A self-adaptive alarm implementation method

Abstract

The application particularly relates to an adaptive alarm implementation method. The adaptive alarm implementation method adopts a statistical analysis algorithm to analyze and calculate mass data, and obtains a threshold interval; if an index triggers an alarm, data is re-collected for statistical analysis, a new threshold interval is obtained, and dynamic adjustment of the threshold is realized; the size period of a window is dynamically divided according to a time level and alarm flow, so that dynamic extraction and analysis of alarm events are realized; alarm event information is preprocessed, and whether the alarm event is of the same type is judged by matching similarity; and a unified template is used to output the alarm event of the same type. The adaptive alarm implementation method can not only adapt to a business environment in a process of continuous service change, better reflect changes of alarm thresholds, but also optimize and improve alarm quality according to different business scales, improve the accuracy of the alarm and the efficiency of fault management, and reduce the cost related to the alarm.

Description

TECHNICAL FIELD

[0001] The present application relates to the computer technical field, in particular to a kind of adaptive alarm implementation method. BACKGROUND

[0002] With the base number and kind of different services carried on network continue to rise, the service in network is also developing towards more diversified, more dispersed trend.But the dependent association between multiple services, the data separation of respective service, lead to lack of high-quality data index.The process of collecting index is mainly metric or log, application scene is more general, there is the problem of data island, and the threshold setting of various services involves the influence of various dependent service factors.

[0003] This network complexity improves simultaneously and will inevitably lead to the difficulty of fault handling.The traditional rule-based alarm analysis usually needs to set a certain threshold, and the threshold is changed after time experience accumulation.And once the threshold is set, it remains unchanged during service running, and the alarm generally has the nature of burst, and the threshold item of alarm index is also relatively scattered, and the data quality is good or bad.

[0004] When the monitoring system has large scale, not only the communication gateway such as short message or email is increased in pressure, but also the bombing alarm appears, and the alarm amount of project with complex and large scale business per minute can be up to thousands, so that important alarm information cannot be clearly paid attention to.

[0005] Based on the above situation, the present application provides an adaptive alarm implementation method. SUMMARY

[0006] The present application provides a simple and efficient adaptive alarm implementation method to make up for the defects of the prior art.

[0007] The present application is realized by the following technical solutions:

[0008] An adaptive alarm implementation method, characterized in that it comprises the following steps:

[0009] Step S1, dynamically adjusting threshold

[0010] The fixed-width window is used to extract alarm index, so that the extracted alarm index can be periodically aggregated and analyzed; statistical analysis algorithm is used to analyze and calculate massive data, to obtain threshold interval;

[0011] If the index triggers alarm, the data is re-collected for statistical analysis to obtain new threshold interval, to realize dynamic adjustment of threshold;

[0012] In the step S1, according to the actual requirement of the application scene, the time period is self-defined, the average value and the standard deviation of the index in each time period are calculated, and the threshold interval is set according to the detected data;

[0013] If the index exceeds the alarm threshold, an alarm is triggered.

[0014] When the index triggers an alarm, the data is re-collected, statistical analysis algorithm is used for statistical analysis, and a new threshold interval is obtained to update the threshold.

[0015] Step S2, dynamically adjust the period

[0016] The size of the window is dynamically divided according to the time level and the alarm flow, so as to realize the dynamic extraction and analysis of the alarm event.

[0017] In the step S2, when setting the window size, if the artificial window size can be set according to the setting, the collection and alarm flow setting are considered for dynamic adjustment.

[0018] In the step S2, when setting the window size, if there is no human setting configuration, and there is no configuration change when the period alarm, the period is dynamically adjusted by calculating the alarm flow and the size of the collected data, and the window size and sliding range value are analyzed and created according to the value of the alarm flow and the collection amount.

[0019] Step S3, alarm convergence

[0020] The alarm event information is preprocessed, and whether it is the same type of alarm event is judged by matching the similarity. The same type of alarm event is output by using a unified template.

[0021] In the step S3, the alarm events on the time granularity in the original window period are read first, and the correlation index of the alarm event is divided according to the self-defined index dimension label information. After the pre-analysis processing of the alarm event information with the same label, whether it is the same type of alarm is judged by matching the similarity.

[0022] In the step S3, the correlation index of the alarm event is divided according to the self-defined index dimension label information, the pre-analysis processing of the alarm event information with the same label is carried out, and the alarm form is converted into the fixed data format defined by the user. Then, the matching similarity of the label and the text is calculated and aggregated, if the matching similarity exceeds the self-defined threshold, it is judged that the alarm event is of the same type. The alarm event of the same type is output by using the template conforming to the specific scene.

[0023] An adaptive alarm implementation device, characterized by comprising a memory and a processor; the memory is used for storing a computer program, and the processor is used for implementing the method steps as described above when executing the computer program.

[0024] A readable storage medium, characterized by storing a computer program on the readable storage medium, and the computer program is executed by a processor to implement the method steps as described above.

[0025] The beneficial effects of the present application are that the adaptive alarm implementation method can not only adapt to the service environment in the process of continuous service change, better reflect the change of alarm threshold, but also optimize and improve alarm quality according to different service scale, improve the accuracy of alarm and the efficiency of fault management, and reduce the cost related to alarm. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0027] ATTACHMENT Figure 1 The adaptive alarm implementation method of the present application is shown in the figure. DETAILED DESCRIPTION

[0028] In order to make the technical personnel in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0029] After the occurrence of traditional IT operation and maintenance alarm faults, it is difficult to find the causes of the faults, and the repair cycle time is long. Therefore, it is necessary to reduce the problem coverage range and give early warning. The traditional monitoring can collect the threshold values of different items of the monitored service in real time to monitor data analysis, and realize alarm combined with threshold values. The traditional monitoring alarm is similar to the collection of metric and log, and the subjective factors exist in the decision of artificial threshold setting, and the threshold is set through practical experience and needs to be changed constantly. Whether it is the pressure on the communication gateway or the setting of subjective factors, or the lack of alarm data quality, all of them affect the fault management efficiency of the service to some extent. Under the consideration of the feasibility of abnormal detection, further analysis of the reasonable setting of threshold values can improve the monitoring and alarm efficiency.

[0030] The adaptive alarm implementation method comprises the following steps:

[0031] Step S1, dynamically adjusting the threshold

[0032] In real application scenarios, different dimensions and different indicators of different services are in dynamic change, such as network complexity, service dependency correlation, etc., which will have a certain impact on the setting of the threshold to a certain extent. The dispersion of the dependent data generated by the threshold will lead to meaningless alarms.

[0033] A fixed-width window is used to extract alarm indicators, so that the extracted alarm indicators can be periodically aggregated and analyzed. Statistical analysis algorithms are used to analyze and calculate massive data to obtain a threshold interval.

[0034] If the indicator triggers an alarm, the data is re-collected for statistical analysis to obtain a new threshold interval, thereby achieving dynamic adjustment of the threshold.

[0035] In step S1, according to the actual needs of the application scenario, the time period is customized, the average value and standard deviation of the indicator in each time period are calculated, and the threshold interval is set according to the data detected and collected.

[0036] If the indicator exceeds the alarm threshold, an alarm is triggered.

[0037] When the indicator triggers an alarm, the data is re-collected, statistical analysis algorithms are used for statistical analysis, and a new threshold interval is obtained to update the threshold.

[0038] Step S2, dynamically adjusting the period

[0039] Because different business scales have different alarm quantities in different alarm periods, for an average of dozens per minute and thousands per minute, the period window should also have different changes. The business has a low and high peak period, and the window size period is dynamically divided according to the time level and alarm traffic, thereby realizing dynamic extraction and analysis of alarm events.

[0040] In step S2, when setting the window size, if the human window size can be set according to the setting, the collection and alarm traffic setting are considered to dynamically adjust.

[0041] In step S2, when setting the window size, if there is no human setting configuration, and there is no configuration change during the period alarm, the period is dynamically adjusted by calculating the alarm traffic and the size of the collected data. The window size and sliding range value are analyzed and created according to the alarm traffic value and the collection amount.

[0042] When setting the window size, the original window parameters are used to obtain the size and step length within a reasonable range.

[0043] Step S3, alarm internalization

[0044] The alarm event information is preprocessed, and whether it is the same type of alarm event is judged by matching similarity. The same type of alarm event is output by using a unified template.

[0045] The internalization of the alarm data is to improve the data quality and significance of the alarm, to a certain extent, to reduce the work burden of the fault management personnel, and to improve the attention of the core alarm.

[0046] In step S3, the alarm events in the original window period are read first. Different operation and maintenance monitoring systems send alarm events in different alarm forms, so the correlation index of the alarm event is divided according to the self-defined index dimension label information. After pre-analysis and processing of the alarm event information with the same label, whether it is the same type of alarm is judged by matching similarity.

[0047] In step S3, the correlation index of the alarm event is divided according to the self-defined index dimension label information, and the alarm event information with the same label is pre-analyzed and processed. According to the alarm form, it is converted into a fixed data format defined by the user. Then, the labels and texts are calculated and aggregated by matching similarity. If the matching similarity exceeds the self-defined threshold, it is judged that the alarm event is of the same type. The alarm event of the same type is output by using a template that meets the specific scene.

[0048] In the output of the alarm, the same type of alarm event uses a unified alarm identifier, and the same label dimension is output uniformly.

[0049] The adaptive alarm implementation device includes a memory and a processor. The memory is used to store a computer program, and the processor is used to execute the computer program to realize the method steps described above.

[0050] The readable storage medium has a computer program stored thereon. The computer program is executed by a processor to realize the method steps described above.

[0051] Compared with the prior art, the adaptive alarm implementation method can adapt to the business environment in the process of continuously changing services by dynamically adjusting a reasonable threshold, better reflecting the change of the alarm threshold. By dynamically adjusting the window size, the quality of the alarm is optimized and improved for different business scales. At the same time, it can also avoid errors caused by some subjective settings, improve the accuracy of the alarm, and optimize the alarm information by reasonable aggregation, reduce redundant alarms, improve the efficiency of fault management, and reduce the cost related to the alarm.

[0052] In summary, the adaptive alarm implementation method is more universal and intelligent by analyzing the rationalization of various index thresholds and alarm time dimensions, or similar user-defined dimensions, etc. For example, similar dimension information is merged and sent, so that the alarm with less similarity and high similarity has little meaning, and the quality and accuracy of the alarm are improved.

[0053] The above-described embodiments are only one of the specific embodiments of the present application, and the usual changes and replacements made by those skilled in the art within the scope of the technical solutions of the present application should be included in the protection scope of the present application.

Claims

1. An adaptive alarm implementation method, characterized in that: Includes the following steps: Step S1: Dynamically adjust the threshold Alarm metrics are extracted using a fixed-width window, enabling periodic aggregation and analysis of the extracted metrics; statistical analysis algorithms are used to analyze and calculate massive amounts of data to obtain threshold ranges. If an indicator triggers an alarm, data is re-collected for statistical analysis to determine a new threshold range, thus enabling dynamic adjustment of the threshold. Step S2, Dynamic Adjustment Cycle The window size period is dynamically divided based on time level and alarm traffic to achieve dynamic extraction and analysis of alarm events; When setting the window size, if the size of the window can be set manually according to the settings, it can be dynamically adjusted to take into account the data collection and alarm traffic settings. When setting the window size, if no configuration is set manually and there is no change in the configuration items during periodic alarms, the period is dynamically adjusted by calculating the alarm traffic and the amount of data collected. The window size and sliding range value are created based on the alarm traffic value and the amount of data collected. Step S3, Alarm Concealment Alarm event information is preprocessed, and similarity is matched to determine whether they are alarm events of the same type; alarm events of the same type are output using a unified template.

2. The adaptive alarm implementation method according to claim 1, characterized in that: In step S1, the time period is customized according to the actual needs of the application scenario, the average value and standard deviation of the indicator in each time period are calculated, and the threshold range is set according to the data collected by the detection. If the metric exceeds the alarm threshold, an alarm will be triggered; When an indicator triggers an alarm, data is re-collected, statistical analysis algorithms are used to perform statistical analysis, and new threshold ranges are obtained to update the thresholds.

3. The adaptive alarm implementation method according to claim 1, characterized in that: In step S3, alarm events at the time granularity within the original window period are first read, and the correlation indicators of alarm events are divided according to the custom indicator dimension label information. After pre-analysis processing of alarm event information with the same label, the similarity is matched to determine whether they are alarms of the same type.

4. The adaptive alarm implementation method according to claim 3, characterized in that: In step S3, the correlation indicators of alarm events are divided according to the custom-defined indicator dimension label information. Alarm event information with the same label is pre-analyzed and processed, and converted into a user-defined fixed data format according to the alarm form. Then, the label and text are aggregated by matching similarity. If the matching similarity exceeds the custom threshold, the alarm events are determined to be of the same type. Alarm events of the same type are output using a template that conforms to a specific scenario.

5. An adaptive alarm implementation device, characterized in that: It includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the steps of the method as described in any one of claims 1 to 4.

6. A readable storage medium, characterized in that: The readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 4.

Images