Abnormal event positioning method and device, electronic equipment and computer readable medium

Abstract

The application discloses an abnormal event positioning method and device, electronic equipment and a computer readable medium, and relates to the technical field of big data processing. A specific embodiment of the method comprises: receiving an alarm message pushed by a monitoring platform; wherein the monitoring platform is used for monitoring and analyzing the running environment of a data center in real time, and an alarm message is sent in response to an abnormality in the running environment; the alarm message is analyzed, and the cause of the abnormal event is located according to the analysis result of the alarm message; in response to being unable to locate the cause of the abnormal event, the cause of the abnormal event is located based on a fishbone diagram; wherein the fishbone trunk of the fishbone diagram represents the operation and maintenance field, the branches under the fishbone trunk represent operation and maintenance elements in the operation and maintenance field, and the operation and maintenance elements correspond one-to-one to the causes of the abnormal event. The embodiment can solve the technical problem that the cause of the abnormal event cannot be quickly located.

Description

Technical Field

[0001] This invention relates to the field of big data processing technology, and in particular to a method, apparatus, electronic device, and computer-readable medium for locating abnormal events. Background Technology

[0002] With the booming development of the data center industry globally and the rapid growth of the social economy, the development and construction of data centers will enter a period of rapid growth. With the vigorous development of the data center industry, there will be significant development potential in many cities, and large-scale data centers will become increasingly common. Data centers are a strategic resource as important as human resources and natural resources. In the information age, only by utilizing data on a large scale and with flexibility can we better understand and utilize data, thus promoting the rapid and efficient development of the data center industry. The generation of massive amounts of data has also prompted a significant transformation in the collection and processing of information data, with enterprises shifting from physical services to data services. The industry's needs and focus have also changed; enterprises are focusing on data, the computer industry is shifting from pursuing computing power to data processing capabilities, the software industry will shift from being primarily programming-based to being data-based, and the dominance of cloud computing will shift from analytics to services.

[0003] In the process of realizing this invention, the inventors discovered at least the following problems in the prior art:

[0004] When an unknown abnormal event occurs in the data center or multiple alarms break out in multiple areas, it can lead to an inability to quickly locate the cause of the abnormal event. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, apparatus, electronic device, and computer-readable medium for locating abnormal events, in order to solve the technical problem of being unable to quickly locate the cause of abnormal events.

[0006] To achieve the above objectives, according to one aspect of the present invention, a method for locating abnormal events is provided, comprising:

[0007] Receive alarm messages pushed by the monitoring platform; wherein the monitoring platform is used to monitor and analyze the operating environment of the data center in real time, and to issue alarm messages in response to abnormalities in the operating environment;

[0008] The alarm message is parsed, and the cause of the abnormal event is located based on the parsing result of the alarm message;

[0009] In response to the inability to locate the cause of the abnormal event, the cause of the abnormal event is located based on a fishbone diagram; wherein, the main trunk of the fishbone diagram represents the operation and maintenance domain, the branches under the main trunk represent the operation and maintenance elements under the operation and maintenance domain, and the operation and maintenance elements correspond one-to-one with the cause of the abnormal event.

[0010] Optionally, before receiving alarm messages pushed by the monitoring platform, the following steps are also included:

[0011] Divide the various operation and maintenance elements into different operation and maintenance domains;

[0012] The various operation and maintenance domains are divided into different operation and maintenance problem categories; among them, the operation and maintenance problem categories include underlying hardware infrastructure, system software level, security level, and business applications;

[0013] A fishbone diagram is constructed in the order of the underlying hardware infrastructure being closer to the tail of the fish and the business application being closer to the head of the fish, or in the order of the underlying hardware infrastructure being closer to the head of the fish and the business application being closer to the tail of the fish; wherein, the fishbone diagram includes multiple fishbone trunks, and each fishbone trunk is connected to multiple branches.

[0014] Optionally, the cause of the abnormal event can be located based on the fishbone diagram, including:

[0015] Run the automated inspection scripts corresponding to each operation and maintenance element to obtain the inspection results of each operation and maintenance element;

[0016] The cause of the abnormal event was located based on the inspection results of each of the aforementioned operation and maintenance elements.

[0017] Optionally, the cause of the abnormal event can be located based on the inspection results of each of the operation and maintenance elements, including:

[0018] Following the order from the tail to the head of the fish, the cause of the abnormal event is located sequentially based on the inspection results of each of the aforementioned operation and maintenance elements.

[0019] or,

[0020] Following the order from head to tail, the causes of abnormal events are located sequentially based on the inspection results of each of the aforementioned operational elements.

[0021] Optionally, following the order from the tail to the head of the fish, the cause of the abnormal event is located sequentially based on the inspection results of each of the operation and maintenance elements, including:

[0022] Based on the inspection results of each maintenance element at the "tail" of the fish, determine whether there are any abnormal maintenance elements at the "tail" of the fish; if there are any abnormal maintenance elements at the "tail" of the fish, execute the solution corresponding to the maintenance element.

[0023] If there are no abnormal operation and maintenance elements at the tail of the fish, then based on the inspection results of the operation and maintenance elements at the belly of the fish, it is determined whether there are any abnormal operation and maintenance elements at the belly of the fish; if there are any abnormal operation and maintenance elements at the belly of the fish, then the solution corresponding to the operation and maintenance element is executed.

[0024] If there are no abnormal operation and maintenance elements in the fish belly, then based on the inspection results of the operation and maintenance elements in the fish head, it is determined whether there are abnormal operation and maintenance elements in the fish head; if there are abnormal operation and maintenance elements in the fish head, then the solution corresponding to the operation and maintenance element is executed.

[0025] or,

[0026] Based on the inspection results of each maintenance element at the fish head, determine whether there are any abnormal maintenance elements at the fish head; if there are abnormal maintenance elements at the fish head, execute the solution corresponding to the maintenance element.

[0027] If there are no abnormal operation and maintenance elements at the fish head, then based on the inspection results of the operation and maintenance elements at the fish belly, it is determined whether there are any abnormal operation and maintenance elements at the fish belly; if there are any abnormal operation and maintenance elements at the fish belly, then the solution corresponding to the operation and maintenance element is executed.

[0028] If there are no abnormal operation and maintenance elements in the belly of the fish, then based on the inspection results of the operation and maintenance elements in the tail of the fish, it is determined whether there are abnormal operation and maintenance elements in the tail of the fish; if there are abnormal operation and maintenance elements in the tail of the fish, then the solution corresponding to the operation and maintenance element is executed.

[0029] Optionally, if there is an abnormal operation and maintenance element at the "tail" of the fish, the solution corresponding to the operation and maintenance element is executed, including:

[0030] Step a: If there is an abnormal operation and maintenance element at the fish tail, then execute the solution corresponding to the operation and maintenance element.

[0031] Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element.

[0032] Step c: Based on the inspection results of each maintenance element at the fish tail, determine whether there are any abnormal maintenance elements at the fish tail.

[0033] Repeat steps a-c until there are no abnormal maintenance elements at the fish tail.

[0034] Optionally, if there is an abnormal operation and maintenance element at the fish belly, the solution corresponding to the operation and maintenance element is executed, including:

[0035] Step a: If there is an abnormal operation and maintenance element in the fish belly, then execute the solution corresponding to the operation and maintenance element.

[0036] Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element.

[0037] Step c: Based on the inspection results of each maintenance element in the fish belly, determine whether there are any abnormal maintenance elements in the fish belly.

[0038] Repeat steps a-c until there are no abnormal maintenance elements in the fish belly.

[0039] Furthermore, according to another aspect of the present invention, an abnormal event locating device is provided, comprising:

[0040] The receiving module is used to receive alarm messages pushed by the monitoring platform; wherein, the monitoring platform is used to monitor and analyze the operating environment of the data center in real time, and to issue alarm messages in response to abnormalities in the operating environment;

[0041] The parsing module is used to parse the alarm message and locate the cause of the abnormal event based on the parsing result of the alarm message;

[0042] The location module is used to locate the cause of the abnormal event based on a fishbone diagram in response to the inability to locate the cause of the abnormal event; wherein, the main trunk of the fishbone diagram represents the operation and maintenance domain, the branches under the main trunk represent the operation and maintenance elements under the operation and maintenance domain, and the operation and maintenance elements correspond one-to-one with the cause of the abnormal event.

[0043] Optionally, it also includes a module for:

[0044] Divide the various operation and maintenance elements into different operation and maintenance domains;

[0045] The various operation and maintenance domains are divided into different operation and maintenance problem categories; among them, the operation and maintenance problem categories include underlying hardware infrastructure, system software level, security level, and business applications;

[0046] A fishbone diagram is constructed in the order of the underlying hardware infrastructure being closer to the tail of the fish and the business application being closer to the head of the fish, or in the order of the underlying hardware infrastructure being closer to the head of the fish and the business application being closer to the tail of the fish; wherein, the fishbone diagram includes multiple fishbone trunks, and each fishbone trunk is connected to multiple branches.

[0047] Optionally, the positioning module is further configured to:

[0048] Run the automated inspection scripts corresponding to each operation and maintenance element to obtain the inspection results of each operation and maintenance element;

[0049] The cause of the abnormal event was located based on the inspection results of each of the aforementioned operation and maintenance elements.

[0050] Optionally, the positioning module is further configured to:

[0051] Following the order from the tail to the head of the fish, the cause of the abnormal event is located sequentially based on the inspection results of each of the aforementioned operation and maintenance elements.

[0052] or,

[0053] Following the order from head to tail, the causes of abnormal events are located sequentially based on the inspection results of each of the aforementioned operational elements.

[0054] Optionally, the positioning module is further configured to:

[0055] Based on the inspection results of each maintenance element at the "tail" of the fish, determine whether there are any abnormal maintenance elements at the "tail" of the fish; if there are any abnormal maintenance elements at the "tail" of the fish, execute the solution corresponding to the maintenance element.

[0056] If there are no abnormal operation and maintenance elements at the tail of the fish, then based on the inspection results of the operation and maintenance elements at the belly of the fish, it is determined whether there are any abnormal operation and maintenance elements at the belly of the fish; if there are any abnormal operation and maintenance elements at the belly of the fish, then the solution corresponding to the operation and maintenance element is executed.

[0057] If there are no abnormal operation and maintenance elements in the fish belly, then based on the inspection results of the operation and maintenance elements in the fish head, it is determined whether there are abnormal operation and maintenance elements in the fish head; if there are abnormal operation and maintenance elements in the fish head, then the solution corresponding to the operation and maintenance element is executed.

[0058] or,

[0059] Based on the inspection results of each maintenance element at the fish head, determine whether there are any abnormal maintenance elements at the fish head; if there are abnormal maintenance elements at the fish head, execute the solution corresponding to the maintenance element.

[0060] If there are no abnormal operation and maintenance elements at the fish head, then based on the inspection results of the operation and maintenance elements at the fish belly, it is determined whether there are any abnormal operation and maintenance elements at the fish belly; if there are any abnormal operation and maintenance elements at the fish belly, then the solution corresponding to the operation and maintenance element is executed.

[0061] If there are no abnormal operation and maintenance elements in the belly of the fish, then based on the inspection results of the operation and maintenance elements in the tail of the fish, it is determined whether there are abnormal operation and maintenance elements in the tail of the fish; if there are abnormal operation and maintenance elements in the tail of the fish, then the solution corresponding to the operation and maintenance element is executed.

[0062] Optionally, the positioning module is further configured to:

[0063] Step a: If there is an abnormal operation and maintenance element at the fish tail, then execute the solution corresponding to the operation and maintenance element.

[0064] Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element.

[0065] Step c: Based on the inspection results of each maintenance element at the fish tail, determine whether there are any abnormal maintenance elements at the fish tail.

[0066] Repeat steps a-c until there are no abnormal maintenance elements at the fish tail.

[0067] Optionally, the positioning module is further configured to:

[0068] Step a: If there is an abnormal operation and maintenance element in the fish belly, then execute the solution corresponding to the operation and maintenance element.

[0069] Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element.

[0070] Step c: Based on the inspection results of each maintenance element in the fish belly, determine whether there are any abnormal maintenance elements in the fish belly.

[0071] Repeat steps a-c until there are no abnormal maintenance elements in the fish belly.

[0072] According to another aspect of the present invention, an electronic device is also provided, comprising:

[0073] One or more processors;

[0074] Storage device for storing one or more programs.

[0075] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0076] According to another aspect of the present invention, a computer-readable medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the methods described in any of the above embodiments.

[0077] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the methods described in any of the above embodiments.

[0078] One embodiment of the above invention has the following advantages or beneficial effects: Because it employs a fishbone diagram to locate the cause of an anomaly in response to the inability to pinpoint the cause, where the main branch of the fishbone diagram represents the operations and maintenance domain, and the branches under the main branch represent operations and maintenance elements within that domain, and there is a one-to-one correspondence between operations and maintenance elements and the cause of the anomaly, it overcomes the technical problem of not being able to quickly locate the cause of anomalies in the prior art. This embodiment of the invention uses a fishbone diagram combined with data center domain division. When an unknown anomaly occurs, an automated inspection script quickly categorizes and locates the operations and maintenance element within the operations and maintenance domain, thereby narrowing the scope of investigation, achieving targeted analysis, rapidly restoring business operations, and ensuring business continuity.

[0079] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0080] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0081] Figure 1 This is a flowchart of an abnormal event localization method according to an embodiment of the present invention;

[0082] Figure 2 This is a schematic diagram of the fishbone diagram according to an embodiment of the present invention;

[0083] Figure 3 This is a flowchart of an abnormal event localization method according to a possible embodiment of the present invention;

[0084] Figure 4 The content to be checked by the automated inspection scripts corresponding to each operation and maintenance element under the operating system according to the embodiments of the present invention;

[0085] Figure 5 The content to be checked by the automated inspection scripts corresponding to each operation and maintenance element under the application of the present invention embodiment;

[0086] Figure 6 This is a schematic diagram of an abnormal event location device according to an embodiment of the present invention;

[0087] Figure 7 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0088] Figure 8This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0089] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0090] It should be noted that the collection, analysis, use, transmission, and storage of user personal information involved in the technical solution of this invention all comply with relevant laws and regulations, are used for legitimate and reasonable purposes, and are not shared, disclosed, or sold outside of these legitimate uses, and are subject to supervision and management by regulatory authorities. Necessary measures should be taken to prevent unauthorized access to such personal information data, ensure that personnel authorized to access personal information data comply with relevant laws and regulations, and ensure the security of user personal information. Once this user personal information data is no longer needed, the risk should be minimized by restricting or even prohibiting data collection and / or deleting the data.

[0091] When applicable, including in certain relevant applications, data deidentification is used to protect user privacy, such as by removing specific identifiers (e.g., name, gender, date of birth, account, etc.), controlling the amount or specificity of stored data, controlling how data is stored, and / or other methods of deidentification.

[0092] Figure 1 This is a flowchart of an abnormal event localization method according to an embodiment of the present invention. As one embodiment of the present invention, such as... Figure 1 As shown, the abnormal event localization method is applied to an abnormal event localization system and may include:

[0093] Step 101: Receive alarm messages pushed by the monitoring platform; wherein, the monitoring platform is used to monitor and analyze the operating environment of the data center in real time, and to issue alarm messages in response to abnormalities in the operating environment.

[0094] The monitoring center monitors and analyzes the operating environment in the data in real time. If the operating environment of the data center is abnormal, it pushes an alarm message to the location system of the abnormal event. The location system receives the alarm message pushed by the monitoring platform.

[0095] Step 102: parse the alarm message and locate the cause of the abnormal event based on the parsing result of the alarm message.

[0096] After receiving an alarm message pushed by the monitoring platform, the positioning system parses the alarm message and then locates the cause of the abnormal event based on the parsing results, such as SQL anomaly, insufficient tablespace, or firewall anomaly.

[0097] Step 103: In response to the inability to locate the cause of the abnormal event, locate the cause of the abnormal event based on the fishbone diagram; wherein, the main trunk of the fishbone diagram represents the operation and maintenance domain, the branches under the main trunk represent the operation and maintenance elements under the operation and maintenance domain, and the operation and maintenance elements correspond one-to-one with the cause of the abnormal event.

[0098] If the cause of the abnormal event cannot be located based on the parsing results of the alarm message, then the cause of the abnormal event is located based on the fishbone diagram, that is, the cause of the abnormal event is classified under a certain branch of the fishbone diagram.

[0099] In a fishbone diagram, for an abnormal event (fish head), list the major causes that caused the abnormal event (fishbone trunk). Continue to dig deeper from the major causes and list the minor causes that each major cause produces. Dig into the minor causes from the minor causes, and so on, layer by layer, until the cause of the abnormal event is located.

[0100] Therefore, a fishbone diagram needs to be constructed before step 101. Optionally, before step 101, the method further includes: classifying each operation and maintenance element into different operation and maintenance domains; classifying each operation and maintenance domain into different operation and maintenance problem categories; wherein the operation and maintenance problem categories include underlying hardware infrastructure, system software level, security level, and business applications; constructing the fishbone diagram in the order of the underlying hardware infrastructure being closer to the tail and the business applications being closer to the head, or in the order of the underlying hardware infrastructure being closer to the head and the business applications being closer to the tail; wherein the fishbone diagram includes multiple fishbone trunks, and each fishbone trunk is connected to multiple branches.

[0101] From an operations and maintenance (O&M) perspective, mainstream application systems primarily encompass the following areas: 1. Servers; 2. Networks; 3. Operating Systems; 4. Databases; 5. Middleware; 6. Security; 7. Applications. These seven O&M areas can be further categorized into different O&M problem types based on their fundamental nature. For example, underlying hardware infrastructure includes servers and networks; system software includes operating systems, databases, and middleware; security includes security; and business applications include applications. Using a fishbone diagram constructed with underlying hardware infrastructure near the tail and business applications near the head as an example, as follows... Figure 2As shown, the underlying hardware infrastructure is located near the tail of the fish, business applications are near the head, and the system software and security layers are located between the tail and head, i.e., the belly of the fish. Each domain can be further subdivided into different operational elements. For example, under servers, there are operational elements such as power supply, virtualization, storage, motherboard, CPU / MEM, etc.; under operating systems, there are operational elements such as cloud services, DNS, NAS, CPU / MEM / DISK, etc.; and under applications, there are operational elements such as application processes, NFTs, logs, green light testing, etc.

[0102] Because the underlying hardware infrastructure is located near the tail of the fishbone diagram, while business applications are near the head (or vice versa), when using a fishbone diagram to locate the cause of anomalies, if the cause is found within the operational elements of the business application, then checking the operational elements at the underlying hardware infrastructure, system software level, and security level is sufficient. However, if the cause is found within the operational elements of the underlying hardware infrastructure, it is also necessary to consider whether there are any related issues at the system software level, security level, and operational elements of the business application. Therefore, this embodiment of the invention, by analyzing the specific details of the branches in the fishbone diagram, can quickly identify the root cause of anomalies and formulate corresponding solutions.

[0103] Optionally, locating the cause of an anomaly based on the fishbone diagram includes: running automated inspection scripts corresponding to each operational element to obtain the inspection results of each operational element; and locating the cause of the anomaly based on the inspection results of each operational element. In embodiments of the present invention, each operational element has its own automated inspection script. By running the automated inspection script, inspection results can be obtained. Further analysis of the inspection results can determine whether the operational element is abnormal, thereby accurately locating the cause of the anomaly. Therefore, embodiments of the present invention can improve the efficiency of automated troubleshooting and analysis, enhance operational capabilities, and, through the visualization and rapid location features of the fishbone diagram, can quickly discover and locate the root cause of anomalies, optimize the maintenance and troubleshooting process of the data center, and improve the operational efficiency and stability of the data center.

[0104] Based on the various embodiments described above, it can be seen that the embodiments of the present invention, in response to the inability to locate the cause of an abnormal event, locate the cause of the abnormal event based on a fishbone diagram. The main trunk of the fishbone diagram represents the operation and maintenance domain, and the branches under the main trunk represent operation and maintenance elements within the operation and maintenance domain. This one-to-one correspondence between operation and maintenance elements and the cause of the abnormal event solves the technical problem of not being able to quickly locate the cause of abnormal events in the prior art. The embodiments of the present invention use a fishbone diagram combined with data center domain division. When an unknown abnormal event occurs, an automated inspection script quickly categorizes and locates the operation and maintenance element within the operation and maintenance domain, thereby narrowing the scope of investigation, achieving targeted analysis, quickly restoring business, and ensuring business continuity.

[0105] Figure 3 This is a flowchart of an abnormal event localization method according to a possible embodiment of the present invention. As another embodiment of the present invention, such as... Figure 3 As shown, the method for locating abnormal events may include:

[0106] Step 301: Divide each operation and maintenance element into different operation and maintenance domains.

[0107] Step 302: Divide each operation and maintenance area into different operation and maintenance problem categories.

[0108] Step 303: Construct a fishbone diagram in the order of the underlying hardware infrastructure being closer to the tail of the fish and the business applications being closer to the head of the fish.

[0109] First, various operational elements are categorized into different operational domains, such as green light testing under applications, DNS under the operating system, and so on. Then, each operational domain is further categorized into different operational problem categories, which can be divided into four main categories: underlying hardware infrastructure, system software level, security level, and business applications. Finally, a fishbone diagram is constructed, with underlying hardware infrastructure near the tail and business applications near the head. This fishbone diagram includes multiple main branches, each connected to multiple branches. The main branches represent operational domains, and the branches represent operational elements within those domains. Each operational element corresponds one-to-one with the cause of an anomaly.

[0110] It should be noted that step 301 can be executed before step 302, or step 302 can be executed before step 301; this embodiment of the invention does not impose any restrictions on this. In step 303, the fishbone diagram can also be constructed in the order of the underlying hardware infrastructure being closer to the head of the fish and the business application being closer to the tail of the fish; this embodiment of the invention does not impose any restrictions on this.

[0111] Step 304: Receive alarm messages pushed by the monitoring platform; wherein the monitoring platform is used to monitor and analyze the operating environment of the data center in real time, and to issue alarm messages in response to abnormalities in the operating environment.

[0112] The monitoring center monitors and analyzes the operating environment in the data in real time. If the operating environment of the data center is abnormal, it pushes an alarm message to the location system of the abnormal event. The location system receives the alarm message pushed by the monitoring platform.

[0113] Step 305: parse the alarm message and locate the cause of the abnormal event based on the parsing result of the alarm message.

[0114] After receiving an alarm message pushed by the monitoring platform, the positioning system parses the alarm message and then locates the cause of the abnormal event based on the parsing results, such as abnormal instance status, abnormal heap memory, or abnormal application process.

[0115] Step 306: In response to the inability to locate the cause of the abnormal event, run the automated inspection scripts corresponding to each operation and maintenance element to obtain the inspection results of each operation and maintenance element.

[0116] If the cause of the abnormal event cannot be located based on the parsing results of the alarm message, the automated check scripts corresponding to each operational element are run simultaneously to obtain the check results for each operational element. It should be noted that each operational element has its own automated check script, and the check results can be obtained by running the automated check script.

[0117] like Figure 4 As shown, taking the operating system as an example, this operation and maintenance field includes operation and maintenance elements such as cloud services, NAS, NTP, system operation, and DNS. Each operation and maintenance element has its own automated inspection script. The automated inspection script for cloud services is used to check cloud service status, certificate validity period, cloud service configuration, and related logs. The automated inspection script for NTP is used to check service status, NTP configuration, and related logs. The automated inspection script for system operation is used to check CPU, MEM, DISK, user permissions, system configuration, and related logs, etc., which will not be elaborated further.

[0118] like Figure 5 As shown, taking an application as an example, this operation and maintenance domain includes operation and maintenance elements such as transaction status, logs, application processes, green light tests, and others. Each operation and maintenance element has its own automated inspection script. The automated inspection script for transaction status is used to check business success rate, system success rate, and system response rate, etc. The automated inspection script for logs is used to check gateway logs, pre-logs, transaction logs, and component logs, etc. The automated inspection script for green light tests is used to check connectivity and business verification, etc., which will not be elaborated further.

[0119] Step 307: Following the order from the tail to the head of the fish, locate the cause of the abnormal event based on the inspection results of each of the operation and maintenance elements.

[0120] Finally, following the order from tail to head, the cause of the abnormal event is located based on the inspection results of each operational element. This means categorizing the cause of the abnormal event under a specific branch of the fishbone diagram. Since the underlying hardware infrastructure is near the tail and the business application is near the head, when using the fishbone diagram to locate the cause of an abnormal event, if the cause is found within an operational element under the business application, then checking the operational elements under the underlying hardware infrastructure, system software level, and security level is sufficient. If the cause is found within an operational element under the underlying hardware infrastructure, then it is also necessary to consider whether there are any related issues at the system software level, security level, and operational elements under the business application.

[0121] It should be noted that if in step 303, a fishbone diagram is constructed in the order of the underlying hardware infrastructure being closer to the fish head and the business application being closer to the fish tail, then in step 307, the cause of the abnormal event is located sequentially based on the inspection results of each of the operation and maintenance elements, in the order from the fish head to the fish tail.

[0122] Optionally, step 307 includes: determining whether there are any abnormal maintenance elements at the tail of the fish based on the inspection results of each maintenance element; if there are abnormal maintenance elements at the tail of the fish, executing the solution corresponding to the maintenance element; if there are no abnormal maintenance elements at the tail of the fish, determining whether there are any abnormal maintenance elements at the belly of the fish based on the inspection results of the maintenance elements at the belly of the fish; if there are abnormal maintenance elements at the belly of the fish, executing the solution corresponding to the maintenance element; if there are no abnormal maintenance elements at the belly of the fish, determining whether there are any abnormal maintenance elements at the head of the fish based on the inspection results of the maintenance elements at the head of the fish; if there are abnormal maintenance elements at the head of the fish, executing the solution corresponding to the maintenance element. After obtaining the inspection results of each operation and maintenance element, first determine whether there is an abnormal operation and maintenance element at the "tail" of the fish. If there is an abnormal operation and maintenance element at the tail, execute the solution corresponding to that operation and maintenance element. If there is no abnormal operation and maintenance element at the tail, then determine whether there is an abnormal operation and maintenance element at the belly of the fish. If there is an abnormal operation and maintenance element at the belly, execute the solution corresponding to that operation and maintenance element. If there is no abnormal operation and maintenance element at the belly, then determine whether there is an abnormal operation and maintenance element at the head of the fish. If there is abnormal operation and maintenance data at the head, execute the solution corresponding to that operation and maintenance element. If there is no abnormal operation and maintenance data at the head, then the process ends.

[0123] This invention utilizes a fishbone diagram and combines it with common data center operation and maintenance domains. It employs automated inspection scripts for each operation and maintenance domain to form a complete inspection and handling flow for each domain, including servers, networks, operating systems, databases, middleware, security, and application orchestration. This allows for the fastest possible location of specific operation and maintenance elements, further pinpointing the root cause of abnormal events, enabling targeted handling, rapid business recovery, and ensuring business continuity.

[0124] Optionally, if there is an abnormal operation and maintenance element at the "tail" of the fish, the solution corresponding to the operation and maintenance element is executed, including: step a, if there is an abnormal operation and maintenance element at the "tail", the solution corresponding to the operation and maintenance element is executed; step b, the automated inspection script corresponding to each operation and maintenance element is run again to obtain the inspection results of each operation and maintenance element; step c, based on the inspection results of each operation and maintenance element at the "tail", it is determined whether there is an abnormal operation and maintenance element at the "tail"; steps a-c are repeated until there are no abnormal operation and maintenance elements at the "tail". If an abnormal operation and maintenance element is found at the "tail" of the fish, the solution corresponding to that operation and maintenance element is executed. After executing the solution corresponding to that operation and maintenance element, the automated check script corresponding to each operation and maintenance element needs to be run again to obtain the check results of each operation and maintenance element. Therefore, based on the check results of each operation and maintenance element at the "tail", it is determined whether there is an abnormal operation and maintenance element at the "tail". If there is an abnormal operation and maintenance element at the "tail", the solution corresponding to that operation and maintenance element is executed, and the above steps are repeated until there are no abnormal operation and maintenance elements at the "tail". If there are no abnormal operation and maintenance elements at the "tail", the check results of the operation and maintenance elements at the "belly" are used to determine whether there is an abnormal operation and maintenance element at the "belly".

[0125] Optionally, if there are abnormal operation and maintenance elements in the "fish belly" area, the solution corresponding to the operation and maintenance element is executed, including: step a, if there are abnormal operation and maintenance elements in the "fish belly" area, the solution corresponding to the operation and maintenance element is executed; step b, each operation and maintenance element's corresponding automated inspection script is run again to obtain the inspection results of each operation and maintenance element; step c, based on the inspection results of each operation and maintenance element in the "fish belly" area, it is determined whether there are abnormal operation and maintenance elements in the "fish belly" area; steps a-c are repeated until there are no abnormal operation and maintenance elements in the "fish belly" area. If an abnormal maintenance element is found in the belly of the fish, the solution corresponding to that maintenance element is executed. After executing the solution corresponding to that maintenance element, the automated check script corresponding to each maintenance element needs to be run again to obtain the check results of each maintenance element. Therefore, based on the check results of each maintenance element in the belly of the fish, it is determined whether there is an abnormal maintenance element in the belly of the fish. If there is an abnormal maintenance element in the belly of the fish, the solution corresponding to that maintenance element is executed, and the above steps are repeated until there are no abnormal maintenance elements in the belly of the fish. If there are no abnormal maintenance elements in the belly of the fish, the check results of the maintenance elements in the head of the fish are used to determine whether there is an abnormal maintenance element in the head of the fish.

[0126] The embodiments of the present invention locate specific operation and maintenance elements in the order from the head to the tail of the fish, thus enabling rapid identification of the cause of abnormal events, thereby improving the accuracy and speed of identifying unknown abnormal events, as well as the efficiency of data center operation and maintenance and fault diagnosis.

[0127] It should be noted that if, in step 303, the fishbone diagram is constructed in the order of the underlying hardware infrastructure being closer to the fish head and the business application being closer to the fish tail, then step 307 includes: determining whether there are any abnormal operation and maintenance elements at the fish head based on the inspection results of each operation and maintenance element at the fish head; if there are abnormal operation and maintenance elements at the fish head, then executing the solution corresponding to the operation and maintenance element; if there are no abnormal operation and maintenance elements at the fish head, then determining whether there are any abnormal operation and maintenance elements at the fish belly based on the inspection results of the operation and maintenance elements at the fish belly; if there are abnormal operation and maintenance elements at the fish belly, then executing the solution corresponding to the operation and maintenance element; if there are no abnormal operation and maintenance elements at the fish belly, then determining whether there are any abnormal operation and maintenance elements at the fish tail based on the inspection results of the operation and maintenance elements at the fish tail; if there are abnormal operation and maintenance elements at the fish tail, then executing the solution corresponding to the operation and maintenance element. After obtaining the inspection results of each operation and maintenance element, first determine whether there is an abnormal operation and maintenance element at the "fish head". If there is an abnormal operation and maintenance element at the "fish head", execute the solution corresponding to that operation and maintenance element. If there is no abnormal operation and maintenance element at the "fish head", then determine whether there is an abnormal operation and maintenance element at the "fish belly". If there is an abnormal operation and maintenance element at the "fish belly", execute the solution corresponding to that operation and maintenance element. If there is no abnormal operation and maintenance element at the "fish tail", then the process ends.

[0128] Optionally, if there is an abnormal operation and maintenance element at the fish head, the solution corresponding to the operation and maintenance element is executed, including: step a, if there is an abnormal operation and maintenance element at the fish head, the solution corresponding to the operation and maintenance element is executed; step b, each operation and maintenance element's corresponding automated check script is run again to obtain the check results of each operation and maintenance element; step c, based on the check results of each operation and maintenance element at the fish head, it is determined whether there is an abnormal operation and maintenance element at the fish head; steps a-c are repeated until there are no abnormal operation and maintenance elements at the fish head. If an abnormal operation and maintenance element is found at the "fish head" (head of the fish), the solution corresponding to that operation and maintenance element is executed. After executing the solution, the automated check scripts for each operation and maintenance element need to be run again to obtain the check results for each operation and maintenance element. Therefore, based on the check results of each operation and maintenance element at the "fish head," it is determined whether there is an abnormal operation and maintenance element at the "fish head." If there is an abnormal operation and maintenance element at the "fish head," the solution corresponding to that operation and maintenance element is executed, and the above steps are repeated until there are no abnormal operation and maintenance elements at the "fish head." If there are no abnormal operation and maintenance elements at the "fish head," the check results of the operation and maintenance elements at the "fish belly" are used to determine whether there are abnormal operation and maintenance elements at the "fish belly."

[0129] Optionally, if there are abnormal operation and maintenance elements in the "fish belly" area, the solution corresponding to the operation and maintenance element is executed, including: step a, if there are abnormal operation and maintenance elements in the "fish belly" area, the solution corresponding to the operation and maintenance element is executed; step b, each operation and maintenance element's corresponding automated inspection script is run again to obtain the inspection results of each operation and maintenance element; step c, based on the inspection results of each operation and maintenance element in the "fish belly" area, it is determined whether there are abnormal operation and maintenance elements in the "fish belly" area; steps a-c are repeated until there are no abnormal operation and maintenance elements in the "fish belly" area. If an abnormal maintenance element is found in the belly of the fish, the solution corresponding to that maintenance element is executed. After executing the solution corresponding to that maintenance element, the automated check script corresponding to each maintenance element needs to be run again to obtain the check results of each maintenance element. Therefore, based on the check results of each maintenance element in the belly of the fish, it is determined whether there is an abnormal maintenance element in the belly of the fish. If there is an abnormal maintenance element in the belly of the fish, the solution corresponding to that maintenance element is executed, and the above steps are repeated until there are no abnormal maintenance elements in the belly of the fish. If there are no abnormal maintenance elements in the belly of the fish, the check results of the maintenance elements in the tail of the fish are used to determine whether there is an abnormal maintenance element in the tail of the fish.

[0130] Furthermore, the specific implementation details of the abnormal event location method in one of the reference embodiments of the present invention have been described in detail in the above-described abnormal event location method, so the details will not be repeated here.

[0131] Figure 6 This is a schematic diagram of an abnormal event location device according to an embodiment of the present invention. Figure 5 As shown, the abnormal event location device 600 includes a receiving module 601, a parsing module 602, and a location module 603. The receiving module 601 receives alarm messages pushed by a monitoring platform. The monitoring platform monitors and analyzes the data center's operating environment in real time and issues alarm messages in response to abnormalities in the operating environment. The parsing module 602 parses the alarm messages and locates the cause of the abnormal event based on the parsing results. The location module 603 locates the cause of the abnormal event based on a fishbone diagram if the cause cannot be located. The fishbone diagram represents the operation and maintenance domain, and the branches under the fishbone represent operation and maintenance elements within that domain. Each operation and maintenance element corresponds one-to-one with the cause of the abnormal event.

[0132] Optionally, it also includes a module for:

[0133] Divide the various operation and maintenance elements into different operation and maintenance domains;

[0134] The various operation and maintenance domains are divided into different operation and maintenance problem categories; among them, the operation and maintenance problem categories include underlying hardware infrastructure, system software level, security level, and business applications;

[0135] A fishbone diagram is constructed in the order of the underlying hardware infrastructure being closer to the tail of the fish and the business application being closer to the head of the fish, or in the order of the underlying hardware infrastructure being closer to the head of the fish and the business application being closer to the tail of the fish; wherein, the fishbone diagram includes multiple fishbone trunks, and each fishbone trunk is connected to multiple branches.

[0136] Optionally, the positioning module 603 is further configured to:

[0137] Run the automated inspection scripts corresponding to each operation and maintenance element to obtain the inspection results of each operation and maintenance element;

[0138] The cause of the abnormal event was located based on the inspection results of each of the aforementioned operation and maintenance elements.

[0139] Optionally, the positioning module 603 is further configured to:

[0140] Following the order from the tail to the head of the fish, the cause of the abnormal event is located sequentially based on the inspection results of each of the aforementioned operation and maintenance elements.

[0141] or,

[0142] Following the order from head to tail, the causes of abnormal events are located sequentially based on the inspection results of each of the aforementioned operational elements.

[0143] Optionally, the positioning module 603 is further configured to:

[0144] Based on the inspection results of each maintenance element at the "tail" of the fish, determine whether there are any abnormal maintenance elements at the "tail" of the fish; if there are any abnormal maintenance elements at the "tail" of the fish, execute the solution corresponding to the maintenance element.

[0145] If there are no abnormal operation and maintenance elements at the tail of the fish, then based on the inspection results of the operation and maintenance elements at the belly of the fish, it is determined whether there are any abnormal operation and maintenance elements at the belly of the fish; if there are any abnormal operation and maintenance elements at the belly of the fish, then the solution corresponding to the operation and maintenance element is executed.

[0146] If there are no abnormal operation and maintenance elements in the fish belly, then based on the inspection results of the operation and maintenance elements in the fish head, it is determined whether there are abnormal operation and maintenance elements in the fish head; if there are abnormal operation and maintenance elements in the fish head, then the solution corresponding to the operation and maintenance element is executed.

[0147] or,

[0148] Based on the inspection results of each maintenance element at the fish head, determine whether there are any abnormal maintenance elements at the fish head; if there are abnormal maintenance elements at the fish head, execute the solution corresponding to the maintenance element.

[0149] If there are no abnormal operation and maintenance elements at the fish head, then based on the inspection results of the operation and maintenance elements at the fish belly, it is determined whether there are any abnormal operation and maintenance elements at the fish belly; if there are any abnormal operation and maintenance elements at the fish belly, then the solution corresponding to the operation and maintenance element is executed.

[0150] If there are no abnormal operation and maintenance elements in the belly of the fish, then based on the inspection results of the operation and maintenance elements in the tail of the fish, it is determined whether there are abnormal operation and maintenance elements in the tail of the fish; if there are abnormal operation and maintenance elements in the tail of the fish, then the solution corresponding to the operation and maintenance element is executed.

[0151] Optionally, the positioning module 603 is further configured to:

[0152] Step a: If there is an abnormal operation and maintenance element at the fish tail, then execute the solution corresponding to the operation and maintenance element.

[0153] Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element.

[0154] Step c: Based on the inspection results of each maintenance element at the fish tail, determine whether there are any abnormal maintenance elements at the fish tail.

[0155] Repeat steps a-c until there are no abnormal maintenance elements at the fish tail.

[0156] Optionally, the positioning module 603 is further configured to:

[0157] Step a: If there is an abnormal operation and maintenance element in the fish belly, then execute the solution corresponding to the operation and maintenance element.

[0158] Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element.

[0159] Step c: Based on the inspection results of each maintenance element in the fish belly, determine whether there are any abnormal maintenance elements in the fish belly.

[0160] Repeat steps a-c until there are no abnormal maintenance elements in the fish belly.

[0161] It should be noted that the specific implementation of the abnormal event location device described in this invention has been described in detail in the abnormal event location method described above, so the content will not be repeated here.

[0162] Figure 7 An exemplary system architecture 700 is shown, in which the method or apparatus for locating abnormal events according to embodiments of the present invention can be applied.

[0163] like Figure 7 As shown, system architecture 700 may include terminal devices 701, 702, and 703, a network 704, and a server 705. Network 704 serves as the medium for providing communication links between terminal devices 701, 702, and 703 and server 705. Network 704 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0164] Users can use terminal devices 701, 702, and 703 to interact with server 705 via network 704 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 701, 702, and 703, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0165] Terminal devices 701, 702, and 703 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0166] Server 705 can be a server that provides various services, such as a backend management server that supports shopping websites browsed by users using terminal devices 701, 702, and 703 (this is just an example). The backend management server can analyze and process data such as received item information query requests, and then feed the processing results back to the terminal devices.

[0167] It should be noted that the abnormal event location method provided in the embodiments of the present invention is generally executed by server 705, and correspondingly, the abnormal event location device is generally set in server 705.

[0168] It should be understood that Figure 7 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0169] The following is for reference. Figure 8 It shows a schematic diagram of the structure of a computer system 800 suitable for implementing a terminal device of the present invention. Figure 8 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0170] like Figure 8As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 802 or programs loaded from storage section 808 into random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the system 800. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0171] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0172] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit (CPU) 801, it performs the functions defined above in the system of this invention.

[0173] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0174] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer programs according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0175] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be housed in a processor; for example, a processor can be described as including a receiving module, a parsing module, and a positioning module. The names of these modules do not necessarily limit the functionality of the module itself.

[0176] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the device, the device implements the following method: receiving alarm messages pushed by a monitoring platform; wherein the monitoring platform is used to monitor and analyze the operating environment of the data center in real time, and issues alarm messages in response to an anomaly in the operating environment; parsing the alarm messages and locating the cause of the abnormal event based on the parsing results of the alarm messages; and, in response to the inability to locate the cause of the abnormal event, locating the cause of the abnormal event based on a fishbone diagram; wherein the main trunk of the fishbone diagram represents the operation and maintenance domain, and the branches under the main trunk represent operation and maintenance elements under the operation and maintenance domain, with each operation and maintenance element corresponding one-to-one with the cause of the abnormal event.

[0177] In another aspect, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in any of the above embodiments.

[0178] According to the technical solution of this invention, because it adopts a fishbone diagram to locate the cause of an abnormal event in response to the inability to pinpoint the cause, where the main branch of the fishbone diagram represents the operation and maintenance domain, and the branches under the main branch represent operation and maintenance elements within the operation and maintenance domain, and there is a one-to-one correspondence between operation and maintenance elements and the cause of the abnormal event, this overcomes the technical problem of not being able to quickly locate the cause of abnormal events in the prior art. This invention uses a fishbone diagram combined with data center domain division. When an unknown abnormal event occurs, an automated inspection script quickly categorizes and locates the operation and maintenance element within the operation and maintenance domain, thereby narrowing the scope of investigation, achieving targeted analysis, quickly restoring business, and ensuring business continuity.

[0179] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for locating abnormal events, characterized in that, include: Receive alarm messages pushed by the monitoring platform; wherein the monitoring platform is used to monitor and analyze the operating environment of the data center in real time, and to issue alarm messages in response to abnormalities in the operating environment; The alarm message is parsed, and the cause of the abnormal event is located based on the parsing result of the alarm message. The cause of the abnormal event includes SQL abnormality, insufficient table space, or firewall abnormality. In response to the inability to pinpoint the cause of the abnormal event, the cause of the abnormal event is located based on a fishbone diagram; wherein, the main trunk of the fishbone diagram represents the operation and maintenance domain, and the branches under the main trunk represent the operation and maintenance elements under the operation and maintenance domain, with each operation and maintenance element corresponding one-to-one with the cause of the abnormal event; locating the cause of the abnormal event based on the fishbone diagram includes: running the automated inspection scripts corresponding to each operation and maintenance element to obtain the inspection results of each operation and maintenance element; and locating the cause of the abnormal event based on the inspection results of each operation and maintenance element. Before receiving alarm messages pushed by the monitoring platform, it also includes: Divide the various operation and maintenance elements into different operation and maintenance domains; The various operation and maintenance domains are divided into different operation and maintenance problem categories; among them, the operation and maintenance problem categories include underlying hardware infrastructure, system software level, security level, and business applications; A fishbone diagram is constructed in the order of the underlying hardware infrastructure being closer to the tail of the fish and the business application being closer to the head of the fish, or in the order of the underlying hardware infrastructure being closer to the head of the fish and the business application being closer to the tail of the fish; wherein, the fishbone diagram includes multiple fishbone trunks, and each fishbone trunk is connected to multiple branches.

2. The method according to claim 1, characterized in that, Based on the inspection results of each of the aforementioned operational elements, the causes of the abnormal events were identified, including: Following the order from the tail to the head of the fish, the cause of the abnormal event is located sequentially based on the inspection results of each of the aforementioned operation and maintenance elements. or, Following the order from head to tail, the causes of abnormal events are located sequentially based on the inspection results of each of the aforementioned operational elements.

3. The method according to claim 2, characterized in that, Following the order from tail to head, the causes of abnormal events are located sequentially based on the inspection results of each operational element, including: Based on the inspection results of each maintenance element at the "tail" of the fish, determine whether there are any abnormal maintenance elements at the "tail" of the fish; if there are any abnormal maintenance elements at the "tail" of the fish, execute the solution corresponding to the maintenance element. If there are no abnormal operation and maintenance elements at the tail of the fish, then based on the inspection results of the operation and maintenance elements at the belly of the fish, it is determined whether there are any abnormal operation and maintenance elements at the belly of the fish; if there are any abnormal operation and maintenance elements at the belly of the fish, then the solution corresponding to the operation and maintenance element is executed. If there are no abnormal operation and maintenance elements in the fish belly, then based on the inspection results of the operation and maintenance elements in the fish head, it is determined whether there are abnormal operation and maintenance elements in the fish head; if there are abnormal operation and maintenance elements in the fish head, then the solution corresponding to the operation and maintenance element is executed. or, Based on the inspection results of each maintenance element at the fish head, determine whether there are any abnormal maintenance elements at the fish head; if there are abnormal maintenance elements at the fish head, execute the solution corresponding to the maintenance element. If there are no abnormal operation and maintenance elements at the fish head, then based on the inspection results of the operation and maintenance elements at the fish belly, it is determined whether there are any abnormal operation and maintenance elements at the fish belly; if there are any abnormal operation and maintenance elements at the fish belly, then the solution corresponding to the operation and maintenance element is executed. If there are no abnormal operation and maintenance elements in the belly of the fish, then based on the inspection results of the operation and maintenance elements in the tail of the fish, it is determined whether there are abnormal operation and maintenance elements in the tail of the fish; if there are abnormal operation and maintenance elements in the tail of the fish, then the solution corresponding to the operation and maintenance element is executed.

4. The method according to claim 3, characterized in that, If there is an abnormal operation and maintenance element at the "tail" of the fish, then the solution corresponding to the operation and maintenance element will be executed, including: Step a: If there is an abnormal operation and maintenance element at the fish tail, then execute the solution corresponding to the operation and maintenance element. Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element. Step c: Based on the inspection results of each maintenance element at the fish tail, determine whether there are any abnormal maintenance elements at the fish tail. Repeat steps a-c until there are no abnormal maintenance elements at the fish tail.

5. The method according to claim 3, characterized in that, If there are abnormal maintenance elements in the fish belly area, the solution corresponding to the maintenance element will be executed, including: Step a: If there is an abnormal operation and maintenance element in the fish belly, then execute the solution corresponding to the operation and maintenance element. Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element. Step c: Based on the inspection results of each maintenance element in the fish belly, determine whether there are any abnormal maintenance elements in the fish belly. Repeat steps a-c until there are no abnormal maintenance elements in the fish belly.

6. A device for locating abnormal events, characterized in that, include: The receiving module is used to receive alarm messages pushed by the monitoring platform; wherein, the monitoring platform is used to monitor and analyze the operating environment of the data center in real time, and to issue alarm messages in response to abnormalities in the operating environment; The parsing module is used to parse the alarm message and locate the cause of the abnormal event based on the parsing result of the alarm message. The cause of the abnormal event includes SQL abnormality, insufficient tablespace, or firewall abnormality. The location module is used to locate the cause of an abnormal event based on a fishbone diagram in response to the inability to locate the cause of the abnormal event. The fishbone diagram represents the operation and maintenance domain, and the branches under the fishbone represent operation and maintenance elements within that domain. Each operation and maintenance element corresponds one-to-one with the cause of the abnormal event. Locating the cause of the abnormal event based on the fishbone diagram includes: running automated inspection scripts corresponding to each operation and maintenance element to obtain the inspection results of each element; and locating the cause of the abnormal event based on the inspection results of each operation and maintenance element. It also includes creating modules for: Divide the various operation and maintenance elements into different operation and maintenance domains; The various operation and maintenance domains are divided into different operation and maintenance problem categories; among them, the operation and maintenance problem categories include underlying hardware infrastructure, system software level, security level, and business applications; A fishbone diagram is constructed in the order of the underlying hardware infrastructure being closer to the tail of the fish and the business application being closer to the head of the fish, or in the order of the underlying hardware infrastructure being closer to the head of the fish and the business application being closer to the tail of the fish; wherein, the fishbone diagram includes multiple fishbone trunks, and each fishbone trunk is connected to multiple branches.

7. The apparatus according to claim 6, characterized in that, The positioning module is also used for: Following the order from the tail to the head of the fish, the cause of the abnormal event is located sequentially based on the inspection results of each of the aforementioned operation and maintenance elements. or, Following the order from head to tail, the causes of abnormal events are located sequentially based on the inspection results of each of the aforementioned operational elements.

8. The apparatus according to claim 7, characterized in that, The positioning module is also used for: Based on the inspection results of each maintenance element at the "tail" of the fish, determine whether there are any abnormal maintenance elements at the "tail" of the fish; if there are any abnormal maintenance elements at the "tail" of the fish, execute the solution corresponding to the maintenance element. If there are no abnormal maintenance elements at the fish tail, then the presence of abnormal maintenance elements at the fish belly is determined based on the inspection results of the maintenance elements at the fish belly. If there are abnormal operation and maintenance elements in the fish belly, then execute the solution corresponding to the operation and maintenance element; If there are no abnormal maintenance elements in the belly of the fish, then based on the inspection results of the maintenance elements in the head of the fish, it is determined whether there are any abnormal maintenance elements in the head of the fish. If there is an abnormal operation and maintenance element at the fish head, then execute the solution corresponding to the operation and maintenance element; or, Based on the inspection results of each maintenance element at the fish head, determine whether there are any abnormal maintenance elements at the fish head. If there is an abnormal operation and maintenance element at the fish head, then execute the solution corresponding to the operation and maintenance element; If there are no abnormal maintenance elements at the fish head, then the presence of abnormal maintenance elements at the fish belly is determined based on the inspection results of the maintenance elements at the fish belly. If there are abnormal operation and maintenance elements in the fish belly, then execute the solution corresponding to the operation and maintenance element; If there are no abnormal maintenance elements in the belly of the fish, then the presence of abnormal maintenance elements in the tail of the fish is determined based on the inspection results of the maintenance elements in the tail of the fish. If there is an abnormal operation and maintenance element at the tail of the fish, then the solution corresponding to the operation and maintenance element will be executed.

9. The apparatus according to claim 8, characterized in that, The positioning module is also used for: Step a: If there is an abnormal operation and maintenance element at the fish tail, then execute the solution corresponding to the operation and maintenance element. Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element. Step c: Based on the inspection results of each maintenance element at the fish tail, determine whether there are any abnormal maintenance elements at the fish tail. Repeat steps a-c until there are no abnormal maintenance elements at the fish tail.

10. The apparatus according to claim 8, characterized in that, The positioning module is also used for: Step a: If there is an abnormal operation and maintenance element in the fish belly, then execute the solution corresponding to the operation and maintenance element. Step b: Run the automated inspection scripts corresponding to each operation and maintenance element again to obtain the inspection results of each operation and maintenance element. Step c: Based on the inspection results of each maintenance element in the fish belly, determine whether there are any abnormal maintenance elements in the fish belly. Repeat steps a-c until there are no abnormal maintenance elements in the fish belly.

11. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-5.

12. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-5.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-5.

Images