Alarm root cause tracing method, device, and electronic equipment

Abstract

The present application discloses a method and device for tracing the root cause of an alarm, and belongs to the field of communication technology. The method includes: generating an alarm root source location identifier based on the resource information of the resource layer, network layer, and application layer of the target monitoring resource; in response to an alarm of the target monitoring resource, obtaining the real-time operation data of the resource information according to the alarm root source location identifier; obtaining the network topology triple of the target monitoring resource according to the alarm root source location identifier; supplementing the real-time operation data and the network topology triple to the alarm root source location identifier; tracing the root cause of the alarm according to the alarm root source location identifier obtained after the supplementary record. This method generates an alarm root source location identifier based on the data of the network layer, resource layer, and application layer, so that the operation and maintenance personnel in the computer room operation and maintenance scenario can quickly understand the information of the alarm from the resource layer to the network layer and then to the application layer through the alarm root source location identifier.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an alarm root cause tracing method and device, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the deepening of digital development, the number of in-operation equipment of communication or network operators has gradually increased, and the demand for equipment maintenance has gradually increased. Even though operation and maintenance has evolved from manual operation and maintenance to tool operation and maintenance and platform operation and maintenance, intelligent operation and maintenance has not yet been achieved. When an alarm occurs, quickly locating the cause of the alarm and troubleshooting is an important guarantee for the stable operation of the network. The results of the alarm root cause analysis are helpful for maintenance personnel to improve the efficiency of system operation and maintenance. However, in the prior art, the alarm root cause analysis data in the computer room operation and maintenance scenario cannot enable operation and maintenance personnel to quickly understand the problems of alarms from the resource layer to the network layer and then to the application layer. Summary of the invention

[0003] The embodiments of the present application provide a method, device, and electronic device for tracing the root cause of an alarm, which are used to solve the problem that the root cause analysis data of the alarm in the computer room operation and maintenance scenario cannot enable the operation and maintenance personnel to quickly understand the alarm from the resource layer to the network layer and then to the application layer.

[0004] In a first aspect, an embodiment of the present application discloses a method for tracing the root cause of an alarm, the method comprising:

[0005] Generate alarm root source location identification based on resource information of the target monitoring resource's resource layer, network layer, and application layer;

[0006] In response to an alarm occurring in the target monitoring resource, obtaining real-time operation data of the resource information according to the alarm root source location identifier;

[0007] According to the alarm root source location identifier, obtaining a network topology triplet of the target monitoring resource;

[0008] The real-time operation data and the network topology triplet are supplementarily recorded in the alarm root source location identifier;

[0009] The root cause of the alarm is traced based on the alarm root source location identifier obtained after the supplementary record.

[0010] Optionally, generating an alarm root source location identifier according to resource information of a resource layer, a network layer, and an application layer of a target monitoring resource includes:

[0011] Obtain resource information of the resource layer, network layer, and application layer of the target monitoring resource through a preset complementary relationship library;

[0012] An alarm root source location identifier is generated in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information.

[0013] Optionally, the resource information includes: IP resource information, network logical topology information, historical alarm associated resource information, application layer resource information and work order associated resource information, and obtaining the resource layer, network layer and application layer resource information of the target monitoring resource by presetting a complementary relationship library includes one or more of the following methods:

[0014] Using the IP address of the target monitoring resource as a query condition, querying the IP resource database to obtain the IP resource information of the resource layer of the target monitoring resource;

[0015] Using the IP address of the target monitoring resource as a query condition, querying the network logical topology database to obtain the network logical topology information of the network layer of the target monitoring resource;

[0016] Using the IP address of the target monitoring resource as a query condition, querying the work order database to obtain the work order-related resource information of the network layer of the target monitoring resource;

[0017] Using the IP address of the target monitoring resource as a query condition, query the historical alarm database to obtain the historical alarm-related resource information of the network layer of the target monitoring resource;

[0018] The IP address of the target monitoring resource is used as a query condition to query the application layer resource database to obtain application layer resource information of the application layer of the target monitoring resource.

[0019] Optionally, generating an alarm root source location identifier in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information includes:

[0020] The information corresponding to different preset complementary relationship libraries is separated by a first separator, and the resource information obtained from the same preset complementary relationship library is separated by a second separator to generate an alarm root source location identifier including the IP address of the target monitoring resource, the information of the preset complementary relationship library and / or the resource information.

[0021] Optionally, the acquiring the real-time operation data of the resource information according to the alarm root source location identifier includes:

[0022] Cut the alarm root source location identifier according to the first separator to obtain cutting information corresponding to each preset complementary relationship library;

[0023] Cut the cutting information corresponding to each preset complementary relationship library according to the second separator to obtain the resource information corresponding to the preset complementary relationship library;

[0024] Collect real-time operation data of the network equipment corresponding to the resource information.

[0025] Optionally, acquiring the network topology triplet of the target monitoring resource according to the alarm root source location identifier includes:

[0026] Acquire a first topology information set of the target monitoring resources according to the resource information recorded in the alarm root source location identifier;

[0027] Acquire a second topology information set of the target monitoring resource according to the log data of the target monitoring resource and the network logical topology information;

[0028] A network topology triplet of the target monitoring resource is acquired according to the first topology information set and the second topology information set.

[0029] Optionally, tracing the root cause of the alarm according to the alarm root source location identifier obtained after supplementing the record includes:

[0030] Acquire a host information set associated with an IP address according to the triplet in the alarm root source location identifier, and perform alarm root cause tracing according to the host assets in the host information set; and / or,

[0031] The alarm root source location identifier is displayed.

[0032] In a second aspect, an embodiment of the present application discloses an alarm root cause tracing device, the device comprising:

[0033] An alarm root source location identifier generation module is used to generate an alarm root source location identifier based on resource information of the resource layer, network layer, and application layer of the target monitoring resource;

[0034] A module for acquiring real-time operation data of associated resources, for acquiring real-time operation data of the resource information according to the alarm root source location identifier in response to an alarm of the target monitoring resource;

[0035] A network topology triplet acquisition module, used to acquire the network topology triplet of the target monitoring resource according to the alarm root source location identifier;

[0036] An alarm source location identifier updating module, used for supplementing the real-time operation data and the network topology triplet to the alarm source location identifier;

[0037] The alarm root cause tracing module is used to trace the alarm root cause according to the alarm root cause location identifier obtained after supplementing the record.

[0038] Optionally, the alarm root source location identifier generation module is further used to:

[0039] Obtain resource information of the resource layer, network layer, and application layer of the target monitoring resource through a preset complementary relationship library;

[0040] An alarm root source location identifier is generated in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information.

[0041] Optionally, the resource information includes: IP resource information, network logical topology information, historical alarm associated resource information, application layer resource information and work order associated resource information, and obtaining the resource layer, network layer and application layer resource information of the target monitoring resource by presetting a complementary relationship library includes one or more of the following methods:

[0042] Using the IP address of the target monitoring resource as a query condition, querying the IP resource database to obtain the IP resource information of the resource layer of the target monitoring resource;

[0043] Using the IP address of the target monitoring resource as a query condition, querying the network logical topology database to obtain the network logical topology information of the network layer of the target monitoring resource;

[0044] Using the IP address of the target monitoring resource as a query condition, querying the work order database to obtain the work order-related resource information of the network layer of the target monitoring resource;

[0045] Using the IP address of the target monitoring resource as a query condition, query the historical alarm database to obtain the historical alarm-related resource information of the network layer of the target monitoring resource;

[0046] The IP address of the target monitoring resource is used as a query condition to query the application layer resource database to obtain application layer resource information of the application layer of the target monitoring resource.

[0047] Optionally, generating an alarm root source location identifier in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information includes:

[0048] The information corresponding to different preset complementary relationship libraries is separated by a first separator, and the resource information obtained from the same preset complementary relationship library is separated by a second separator to generate an alarm root source location identifier including the IP address of the target monitoring resource, the information of the preset complementary relationship library and / or the resource information.

[0049] Optionally, the associated resource real-time operation data acquisition module is further used to:

[0050] Cut the alarm root source location identifier according to the first separator to obtain cutting information corresponding to each preset complementary relationship library;

[0051] Cut the cutting information corresponding to each preset complementary relationship library according to the second separator to obtain the resource information corresponding to the preset complementary relationship library;

[0052] Collect real-time operation data of the network equipment corresponding to the resource information.

[0053] Optionally, the network topology triplet acquisition module is further used to:

[0054] Acquire a first topology information set of the target monitoring resources according to the resource information recorded in the alarm root source location identifier;

[0055] Acquire a second topology information set of the target monitoring resource according to the log data of the target monitoring resource and the network logical topology information;

[0056] A network topology triplet of the target monitoring resource is acquired according to the first topology information set and the second topology information set.

[0057] Optionally, the alarm root cause tracing module is further used to:

[0058] Acquire a host information set associated with an IP address according to the triplet in the alarm root source location identifier, and perform alarm root cause tracing according to the host assets in the host information set; and / or,

[0059] The alarm root source location identifier is displayed.

[0060] In a third aspect, an embodiment of the present application further discloses an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the alarm root cause tracing method described in the embodiment of the present application when executing the computer program.

[0061] In a fourth aspect, an embodiment of the present application discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the alarm root cause tracing method disclosed in the embodiment of the present application.

[0062] The alarm root cause tracing method disclosed in the embodiment of the present application generates an alarm root source location identifier according to the resource information of the resource layer, network layer and application layer of the target monitoring resource; in response to the occurrence of an alarm in the target monitoring resource, obtains the real-time operation data of the resource information according to the alarm root source location identifier; obtains the network topology triplet of the target monitoring resource according to the alarm root source location identifier; supplements the real-time operation data and the network topology triplet to the alarm root source location identifier; and traces the root cause of the alarm according to the alarm root source location identifier obtained after the supplementary record. Since the alarm root source location identifier is generated according to the data of the network layer, the resource layer and the application layer, the operation and maintenance personnel in the computer room operation and maintenance scenario can quickly understand the information of the alarm from the resource layer to the network layer and then to the application layer through the alarm root source location identifier.

[0063] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0065] Figure 1 It is a flow chart of the alarm root cause tracing method disclosed in the embodiment of the present application;

[0066] Figure 2 This is a flow chart of a method for generating an alarm root source location identifier in an embodiment of the present application;

[0067] Figure 3 It is a schematic diagram of the structure of the alarm root cause tracing device disclosed in the embodiment of the present application;

[0068] Figure 4 A block diagram schematically shows an electronic device for executing the method according to the present application; and

[0069] Figure 5 A storage unit for holding or carrying a program code for implementing the method according to the present application is schematically shown. DETAILED DESCRIPTION

[0070] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0071] like Figure 1 As shown, an alarm root cause tracing method disclosed in an embodiment of the present application includes: steps 110 to 150.

[0072] Step 110, generating an alarm root source location identifier according to resource information of the resource layer, network layer, and application layer of the target monitoring resource.

[0073] In the embodiment of the present application, the target monitoring resources are network resources monitored by the alarm system, for example, they may be network devices such as servers, routers, switches, etc.

[0074] The alarm root source location identifier may be in the form of a text string, a character string, a text sequence, etc.

[0075] The resource information of the target monitoring resource may include: historical data and real-time operation data. In some embodiments of the present application, the resource information includes but is not limited to one or more of the following: host IP address, IP resource information, network logical topology information, historical alarm associated resource information, application layer resource information and work order associated resource information.

[0076] The associated resource information covers operation and maintenance data, configuration data, working status data, equipment information of target monitoring resources, and network logical topology information.

[0077] In some embodiments of the present application, the host IP address can be obtained through an alarm monitoring system, and the IP resource information, network logical topology information, historical alarm associated resource information, application layer resource information, and work order associated resource information as associated information of the host IP address can be obtained through a preset complementary relationship library. After obtaining the above information, the above information is recorded in the alarm root source location identifier according to preset rules.

[0078] In some embodiments of the present application, Figure 2 As shown, the method of generating an alarm root source location identifier according to the resource information of the resource layer, network layer, and application layer of the target monitoring resource includes: sub-step 1101 and sub-step 1102.

[0079] Sub-step 1101, obtaining resource information of the resource layer, network layer, and application layer of the target monitoring resource through a preset complementary relationship library.

[0080] In some embodiments of the present application, the preset complementary relationship library includes but is not limited to one or more of the following databases: IP resource database, network logical topology database, historical alarm database, application layer resource database, work order database. The preset complementary relationship library covers the resource layer, network layer and application layer, and resource information of different layers in the network structure can be obtained by querying different preset complementary relationship libraries.

[0081] In some embodiments of the present application, the resource information of the resource layer, network layer, and application layer of the target monitoring resource is obtained by presetting a complementary relationship library, including one or more of the following methods: using the IP address of the target monitoring resource as a query condition, querying the IP resource database, and obtaining the IP resource information of the resource layer of the target monitoring resource; using the IP address of the target monitoring resource as a query condition, querying the network logical topology database, and obtaining the network logical topology information of the network layer of the target monitoring resource; using the IP address of the target monitoring resource as a query condition, querying the work order database, and obtaining the work order-related resource information of the network layer of the target monitoring resource; using the IP address of the target monitoring resource as a query condition, querying the historical alarm database, and obtaining the historical alarm-related resource information of the network layer of the target monitoring resource; using the IP address of the target monitoring resource as a query condition, querying the application layer resource database, and obtaining the application layer resource information of the application layer of the target monitoring resource.

[0082] The following describes the methods for obtaining the above resource information.

[0083] Optionally, the IP resource database is used to query IP resource information based on the IP condition of the target monitoring resource. For example, the IP resource database is queried with the IP address of the target monitoring resource as the query condition to obtain the IP resource information associated with the target monitoring resource. Optionally, the IP resource information includes but is not limited to one or more of the following information: the coordinate information of the cabinet where the target monitoring resource is located (such as spatial coordinates), the device type, the U position of the cabinet, and the device SN serial number. Furthermore, if the above resource information is obtained in the IP resource database according to the IP condition of the target monitoring resource, the obtained IP resource information is recorded in the corresponding position of the IP resource information in the alarm root source location identifier; if the above resource information is not obtained in the IP resource database according to the IP condition of the target monitoring resource, 0 is recorded in the corresponding position of the IP resource information in the alarm root source location identifier.

[0084] Optionally, the network logical topology database is used to query the network logical topology information based on the IP condition of the target monitoring resource. For example, the network logical topology database is queried based on the IP address of the target monitoring resource to obtain the network logical topology information of the target monitoring resource (such as a network device). Optionally, the network logical topology information includes but is not limited to one or more of the following information: end-to-end physical interface name, IP address. Furthermore, if the above-mentioned network logical topology information is obtained in the network logical topology database based on the IP condition of the target monitoring resource, the obtained network logical topology information is recorded in the corresponding position of the network logical topology information in the alarm root source location identifier; if the above-mentioned network logical topology information is not obtained in the network logical topology database based on the IP condition of the target monitoring resource, 0 is recorded in the corresponding position of the network logical topology information in the alarm root source location identifier. In this way, the location of part of the network layer resources in the network structure is completed.

[0085] The historical alarm database is used to query historical alarm records based on the IP conditions of the target monitoring resource. For example, the historical alarm database is queried based on the IP address of the target monitoring resource as the query condition to obtain the historical alarm records of the target monitoring resource (such as a network device). Afterwards, according to the severity of the alarm, the IP addresses of the top three opposite-end physical devices with the highest frequency of associated physical devices in the alarm content description are used as the historical alarm associated resource information of the target monitoring resource. The obtained historical alarm associated resource information is recorded at the position corresponding to the historical alarm associated resource information in the alarm root source location identifier. If no historical alarm record related to the target monitoring resource is found, 0 is recorded at the position corresponding to the historical alarm associated resource information in the alarm root source location identifier. The historical alarm associated resource information can be used as a part of the network layer resources in the network structure.

[0086] The application layer resource database is used to query application layer resources based on the IP conditions of the target monitoring resources. For example, the application layer resource database is queried based on the IP address of the target monitoring resource as the query condition to obtain the application layer resources of the target monitoring resource (such as a network device). Optionally, the application layer resources include but are not limited to: application software name, application IP address. And the obtained application layer resources are recorded in the position corresponding to the application layer resource information in the alarm root source location identifier. If no application layer resources related to the target monitoring resource are queried, 0 is recorded in the position corresponding to the application layer resource information in the alarm root source location identifier. In this way, the application layer resource location is completed.

[0087] The work order database is used to query the work order database based on the IP condition of the target monitoring resource. For example, the work order database is queried based on the IP address of the target monitoring resource as the query condition to obtain the work order associated with the target monitoring resource (such as a network device). Further, based on the queried work order, it is determined whether the IP address of the target monitoring resource has changed under the network cutover and equipment migration of the computer room that the target monitoring resource has performed. The work order completion time is sorted, and the name of the opposite physical device and the device IP of the last work order completed are used as the work order associated resource information. The obtained work order associated resource information is recorded in the position corresponding to the work order associated resource information in the alarm root source location identifier. If no work order associated with the target monitoring resource is found, or the IP address of the target monitoring resource has not changed, 0 is recorded in the position corresponding to the work order associated resource information in the alarm root source location identifier. The work order associated resource information can be used as part of the network layer resources in the network structure.

[0088] Sub-step 1102, generating an alarm root source location identifier in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information.

[0089] In the specific implementation process, the resource information is obtained by acquiring the above-mentioned associated data and abstracting the associated data, and then an alarm root source location identifier is generated according to a preset rule.

[0090] In some embodiments of the present application, an alarm root source location identifier is generated in a preset format based on the IP address of the target monitoring resource, the information of the preset complementary relationship library and the obtained resource information, including: separating the information corresponding to different preset complementary relationship libraries with a first separator, and separating the resource information obtained from the same preset complementary relationship library with a second separator, to generate an alarm root source location identifier including the IP address of the target monitoring resource, the information of the preset complementary relationship library and / or the resource information.

[0091] Optionally, the alarm root source location identifier may include: IP address, IP resource information, historical alarm associated resource information, work order associated resource information, host deployment application information name, and resource information such as preset complementary relationship library. Different preset complementary relationship libraries may be separated by a first separator, and resource information in the same preset complementary relationship library may be separated by a second separator.

[0092] Taking the first separator as “#” and the second separator as “@” as an example, in some embodiments of the present application, the alarm root source location identifier can be expressed as: "Target monitoring resource IP address###IP resource database cabinet coordinates X, Y, Z@device type@device sn serial number###network logical topology database end-to-end physical interface name@target monitoring resource local IP@opposite IP###historical alarm database opposite physical device IP1@opposite physical device IP2@opposite physical device IP3###application layer resource database application software name@application IP address###work order database opposite physical device name@device IP address".

[0093] Through the generation process of the above alarm root source location identifier, it can be concluded that the alarm root source location identifier carries resource information of the network layer, application layer, and resource layer associated with the target monitoring resources (such as switches, servers and other monitoring resources).

[0094] In some embodiments of the present application, the above method may be used to generate an alarm root source location identifier for each resource monitored in the alarm monitoring system (such as the aforementioned target monitoring resource).

[0095] In some embodiments of the present application, the generated alarm root source location identifier can be preset to the monitoring configuration library as a visualization scene to call the underlying data.

[0096] At this point, the root cause relationship data collection of the network layer, application layer, and resource layer associated with the target monitoring resources has been completed, and data preparation has been made for the next step of visual alarm root cause location.

[0097] Step 120: In response to an alarm being generated by the target monitoring resource, real-time operation data of the resource information is acquired according to the alarm root source location identifier.

[0098] In some embodiments of the present application, while presetting the alarm source location identifier to the monitoring configuration library, the alarm source location identifier can also be placed in the Web-side cache database as preloaded scene data. The Web-side cache database obtains the alarm source location identifier through the monitoring configuration library each time it is started, and caches it locally in the Web-side cache database.

[0099] Web-side cache is an information technology used to temporarily store (cache) Web documents (such as HTML pages and images) to reduce server delays. In some embodiments of the present application, by placing the alarm source location identifier into the Web-side cache database, when an alarm occurs, the alarm source location identifier can be obtained from the Web-side cache database without requesting the server, which can greatly reduce the access to the server, thereby increasing the page loading speed, shortening the page loading time, and reducing the server pressure and reducing the network bandwidth and traffic occupied by data transmission.

[0100] In some embodiments of the present application, after the alarm source location identifier is obtained, the alarm source location identifier is parsed to obtain complementary relationship library information recorded in the alarm source location identifier and resource information corresponding to the complementary relationship library.

[0101] In some embodiments of the present application, obtaining the real-time operation data of the resource information according to the alarm root source location identifier includes: cutting the alarm root source location identifier according to the first separator to obtain the cutting information corresponding to each of the preset complementary relationship libraries; cutting the cutting information corresponding to each of the preset complementary relationship libraries according to the second separator to obtain the resource information corresponding to the preset complementary relationship library; and collecting the real-time operation data of the network device corresponding to the resource information.

[0102] Considering the interval time from the occurrence of an alarm to the display, especially taking second-level monitoring as an example: in order to prevent the unnecessary visualization display caused by false alarms such as network jitter, in some embodiments of the present application, the alarm source location identifier is first cut according to the first separator, and the resource information corresponding to the complementary relationship library associated with the target monitoring resource recorded in the alarm source location identifier is obtained. After that, the real-time operation data of the corresponding resource information is queried through the corresponding complementary relationship library to obtain the alarm information of the corresponding resource information.

[0103] For example, the alarm root source location identifier is cut for the first time through the '#' symbol to obtain the cutting information corresponding to each complementary relationship library. Furthermore, the cutting information corresponding to each complementary relationship library is cut for the second time through the '@' symbol.

[0104] In some embodiments of the present application, when resolving the alarm source location identifier, if there is no corresponding resource information in a complementary relationship library, that is, the symbol of the location record of the corresponding resource information is "0", the query of the complementary relationship library is ignored.

[0105] In some embodiments of the present application, the resource information includes: a resource identifier, such as an IP address, port, name, etc. of a network device. After obtaining the resource identifier in the resource information corresponding to the corresponding complementary relationship library, the resource identifier in each resource information is used as a query condition to query the corresponding complementary relationship library and obtain the query result.

[0106] In some embodiments of the present application, the resource information can be represented by a resource identifier, and the resource identifier includes: the IP address and / or physical port of the network device. The collecting of real-time operation data of the network device corresponding to the resource information includes: collecting the real-time operation data of the network device using the TR069 protocol based on the IP address and / or physical port of the network device.

[0107] For example, after the query result of the acquired complementary relationship library includes the corresponding resource identifier, the real-time operation data of the network device corresponding to the acquired resource identifier is further collected through the TR069 protocol, and the collected real-time operation data of the network device is recorded in the alarm source location identifier. Optionally, the collected real-time operation data of the network device includes but is not limited to one or more of the following data: monitoring information such as the CPU usage status, memory usage status, disk usage status, and process operation status of the network device. The real-time operation data is used to evaluate the health of the network device.

[0108] After the real-time operation data of the network device corresponding to the resource identifier is collected, the collected real-time operation data is recorded at the position where the corresponding resource identifier matches in the alarm root source location identifier.

[0109] The following is an example of an alarm root source location identifier to illustrate the analysis and update solution of the alarm root source location identifier.

[0110] Assuming that the alarm root source location identifier includes the following content: "Target monitoring resource IP address###IP resource database cabinet coordinates X, Y, Z@device type@device sn serial number###Network logical topology database end-to-end physical interface name@target monitoring resource local IP@opposite IP###Historical alarm database opposite physical device IP1@opposite physical device IP2@opposite physical device IP3###Application layer resource database application software name@application IP address###Work order database 0", after the alarm root source location identifier is cut for the first time, the following cutting information is obtained: "IP resource database cabinet coordinates X, Y, Z@device type@device sn serial number", "Network logical topology database end-to-end physical interface name@target monitoring resource local IP@opposite IP", "Historical alarm database opposite physical device IP1@opposite physical device IP2@opposite physical device IP3", "Application layer resource database application software name@application IP address", "Work order database 0".

[0111] Next, each cutting information is further cut according to the second separator @ to obtain the resource information corresponding to each preset complementary relationship library. Taking the second cutting of the cutting information "network logical topology database end-to-end physical interface name @ target monitoring resource local IP @ opposite IP" as an example, two resource information of the target monitoring resource local IP and opposite IP corresponding to the network logical topology database will be obtained.

[0112] By performing secondary cutting on the cutting information corresponding to each preset complementary relationship library, resource identifiers of resource information associated with the target monitoring resource at the network layer, application layer and resource layer can be obtained. Optionally, the resource identifier includes but is not limited to one or more of the following: IP address, port number, device name.

[0113] In the TR069 protocol, the network management server is called ACS (Auto Configuration Server) and has a dedicated IP address and URL; the managed device obtains the URL of the ACS through the DHCP server. After the managed device obtains the network management IP, it starts to establish an HTTP session based on the URL of the ACS. After the session is established, initialization is required. Its purpose is to authenticate the identity. The ACS must ensure the legitimacy of the managed device. After the initialization is completed, the network management server can obtain various monitoring information from the CPE. The TR069 protocol uses the HTTP protocol to collect information and can transmit structured data information. Therefore, all required information can be collected at one time and all collection results can be returned, which can improve the real-time operation data collection speed of the network device corresponding to the resource identifier.

[0114] Step 130: Acquire the network topology triplet of the target monitoring resource according to the alarm root source location identifier.

[0115] As mentioned above, the alarm root source location identifier records the network logical topology information. Next, based on the network logical topology information, the network topology triplet of the target monitoring resource is further obtained.

[0116] In some embodiments of the present application, obtaining the network topology triplet of the target monitoring resource based on the alarm root source location identifier includes: obtaining a first topology information set of the target monitoring resource based on the resource information recorded in the alarm root source location identifier; obtaining a second topology information set of the target monitoring resource based on the log data of the target monitoring resource and the network logical topology information; and obtaining the network topology triplet of the target monitoring resource based on the first topology information set and the second topology information set.

[0117] Optionally, the first topology information set includes: the network connection relationship of the target resources (such as network devices, applications, etc.) associated with the target monitoring resources. The target resources associated with the target monitoring resources include, but are not limited to, one or more of the following: network devices indicated by network logical topology information, network devices indicated by historical alarm associated resource information, network devices indicated by work order associated resource information, and application IP addresses indicated by application layer resource information.

[0118] Optionally, the network logical topology information is used to describe the network connection logic of the network device, and can be expressed by a combination of IP addresses of the network device. For example, in some embodiments of the present application, the network logical topology information includes: the local IP address and the peer IP address of the target monitoring resource.

[0119] Optionally, the second topology information set includes: a database, middleware, and server associated with the target monitoring resource, and a service relationship between the target monitoring resource and the database, the middleware, and the server. Acquiring the network topology triple of the target monitoring resource based on the first topology information set and the second topology information set includes: mining a triple with the target monitoring resource as a starting node or a destination node based on the first topology information set and the second topology information set.

[0120] In some embodiments of the present application, data mining methods in the prior art can be used to perform data mining on the first topology information and the second topology information to obtain associated resources that have network connections or data interactions with the target monitoring resources, as well as the relationship between the associated resources and the target monitoring resources, and generate a number of triplets using the mined associated resources, relationships, and the target monitoring resources.

[0121] In some embodiments of the present application, the second topology information set of the target monitoring resource is obtained based on the log data of the target monitoring resource and the network logical topology information, including: obtaining the log data associated with the target monitoring resource; mining the application service topology relationship set between the target monitoring resource and the database, middleware, and server in the log data based on the network logical topology information; and mining the data set corresponding to the application service topology relationship set from the log data based on the application service topology relationship set, wherein the data set user describes the relationship between the real-time operation data of the target monitoring resource and the database, middleware, and server in different time dimensions.

[0122] For example, first, the log data including the IP address of the target monitoring resource is obtained through the log service application database, and then the log data is divided into two layers of analysis. In the first layer, the association relationship (database, middleware, server basic monitoring indicators) in the log service application database is used to mine the application service topology as a supplement to the network logical topology information. The application service topology records the relationship between the three types of indicators (database, middleware, server CPU, memory, disk, process) between different servers.

[0123] The second layer is to mine a data set based on the topological relationship of the first-layer application services from the logs of each application service, called the topological data set. The data in the topological data set records the monitoring data and operation health status between the server and the database, middleware, server CPU, memory, disk, and process in different time dimensions.

[0124] In some embodiments of the present application, other data mining methods may also be used to mine the second topology information, which will not be listed one by one in the embodiments of the present application.

[0125] Afterwards, the first topology information in the network logical topology information in the alarm root source location identifier and the second topology information mined from the log data are aggregated to obtain a topology information set. Then, a triple information mining method is used to mine triples in the topology information set with the target monitoring resource as the starting node or the destination node.

[0126] Taking the triple represented as (h, r, t) as an example, the generation method of the triple is as follows:

[0127] Tail entity link prediction: Given a relation r and a head entity h, predict what the possible tail entity t is, that is, given h and r, predict which triple (h, r, t) is more likely to be true.

[0128] Head entity link prediction: Given r, t, predict what the possible head entity h is.

[0129] Wherein, h represents the starting node, for example, the service initiation point, t represents the destination node, and r represents the relationship between h and t. By performing entity and relationship mining on the first topology information and the second topology information obtained in the above steps with the target monitoring resource as the entity, multiple triples can be obtained.

[0130] The method for mining triples can be found in the prior art and will not be described in detail in the embodiments of this application.

[0131] In the embodiment of the present application, by performing two-layer data analysis in the log system and mining topology information, the triples with the target monitoring resources as entities can be expanded, thereby expanding the traceability scope of hardware and application software.

[0132] Step 140: record the real-time operation data and the network topology triplet in the alarm root source location identifier.

[0133] After the network topology triplet is mined, the network topology triplet is recorded at the end of the alarm root source location identifier to supplement the data recorded in the alarm root source location identifier.

[0134] On the other hand, the collected real-time operation data of other resources associated with the target monitoring resource are supplemented and recorded in the alarm root source location identifier, so that the alarm root source location identifier carries more information for fault tracing.

[0135] Step 150, tracing the root cause of the alarm according to the alarm root source location identifier obtained after supplementing the record.

[0136] In some embodiments of the present application, the root cause of the alarm is traced based on the alarm root source location identifier obtained after the supplementary record, including: obtaining a host information set associated with the IP address based on the triple in the alarm root source location identifier, and tracing the root cause of the alarm based on the host assets in the host information set; and / or displaying the alarm root source location identifier.

[0137] For example, the alarm root source location identifier can be visualized and displayed to operation and maintenance personnel, so that they can understand the relevant resources of the target monitoring resources from the resource layer, to the network layer to the application layer, and thus use them for fault analysis.

[0138] For another example, for the head entity (h) and the tail entity (t) in the triplet, the corresponding network device IP address is obtained, and multiple host information associated with the IP address is obtained to form a host information set. The tracer can query the vulnerability of a host asset suspected of being attacked in the host information set, and find the attack threat associated with the vulnerability through the vulnerability to obtain the tracing strategy for the attack. The tracer can trace the source of the attack to the source by executing the tracing strategy.

[0139] For another example, based on a certain attack threat, the tracer can generate a quintuple according to the port information corresponding to the entity IP address in the triplet and the ID address recorded in the alarm root source location identifier. After that, the quintuple (source address, destination address, source port, destination port, protocol) is used to determine a certain attack threat. Then, by querying the network security knowledge base, the traceability strategy corresponding to the attack threat is executed to find out the traces and location left by the attack, and finally locate the attacked host assets.

[0140] First, based on the query condition to obtain the host asset, we first query the MDATA network security knowledge base to obtain the policy set S-{S1, S2, ..., S i}(i≥1), and then traverse the set. If the type of a strategy S{i} is a tool traceability type, first query the dependency information D={D1,D2,…,D j}(j≥1), that is, the trace and location associated with the tracing strategy, and then save the obtained trace and location information to variables e and d respectively. i The process attributes and e and d are used to execute the attack tracing strategy, and the tracing result R is finally obtained. i Put the traceability result set R = {R1, R2, ..., R i}(i≥1). If the type of a policy is an associated traceability policy, first query the network security knowledge base to obtain the sub-policy set of the policy. Then with As a parameter, recursively execute the traceability algorithm and obtain the result According to this strategy S i Perform logical operations on the association rules to obtain the traceability result R i , put it into the traceability result set R, and finally return the traceability result set R.

[0141] From the aforementioned method of generating triples, it can be seen that the relationship between the head entity and the tail entity recorded in the triple reflects the relationship with the target monitoring resource and other resources associated with the target monitoring resource (such as network equipment and applications). According to the association relationship reflected by the triple, the faults of the target monitoring resource can be checked one by one to achieve fault tracing.

[0142] The embodiment of the present application also discloses an alarm root cause tracing method, which generates an alarm root source location identifier based on resource information of the resource layer, network layer, and application layer of the target monitoring resource; in response to an alarm of the target monitoring resource, obtains real-time operation data of the resource information according to the alarm root source location identifier; obtains the network topology triplet of the target monitoring resource according to the alarm root source location identifier; supplements the real-time operation data and the network topology triplet to the alarm root source location identifier; and traces the root cause of the alarm according to the alarm root source location identifier obtained after the supplementary record. Since the alarm root source location identifier is generated based on data of the network layer, resource layer, and application layer, the operation and maintenance personnel in the computer room operation and maintenance scenario can quickly understand the information of the alarm from the resource layer to the network layer and then to the application layer through the alarm root source location identifier.

[0143] On the other hand, by first generating an alarm root source location identifier and analyzing the possible alarm root causes of the target monitoring resources, after the alarm occurs, further queries and data collection are performed based on the possible alarm root causes (such as the resources recorded in the alarm root source location identifier), thereby avoiding frequent database queries and locating the alarm root causes more efficiently and quickly.

[0144] Furthermore, by combining log data with topology information mining and generating triples, the network topology information can be expanded based on the operating data of the basic monitoring resources, effectively expanding the location range of the root cause of the alarm and improving the success rate of tracing the root cause of the alarm.

[0145] Correspondingly, the embodiment of the present application also discloses an alarm root cause tracing device, such as Figure 3 As shown, the device comprises:

[0146] The alarm root source location identifier generating module 310 is used to generate an alarm root source location identifier according to the resource information of the resource layer, network layer and application layer of the target monitoring resource;

[0147] The associated resource real-time operation data acquisition module 320 is used to obtain the real-time operation data of the resource information according to the alarm root source location identifier in response to the alarm of the target monitoring resource;

[0148] A network topology triplet acquisition module 330, configured to acquire a network topology triplet of the target monitoring resource according to the alarm root source location identifier;

[0149] The alarm source location identifier updating module 340 is used to add the real-time operation data and the network topology triplet to the alarm source location identifier;

[0150] The alarm root cause tracing module 350 is used to trace the alarm root cause according to the alarm root cause location identifier obtained after the supplementary record.

[0151] Optionally, the alarm root source location identifier generating module 310 is further used to:

[0152] Obtain resource information of the resource layer, network layer, and application layer of the target monitoring resource through a preset complementary relationship library;

[0153] An alarm root source location identifier is generated in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information.

[0154] Optionally, the resource information includes: IP resource information, network logical topology information, historical alarm associated resource information, application layer resource information and work order associated resource information, and obtaining the resource layer, network layer and application layer resource information of the target monitoring resource by presetting a complementary relationship library includes one or more of the following methods:

[0155] Using the IP address of the target monitoring resource as a query condition, querying the IP resource database to obtain the IP resource information of the resource layer of the target monitoring resource;

[0156] Using the IP address of the target monitoring resource as a query condition, querying the network logical topology database to obtain the network logical topology information of the network layer of the target monitoring resource;

[0157] Using the IP address of the target monitoring resource as a query condition, querying the work order database to obtain the work order-related resource information of the network layer of the target monitoring resource;

[0158] Using the IP address of the target monitoring resource as a query condition, query the historical alarm database to obtain the historical alarm-related resource information of the network layer of the target monitoring resource;

[0159] The IP address of the target monitoring resource is used as a query condition to query the application layer resource database to obtain application layer resource information of the application layer of the target monitoring resource.

[0160] Optionally, generating an alarm root source location identifier in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information includes:

[0161] The information corresponding to different preset complementary relationship libraries is separated by a first separator, and the resource information obtained from the same preset complementary relationship library is separated by a second separator to generate an alarm root source location identifier including the IP address of the target monitoring resource, the information of the preset complementary relationship library and / or the resource information.

[0162] Optionally, the associated resource real-time operation data acquisition module 320 is further used to:

[0163] Cut the alarm root source location identifier according to the first separator to obtain cutting information corresponding to each preset complementary relationship library;

[0164] Cut the cutting information corresponding to each preset complementary relationship library according to the second separator to obtain the resource information corresponding to the preset complementary relationship library;

[0165] Collect real-time operation data of the network equipment corresponding to the resource information.

[0166] Optionally, the network topology triplet acquisition module 330 is further used to:

[0167] Acquire a first topology information set of the target monitoring resources according to the resource information recorded in the alarm root source location identifier;

[0168] Acquire a second topology information set of the target monitoring resource according to the log data of the target monitoring resource and the network logical topology information;

[0169] A network topology triplet of the target monitoring resource is acquired according to the first topology information set and the second topology information set.

[0170] Optionally, the alarm root cause tracing module 350 is further configured to:

[0171] Acquire a host information set associated with an IP address according to the triplet in the alarm root source location identifier, and perform alarm root cause tracing according to the host assets in the host information set; and / or,

[0172] The alarm root source location identifier is displayed.

[0173] The alarm root cause tracing device disclosed in the embodiment of the present application is used to implement the alarm root cause tracing method described in the embodiment of the present application. The specific implementation methods of each module of the device will not be repeated here. Please refer to the specific implementation methods of the corresponding steps in the method embodiment.

[0174] An alarm root cause tracing device disclosed in an embodiment of the present application generates an alarm root source location identifier based on resource information of the resource layer, network layer, and application layer of the target monitoring resource; in response to an alarm of the target monitoring resource, obtains real-time operation data of the resource information according to the alarm root source location identifier; obtains a network topology triplet of the target monitoring resource according to the alarm root source location identifier; supplements the real-time operation data and the network topology triplet to the alarm root source location identifier; and traces the root cause of the alarm according to the alarm root source location identifier obtained after the supplementary record. Since the alarm root source location identifier is generated according to data of the network layer, resource layer, and application layer, operation and maintenance personnel in the computer room operation and maintenance scenario can quickly understand the information of the alarm from the resource layer to the network layer and then to the application layer through the alarm root source location identifier.

[0175] On the other hand, by first generating an alarm root source location identifier and analyzing the possible alarm root causes of the target monitoring resources, after the alarm occurs, further queries and data collection are performed based on the possible alarm root causes (such as the resources recorded in the alarm root source location identifier), thereby avoiding frequent database queries and locating the alarm root causes more efficiently and quickly.

[0176] Furthermore, by combining log data with topology information mining and generating triples, the network topology information can be expanded based on the operating data of the basic monitoring resources, effectively expanding the location range of the root cause of the alarm and improving the success rate of tracing the root cause of the alarm.

[0177] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0178] The above is a detailed introduction to an alarm root cause tracing method and device provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, based on the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

[0179] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0180] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the electronic device according to the embodiment of the present application. The present application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0181] For example, Figure 4An electronic device that can implement the method according to the present application is shown. The electronic device can be a PC, a mobile terminal, a personal digital assistant, a tablet computer, etc. The electronic device traditionally includes a processor 410 and a memory 420 and a program code 430 stored on the memory 420 and can be run on the processor 410, and the processor 410 implements the method described in the above embodiment when executing the program code 430. The memory 420 can be a computer program product or a computer-readable medium. The memory 420 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory 420 has a storage space 4201 for the program code 430 of the computer program for executing any method step in the above method. For example, the storage space 4201 for the program code 430 can include various computer programs for implementing the various steps in the above method respectively. The program code 430 is a computer-readable code. These computer programs can be read from one or more computer program products or written into the one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. The computer program includes a computer readable code, and when the computer readable code is executed on an electronic device, the electronic device is caused to execute the method according to the above embodiment.

[0182] The embodiment of the present application further discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the alarm root cause tracing method as described in the embodiment of the present application are implemented.

[0183] Such a computer program product may be a computer-readable storage medium, which may have a computer-readable storage medium having a Figure 4 The memory 420 in the electronic device shown in the figure is similar to the storage segment, storage space, etc. The program code can be compressed and stored in the computer-readable storage medium in an appropriate form. The computer-readable storage medium is generally as shown in the reference Figure 5 The portable or fixed storage unit. Generally, the storage unit includes computer readable code 430', which is a code read by a processor. When the code is executed by the processor, each step in the method described above is implemented.

[0184] The term "one embodiment", "embodiment" or "one or more embodiments" herein means that a particular feature, structure or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present application. In addition, please note that the examples of the term "in one embodiment" here do not necessarily all refer to the same embodiment.

[0185] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0186] In the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0187] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for tracing the root cause of an alarm, characterized in that: The method comprises: Generate alarm root source location identification based on resource information of the target monitoring resource's resource layer, network layer, and application layer; In response to an alarm occurring in the target monitoring resource, obtaining real-time operation data of the resource information according to the alarm root source location identifier; According to the alarm root source location identifier, obtaining a network topology triplet of the target monitoring resource; The real-time operation data and the network topology triplet are supplementarily recorded in the alarm root source location identifier; According to the alarm root source location identifier obtained after supplementing the record, the alarm root cause is traced; The generating of the alarm root source location identifier according to the resource information of the resource layer, network layer and application layer of the target monitoring resource includes: Obtain resource information of the resource layer, network layer, and application layer of the target monitoring resource through a preset complementary relationship library; An alarm root source location identifier is generated in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information.

2. The method according to claim 1, characterized in that The resource information includes: IP resource information, network logical topology information, historical alarm associated resource information, application layer resource information and work order associated resource information. The resource information of the resource layer, network layer and application layer of the target monitoring resource is obtained by presetting a complementary relationship library, including one or more of the following methods: Using the IP address of the target monitoring resource as a query condition, querying the IP resource database to obtain the IP resource information of the resource layer of the target monitoring resource; Using the IP address of the target monitoring resource as a query condition, querying the network logical topology database to obtain the network logical topology information of the network layer of the target monitoring resource; Using the IP address of the target monitoring resource as a query condition, querying the work order database to obtain the work order-related resource information of the network layer of the target monitoring resource; Using the IP address of the target monitoring resource as a query condition, query the historical alarm database to obtain the historical alarm-related resource information of the network layer of the target monitoring resource; The IP address of the target monitoring resource is used as a query condition to query the application layer resource database to obtain application layer resource information of the application layer of the target monitoring resource.

3. The method according to claim 1, characterized in that The generating of the alarm root source location identifier in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information includes: The information corresponding to different preset complementary relationship libraries is separated by a first separator, and the resource information obtained from the same preset complementary relationship library is separated by a second separator to generate an alarm root source location identifier including the IP address of the target monitoring resource, the information of the preset complementary relationship library and / or the resource information.

4. The method according to claim 3, characterized in that The acquiring the real-time operation data of the resource information according to the alarm root source location identifier includes: Cut the alarm root source location identifier according to the first separator to obtain cutting information corresponding to each preset complementary relationship library; Cut the cutting information corresponding to each preset complementary relationship library according to the second separator to obtain the resource information corresponding to the preset complementary relationship library; Collect real-time operation data of the network equipment corresponding to the resource information.

5. The method according to claim 1, characterized in that: The resource information includes: network logical topology information, and the obtaining of the network topology triplet of the target monitoring resource according to the alarm root source location identifier includes: Acquire a first topology information set of the target monitoring resources according to the resource information recorded in the alarm root source location identifier; Acquire a second topology information set of the target monitoring resource according to the log data of the target monitoring resource and the network logical topology information; A network topology triplet of the target monitoring resource is acquired according to the first topology information set and the second topology information set.

6. The method according to claim 1, characterized in that The step of tracing the root cause of the alarm according to the alarm root source location identifier obtained after the supplementary record includes: Acquire a host information set associated with an IP address according to the triplet in the alarm root source location identifier, and perform alarm root cause tracing according to the host assets in the host information set; and / or, The alarm root source location identifier is displayed.

7. An alarm root cause tracing device, characterized in that: The device comprises: An alarm root source location identifier generation module is used to generate an alarm root source location identifier based on resource information of the resource layer, network layer, and application layer of the target monitoring resource; A module for acquiring real-time operation data of associated resources, for acquiring real-time operation data of the resource information according to the alarm root source location identifier in response to an alarm of the target monitoring resource; A network topology triplet acquisition module, used to acquire the network topology triplet of the target monitoring resource according to the alarm root source location identifier; An alarm source location identifier updating module, used for supplementing the real-time operation data and the network topology triplet to the alarm source location identifier; An alarm root cause tracing module is used to trace the alarm root cause according to the alarm root source location identifier obtained after supplementing the record; Wherein, the alarm root source location identifier generation module is further used to: Obtain resource information of the resource layer, network layer, and application layer of the target monitoring resource through a preset complementary relationship library; An alarm root source location identifier is generated in a preset format according to the IP address of the target monitoring resource, the information of the preset complementary relationship library and the acquired resource information.

8. An electronic device comprising a memory, a processor, and a program code stored in the memory and executable on the processor, wherein: When the processor executes the program code, the alarm root cause tracing method described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having program code stored thereon, characterized in that: When the program code is executed by a processor, the steps of the alarm root cause tracing method described in any one of claims 1 to 6 are implemented.

Images