Alarm solving system based on multi-agent technology

Abstract

The invention discloses an alarm solution system based on a multi-agent technology. The alarm solution system comprises an alarm identification agent, a process planning agent and a solution agent, the alarm identification agent performs authenticity judgment on the received alarm events, classifies and ranks the real alarm events, and forwards the classified and ranked real alarm events to the process planning agent; the process planning agent divides the received alarm event into a plurality of sub-tasks according to a root cause analysis task, allocates the sub-tasks to different root cause analysis agents for root cause analysis, and summarizes root cause analysis results; and the solution intelligent agent gives a corresponding alarm solution according to a root cause analysis result. According to the invention, an automatic processing flow from alarm receiving to alarm root cause determination is formed through cooperation of multiple agents, so that the alarm processing efficiency is improved, and the alarm processing accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of information alarm processing, and in particular, relates to an alarm resolution system based on multi-agent technology. Background Art

[0002] In complex information systems, the occurrence of alarm events is often uncertain and diverse. Traditional alarm event identification and resolution methods usually rely on manual experience and a single monitoring tool. Alarm events are often discovered only when they are already serious. The operation and maintenance response time is long, and it may take multiple links of communication and coordination to start processing the alarm time. It is difficult to quickly and accurately identify and resolve various types of faults. In addition, as the scale and complexity of information systems continue to expand, the scope of impact of faults is also increasing. Manual experience can lead to misjudgment and omission of alarm events, thereby reducing the accuracy of alarm event resolution. Summary of the invention

[0003] In response to the problems existing in the prior art, the present invention provides an alarm resolution system based on multi-agent technology, which forms an automated processing flow from receiving alarms to determining the root causes of alarms through multi-agent collaboration, thereby improving not only the efficiency of alarm processing but also the accuracy of alarm processing.

[0004] To achieve the above technical objectives, the present invention adopts the following technical solutions: an alarm resolution system based on multi-agent technology, comprising: an alarm recognition agent, a process planning agent and a solution agent;

[0005] The alarm recognition agent determines the authenticity of the received alarm events, classifies and sorts the real alarm events, and forwards them to the process planning agent;

[0006] The process planning agent divides the received alarm events into multiple subtasks according to the root cause analysis tasks, assigns them to different root cause analysis agents for root cause analysis, and summarizes the results of the root cause analysis;

[0007] The solution agent provides corresponding alarm solutions according to the results of the root cause analysis.

[0008] Furthermore, the alarm recognition agent judges the authenticity of the alarm event based on the business indicators and system indicators. If any one of the business indicators and system indicators is abnormal, it is a real alarm event. The real alarm event is classified according to the severity, and the classified alarm events are sorted in chronological order.

[0009] Furthermore, the process planning agent divides the root cause analysis task into a fault assessment task, a dependency analysis task, a data analysis task and a fault drawing task, assigns the fault assessment task to the fault assessment agent for root cause analysis, assigns the dependency analysis task to the dependency analysis agent for root cause analysis, assigns the data analysis task to the data analysis agent for root cause analysis, and assigns the fault drawing task to the fault drawing agent for root cause analysis.

[0010] Furthermore, the process planning agent weights the analysis results of different root cause analysis agents according to weights, and summarizes the weighted analysis results; the weights are jointly determined by the contribution index and professional index of the root cause analysis agent.

[0011] Furthermore, the specific process of assigning the fault assessment task to the fault assessment agent for root cause analysis is as follows: after the fault assessment agent receives the fault assessment task assigned by the process planning agent, the fault assessment agent queries whether each node in the business is accessible. For inaccessible nodes, the fault assessment agent determines the failure probability of the node based on the location of the node in the business and the number of nodes in the cluster where the node is located; for accessible nodes, the fault assessment agent directly calculates the failure probability of the node: the failure probability of an accessible node = the number of failures ÷ (total running time × total number of nodes).

[0012] Furthermore, the specific process of assigning the dependency analysis task to the dependency analysis agent for root cause analysis is as follows: after the dependency analysis agent receives the alarm dependency analysis task assigned by the process planning agent, the dependency analysis agent uses log recursion to determine the global topology of the business, and according to the position of the alarm event in the global topology of the business, finds the upstream and downstream of the alarm event in the global topology, determines the path of the alarm event, and marks the affected nodes.

[0013] Furthermore, the specific process of assigning the data analysis task to the data analysis agent for root cause analysis is as follows: after the data analysis agent receives the data analysis task assigned by the process planning agent, the data analysis agent collects data from the node where the alarm event occurs, including: average delay, traffic, error rate, resource saturation and number of concurrent users, and uses the collected data to analyze the cause of the alarm event.

[0014] Furthermore, the specific process of assigning the fault drawing task to the fault drawing agent for root cause analysis is as follows: after the fault drawing agent receives the fault drawing task assigned by the process planning agent, it visualizes the path of the alarm event determined by the dependency analysis agent and the failure probability of each node on the corresponding path determined by the fault assessment agent.

[0015] Furthermore, the solution agent provides corresponding alarm solutions based on the results of the root cause analysis and with reference to successful cases of solving historical alarm events with the same root cause analysis.

[0016] Compared with the prior art, the present invention has the following beneficial effects: the alarm resolution system based on multi-agent technology of the present invention utilizes an alarm recognition agent to monitor alarm events, and classifies and sorts real alarm events, and forwards them to a process planning agent for root cause analysis. The solution agent gives a corresponding alarm solution based on the result of the root cause analysis. Therefore, as long as an alarm event occurs, the response operation of the alarm resolution system of the present invention can be immediately triggered, so that the alarm resolution system can quickly identify alarm events and give alarm event solutions, greatly improving the efficiency of alarm event processing; in addition, the process planning agent is divided into multiple subtasks according to the root cause analysis task, and the alarm events are assigned to different root cause analysis agents for root cause analysis. The agent uses big data analysis and machine learning technology to perform root cause analysis of alarm events in different dimensions, accurately diagnose the causes of the alarm events, and thus improve the accuracy of alarm event processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a structural diagram of the alarm resolution system based on multi-agent technology of the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is further explained below in conjunction with the accompanying drawings.

[0019] like Figure 1This is a structural diagram of the alarm resolution system based on multi-agent technology of the present invention, which includes: an alarm recognition agent, a process planning agent and a solution agent; the alarm recognition agent judges the authenticity of the received alarm events, classifies and sorts the real alarm events, and forwards them to the process planning agent; the process planning agent divides the received alarm events into multiple subtasks according to the root cause analysis tasks, assigns them to different root cause analysis agents for root cause analysis, and summarizes the results of the root cause analysis; the solution agent gives corresponding alarm solutions according to the results of the root cause analysis. Therefore, as long as an alarm event occurs, the response operation of the alarm resolution system of the present invention can be immediately triggered, so that the alarm resolution system can quickly identify the alarm event and provide an alarm event solution, greatly improving the efficiency of alarm event processing; at the same time, the intelligent agent in the present invention has certain scalability and flexibility, and more intelligent agents can be added or the functions of the intelligent agent can be adjusted according to actual needs to adapt to the ever-changing technical and business needs. Moreover, the intelligent agent uses big data analysis and machine learning technology to perform root cause analysis of alarm events in different dimensions, accurately diagnose the causes of alarm events, thereby improving the accuracy of alarm event processing.

[0020] In the present invention, the alarm recognition agent judges the authenticity of the alarm event based on the business indicators and system indicators. Specifically, the business indicators include: business success rate, year-on-year analysis of business data and month-on-month analysis of business data. The system indicators include: stack overflow indicators, middleware health indicators, and instance health indicators. If any one of the business indicators and system indicators is abnormal, it is a real alarm event. The real alarm event is classified according to the severity. Specifically, the severity of the real alarm event is divided into three levels: low, medium, and high. The highest level of severity in the business indicators and system indicators of the alarm event is used as the severity of the alarm event, and the classified alarm events are sorted in chronological order. In the present invention, the alarm recognition agent can work uninterruptedly around the clock and more accurately identify real alarm events to reduce false alarms and missed alarms, and ensure the stability and reliability of business operations.

[0021] The process planning agent in the present invention divides the root cause analysis task into a fault assessment task, a dependency analysis task, a data analysis task and a fault drawing task, and assigns the fault assessment task to the fault assessment agent for root cause analysis, which is used to assess the fault probability of the business passing through each node; assigns the dependency analysis task to the dependency analysis agent for root cause analysis, which is used to analyze the dependency relationship analysis of the internal nodes in the business system architecture; assigns the data analysis task to the data analysis agent for root cause analysis, which is used to further analyze the information in the alarm event; assigns the fault drawing task to the fault drawing agent for root cause analysis, and visualizes the nodes in the business according to the assessed fault probability. The process planning agent in the present invention can perform root cause analysis of alarm events in different dimensions, so that the result of the root cause analysis is more accurate.

[0022] The process planning agent weights the analysis results of different root cause analysis agents according to the weights, and summarizes the weighted analysis results; the weights are jointly determined by the contribution index and professional index of the root cause analysis agent. The task completion is the main indicator of the contribution index, including: whether the root cause analysis agent completes the assigned tasks on time and with high quality. For example, the more data dimensions the data analysis agent analyzes based on the actual situation of the business data, and the higher the accuracy, the greater the contribution of the data analysis agent in task completion; knowledge reserve is the main indicator of the professional index, which includes: the degree of mastery of relevant theories, concepts, technologies and methods. For example, the professional index of the data analysis agent may depend on its familiarity with data cleaning, processing, association, mapping and analysis solutions; the contribution index reflects the root cause analysis agent's level of activity in making suggestions and the root cause analysis agent, and the professional index is determined by the root cause analysis agent's professional contribution and action quality in a specific field. The weight is jointly determined by the contribution index and professional index of the root cause analysis agent, so that the process planning agent enhances the fairness and accuracy of the root cause analysis of alarm events.

[0023] The specific process of assigning the fault assessment task to the fault assessment agent for root cause analysis is as follows: After the fault assessment agent receives the fault assessment task assigned by the process planning agent, the fault assessment agent queries whether each node in the business is accessible. For inaccessible nodes, the fault assessment agent determines the node's failure probability based on the node's location in the business and the number of nodes in the node's cluster. For an inaccessible node, the probability of its alarm is higher than that of an accessible node; for accessible nodes, the fault assessment agent directly calculates the node's failure probability: the failure probability of an accessible node = the number of failures ÷ (total running time × total number of nodes). By evaluating the failure probability of each node in the business through the fault assessment agent, the problem point can be discovered in a timely manner, and the root cause of the failure can be more accurately identified based on the interaction and influence between the problem point and its surrounding nodes.

[0024] The specific process of assigning dependency analysis tasks to dependency analysis agents for root cause analysis is as follows: After the dependency analysis agent receives the alarm dependency analysis task assigned by the process planning agent, the dependency analysis agent uses log recursion to determine the global topology of the business, and according to the location of the alarm event in the global topology of the business, finds the upstream and downstream of the alarm event in the global topology, determines the path of the alarm event, and marks the affected nodes. By performing dependency analysis through the dependency analysis agent, the root cause of the problem can be quickly located. By analyzing the dependency relationship in the global topology where the alarm event is located, the root cause of the alarm event can be determined more quickly. When the location of the alarm event in the global topology of the business is found, dependency analysis can help determine which related paths may be affected, thereby narrowing the scope of the alarm event investigation.

[0025] The specific process of assigning data analysis tasks to data analysis agents for root cause analysis is as follows: after the data analysis agent receives the data analysis tasks assigned by the process planning agent, the data analysis agent collects data from the nodes where the alarm events occur, including: average delay, traffic, error rate, resource saturation, and number of concurrent users, and uses the collected data to analyze the causes of the alarm events. Specifically, if the average delay is too high, it may be caused by network problems, server overload, slow database response, or bottlenecks in the application code, leading to business congestion; traffic anomalies may be caused by network attacks, improper configuration, etc. When, network failure, etc.; an error rate that is too high may be caused by hardware failure, software defects, network instability or configuration errors; excessive resource saturation may be caused by a high number of concurrent users, inefficient code or improperly configured resource allocation strategies; a high number of concurrent users may lead to server overload, database bottlenecks, network congestion or lock contention problems in the application code. Data analysis based on data analysis agents can improve the accuracy of alarm event positioning. By analyzing the alarm data, the root cause and scope of the alarm can be determined more accurately, avoiding blind investigation when solving alarm events and improving the resolution efficiency.

[0026] The specific process of assigning the fault drawing task to the fault drawing agent for root cause analysis is as follows: after the fault drawing agent receives the fault drawing task assigned by the process planning agent, it visualizes the path of the alarm event determined by the dependency analysis agent and the fault probability of each node on the corresponding path determined by the fault assessment agent.

[0027] The solution agent in the present invention provides corresponding alarm solutions based on the results of the root cause analysis and the successful cases of solving historical alarm events with the same root cause analysis, such as restarting the service, rolling back the most recent code deployment, or adjusting the configuration settings, so as to restore the normal operation of the service as soon as possible. Therefore, the solution agent in the present invention needs to have strong problem-solving ability and rich experience, and be able to formulate effective solutions according to actual conditions.

[0028] The alarm resolution system based on multi-agent technology of the present invention provides a new alarm event identification and solution, which can quickly restore business and maintain the continuous service capability of the alarm resolution system.

[0029] The method for solving alarms by using the alarm solving system based on multi-agent technology of the present invention specifically comprises the following steps:

[0030] Step S1, the alarm recognition agent is responsible for receiving and processing alarm events generated due to access function blockage or in the business system. In this process, the alarm recognition agent needs to process a large number of alarm events, which may come from different parts of the business system and involve various types of faults. Therefore, the alarm recognition agent is introduced in the present invention to conduct a preliminary analysis of these alarm events based on business indicators and system indicators, determine which alarm events are real and which may be false alarms, and then classify the real alarm events according to the severity, sort them in time sequence, and determine their processing order. This process requires the alarm recognition agent to have a high degree of intelligence and judgment, and be able to quickly and accurately process a large amount of information;

[0031] Step S2: After determining the processing order of the alarm events, the alarm identification agent will forward the most urgent and most widely-affected alarm events to the process planning agent for multi-dimensional root cause analysis. The process planning agent is the core of the entire alarm resolution system. It is responsible for coordinating multiple root cause analysis agents to perform root cause analysis work in different dimensions, and finally summarizes the results of the root cause analysis. Specifically, the process planning agent divides the root cause analysis task into multiple subtasks and assigns these subtasks to the corresponding root cause analysis agents. This process requires the process planning agent to have strong coordination and decision-making capabilities, and to be able to reasonably allocate tasks based on the actual situation of the alarm resolution system and the analysis capabilities of the root cause analysis agent;

[0032] Step S3: Under the coordination of the process planning agent, the data analysis agent is responsible for collecting data from the nodes where the alarm event occurs, including: average delay, traffic, error rate, resource saturation and number of concurrent users, and using the collected data to further analyze the cause of the alarm event. Therefore, the data analysis agent needs to have strong data processing and analysis capabilities, be able to extract valuable information from a large amount of data, and use the extracted information to further analyze the alarm event;

[0033] Step S4: The process planning agent sends a dependency request including the alarm node information and the alarm time to the dependency analysis agent. The dependency analysis agent uses log recursion to determine the global topology of the service, accurately determine the direct and indirect dependent nodes of the alarm node, determine the fault path, and mark the affected nodes.

[0034] Step S5: When the process planning agent sends a fault assessment request to the fault assessment agent, the fault assessment agent queries whether each node in the service is accessible. For inaccessible nodes, the fault assessment agent determines the failure probability of the node based on the location of the node in the service and the number of nodes in the cluster where the node is located; for accessible nodes, the fault assessment agent directly calculates the failure probability of the node: the failure probability of an accessible node = the number of failures / (total running time × total number of nodes);

[0035] Step S6: After the fault mapping agent receives the fault mapping task assigned by the process planning agent, the fault mapping agent receives the fault probability information from the fault assessment agent and the alarm event path determined by the dependency analysis agent, and visualizes the path of the alarm event determined by the dependency analysis agent and the fault probability of each node on the corresponding path determined by the fault assessment agent;

[0036] Step S7: The process planning agent weights the analysis results of different root cause analysis agents according to the weights jointly determined by the contribution index and the professional index of the root cause analysis agent, and summarizes the weighted analysis results;

[0037] Step S8: The solution agent provides corresponding alarm solutions based on the results of the root cause analysis and with reference to successful cases of solving historical alarm events with the same root cause analysis, so as to restore business operations as soon as possible.

[0038] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. An alarm resolution system based on multi-agent technology, characterized in that: include: Alarm identification agent, process planning agent and solution agent; The alarm recognition agent determines the authenticity of the received alarm events, classifies and sorts the real alarm events, and forwards them to the process planning agent; The process planning agent divides the received alarm events into multiple subtasks according to the root cause analysis tasks, assigns them to different root cause analysis agents for root cause analysis, and summarizes the results of the root cause analysis; The solution agent provides corresponding alarm solutions according to the results of the root cause analysis.

2. The alarm resolution system based on multi-agent technology according to claim 1, characterized in that: The alarm recognition agent determines the authenticity of the alarm event based on the business indicators and system indicators. If any of the business indicators and system indicators is abnormal, it is a real alarm event. The real alarm event is classified according to the severity and the classified alarm events are sorted in chronological order.

3. The alarm resolution system based on multi-agent technology according to claim 1 is characterized in that: The process planning agent divides the root cause analysis task into a fault assessment task, a dependency analysis task, a data analysis task and a fault drawing task, assigns the fault assessment task to the fault assessment agent for root cause analysis, assigns the dependency analysis task to the dependency analysis agent for root cause analysis, assigns the data analysis task to the data analysis agent for root cause analysis, and assigns the fault drawing task to the fault drawing agent for root cause analysis.

4. The multi-agent technology-based alarm resolution system according to claim 3, characterized in that: The process planning agent weights the analysis results of different root cause analysis agents according to the weights, and summarizes the weighted analysis results; The weight is determined by the contribution index and the professional index of the root cause analysis agent.

5. The multi-agent technology-based alarm resolution system according to claim 3, characterized in that: The specific process of assigning the fault assessment task to the fault assessment agent for root cause analysis is as follows: after the fault assessment agent receives the fault assessment task assigned by the process planning agent, the fault assessment agent queries whether each node in the business is accessible. For inaccessible nodes, the fault assessment agent determines the failure probability of the node based on the location of the node in the business and the number of nodes in the cluster where the node is located; for accessible nodes, the fault assessment agent directly calculates the failure probability of the node: the failure probability of an accessible node = the number of failures ÷ (total running time × total number of nodes).

6. The multi-agent technology-based alarm resolution system according to claim 5, characterized in that: The specific process of assigning the dependency analysis task to the dependency analysis agent for root cause analysis is as follows: after the dependency analysis agent receives the alarm dependency analysis task assigned by the process planning agent, the dependency analysis agent uses log recursion to determine the global topology of the business, and according to the position of the alarm event in the global topology of the business, finds the upstream and downstream of the alarm event in the global topology, determines the path of the alarm event, and marks the affected nodes.

7. The multi-agent technology-based alarm resolution system according to claim 6, characterized in that: The specific process of assigning data analysis tasks to data analysis agents for root cause analysis is as follows: after the data analysis agent receives the data analysis tasks assigned by the process planning agent, the data analysis agent collects data from the nodes where the alarm events occur, including: average delay, traffic, error rate, resource saturation and number of concurrent users, and uses the collected data to analyze the causes of the alarm events.

8. The multi-agent technology-based alarm resolution system according to claim 7, characterized in that: The specific process of assigning the fault drawing task to the fault drawing agent for root cause analysis is as follows: after the fault drawing agent receives the fault drawing task assigned by the process planning agent, it visualizes the path of the alarm event determined by the dependency analysis agent and the fault probability of each node on the corresponding path determined by the fault assessment agent.

9. The multi-agent technology-based alarm resolution system according to claim 3, characterized in that: The solution agent provides corresponding alarm solutions based on the results of the root cause analysis and with reference to successful cases of solving historical alarm events with the same root cause analysis.

Images