the monitoring object as the content of the monitoring event source to obtain a target monitoring event source; use the alarm rule as the processing logic of the first processing middleware to obtain a first target processing middleware; use the alarm rule as the message generation logic of the message receiver to obtain a target message receiver; based on the target monitoring event source, the business operation event source, the first target processing middleware and the target message receiver, the target monitoring task flow is constructed; The processing module is also used to input the operation log into the business operation event source to obtain the target business operation event source; input the target monitoring event source and the target business operation event source into the first target processing middleware to obtain the alarm indication information output by the first target processing middleware; the alarm indication information indicates that the target monitoring event source and the target business operation event source comply with the alarm rules; input the alarm indication information into the target message receiver to obtain the alarm content output by the message receiver.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the monitoring method according to any one of claims 1 to 5 are implemented.

8. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the monitoring method according to any one of claims 1 to 5 is implemented.

Images