Business monitoring methods, devices, storage media and electronic equipment

Abstract

This application discloses a business monitoring method, apparatus, storage medium, and electronic device. The method involves: determining a multi-dimensional indicator system based on multiple business items, at least one application module associated with the multiple business items, at least one monitoring indicator associated with the multiple application modules, and fault issues associated with the multiple monitoring indicators; determining an alarm standard for at least one business item based on the multi-dimensional indicator system; obtaining a target alarm indicator related to the fault issue when a business system fault occurs; and designating at least one business item whose alarm standard includes the target alarm indicator as an abnormal business item. This method utilizes the multi-dimensional indicator system and the alarm standard for business items to quickly and effectively identify abnormal business items, thereby significantly improving the operational efficiency of business monitoring.

Description

Technical Field

[0001] This application relates to the field of business monitoring, and more particularly to a business monitoring method, apparatus, storage medium, and electronic device. Background Technology

[0002] Monitoring operations and proactively identifying business risks are crucial for mitigating operational losses. This involves configuring monitoring metrics, and when these metrics change, various detection algorithms identify anomalies and notify operations personnel via alerts. However, with the ever-increasing volume of business data and the tight coupling between different data streams, problems in any application module along the entire business chain can lead to a massive number of alerts.

[0003] Existing business monitoring methods can mostly only determine whether an application module is abnormal based on the monitoring indicators corresponding to the application module, but cannot determine which specific business item is abnormal, requiring further investigation and location by operations and maintenance personnel. Summary of the Invention

[0004] This application provides a business monitoring method, apparatus, storage medium, and electronic device, with the aim of quickly and effectively identifying abnormal business items.

[0005] To achieve the above objectives, this application provides the following technical solution:

[0006] A business monitoring method, comprising:

[0007] A multi-dimensional indicator system is determined based on multiple business items, at least one application module associated with the multiple business items, at least one monitoring indicator associated with the multiple application modules, and fault issues associated with the multiple monitoring indicators.

[0008] Based on the aforementioned multi-dimensional indicator system, an alarm standard for at least one business item is determined; the alarm standard includes at least one alarm indicator; the alarm indicator is a monitoring indicator whose value does not meet the threshold range.

[0009] When a business system malfunctions, target alarm indicators related to the fault issue to which the malfunction belongs are obtained;

[0010] Based on the at least one business item, the business item whose alarm standard includes the target alarm indicator is considered an abnormal business item.

[0011] Optionally, based on the aforementioned multi-dimensional indicator system, an alarm standard for at least one business item is determined, including:

[0012] Based on the aforementioned multi-dimensional indicator system, a dataset is determined; the dataset includes multiple anomaly information; the anomaly information includes: alarm indicators generated by application modules related to the business item within a specified time period during which the business item experiences an anomaly;

[0013] Using the dataset, a classification model is trained; the classification model is used to classify at least one alarm indicator in the dataset to obtain alarm criteria for at least one business item.

[0014] Optionally, using the dataset, a classification model is trained, including:

[0015] Initialize the random forest model; the random forest model includes multiple decision trees;

[0016] Based on the dataset, multiple training sets were determined;

[0017] The random forest model is trained using the multiple training sets.

[0018] The random forest model obtained after training is used as a classification model.

[0019] Optionally, based on the at least one service item, the service item whose alarm criteria include the target alarm indicator is considered as an abnormal service item, including:

[0020] The target alarm metric is used as input to the random forest model to obtain the abnormal business items output by the random forest model.

[0021] Optional, also includes:

[0022] If there are multiple abnormal business items, at least one monitoring indicator associated with the multiple abnormal business items shall be determined based on the multi-dimensional indicator system.

[0023] The target monitoring indicator is determined based on the occurrence time corresponding to at least one of the monitoring indicators; the occurrence time corresponding to the target monitoring indicator is the earliest among the at least one monitoring indicator.

[0024] Based on the aforementioned multi-dimensional indicator system, the fault problems associated with the target monitoring indicators are identified.

[0025] The faults associated with the target monitoring indicators are considered as the root causes of the failures in the business system.

[0026] Optional, also includes:

[0027] Obtain the target graphic component corresponding to the target monitoring indicator from the specified graphic database;

[0028] Based on the target graphical component and the root cause, a root cause localization interface is constructed and displayed.

[0029] Optional, also includes:

[0030] Based on the alarm criteria of the abnormal business item, a first graph is generated;

[0031] Based on the target alarm indicator, the first graph is adjusted to obtain the second graph;

[0032] Visualize the first and second graphics.

[0033] A business monitoring device, comprising:

[0034] The system determination unit is used to determine a multi-dimensional indicator system based on multiple business items, at least one application module associated with the multiple business items, at least one monitoring indicator associated with the multiple application modules, and fault problems associated with the multiple monitoring indicators.

[0035] The standard determination unit is used to determine the alarm standard for at least one business item based on the multi-dimensional indicator system; the alarm standard includes at least one alarm indicator; the alarm indicator is a monitoring indicator whose indicator value does not meet the threshold range.

[0036] An alarm determination unit is used to obtain target alarm indicators related to the fault problem to which the fault belongs when a fault occurs in the business system.

[0037] An anomaly determination unit is used to identify, based on the at least one service item, the service item whose alarm criteria include the target alarm indicator as an anomaly service item.

[0038] Optionally, the standard determination unit is specifically used for:

[0039] Based on the aforementioned multi-dimensional indicator system, a dataset is determined; the dataset includes multiple anomaly information; the anomaly information includes: alarm indicators generated by application modules related to the business item within a specified time period during which the business item experiences an anomaly;

[0040] Using the dataset, a classification model is trained; the classification model is used to classify at least one alarm indicator in the dataset to obtain alarm criteria for at least one business item.

[0041] Optionally, the standard determination unit is specifically used for:

[0042] Initialize the random forest model; the random forest model includes multiple decision trees;

[0043] Based on the dataset, multiple training sets were determined;

[0044] The random forest model is trained using the multiple training sets.

[0045] The random forest model obtained after training is used as a classification model.

[0046] Optionally, the anomaly determination unit is specifically used for:

[0047] The target alarm metric is used as input to the random forest model to obtain the abnormal business items output by the random forest model.

[0048] Optionally, it also includes a root cause determination unit for:

[0049] If there are multiple abnormal business items, at least one monitoring indicator associated with the multiple abnormal business items shall be determined based on the multi-dimensional indicator system.

[0050] The target monitoring indicator is determined based on the occurrence time corresponding to at least one of the monitoring indicators; the occurrence time corresponding to the target monitoring indicator is the earliest among the at least one monitoring indicator.

[0051] Based on the aforementioned multi-dimensional indicator system, the fault problems associated with the target monitoring indicators are identified.

[0052] The faults associated with the target monitoring indicators are considered as the root causes of the failures in the business system.

[0053] Optionally, the root cause determination unit is further configured to:

[0054] Obtain the target graphic component corresponding to the target monitoring indicator from the specified graphic database;

[0055] Based on the target graphical component and the root cause, a root cause localization interface is constructed and displayed.

[0056] Optionally, it also includes a visualization unit, which is used for:

[0057] Based on the alarm criteria of the abnormal business item, a first graph is generated;

[0058] Based on the target alarm indicator, the first graph is adjusted to obtain the second graph;

[0059] Visualize the first and second graphics.

[0060] A storage medium comprising a stored program, wherein the program is executed by a processor to perform the business monitoring method.

[0061] An electronic device includes: a processor, a memory, and a bus; the processor and the memory are connected via the bus.

[0062] The memory is used to store the program, and the processor is used to run the program, wherein the program is executed by the processor to perform the business monitoring method.

[0063] The technical solution provided in this application establishes a multi-dimensional indicator system based on multiple business items, at least one application module associated with these business items, at least one monitoring indicator associated with these application modules, and fault issues associated with these monitoring indicators. Based on this multi-dimensional indicator system, an alarm standard for at least one business item is determined. When a fault occurs in the business system, a target alarm indicator related to the fault issue is obtained. Among the at least one business item, those whose alarm standards include the target alarm indicator are designated as abnormal business items. This application, utilizing the multi-dimensional indicator system and the alarm standards for business items, can quickly and effectively identify abnormal business items, significantly improving the operational efficiency of business monitoring. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 A flowchart illustrating a business monitoring method provided in an embodiment of this application;

[0066] Figure 2 A schematic diagram of an association relationship provided for an embodiment of this application;

[0067] Figure 3 Another diagram illustrating the relationship provided in this application embodiment;

[0068] Figure 4 A schematic diagram of a multi-dimensional three-dimensional index system provided for an embodiment of this application;

[0069] Figure 5 A flowchart illustrating another business monitoring method provided in an embodiment of this application;

[0070] Figure 6 A schematic diagram of a business system display page provided in an embodiment of this application;

[0071] Figure 7 A flowchart illustrating yet another business monitoring method provided in an embodiment of this application;

[0072] Figure 8 A graphic schematic diagram provided for an embodiment of this application;

[0073] Figure 9 Another graphical illustration provided for an embodiment of this application;

[0074] Figure 10 This is a schematic diagram of the architecture of a business monitoring device provided in an embodiment of this application. Detailed Implementation

[0075] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0076] In this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0077] like Figure 1 The diagram shown is a flowchart of a business monitoring method provided in an embodiment of this application, including the following steps.

[0078] S101: Based on multiple business items, at least one application module associated with multiple business items, at least one monitoring indicator associated with multiple application modules, and fault issues associated with multiple monitoring indicators, determine a multi-dimensional indicator system.

[0079] The relationships between multiple business items, multiple application modules, multiple monitoring indicators, and multiple fault issues can be obtained by analyzing the business processes.

[0080] In some examples, the processing of a business item involves at least one application module. Each application module is used to process a portion of the business data of the business item. Each application module is associated with at least one monitoring metric. Each monitoring metric is used to monitor for potential faults or problems that may occur during the processing of business data by the application module.

[0081] In one possible implementation, taking Alipay as an example, such as... Figure 2 As shown, Alipay's business accesses the system through external partners NetsUnion and UnionPay. This Alipay business involves 12 application modules: Application Component A, Application Component B, Application Component C, Application Component D, Application Component E, Application Component F, Application Component G, Application Component H, Application Component I, Application Component J, Application Component K, and Application Component L. Among them, as... Figure 3 As shown, application component A is associated with transaction code A, application component B with transaction code B, application component C with transaction code C, application component D with transaction code D, application component E with transaction code E, application component F with transaction code F, application component G with transaction code G, application component H with transaction code H, application component I with transaction code I, application component J with transaction code J, and application component K with transaction code K. Figure 3 Each transaction code shown corresponds to multiple monitoring metrics, which include at least transaction volume, business success rate, system success rate, average response time, average processing time, long transaction volume, and production transaction rate.

[0082] In some examples, the business system involves at least one business item, and each business item may involve the same or different application modules. The monitoring indicators of the same application module may have different names in different business items. Therefore, in the process of determining the multi-dimensional indicator system, the names of the monitoring indicators can also be unified.

[0083] In some examples, application modules are deployed on different operating platforms. By defining a multi-dimensional indicator system, a comprehensive multi-dimensional monitoring system can be established, transforming business monitoring from single-dimensional indicator monitoring to multi-dimensional indicator monitoring, which can more accurately reflect the actual operation of the business system.

[0084] In one possible implementation, a multi-dimensional indicator system is determined based on multiple business items, at least one application module associated with the multiple business items, at least one monitoring indicator associated with the multiple application modules, and fault issues associated with the multiple monitoring indicators. (See also...) Figure 4 As shown.

[0085] S102: Based on a multi-dimensional indicator system, determine the alarm standard for at least one business item.

[0086] The alarm criteria include at least one alarm indicator, which is a monitoring indicator whose value does not meet the threshold range.

[0087] In some examples, machine learning models can be used to train and learn a multi-dimensional indicator system to obtain alarm criteria for at least one business item. Generally speaking, the process of determining alarm criteria for at least one business item can be simply understood as the process of determining the attribution of alarm indicators, that is, determining which business items contain alarm indicators.

[0088] Optionally, the specific implementation process for determining the alarm standard for at least one business item based on a multi-dimensional indicator system includes: determining a dataset based on the multi-dimensional indicator system; the dataset includes multiple anomaly information; the anomaly information includes: alarm indicators generated by application modules related to the business item within a specified time period when the business item is abnormal; using the dataset, training a classification model; the classification model is used to classify at least one alarm indicator in the dataset to obtain the alarm standard for at least one business item.

[0089] It is understandable that a multi-dimensional, comprehensive indicator system can be used to monitor the operation of business systems in order to obtain information on anomalies that have occurred in the past. Furthermore, the classification model can employ a machine learning model.

[0090] In some examples, the classification model can be a random forest model. The specific implementation process of training the classification model using the dataset can be found in [link to documentation]. Figure 5 The steps shown are explained below.

[0091] S103: When a business system fails, obtain target alarm indicators related to the fault problem to which the fault belongs.

[0092] When a business system malfunctions, a target alarm indicator related to the fault is determined based on a multi-dimensional indicator system. This target alarm indicator may be associated with one or more application modules.

[0093] S104: Based on at least one business item, the business item whose alarm criteria include the target alarm indicator is designated as an abnormal business item.

[0094] Among them, the comparison between the alarm standards of business items and the target alarm indicators can identify abnormal business items, which can effectively and accurately realize the investigation and location of anomalies, avoid the investigation work of operation and maintenance personnel, and improve the operation and maintenance efficiency of business monitoring.

[0095] In some examples, the alarm criteria for at least one business item are expressed based on a random forest model. Using the random forest model, it is possible to quickly compare the alarm criteria of the business item with the target alarm metric.

[0096] Optionally, the target alarm metric can be used as input to the random forest model to obtain the abnormal business items output by the random forest model.

[0097] In some examples, business monitoring not only needs to investigate and locate abnormal business items, but also needs to determine the root cause of the business system failure, that is, to determine which failure problem is the main reason for the failure of the business system.

[0098] Optionally, if there are multiple abnormal business items, at least one monitoring indicator associated with the multiple abnormal business items is determined based on a multi-dimensional indicator system; a target monitoring indicator is determined based on the occurrence time corresponding to the at least one monitoring indicator; the occurrence time corresponding to the target monitoring indicator is the earliest among the at least one monitoring indicator; the fault problem associated with the target monitoring indicator is determined based on the multi-dimensional indicator system; and the fault problem associated with the target monitoring indicator is taken as the root cause of the failure of the business system.

[0099] In some examples, to allow users to intuitively understand the root cause, the root cause of the business system failure can be displayed through a graphical interface.

[0100] Optionally, the target graphical components corresponding to the target monitoring indicators can be obtained from a specified graphical database; based on the target graphical components and the root cause, a root cause localization interface can be constructed and displayed.

[0101] In one possible implementation, such as Figure 6 The root cause analysis interface shown presents the user with the root causes of the business system failure. These root causes include application problems, business problems, database problems, Garbage Collection (GC) problems, middleware problems, storage problems, network problems, and host problems.

[0102] The processes shown in S101-S104 above utilize a multi-dimensional indicator system and alarm standards for business items to quickly and effectively identify abnormal business items, thereby improving the operational efficiency of business monitoring.

[0103] like Figure 5 The diagram shown is a flowchart of another business monitoring method provided in this application embodiment, which includes the following steps.

[0104] S501: Initialize the random forest model.

[0105] The random forest model includes multiple decision trees.

[0106] In some examples, the parameters of the random forest model can be set by technicians according to the actual situation. Generally speaking, the features involved in the initialization of the random forest model can be determined based on the alarm indicators in the dataset. The features can be obtained by performing feature engineering on the alarm indicators.

[0107] S502: Based on the dataset, determine multiple training sets.

[0108] The alarm metrics in the dataset may contain missing values ​​and outliers. Therefore, it is necessary to process the dataset for missing values ​​and outliers in order to obtain a valid training set.

[0109] In one possible implementation, in addition to determining multiple training sets, test sets and validation sets also need to be determined, and the data distribution in the training, test, and validation sets should be the same in order to improve the training performance of the random forest model.

[0110] S503: Train the random forest model using multiple training sets.

[0111] The random forest model can be trained using a random search algorithm. During training, the number of decision trees can be increased from 100 to 500, and the depth of the decision trees can be increased from 20 to 200. Each decision tree will expand its nodes until all leaves are pure, and the performance of the random forest model can be evaluated using a confusion matrix.

[0112] S504: A random forest model obtained after training, used as a classification model.

[0113] Among them, using the random forest model obtained after training as a classification model can effectively improve the operational efficiency of business monitoring and make it easier for operation and maintenance personnel to use the classification model to investigate and locate abnormal business items.

[0114] The processes shown in S501-S504 above can be used to construct a classification model using a random forest model.

[0115] like Figure 7 The diagram shown is a flowchart of another business monitoring method provided in this application embodiment, including the following steps.

[0116] S701: Generate the first graph based on the alarm standard of abnormal business items.

[0117] The alarm criteria include at least one alarm indicator. Therefore, the first graph generated based on the alarm criteria for abnormal business items can be an irregular curved surface, such as... Figure 8 As shown.

[0118] S702: Adjust the first graph according to the target alarm indicator to obtain the second graph.

[0119] The process involves adjusting the first graphic based on the target alarm indicator. Essentially, this involves adjusting the parameters of the first graphic to obtain the second graphic. Generally speaking, the second graphic can also be an irregular curved surface.

[0120] S703: Visualize the first and second graphics.

[0121] In one possible implementation, the visualization results of the first and second graphics can be found in [reference needed]. Figure 9 As shown.

[0122] The processes shown in S701-S703 above can visualize abnormal business items, so that operation and maintenance personnel can intuitively understand the abnormal business items.

[0123] Corresponding to the business monitoring method provided in the above embodiments of this application, the embodiments of this application also provide a business monitoring device.

[0124] like Figure 10 The diagram shown is an architectural schematic of a business monitoring device provided in an embodiment of this application, which includes the following units.

[0125] System determination unit 100 is used to determine a multi-dimensional indicator system based on multiple business items, at least one application module associated with multiple business items, at least one monitoring indicator associated with multiple application modules, and fault problems associated with multiple monitoring indicators.

[0126] The standard determination unit 200 is used to determine the alarm standard for at least one business item based on a multi-dimensional indicator system; the alarm standard includes at least one alarm indicator; the alarm indicator is a monitoring indicator whose indicator value does not meet the threshold range.

[0127] Optionally, the standard determination unit 200 is specifically used for: determining a dataset based on a multi-dimensional indicator system; the dataset includes multiple anomaly information; the anomaly information includes: alarm indicators generated by application modules related to the business item within a specified time period when the business item is abnormal; using the dataset, training a classification model; the classification model is used to classify at least one alarm indicator in the dataset to obtain alarm standards for at least one business item.

[0128] Optionally, the standard determination unit 200 is specifically used for: initializing a random forest model; the random forest model includes multiple decision trees; determining multiple training sets based on the dataset; training the random forest model using the multiple training sets; and using the trained random forest model as a classification model.

[0129] The alarm determination unit 300 is used to obtain target alarm indicators related to the fault problem when a fault occurs in the business system.

[0130] The anomaly determination unit 400 is used to identify at least one business item as an abnormal business item based on the fact that the alarm criteria include the target alarm indicator.

[0131] Optionally, the anomaly determination unit 400 is specifically used to: take the target alarm indicator as input to the random forest model to obtain the abnormal business items output by the random forest model.

[0132] The root cause determination unit 500 is used to: if there are multiple abnormal business items, determine at least one monitoring indicator associated with the multiple abnormal business items based on a multi-dimensional indicator system; determine a target monitoring indicator based on the occurrence time corresponding to the at least one monitoring indicator; the occurrence time corresponding to the target monitoring indicator is the earliest among the at least one monitoring indicator; determine the fault problem associated with the target monitoring indicator based on the multi-dimensional indicator system; and take the fault problem associated with the target monitoring indicator as the root cause of the failure of the business system.

[0133] Optionally, the root cause determination unit 500 is also used to: obtain the target graphic component corresponding to the target monitoring indicator from the specified graphic database; construct the root cause location interface based on the target graphic component and the root cause, and display the root cause location interface.

[0134] The visualization unit 600 is used to: generate a first graph based on the alarm criteria of abnormal business items; adjust the first graph according to the target alarm indicator to obtain a second graph; and visualize the first and second graphs.

[0135] The units shown above, by utilizing a multi-dimensional indicator system and alarm standards for business items, can quickly and effectively identify abnormal business items, thereby improving the operational efficiency of business monitoring.

[0136] This application also provides a computer-readable storage medium including a stored program, wherein the program executes the business monitoring method provided in this application.

[0137] This application also provides an electronic device, including a processor, a memory, and a bus. The processor and the memory are connected via the bus. The memory is used to store a program, and the processor is used to run the program. During program execution, the business monitoring method provided in this application is performed.

[0138] Furthermore, the functions described above in the embodiments of this application can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that can be used include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SOCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0139] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

[0140] While several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0141] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A business monitoring method, characterized in that, include: A multi-dimensional indicator system is determined based on multiple business items, at least one application module associated with the multiple business items, at least one monitoring indicator associated with the multiple application modules, and fault issues associated with the multiple monitoring indicators. Based on the aforementioned multi-dimensional indicator system, an alarm standard for at least one business item is determined. This determination includes: defining a dataset based on the multi-dimensional indicator system; the dataset includes multiple anomaly information sets; the anomaly information sets include alarm indicators generated by application modules related to the business item within a specified time period when the business item exhibits an anomaly; initializing a random forest model; the random forest model includes multiple decision trees; determining multiple training sets based on the dataset; training the random forest model using the multiple training sets; using the trained random forest model as a classification model; the classification model is used to classify at least one alarm indicator in the dataset to obtain an alarm standard for at least one business item; the alarm standard includes at least one alarm indicator; the alarm indicator is a monitoring indicator whose value does not meet a threshold range. When a business system malfunctions, target alarm indicators related to the fault issue to which the malfunction belongs are obtained; Based on the at least one business item, the business item whose alarm standard includes the target alarm indicator is designated as an abnormal business item; wherein, the step of designating the business item whose alarm standard includes the target alarm indicator as an abnormal business item includes: using the target alarm indicator as input to the random forest model to obtain the abnormal business item output by the random forest model.

2. The method according to claim 1, characterized in that, Also includes: If there are multiple abnormal business items, at least one monitoring indicator associated with the multiple abnormal business items shall be determined based on the multi-dimensional indicator system. The target monitoring indicator is determined based on the occurrence time corresponding to at least one of the monitoring indicators; The occurrence time corresponding to the target monitoring indicator is the earliest among at least one of the monitoring indicators; Based on the aforementioned multi-dimensional indicator system, the fault problems associated with the target monitoring indicators are identified. The faults associated with the target monitoring indicators are considered as the root causes of the failures in the business system.

3. The method according to claim 2, characterized in that, Also includes: Obtain the target graphic component corresponding to the target monitoring indicator from the specified graphic database; Based on the target graphical component and the root cause, a root cause localization interface is constructed and displayed.

4. The method according to claim 1, characterized in that, Also includes: Based on the alarm criteria of the abnormal business item, a first graph is generated; Based on the target alarm indicator, the first graph is adjusted to obtain the second graph; Visualize the first and second graphics.

5. A business monitoring device, characterized in that, include: The system determination unit is used to determine a multi-dimensional indicator system based on multiple business items, at least one application module associated with the multiple business items, at least one monitoring indicator associated with the multiple application modules, and fault problems associated with the multiple monitoring indicators. A standard determination unit is used to determine the alarm standard for at least one business item based on the multi-dimensional indicator system. The determination of the alarm standard for at least one business item based on the multi-dimensional indicator system includes: determining a dataset based on the multi-dimensional indicator system; the dataset includes multiple anomaly information; the anomaly information includes alarm indicators generated by application modules related to the business item within a specified time period when the business item exhibits an anomaly; initializing a random forest model; the random forest model includes multiple decision trees; determining multiple training sets based on the dataset; training the random forest model using the multiple training sets; using the trained random forest model as a classification model; the classification model is used to classify at least one alarm indicator in the dataset to obtain the alarm standard for at least one business item; the alarm standard includes at least one alarm indicator; the alarm indicator is a monitoring indicator whose value does not meet a threshold range. An alarm determination unit is used to obtain target alarm indicators related to the fault problem to which the fault belongs when a fault occurs in the business system. An anomaly determination unit is used to identify, based on the at least one service item, service items whose alarm criteria include the target alarm indicator as an anomaly service item; wherein, identifying, based on the at least one service item, service items whose alarm criteria include the target alarm indicator as an anomaly service item includes: using the target alarm indicator as input to the random forest model to obtain the anomaly service items output by the random forest model.

6. A storage medium, characterized in that, The storage medium includes a stored program, wherein the program is executed by a processor to perform the business monitoring method according to any one of claims 1-4.

7. An electronic device, characterized in that, include: Processor, memory, and bus; The processor and the memory are connected via the bus; The memory is used to store the program, and the processor is used to run the program, wherein the program is executed by the processor to perform the business monitoring method according to any one of claims 1-4.

Images