Alarm index processing method and device, electronic equipment and storage medium

Abstract

The invention provides an alarm index processing method and device, electronic equipment and a storage medium, and the method comprises the steps: responding to a monitored alarm index, and determining alarm time and an alarm service node; determining an associated service node of the alarm service node at the alarm time; determining a monitoring index of the associated service node and a monitoring index value of the monitoring index at the alarm time; selecting monitoring indexes corresponding to the abnormal monitoring index values to form a target candidate root cause index set; constructing a first causal relationship between the alarm index and the target candidate root cause index set, and executing a random walk algorithm according to the first causal relationship to obtain a root cause service node; and constructing a second causal relationship between the alarm index and the abnormal monitoring index corresponding to the root cause service node, and executing a random walk algorithm according to the second causal relationship to obtain a root cause monitoring index corresponding to the root cause service node. According to the method, the accuracy and the efficiency of processing the alarm indexes of the service nodes in the micro-service architecture can be ensured.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, relates to data processing technology, and in particular to an alarm indicator processing method, device, electronic device and storage medium. Background Art

[0002] Currently, microservice architecture is widely used in various scenarios. Microservice architecture splits applications into multiple core functions and deploys service nodes for each core function. Service nodes can communicate through interfaces to jointly complete business functions. During the operation of microservice architecture, each service node will report the monitoring indicator values ​​corresponding to many monitoring indicators. By analyzing the monitoring indicator values ​​of the alarm, the cause and location of the failure of the microservice architecture can be determined.

[0003] However, in the related art, it is often necessary to combine historical alarm data for fault analysis, which not only affects the efficiency of fault location, but also affects the accuracy of fault analysis when historical alarm data is insufficient. Summary of the invention

[0004] The embodiments of the present application provide an alarm indicator processing method, device, electronic device and storage medium to solve the problems of accuracy and low efficiency in fault analysis of a microservice architecture.

[0005] The first aspect of an embodiment of the present application provides an alarm indicator processing method, the method comprising: responding to the monitored alarm indicator, determining the alarm time and alarm service node corresponding to the alarm indicator; determining the associated service node corresponding to the alarm service node at the alarm time; determining the monitoring indicator corresponding to the associated service node and obtaining the monitoring indicator value corresponding to the monitoring indicator at the alarm time; selecting the monitoring indicator corresponding to the abnormal monitoring indicator value to form a target candidate root cause indicator set; constructing a first causal relationship between the alarm indicator and the target candidate root cause indicator set, and executing a random walk algorithm according to the first causal relationship to obtain a root cause service node; constructing a second causal relationship between the alarm indicator and the abnormal monitoring indicator corresponding to the root cause service node, and executing the random walk algorithm according to the second causal relationship to obtain the root cause monitoring indicator corresponding to the root cause service node.

[0006] Furthermore, in the above method provided in the embodiment of the present application, the determining of the alarm time and alarm service node corresponding to the alarm indicator includes: obtaining the alarm log corresponding to the alarm indicator; locating the preset time keyword in the alarm log; obtaining the alarm time corresponding to the alarm indicator according to the preset index relationship between the preset time keyword and the alarm time; obtaining the mapping relationship between the preset indicator and the service node; traversing the mapping relationship to determine the alarm service node corresponding to the alarm indicator.

[0007] Furthermore, in the above method provided in an embodiment of the present application, determining the associated service node corresponding to the alarm service node at the alarm time includes: determining the service call relationship graph corresponding to the alarm service node at the alarm time; parsing the service call relationship graph to obtain the upstream service node and the downstream service node corresponding to the alarm service node; and combining the upstream service node and the downstream service node to obtain the associated service node.

[0008] Furthermore, in the above method provided in the embodiment of the present application, determining the monitoring indicator corresponding to the associated service node and obtaining the monitoring indicator value corresponding to the monitoring indicator at the alarm time include: traversing the mapping relationship to obtain the monitoring indicator corresponding to the associated service node; obtaining multiple monitoring data points of the monitoring indicator within a preset time period, each of the monitoring data point including a timestamp and a monitoring indicator value; selecting a target monitoring data point whose timestamp is the alarm time; and determining that the monitoring indicator value corresponding to the target monitoring data point is the monitoring indicator value corresponding to the monitoring indicator at the alarm time.

[0009] Furthermore, in the above method provided in the embodiment of the present application, the monitoring indicators corresponding to the selected abnormal monitoring indicator values ​​constitute a target candidate root cause indicator set, including: determining the monitoring indicator value corresponding to each of the monitoring data points of the monitoring indicator to obtain a monitoring indicator value set; analyzing the monitoring indicator value set in a preset manner to assign each of the monitoring indicator values ​​to a preset numerical range; selecting the preset numerical range with the largest number of assigned monitoring indicator values ​​as the target numerical range; calculating the mean and variance of the monitoring indicator values ​​corresponding to the target numerical range, and determining a normal numerical range based on the mean and variance; when the monitoring indicator value is not in the normal numerical range, determining that the monitoring indicator value is abnormal, and determining the monitoring indicator with the abnormal monitoring indicator value as an initial candidate root cause indicator; combining multiple initial candidate root cause indicators to obtain an initial candidate root cause indicator set; preprocessing the initial candidate root cause indicator set to obtain a target candidate root cause indicator set.

[0010] Furthermore, in the above method provided in the embodiment of the present application, the preprocessing of the initial candidate root cause indicator set to obtain the target candidate root cause indicator set includes: traversing a preset filtering rule library according to the initial candidate root cause indicator set to obtain the correlation between the alarm indicator and the initial candidate root cause indicator, wherein the correlation includes correlation and irrelevance; deleting irrelevant initial candidate root cause indicators from the initial candidate root cause indicator set to obtain the target candidate root cause indicator set.

[0011] Furthermore, in the above method provided in an embodiment of the present application, the construction of the first causal relationship graph corresponding to the alarm indicator and the target candidate root cause indicator set includes: combining the alarm indicator and the target candidate root cause indicator set to obtain a first indicator set to be analyzed; constructing a first causal relationship graph based on the first indicator set to be analyzed, the indicators to be analyzed in the first indicator set to be analyzed are used to form nodes of the first causal relationship graph, and the causal relationship between the indicators to be analyzed is used to form lines between corresponding nodes, and the lines point from the cause node to the result node.

[0012] Furthermore, in the above method provided in the embodiment of the present application, the random walk algorithm is executed according to the first causal relationship graph to obtain the root cause service node, including: based on the first causal relationship graph, the random walk algorithm is executed with the node corresponding to the alarm indicator as the starting point; the number of visits corresponding to each node in the first causal relationship graph is determined; the number of visits is sorted in descending order, and the indicators to be analyzed corresponding to a preset number of nodes are selected; the mapping relationship between the monitoring indicators and the service nodes is traversed to obtain the root cause service node corresponding to the determined indicator to be analyzed.

[0013] The second aspect of the embodiment of the present application also provides an alarm indicator processing device, which includes: an alarm indicator monitoring module, which is used to respond to the monitored alarm indicators and determine the alarm time and alarm service node corresponding to the alarm indicator; an associated node determination module, which is used to determine the associated service node corresponding to the alarm service node at the alarm time; a monitoring indicator determination module, which is used to determine the monitoring indicator corresponding to the associated service node and obtain the monitoring indicator value corresponding to the monitoring indicator at the alarm time; an abnormal indicator selection module, which is used to select monitoring indicators corresponding to abnormal monitoring indicator values ​​to form a target candidate root cause indicator set; a root cause node determination module, which is used to construct a first causal relationship between the alarm indicator and the target candidate root cause indicator set, and execute a random walk algorithm based on the first causal relationship to obtain a root cause service node; a root cause indicator determination module, which is used to construct a second causal relationship between the alarm indicator and the abnormal monitoring indicator corresponding to the root cause service node, and execute the random walk algorithm based on the second causal relationship to obtain the root cause monitoring indicator corresponding to the root cause service node.

[0014] A third aspect of an embodiment of the present application further provides an electronic device, comprising a controller and a memory, wherein the controller is configured to implement the alarm indicator processing method as described in any one of the above when executing a computer program stored in the memory.

[0015] A fourth aspect of the embodiments of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a controller, the above-mentioned alarm indicator processing method is implemented.

[0016] The above-mentioned alarm indicator processing method provided by the embodiment of the present application determines the associated service node of the alarm service node corresponding to the alarm indicator at the alarm time, and then obtains the monitoring indicator of the abnormal monitoring indicator value corresponding to the associated service node at the alarm time to form a target candidate root cause indicator set; then constructs a first causal relationship graph corresponding to the alarm indicator and the target candidate root cause indicator set, and executes a random walk algorithm on the first causal relationship graph to obtain the root cause service node; finally, constructs a second causal relationship graph corresponding to the abnormal monitoring indicator corresponding to the alarm indicator and the root cause service node, and executes a random walk algorithm on the second causal relationship graph to obtain the root cause monitoring indicator, thereby completing the fault analysis of the microservice architecture. When performing fault analysis on the microservice architecture, the embodiment of the present application does not need to perform correlation analysis on the historical alarm data, which can improve the efficiency and accuracy of fault analysis; and the embodiment of the present application can more quickly determine the cause of the alarm by performing fault analysis on the alarm indicators one by one, further improving the efficiency of fault analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is an application scenario diagram of an alarm indicator processing method provided in an embodiment of the present application.

[0018] Figure 2 It is a flowchart of an alarm indicator processing method provided in an embodiment of the present application.

[0019] Figure 3 This is the first cause-and-effect relationship diagram provided in the embodiment of the present application.

[0020] Figure 4 This is a flow chart for determining alarm information provided by an embodiment of the present application.

[0021] Figure 5 This is a flowchart for determining an associated service node provided in an embodiment of the present application.

[0022] Figure 6 It is a schematic diagram of the service call relationship provided in the embodiment of the present application.

[0023] Figure 7 It is a flow chart for determining the monitoring indicator value provided in the embodiment of the present application.

[0024] Figure 8 This is a flow chart for determining a candidate root cause indicator set provided in an embodiment of the present application.

[0025] Fig. 9 It is a flowchart of the preprocessing provided in the embodiment of the present application.

[0026] Fig.10 It is a determination flow chart of the first causal relationship diagram provided in an embodiment of the present application.

[0027] Fig.11 This is a flow chart for determining a root cause service node provided in an embodiment of the present application.

[0028] Fig.12 It is a structural diagram of the alarm indicator processing device provided in an embodiment of the present application.

[0029] Fig.13 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] It should be noted that the terms "first" and "second" in the specification, claims and drawings of the present application are used to distinguish similar objects rather than to describe a specific order or sequence.

[0031] It should also be noted that the method disclosed in the embodiments of the present application or the method shown in the flowchart includes one or more steps for implementing the method. Without departing from the scope of the claims, the execution order of multiple steps can be interchangeable with each other, and some of the steps can also be deleted.

[0032] Some embodiments will be described below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments may be combined with each other.

[0033] In order to solve the problems of network integration, system integration, business integration within the enterprise and network integration, system integration, business integration between enterprises, the system architecture model of the enterprise is gradually transformed from the traditional monolithic architecture to the microservice architecture. The main function of the microservice architecture is to disperse the different business functions of the application into discrete service nodes. Each service node can be deployed independently, and each service node only needs to focus on its own business, thereby reducing the coupling of the system.

[0034] Combination Figure 1 The application scenario of the embodiment of the present application is described by taking an application including three business functions: product service, order service, and user service as an example. Figure 1 As shown in the figure, product service, order service and user service are deployed separately as service nodes, namely product service node, order service node and user service node. Product service node, order service node and user service node are separated from each other, and the data resources of each service node are stored in their own database (Database, DB), which can call each other through communication methods such as HTTP protocol to provide services to the outside.

[0035] During the operation of the microservice architecture, each service node sets multiple monitoring indicators, and each monitoring indicator will report the corresponding monitoring indicator value. When a physical device or logic module that provides or executes a service has an abnormality, an alarm log for transmitting fault information will be issued. The alarm log may include alarms issued by service nodes that actually have a fault (also called: root alarms) and alarms issued because other related service nodes cannot work normally due to the occurrence of root alarms (also called: derivative alarms). In one embodiment, please refer to Figure 1 , each service node is connected to the electronic device for communication, and the service node can upload the alarm log to the electronic device, which can distinguish the root alarm from the derivative alarm, and then quickly and accurately determine the nature and location of the fault based on the root alarm, so as to quickly troubleshoot the fault. In other embodiments, the electronic device can also be any service node in the microservice architecture, and the service node can distinguish the root alarm from the derivative alarm based on the alarm log, and then quickly and accurately determine the nature and location of the fault based on the root alarm, so as to quickly troubleshoot the fault.

[0036] However, in the related technology, before performing fault analysis on the microservice architecture, it is necessary to first perform relevant analysis on the historical alarm data, and then implement fault analysis based on the analysis results of the historical alarm data, resulting in low efficiency of fault analysis; and the accuracy of fault analysis is affected by the amount of historical alarm data. When the amount of historical alarm data is too small, the accuracy of fault analysis cannot be guaranteed.

[0037] Based on the above problems, an embodiment of the present application provides an alarm indicator processing method. When performing fault analysis of a microservice architecture, there is no need to perform relevant analysis on historical alarm data, thereby improving the efficiency and accuracy of fault analysis.

[0038] Figure 2 1 is a flow chart of an alarm indicator processing method provided in an embodiment of the present application, and the alarm indicator processing method is applied to electronic equipment. Figure 2 As shown, the alarm indicator processing method may include the following steps S11-S16. According to different requirements, the order of the steps in the flowchart can be changed, and some can be omitted.

[0039] S11, responding to the monitored alarm indicator, determining the alarm time and alarm service node corresponding to the alarm indicator.

[0040] In some embodiments, the microservice architecture includes multiple service nodes, and each service node is provided with multiple monitoring indicators. The monitoring indicator can be an indicator that identifies the response time of the service node, for example, interface response time, http response code and other indicators; the monitoring indicator can also be an indicator that identifies the load of the service node, for example, interface traffic indicators, node own resource monitoring indicators, etc. The monitoring indicators between different service nodes can be the same or different, and are not limited here. During the operation of the microservice architecture, each monitoring indicator will generate a corresponding monitoring indicator value. Each monitoring indicator value has a corresponding abnormal determination method, and it can be determined whether the monitoring indicator value is abnormal according to the abnormal determination method. In one embodiment, the abnormal determination method may include a method of setting a threshold, for example, setting a normal value interval, when the monitoring indicator value exceeds the normal value interval, it is determined that the monitoring indicator value is abnormal; when the monitoring indicator value is in the normal value interval, it is determined that the monitoring indicator value is normal. In other embodiments, the abnormal determination method may also include a method of data statistical analysis, for example, statistical analysis of the historical normal monitoring indicator value of the monitoring indicator is performed to obtain the distribution trend of the corresponding monitoring indicator value of the monitoring indicator. When the monitoring indicator value deviates from the distribution pattern, it is determined that the monitoring indicator value is abnormal; when the monitoring indicator value is within the distribution pattern, it is determined that the monitoring indicator value is normal. According to the abnormal monitoring indicator value, the corresponding abnormal monitoring indicator is determined, and a monitoring indicator is selected from the abnormal monitoring indicators as the alarm indicator for fault analysis. The alarm time refers to the time when the alarm is issued after the abnormal monitoring indicator value is detected, and the alarm service node refers to the only service node in the microservice architecture corresponding to the alarm indicator.

[0041] At the same time, the number of abnormal monitoring indicators monitored can be one or more. In one embodiment of the present application, when the number of abnormal monitoring indicators monitored at the same time is one, it is determined that the alarm is an alarm issued by a service node with a fault, which can also be called a root cause alarm. The abnormal monitoring indicator is used as an alarm indicator and determined as a root cause monitoring indicator. The alarm service node corresponding to the alarm indicator is the root cause service node. After that, the operation and maintenance personnel or the troubleshooting personnel can perform fault processing on the microservice architecture according to the root cause monitoring indicator and the root cause service node. In another embodiment of the present application, when the number of abnormal monitoring indicators monitored at the same time is multiple, it indicates that the monitored alarm may be a root cause alarm, or it may be a derivative alarm issued due to the appearance of the root cause alarm that causes other related service nodes to fail to work normally. In the face of the above different situations, it is necessary to perform fault analysis on the microservice architecture to determine the root cause monitoring indicator and the root cause service node that are closest to the alarm indicator.

[0042] The embodiment of the present application is explained by taking the number of abnormal monitoring indicators monitored at the same time as multiple as an example, selecting one of the monitoring indicators from the multiple abnormal monitoring indicators as an alarm indicator, and performing fault analysis based on the alarm indicator. Among them, the selection method can be random selection, or sequential selection, and can also be selected according to preset selection conditions (for example, pre-determining the importance of the monitoring indicators in the microservice architecture, and selecting one of the monitoring indicators from the multiple abnormal monitoring indicators in descending order of importance as the alarm indicator; for example, pre-setting a key monitoring indicator, when the key monitoring indicator is included in multiple abnormal monitoring indicators, the key monitoring indicator is preferentially selected as the alarm indicator, and the remaining abnormal monitoring indicators can be selected in a random or sequential manner), and the embodiment of the present application does not limit this.

[0043] S12: Determine an associated service node corresponding to the alarm service node at the alarm time.

[0044] In some embodiments, the associated service node includes a service node that has a calling relationship with the alarm service node at the alarm time, and the number of associated service nodes can be one or more, which is not limited here. The calling relationship can include the alarm service node calling other service nodes, or other service nodes calling the alarm service node. If the alarm service node calls other service nodes, the other service nodes can be regarded as upstream service nodes of the alarm service node; if other service nodes call the alarm service node, the other service nodes can be regarded as downstream service nodes of the alarm service node, and the upstream service node and the downstream service node constitute an associated service node.

[0045] S13, determining the monitoring indicator corresponding to the associated service node and obtaining the monitoring indicator value corresponding to the monitoring indicator at the alarm time.

[0046] In some embodiments, for each associated service node, there are several monitoring indicators, and each monitoring indicator has a corresponding monitoring indicator value. When the microservice architecture is monitored, the monitoring indicator value of each monitoring indicator is collected at a preset time interval, and the monitoring indicator value and the collected timestamp are combined into a monitoring data point according to a preset data format, wherein the preset time interval can be 1 second, 5 seconds or 1 minute, which is not limited here. The preset data format can be in the format of (timestamp, monitoring indicator value). A monitoring data point with a timestamp of the alarm time is selected from the multiple monitoring data points corresponding to the monitoring indicator, and the monitoring indicator value corresponding to the monitoring data point is used as the monitoring indicator value corresponding to the monitoring indicator at the alarm time.

[0047] S14, selecting monitoring indicators corresponding to abnormal monitoring indicator values ​​to form a target candidate root cause indicator set.

[0048] In some embodiments, a normal value interval can be set for each monitoring indicator. When the monitoring indicator value is within the normal value interval, the monitoring indicator value is determined to be normal; when the monitoring indicator value is not within the normal value interval, the monitoring indicator value is determined to be abnormal. At the alarm time, the monitoring indicator corresponding to the abnormal monitoring value (hereinafter referred to as "abnormal monitoring indicator") may be the root cause monitoring indicator. In this embodiment, a target candidate root cause indicator set is formed based on the abnormal monitoring indicator.

[0049] S15, constructing a first causal relationship between the alarm indicator and the target candidate root cause indicator set, and executing a random walk algorithm according to the first causal relationship to obtain a root cause service node.

[0050] In some embodiments, the alarm indicator and the target candidate root cause indicator set are combined into a first indicator set to be analyzed, and a first causal relationship is constructed for the first indicator set to be analyzed. The nodes in the first causal relationship include the indicators to be analyzed in the first indicator set to be analyzed. For example, the indicators to be analyzed include the alarm indicator and the abnormal monitoring indicators in the target candidate root cause indicator set. In one embodiment, the first causal relationship can be presented through a first causal relationship graph, combined with Figure 3 The first causal relationship diagram provided in the embodiment of the present application is described. In the figure, only five nodes are included in the first causal relationship diagram as an example, which are nodes corresponding to alarm indicators ( Figure 3 The lines between the nodes in the first causal relationship graph indicate the causal relationship between the indicators to be analyzed, and the lines point from the cause nodes to the result nodes. The cause node can be a node that has a direct impact on an indicator, that is, the parent node of the indicator; the result node can be a node that is directly affected by an indicator, that is, the child node of the indicator. In one embodiment, the first causal relationship graph can be constructed by the PC (Peter-Clark) algorithm, wherein the PC algorithm is an algorithm for constructing a causal relationship graph, which can automatically infer the causal relationship between the indicators to be analyzed from the first set of indicators to be analyzed based on probability models and graph theory principles.

[0051] In other embodiments, the first causal relationship can also be presented through a first causal relationship tree, wherein the root node is used to identify the cause node and the child node is used to identify the result node. Exemplarily, the root node is used as the starting point, and all direct or indirect results are connected to the root node as child nodes, and then each child node is used as the starting point, and the above steps are repeated to obtain a causal relationship tree. In another embodiment, the first causal relationship can also be presented through a first causal relationship table. Exemplarily, a table is created, and the column headings of the table are "Cause" and "Result" respectively; the cause node is entered under the "Cause" column, and the result node related to each cause node is entered under the "Result" column; each cause node is connected to its corresponding result node using arrows or lines to display the first causal relationship.

[0052] In some embodiments, the first causal relationship diagram presents the first causal relationship as an example for explanation. In the first causal relationship diagram, the node corresponding to the alarm indicator is determined as the starting point, and the neighbor node directly connected to the starting point is selected as the next moving position according to the random walk algorithm. When executing the random walk algorithm, the probability of reaching another node from one node in the first causal relationship diagram can be described by establishing a transfer matrix, so as to randomly move in the first causal relationship diagram according to the probability, simulating the random walk process.

[0053] The establishment process of the transfer matrix in the random walk algorithm can be found below. Fig.11 Detailed description.

[0054] In some embodiments, on the first causal relationship graph, starting from the alarm node, a random walk algorithm is executed to record the number of times each node on the first causal relationship graph is visited during the execution of the random walk algorithm. The number of visits is used to indicate the frequency with which a node is visited during the random walk, and can be used to estimate the importance of each node in the first causal relationship graph. The higher the number of visits to a node, the higher the importance of the node; the lower the number of visits to a node, the lower the importance of the node. The indicators to be analyzed corresponding to the preset number of nodes (for example, 3) with the highest number of visits are selected, and then the service nodes corresponding to the determined indicators to be analyzed are used as the root cause service nodes.

[0055] S16, constructing a second causal relationship between the alarm indicator and the abnormal monitoring indicator corresponding to the root cause service node, and executing the random walk algorithm according to the second causal relationship to obtain the root cause monitoring indicator corresponding to the root cause service node.

[0056] In some embodiments, the number of root cause service nodes may be one or more. The root cause service node may include an alarm service node corresponding to the alarm indicator or may not include an alarm service node corresponding to the alarm indicator. In one embodiment, when the root cause service node includes an alarm service node and the number of root cause service nodes is 1, it indicates that the alarm service node is the root cause service node, and multiple abnormal monitoring indicators corresponding to the alarm service node are determined to form a second set of indicators to be analyzed; a second causal relationship is constructed for the second set of indicators to be analyzed, and a random walk algorithm is executed according to the second causal relationship to obtain the root cause monitoring indicator corresponding to the alarm service node. In one embodiment, when the number of root cause service nodes is multiple, for each root cause service node other than the alarm service node, multiple abnormal monitoring indicators corresponding to the root cause service node (also referred to as a target candidate root cause indicator set) are determined, and the alarm indicator and the target candidate root cause indicator set are combined to obtain a second set of indicators to be analyzed; a second causal relationship is constructed for the second set of indicators to be analyzed, and a random walk algorithm is executed according to the second causal relationship to obtain the root cause monitoring indicator corresponding to the alarm service node.

[0057] In one embodiment, the second causal relationship may be presented through a second causal relationship graph, and the nodes in the second causal relationship graph include indicators to be analyzed in the second indicator set to be analyzed, for example, the indicators to be analyzed may include alarm indicators and abnormal monitoring indicators in the target candidate root cause indicator set. In other embodiments, the second causal relationship may also be presented in the form of a second causal relationship tree or a second causal relationship table, and the construction method has been described above and will not be repeated here.

[0058] In some embodiments, on the second causal relationship graph, starting from the alarm node, a random walk algorithm is executed, and the number of visits of each node on the second causal relationship graph can be obtained by the random walk algorithm, and then the indicators to be analyzed corresponding to the preset number (for example, 3) of nodes with the highest number of visits are selected as the root cause monitoring indicators corresponding to the root cause service node. After obtaining the root cause service node and the root cause monitoring indicator, the root cause service node and the root cause monitoring indicator closest to the alarm indicator are output. In one embodiment, the operation and maintenance personnel or the troubleshooting personnel can judge whether the requirements of fault handling are met according to the determined root cause service node and the root cause monitoring indicator. When the determined root cause service node and the root cause monitoring indicator can meet the requirements of fault handling, the microservice architecture is fault-handled; when the determined root cause service node and the root cause monitoring indicator do not meet the requirements of fault handling, the root cause monitoring indicator is used as the alarm indicator in step S11, and the above S11-S16 process is re-executed to obtain further updated root cause service nodes and root cause monitoring indicators, until the root cause service node and the root cause monitoring indicator meet the requirements of fault handling. The embodiment of the present application can more quickly determine the cause of the alarm by performing fault analysis on the alarm indicators one by one, thereby improving the efficiency of fault analysis. In other embodiments, the fault handling requirements can also be pre-integrated into the neural network model to obtain a fault demand determination model, and the root cause service nodes and root cause monitoring indicators determined by the fault demand determination model monitor whether they meet the fault handling requirements. Among them, the input data of the fault demand determination model can be the root cause service node and the root cause service indicator, and the output data is whether the fault handling requirements are met or not. In the training process of the fault demand determination model, a training data set is prepared. The training data set includes multiple service nodes, monitoring indicators corresponding to the service nodes, and conclusions on whether the fault handling requirements are met. The training data set can be pre-set by system personnel. The fault demand determination model is trained according to the above training data set until the loss value corresponding to the loss function in the fault demand determination model meets the preset loss range. The preset loss range refers to a preset numerical range for evaluating whether the model converges.

[0059] The above-mentioned alarm indicator processing method provided by the embodiment of the present application determines the associated service node of the alarm service node corresponding to the alarm indicator at the alarm time, and then obtains the monitoring indicator of the abnormal monitoring indicator value corresponding to the associated service node at the alarm time to form a target candidate root cause indicator set; then constructs a first causal relationship graph corresponding to the alarm indicator and the target candidate root cause indicator set, and executes a random walk algorithm on the first causal relationship graph to obtain the root cause service node; finally, constructs a second causal relationship graph corresponding to the abnormal monitoring indicator corresponding to the alarm indicator and the root cause service node, and executes a random walk algorithm on the second causal relationship graph to obtain the root cause monitoring indicator, thereby completing the fault analysis of the microservice architecture. When performing fault analysis on the microservice architecture, the embodiment of the present application does not need to perform correlation analysis on the historical alarm data, which can improve the efficiency and accuracy of fault analysis; and the embodiment of the present application can more quickly determine the cause of the alarm by performing fault analysis on the alarm indicators one by one, further improving the efficiency of fault analysis.

[0060] Figure 4 1 is a flowchart of determining alarm information provided by an embodiment of the present application, and the alarm information determination process is applied to electronic equipment. Figure 4 As shown, the following steps are included:

[0061] S21, obtaining the alarm log corresponding to the alarm indicator.

[0062] In some embodiments, when an abnormal monitoring indicator (i.e., an alarm indicator) is detected, an alarm log corresponding to the alarm indicator will be written into the system's operation log, and the alarm log will be output so that the administrator can find and handle it in time. The alarm log may include, but is not limited to: the name of the abnormal monitoring indicator, the abnormal value of the abnormal monitoring indicator, the alarm time, and other information.

[0063] S22: Locate the preset time keyword in the alarm log.

[0064] In some embodiments, the preset time keyword refers to a keyword preset to identify the alarm time, for example, the preset time keyword may be: Alert time. In this embodiment, the preset time keyword may be used as a search keyword, and the alarm time may be located by searching the preset time keyword in the alarm log.

[0065] S23, obtaining the alarm time corresponding to the alarm indicator according to the pre-set index relationship between the preset time keyword and the alarm time.

[0066] In some embodiments, in the alarm log, there is an index relationship between the preset time keyword and the alarm time. For example, the index relationship can be expressed as: {Alert time: 2023-05-15T14:36:35+08:00}. As in the above embodiment, the preset time keyword can be retrieved in the alarm log, and the preset time keyword can be located, and then the alarm time corresponding to the alarm indicator can be determined according to the preset time keyword and the index relationship.

[0067] S24, obtaining a mapping relationship between preset monitoring indicators and service nodes.

[0068] In some embodiments, there is a mapping relationship between monitoring indicators and service nodes. A service node may correspond to only one monitoring indicator or may correspond to multiple monitoring indicators, which is not limited here.

[0069] S25, traversing the mapping relationship to determine the alarm service node corresponding to the alarm indicator.

[0070] The embodiment of the present application can quickly and accurately obtain the associated service node corresponding to the alarm service node at the alarm time by determining the alarm time and alarm service node of the alarm indicator, and then perform system fault analysis in combination with the associated service node corresponding to the alarm service node at the alarm time. There is no need to perform relevant analysis on historical alarm data, which can improve the efficiency and accuracy of fault analysis.

[0071] Figure 5 is a flowchart of determining an associated service node provided in an embodiment of the present application, and the determination process of an associated service node can be applied to an electronic device. Figure 5 As shown, the following steps are included:

[0072] S31, determining a service call relationship graph corresponding to the alarm service node at the alarm time.

[0073] In some embodiments, the service call relationship diagram is a topological relationship diagram that reflects the service call relationship between the alarm service node and the remaining service nodes in the microservice architecture. By querying the operation log corresponding to the alarm service node at the alarm time, the associated service nodes with call conditions and the service call relationship between the service nodes can be obtained, and the pre-trained network mapping tool is called to construct the service call relationship diagram of the above service node according to the service call relationship. Among them, in the service call relationship diagram, only the nearest level associated service nodes with call conditions with the alarm service node are selected. For example, the alarm service node is A, service node D calls the relevant data in the alarm service node A, service node E calls the relevant data in the service node D, alarm service node A calls the relevant data in service node B and service node C, and service node B calls the relevant data in service node F, wherein service node D, service node B and service node C are the nearest level associated service nodes corresponding to the alarm service node A, and service node E and service node F are not the nearest level associated service nodes corresponding to the alarm service node A. Therefore, when constructing the service call relationship diagram, there is no need to select service node E and service node F.

[0074] Combination Figure 6 To explain, Figure 6 This is a schematic diagram of the service call relationship provided by the embodiment of the present application. There are service nodes [A, B, C, D], and the service call relationship is [(D, A), (A, B), (A, C)], where A is an alarm service node, service node D calls the relevant data in alarm service node A, and alarm service node A calls the relevant data in service node B and service node C.

[0075] S32, parsing the service call relationship graph to obtain the upstream service node and the downstream service node corresponding to the alarm service node.

[0076] In some embodiments, an upstream service node refers to a service node that provides services or resources to a downstream service node, and a downstream service node refers to a service node that obtains services or resources from an upstream service node. In the service call relationship graph, the alarm service node is determined and marked, and then the upstream service node and the downstream service node are determined according to the call relationship of the alarm service node. In one embodiment, the alarm service node may only have an upstream service node, or only have a downstream service node, or both the upstream service node and the downstream service node exist or neither exists. When both the upstream service node and the downstream service node do not exist, the alarm service node is determined to be the root cause service node, and then the abnormal monitoring indicators corresponding to the root cause service node are obtained to form an indicator set to be analyzed; a causal relationship graph corresponding to the indicator set to be analyzed is constructed, and a random walk algorithm is executed on the causal relationship graph with the alarm indicator as the starting point to obtain the root cause monitoring indicator corresponding to the root cause service node, and finally the root cause service node and the root cause monitoring indicator are output.

[0077] S33: Combine the upstream service node and the downstream service node to obtain the associated service node.

[0078] In some embodiments, when an alarm service node has an upstream service node and a downstream service node, the upstream service node and the downstream service node are combined to obtain an associated service node; when an alarm service node only has an upstream service node, the associated service node is the upstream service node; when an alarm service node only has a downstream service node, the associated service node is the downstream service node; when neither the upstream service node nor the downstream service node corresponding to the alarm service node exists, this step does not need to be performed.

[0079] The embodiment of the present application analyzes the service call relationship diagram corresponding to the alarm service node at the alarm time, and can quickly and accurately obtain the upstream service node and the downstream service node corresponding to the alarm service node, thereby improving the efficiency and accuracy of fault analysis.

[0080] Figure 7 1 is a flow chart for determining the monitoring index value provided by an embodiment of the present application, and the process for determining the monitoring index value can be applied to electronic devices. Figure 7 As shown, the following steps are included:

[0081] S41, traverse the mapping relationship between monitoring indicators and service nodes to obtain monitoring indicators corresponding to the associated service nodes.

[0082] In some embodiments, there is a mapping relationship between monitoring indicators and service nodes. A service node may correspond to only one monitoring indicator or may correspond to multiple monitoring indicators, which is not limited here.

[0083] S42, obtaining a plurality of monitoring data points of the monitoring indicator within a preset time period, each of the monitoring data points including a timestamp and a monitoring indicator value.

[0084] In some embodiments, the preset time period may be a preset period of time that traces back to the alarm time, for example, the preset time period may be 1 hour, and there is no limitation on this. The multiple monitoring data points may be as follows:

[0085] [(timestamp1,value1),(timestamp2,value2),…,(timestampN,valueN)]

[0086] Among them, timestamp1 is used to identify the timestamp of collecting monitoring data values, and value1 is used to identify the monitoring indicator value at the timestamp.

[0087] S43, selecting a target monitoring data point whose timestamp is the alarm time.

[0088] In some embodiments, a timestamp that is the same as the alarm time is selected from timestamps corresponding to multiple monitoring data points, and the monitoring data point corresponding to the timestamp is determined to be the target monitoring data point.

[0089] S44, determining that the monitoring indicator value corresponding to the target monitoring data point is the monitoring indicator value corresponding to the monitoring indicator at the alarm time.

[0090] In some embodiments, a monitoring indicator value corresponding to a target monitoring data point is obtained, where the monitoring indicator value is a monitoring indicator value corresponding to a monitoring indicator corresponding to an associated service node at an alarm time.

[0091] According to the index relationship between the timestamp and the monitoring index value in the monitoring data point, the embodiment of the present application can quickly select the target monitoring data point with the timestamp as the alarm time, thereby determining the monitoring index value corresponding to the target monitoring data point, thereby improving the efficiency of system fault analysis.

[0092] Figure 8 1 is a flow chart for determining a candidate root cause indicator set provided by an embodiment of the present application. The process for determining a candidate root cause indicator set can be applied to electronic devices. Figure 8 As shown, the following steps are included:

[0093] S51, determining a monitoring indicator value corresponding to each monitoring data point of the monitoring indicator to obtain a monitoring indicator value set.

[0094] In some embodiments, monitoring indicator values ​​corresponding to multiple monitoring data points of the monitoring indicator within a preset time period are obtained. The preset time period can be set according to actual needs. For example, the preset time period is 1 hour.

[0095] S52, analyzing the monitoring indicator value set in a preset manner, and assigning each monitoring indicator value to a preset value range.

[0096] In some embodiments, the preset method can be a histogram, the preset value interval can be determined according to the preset number of intervals and the numerical range of the monitoring indicator value in the monitoring indicator value set, the preset value interval can be an equidistant interval, and the preset value interval can reflect the distribution characteristics of the monitoring indicator value. After determining the preset value interval, the monitoring indicators in the monitoring indicator set are allocated to the above-mentioned preset value interval. In other embodiments, the preset method can also be other icon analysis methods, and the present application is not limited thereto.

[0097] S53, selecting a preset numerical interval with the largest number of allocated monitoring indicator values ​​as a target numerical interval.

[0098] In some embodiments, the number of monitoring indicator values ​​within a preset numerical interval can reflect the stability of the data. When the number of monitoring indicator values ​​within the preset numerical interval is greater, the data is more stable, and the monitoring indicator values ​​within the interval will not deviate too far from the average value, and the interval is selected for relevant data analysis; when the number of monitoring indicator values ​​within the preset numerical interval is smaller, the data volatility is higher, and the monitoring indicator values ​​within the interval may deviate far from the average value.

[0099] S54, calculating the mean and variance of the monitoring indicator value corresponding to the target numerical interval, and determining a normal numerical interval according to the mean and variance.

[0100] In some embodiments, the mean calculation function and the variance calculation function are respectively called to process the monitoring index value within the target numerical interval, and the mean and variance corresponding to the target numerical interval are obtained. The upper and lower numerical limits are determined according to the mean and variance, and the interval between the upper and lower numerical limits is taken as the normal numerical interval, and the interval exceeding the upper or lower numerical limits is taken as the abnormal numerical interval. In one embodiment, assuming that the mean is mean, the variance is std, the upper numerical limit is mean-3*std, the lower numerical limit is mean+3*std, and the normal numerical interval is [mean-3*std, mean+3*std]. Among them, the method for determining the upper and lower numerical limits can be set according to actual needs, and is not limited here.

[0101] S55, when the monitoring indicator value is not within the normal value range, determining that the monitoring indicator value is abnormal, and determining the monitoring indicator with the abnormal monitoring indicator value as an initial candidate root cause indicator.

[0102] In some embodiments, a monitoring indicator value is determined to be an abnormal monitoring indicator, and the monitoring indicator is used as an initial candidate root cause indicator.

[0103] S56, combining several of the initial candidate root cause indicators to obtain an initial candidate root cause indicator set.

[0104] S57, preprocessing the initial candidate root cause indicator set to obtain a target candidate root cause indicator set.

[0105] In some embodiments, preprocessing may include filtering the candidate root cause indicators in the initial candidate root cause indicator set that are not related to the alarm indicator. Exemplarily, when the alarm indicator is the response time indicator of the interface, the indicators related to the alarm indicator may include flow indicators (such as the number of requests per minute), node resource monitoring indicators (such as CPU utilization) and the response time indicator of the downstream interface, and the indicators that are not related to the alarm indicator may be the resource monitoring indicators of the upstream node. Therefore, when the alarm indicator is the response time indicator of the interface, the resource monitoring indicators of the upstream node need to be filtered out.

[0106] The embodiment of the present application first performs a histogram analysis on the monitoring indicator value corresponding to each monitoring data point of the monitoring indicator, assigns each monitoring indicator value to a preset numerical interval, then selects the preset numerical interval with the largest number of monitoring indicator values ​​as the target numerical interval, then determines the normal numerical interval according to the mean and variance corresponding to the target numerical interval, and finally determines whether the monitoring indicator value is abnormal according to the normal numerical interval. Compared with setting a fixed numerical interval, dynamically adjusting the normal numerical interval according to the monitoring indicator value can improve the accuracy of abnormal monitoring and thus improve the accuracy of fault analysis; and the present application further improves the accuracy of fault analysis by preprocessing the initial candidate root cause indicator set and removing the candidate root cause indicators that are not related to the alarm indicator in the initial candidate root cause indicator set.

[0107] Fig. 9 1 is a flowchart of preprocessing provided in an embodiment of the present application, and the preprocessing process can be applied to electronic devices. Fig. 9 As shown, the following steps are included:

[0108] S62, traversing a preset filtering rule base according to the initial candidate root cause indicator set to obtain the correlation between the alarm indicator and the initial candidate root cause indicator, where the correlation includes correlation and non-correlation.

[0109] In some embodiments, relevant monitoring indicators and irrelevant monitoring indicators are set for each monitoring indicator in the microservice architecture, and a preset filtering rule base is constructed based on the above relevant information. The preset filtering rule base is queried according to the alarm indicator to obtain monitoring indicators related to the alarm indicator and irrelevant monitoring indicators. Among them, the correlation can be distinguished by a preset identifier, for example, the correlation can be identified as Y, and the irrelevant can be identified as N. By checking the preset identifier, the correlation between the alarm indicator and the initial candidate root cause indicator can be quickly distinguished.

[0110] S63, deleting irrelevant initial candidate root cause indicators from the initial candidate root cause indicator set to obtain a target candidate root cause indicator set.

[0111] In some embodiments, a monitoring indicator that is not related to the alarm indicator is determined from a preset filtering rule library, and the monitoring indicator is deleted from the initial candidate root cause indicator set to obtain a target candidate root cause indicator set.

[0112] The embodiment of the present application can quickly determine the monitoring indicators that are not related to the alarm indicators by traversing the pre-set filtering rule base, so as to quickly pre-process the initial candidate root cause indicator set, thereby improving the accuracy of fault analysis.

[0113] Fig.10 1 is a flow chart for determining a first causal relationship graph provided in an embodiment of the present application. The flow chart for determining the first causal relationship graph can be applied to electronic devices. Fig.10 As shown, the following steps are included:

[0114] S71, combining the alarm indicator with the target candidate root cause indicator set to obtain a first indicator set to be analyzed.

[0115] S72, constructing a first causal relationship graph according to the first set of indicators to be analyzed, wherein the indicators to be analyzed in the first set of indicators to be analyzed are used to form nodes of the first causal relationship graph, and the causal relationships between the indicators to be analyzed are used to form lines between corresponding nodes, and the lines point from cause nodes to result nodes.

[0116] In some embodiments, when constructing a first causal relationship graph based on the first set of indicators to be analyzed, the correlation between the indicators to be analyzed in the first set of indicators to be analyzed is first calculated, and an initial undirected graph is constructed based on the correlation between the indicators to be analyzed; then the conditional independence test is used to determine the lines to be deleted in the initial undirected graph; then the lines to be deleted are removed from the initial undirected graph to obtain the first causal relationship graph. Among them, the correlation between the indicators to be analyzed can be evaluated by calculating the covariance matrix between the indicators to be analyzed. The initial undirected graph is used to reflect the correlation between all indicators to be analyzed, but does not indicate a causal relationship. The conditional independence test can detect the independence between the three indicators to be analyzed, thereby determining whether there is a direct causal relationship between two indicators to be analyzed. In the first causal relationship graph, each node corresponds to an indicator to be analyzed, and each directed line indicates a causal relationship between the indicators to be analyzed.

[0117] The embodiment of the present application constructs a first causal relationship graph for the first set of indicators to be analyzed. The causal dependency relationship between the indicators to be analyzed can be determined through the first causal relationship graph. According to the causal dependency relationship, the real risk factors in the system can be accurately analyzed, thereby improving the accuracy of fault analysis.

[0118] Fig.11 is a flow chart of determining a root cause service node provided by an embodiment of the present application, and the process of determining a root cause service node can be applied to an electronic device. Fig.11 As shown, the following steps are included:

[0119] S81: Based on the first causal relationship graph, execute the random walk algorithm with the node corresponding to the alarm indicator as the starting point.

[0120] In some embodiments, in the first causal relationship diagram, assuming that v a is the node corresponding to the alarm indicator, v i and v j For any two nodes in the graph, e ij =1 indicates that there is a bar from v i Point to v j Each item in the transfer matrix Q ij The calculation is as follows:

[0121] If e ij =1, then Q ij =R(v a ,v j ), where R(v a ,v j ) Identify the indicator to be analyzed v j With the alarm indicator v a The correlation coefficient between

[0122] If e ji=1 and e ij =0, then Q ji =ρR(v a ,v i ), where ρ∈[0,1];

[0123] in, v k is any node in the graph.

[0124] Normalize each row in the above transfer matrix. is the normalized value used to represent the random walk algorithm from v i Node transfer to v j The probability of a node.

[0125] S82: Determine the number of visits corresponding to each node in the first causal relationship graph.

[0126] In some embodiments, in the random walk algorithm, the number of times a node is visited is related to the importance of the node in the graph. The more times a node is visited, the higher the importance of the node in the graph; the fewer times a node is visited, the lower the importance of the node in the graph.

[0127] S83, sorting the access times in descending order, and selecting indicators to be analyzed corresponding to a preset number of nodes.

[0128] In some embodiments, the number of times the nodes are visited is sorted in descending order, and a preset number of nodes with the highest ranking are selected. In one embodiment, the preset number is a preset value, for example, the preset number may be 3, 5, 6, or 7. In other embodiments, the preset number may be determined based on the total number of nodes in the first causal relationship graph, for example, the preset number may refer to 10% of the total number (the data type of the preset number is an integer).

[0129] S84, traverse the mapping relationship between the monitoring indicators and the service nodes to obtain the root cause service node corresponding to the determined indicator to be analyzed.

[0130] In some embodiments, there is a mapping relationship between the indicator to be analyzed and the root cause service node. By traversing the mapping relationship, the root cause service node corresponding to the indicator to be analyzed can be obtained. The number of the root cause service nodes can be one or more.

[0131] The embodiment of the present application executes a random walk algorithm in conjunction with a causal relationship graph, which can avoid getting lost during the random walk process, and guides the random walk process according to the causal dependencies in the causal relationship graph, which can improve the efficiency and accuracy of the random walk algorithm, thereby improving the accuracy and efficiency of fault analysis.

[0132] See also Fig.12 , Fig.12 is a schematic diagram of the structure of the alarm indicator processing device provided in an embodiment of the present application. In some embodiments, the alarm indicator processing device 20 may include a plurality of functional modules composed of computer program segments. The computer program of each program segment in the alarm indicator processing device 20 may be stored in the memory of the computer device 30 and executed by at least one controller to execute (see Figure 2 Description) Function of alarm indicator processing.

[0133] In this embodiment, the alarm indicator processing device 20 can be divided into multiple functional modules according to the functions it performs. When the alarm indicator processing device 20 is applied to the main device, the functional modules may include: an alarm indicator monitoring module 201, an associated node determination module 202, a monitoring indicator determination module 203, an abnormal indicator selection module 204, a root cause node determination module 205, and a root cause indicator determination module 206. The module referred to in this application refers to a series of computer program segments that can be executed by at least one controller and can complete fixed functions, which are stored in a memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0134] The alarm indicator monitoring module 201 is used to respond to the monitored alarm indicators and determine the alarm time and alarm service node corresponding to the alarm indicators.

[0135] The associated node determination module 202 is used to determine the associated service node corresponding to the alarm service node at the alarm time.

[0136] The monitoring indicator determination module 203 is used to determine the monitoring indicator corresponding to the associated service node and obtain the monitoring indicator value corresponding to the monitoring indicator at the alarm time.

[0137] The abnormal indicator selection module 204 is used to select monitoring indicators corresponding to the abnormal monitoring indicator values ​​to form a target candidate root cause indicator set.

[0138] The root cause node determination module 205 is used to construct a first causal relationship between the alarm indicator and the target candidate root cause indicator set, and execute a random walk algorithm according to the first causal relationship to obtain a root cause service node.

[0139] The root cause indicator determination module 206 is used to construct a second causal relationship between the alarm indicator and the abnormal monitoring indicator corresponding to the root cause service node, and execute the random walk algorithm according to the second causal relationship to obtain the root cause monitoring indicator corresponding to the root cause service node.

[0140] In some embodiments, the alarm indicator monitoring module 201 also includes: an alarm log acquisition submodule, used to obtain the alarm log corresponding to the alarm indicator; a keyword positioning submodule, used to locate the preset time keyword in the alarm log; an alarm time determination submodule, used to obtain the alarm time corresponding to the alarm indicator based on the preset index relationship between the preset time keyword and the alarm time; a mapping relationship determination submodule, used to obtain the mapping relationship between the preset indicator and the service node; an alarm service node determination submodule, used to traverse the mapping relationship and determine the alarm service node corresponding to the alarm indicator.

[0141] In some embodiments, the associated node determination module 202 also includes: a call relationship determination sub-module, used to determine the service call relationship graph corresponding to the alarm service node at the alarm time; a call relationship parsing sub-module, used to parse the service call relationship graph to obtain the upstream service node and the downstream service node corresponding to the alarm service node; an associated node determination sub-module, used to combine the upstream service node and the downstream service node to obtain the associated service node.

[0142] In some embodiments, the monitoring indicator determination module 203 also includes: a mapping relationship traversal submodule, used to traverse the mapping relationship to obtain the monitoring indicator corresponding to the associated service node; a monitoring data point acquisition submodule, used to obtain multiple monitoring data points of the monitoring indicator within a preset time period, each of the monitoring data point includes a timestamp and a monitoring indicator value; a target data point selection submodule, used to select the target monitoring data point whose timestamp is the alarm time; a monitoring indicator value determination submodule, used to determine that the monitoring indicator value corresponding to the target monitoring data point is the monitoring indicator value corresponding to the monitoring indicator at the alarm time.

[0143] In some embodiments, the abnormal indicator selection module 204 also includes: an indicator value set determination submodule, which is used to determine the monitoring indicator value corresponding to each of the monitoring data points of the monitoring indicator to obtain a monitoring indicator value set; an indicator value analysis submodule, which is used to analyze the monitoring indicator value set in a preset manner and assign each of the monitoring indicator values ​​to a preset numerical range; a numerical range selection submodule, which is used to select the preset numerical range with the largest number of assigned monitoring indicator values ​​as the target numerical range; a numerical range determination submodule, which is used to calculate the mean and variance of the monitoring indicator value corresponding to the target numerical range, and determine the normal numerical range according to the mean and variance; an indicator value abnormality determination submodule, which is used to determine that the monitoring indicator value is abnormal when the monitoring indicator value is not in the normal numerical range, and determine that the monitoring indicator with the abnormal monitoring indicator value is the initial candidate root cause indicator; a root cause indicator combination submodule, which is used to combine multiple initial candidate root cause indicators to obtain an initial candidate root cause indicator set; an indicator preprocessing submodule, which is used to preprocess the initial candidate root cause indicator set to obtain a target candidate root cause indicator set.

[0144] In some embodiments, the indicator preprocessing submodule also includes: a correlation determination unit, which is used to traverse a preset filtering rule base according to the initial candidate root cause indicator set to obtain the correlation between the alarm indicator and the initial candidate root cause indicator, and the correlation includes correlation and irrelevance; an indicator deletion unit, which is used to delete irrelevant initial candidate root cause indicators from the initial candidate root cause indicator set to obtain a target candidate root cause indicator set.

[0145] In some embodiments, the root cause node determination module 205 also includes: an indicator combination submodule, used to combine the alarm indicator with the target candidate root cause indicator set to obtain a first indicator set to be analyzed; a relationship construction submodule, used to construct a first cause-effect relationship graph based on the first indicator set to be analyzed, the indicators to be analyzed in the first indicator set to be analyzed are used to form nodes of the first cause-effect relationship graph, and the cause-effect relationship between the indicators to be analyzed is used to form a connection between corresponding nodes, and the connection is from the cause node to the result node.

[0146] In some embodiments, the root cause node determination module 205 also includes: an algorithm execution submodule, which is used to execute the random walk algorithm based on the first causal relationship diagram and takes the node corresponding to the alarm indicator as the starting point; a visit count determination submodule, which is used to determine the number of visits corresponding to each node in the first causal relationship diagram; a node selection submodule, which is used to sort the number of visits in descending order and select the indicators to be analyzed corresponding to a preset number of nodes; a root cause service node determination submodule, which is used to traverse the mapping relationship and obtain the root cause service node corresponding to the determined indicator to be analyzed.

[0147] It can be understood that the alarm indicator processing device 20 and the alarm indicator processing method of the above embodiment belong to the same inventive concept, and the specific implementation method of each module of the alarm indicator processing device 20 corresponds to the steps of the alarm indicator processing method in the above embodiment, which will not be repeated in this application.

[0148] The module division described above is a logical function division, and there may be other division methods in actual implementation. In addition, the functional modules in each embodiment of the present application may be integrated in the same processing unit, or each module may exist physically separately, or two or more modules may be integrated in the same unit. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0149] Fig.13 Schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Fig.13 As shown, the electronic device 30 includes a memory 31, at least one controller 32 and at least one communication bus 33. The controller 32 is used to implement the alarm indicator processing method when executing the computer program stored in the memory 31, and the at least one communication bus 33 is configured to realize the connection and communication between the memory 31 and at least one controller 32.

[0150] Fig.13 The structure of the electronic device shown does not constitute a limitation on the embodiments of the present application. The electronic device 30 may also include more or less other hardware or software than shown in the figure, or a different arrangement of components.

[0151] In some embodiments of the present application, the electronic device 30 can also be connected to a client device, which includes but is not limited to any electronic product that can interact with a user through a keyboard, mouse, remote control, touchpad or voice control device, such as a personal computer, a tablet computer, a smart phone, a digital camera, etc.

[0152] It should be noted that the electronic device 30 is only an example, and other existing or future electronic products that are suitable for the present application should also be included in the protection scope of the present application and included here by reference.

[0153] In some embodiments, the electronic device 30 may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0154] The memory 31 stores a computer program, and when the computer program is executed by at least one controller 32, all or part of the steps in the alarm indicator processing method are implemented. The memory 31 includes a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0155] Furthermore, the computer-readable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of the electronic device 30, etc.

[0156] In some embodiments, at least one controller 32 is the control core (Control Unit) of the electronic device 30, and uses various interfaces and lines to connect the various components of the entire electronic device 30, and executes various functions and processes data of the electronic device 30 by running or executing programs or modules stored in the memory 31, and calling data stored in the memory 31. For example, when at least one controller 32 executes the computer program stored in the memory, it implements all or part of the steps of the alarm indicator processing method in the embodiment of the present application; or implements all or part of the functions of the alarm indicator processing device. At least one controller 32 can be composed of an integrated circuit, for example, it can be composed of a single packaged integrated circuit, or it can be composed of multiple integrated circuits with the same function or different functions, including one or more central controllers (Central Processing unit, CPU), microcontrollers, digital processing chips, graphics controllers and combinations of various control chips.

[0157] The above-mentioned integrated unit implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling an electronic device (which can be a personal computer, an electronic device, or a network device, etc.) or a controller (processor) to execute parts of the methods of various embodiments of the present application.

[0158] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation.

[0159] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0160] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0161] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is limited by the attached claims rather than the above description, so it is intended to include all changes that fall within the meaning and scope of the equivalent elements of the claims in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "including" does not exclude other units or, and the singular does not exclude the plural. Multiple units or devices stated in the specification can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

[0162] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present application and are not intended to limit it. Although the present application has been described in detail with reference to the preferred embodiments, a person of ordinary skill in the art should understand that the technical solution of the present application may be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present application.

Claims

1. A method for processing alarm indicators, characterized in that: The method comprises: Responding to the monitored alarm indicators, determining the alarm time and alarm service node corresponding to the alarm indicators; Determine an associated service node corresponding to the alarm service node at the alarm time; Determine the monitoring indicator corresponding to the associated service node and obtain the monitoring indicator value corresponding to the monitoring indicator at the alarm time; Select monitoring indicators corresponding to abnormal monitoring indicator values ​​to form a target candidate root cause indicator set; Constructing a first causal relationship between the alarm indicator and the target candidate root cause indicator set, and executing a random walk algorithm according to the first causal relationship to obtain a root cause service node; A second causal relationship between the alarm indicator and the abnormal monitoring indicator corresponding to the root cause service node is constructed, and the random walk algorithm is executed according to the second causal relationship to obtain the root cause monitoring indicator corresponding to the root cause service node.

2. The method according to claim 1, characterized in that The determining the alarm time and the alarm service node corresponding to the alarm indicator includes: Obtain the alarm log corresponding to the alarm indicator; Locating a preset time keyword in the alarm log; Obtaining the alarm time corresponding to the alarm indicator according to the preset index relationship between the preset time keyword and the alarm time; Get the mapping relationship between the preset monitoring indicators and service nodes; The mapping relationship is traversed to determine the alarm service node corresponding to the alarm indicator.

3. The method according to claim 1, characterized in that The determining the associated service node corresponding to the alarm service node at the alarm time includes: Determine a service call relationship graph corresponding to the alarm service node at the alarm time; Parse the service call relationship graph to obtain the upstream service node and the downstream service node corresponding to the alarm service node; The upstream service node and the downstream service node are combined to obtain the associated service node.

4. The method according to claim 2, characterized in that The determining the monitoring indicator corresponding to the associated service node and obtaining the monitoring indicator value corresponding to the monitoring indicator at the alarm time includes: Traversing the mapping relationship to obtain the monitoring indicator corresponding to the associated service node; Acquire multiple monitoring data points of the monitoring indicator within a preset time period, each of the monitoring data points including a timestamp and a monitoring indicator value; Selecting a target monitoring data point whose timestamp is the alarm time; Determine that the monitoring indicator value corresponding to the target monitoring data point is the monitoring indicator value corresponding to the monitoring indicator at the alarm time.

5. The method according to claim 4, characterized in that The monitoring indicators corresponding to the selected abnormal monitoring indicator values ​​constitute a target candidate root cause indicator set, including: Determine a monitoring indicator value corresponding to each monitoring data point of the monitoring indicator to obtain a monitoring indicator value set; Analyzing the monitoring indicator value set in a preset manner and assigning each monitoring indicator value to a preset value interval; Selecting the preset numerical interval with the largest number of assigned monitoring indicator values ​​as the target numerical interval; Calculate the mean and variance of the monitoring indicator value corresponding to the target numerical interval, and determine the normal numerical interval according to the mean and variance; When the monitoring indicator value is not within the normal value interval, determining that the monitoring indicator value is abnormal, and determining the monitoring indicator with the abnormal monitoring indicator value as an initial candidate root cause indicator; Combining a plurality of the initial candidate root cause indicators to obtain an initial candidate root cause indicator set; The initial candidate root cause indicator set is preprocessed to obtain a target candidate root cause indicator set.

6. The method according to claim 5, characterized in that The preprocessing of the initial candidate root cause indicator set to obtain a target candidate root cause indicator set includes: Traversing a preset filtering rule base according to the initial candidate root cause indicator set to obtain the correlation between the alarm indicator and the initial candidate root cause indicator, wherein the correlation includes correlation and non-correlation; Irrelevant initial candidate root cause indicators are deleted from the initial candidate root cause indicator set to obtain a target candidate root cause indicator set.

7. The method according to claim 1, characterized in that The constructing a first causal relationship between the alarm indicator and the target candidate root cause indicator set includes: Combining the alarm indicator with the target candidate root cause indicator set to obtain a first indicator set to be analyzed; A first causal relationship graph is constructed according to the first set of indicators to be analyzed, the indicators to be analyzed in the first set of indicators to be analyzed are used to form nodes of the first causal relationship graph, and the causal relationships between the indicators to be analyzed are used to form lines between corresponding nodes, and the lines point from cause nodes to result nodes.

8. The method according to claim 7, characterized in that The performing a random walk algorithm according to the first causal relationship graph to obtain a root cause service node includes: Based on the first causal relationship graph, executing the random walk algorithm with the node corresponding to the alarm indicator as the starting point; Determine the number of visits corresponding to each node in the first causal relationship graph; Sort the access times in descending order, and select the indicators to be analyzed corresponding to the preset number of nodes; The mapping relationship between monitoring indicators and service nodes is traversed to obtain the root cause service node corresponding to the determined indicator to be analyzed.

9. An alarm indicator processing device, characterized in that: The device comprises: An alarm indicator monitoring module is used to respond to the monitored alarm indicators and determine the alarm time and alarm service node corresponding to the alarm indicators; An associated node determination module, used to determine an associated service node corresponding to the alarm service node at the alarm time; A monitoring indicator determination module, used to determine the monitoring indicator corresponding to the associated service node and obtain the monitoring indicator value corresponding to the monitoring indicator at the alarm time; An abnormal indicator selection module is used to select monitoring indicators corresponding to abnormal monitoring indicator values ​​to form a target candidate root cause indicator set; A root cause node determination module is used to construct a first causal relationship between the alarm indicator and the target candidate root cause indicator set, and execute a random walk algorithm according to the first causal relationship to obtain a root cause service node; The root cause indicator determination module is used to construct a second causal relationship between the alarm indicator and the abnormal monitoring indicator corresponding to the root cause service node, and execute the random walk algorithm according to the second causal relationship to obtain the root cause monitoring indicator corresponding to the root cause service node.

10. An electronic device, characterized in that: The electronic device includes a controller and a memory, and the controller is used to implement the alarm indicator processing method according to any one of claims 1 to 8 when executing a computer program stored in the memory.

Images