Business system performance alarm method and device, equipment and storage medium

Abstract

The invention discloses a service system performance alarm method, device and equipment and a storage medium, and relates to the technical field of micro-services, the method comprises the following steps: performing streaming processing on an APM interface call chain log of a service system to obtain various performance index data; pushing the various performance index data to a time sequence database, and performing application performance analysis and method performance analysis to obtain abnormal floating data; and when the abnormal floating data meets the preset alarm condition, performing differential alarm on the interface corresponding to the preset alarm condition. According to the method, the APM interface call chain log is subjected to streaming processing to obtain various performance index data, and the abnormal floating data in the service system can be quickly analyzed according to the various performance index data, so that the situation that the traditional alarm based on a call chain of a single request needs to depend on manual analysis is avoided; therefore, the interface differentiation alarm of the business system can be quickly realized, and the service management effect and the operation and maintenance efficiency are improved.

Description

Technical Field

[0001] The present application relates to the field of microservice technology, and in particular to a business system performance alarm method, device, equipment and storage medium. Background Art

[0002] With the application of microservice design concepts in the system, the business call chain is becoming more and more complex. Microservice design is to split a single application into multiple small services. In the microservice architecture, each microservice has relatively independent functions and clear business boundaries, and can be independently developed, deployed, expanded and maintained.

[0003] However, a request in the business call chain of microservices may involve the coordinated operation of dozens of services and the business systems of multiple teams. When a problem needs to be located, the traditional method is to issue an alarm based on the call chain of a single request (such as an application, service, or method). However, a single request shows a chain of a large number of requests, which cannot provide support for operation and maintenance personnel to discover problems in advance. It is necessary to rely on the experience of operation and maintenance personnel and a large amount of manual analysis to realize alarm location, resulting in low operation and maintenance efficiency. Summary of the invention

[0004] The main purpose of this application is to provide a business system performance alarm method, device, equipment and storage medium, aiming to solve the technical problem that the traditional alarm is based on a call chain of a single request, which cannot provide support for operation and maintenance personnel to discover problems in advance, and needs to rely on the experience of operation and maintenance personnel and a large amount of manual analysis to achieve alarm location, resulting in low operation and maintenance efficiency.

[0005] To achieve the above purpose, the present application proposes a service system performance alarm method, the method comprising:

[0006] Perform streaming processing on the APM interface call chain log of the business system to obtain various performance indicator data of the business system;

[0007] Pushing the multiple performance indicator data to a time series database;

[0008] Performing application performance analysis and method performance analysis on the various performance indicator data through the time series database to obtain abnormal floating data;

[0009] When the abnormal floating data meets the preset alarm condition, a differentiated alarm is issued to the interface corresponding to the preset alarm condition.

[0010] In one embodiment, the step of performing streaming processing on the APM interface call chain log of the business system to obtain multiple performance indicator data of the business system includes:

[0011] Collect the APM interface call chain log of the business system;

[0012] Process the APM interface call chain log through a distributed publish-subscribe message system to obtain call interface data;

[0013] The calling interface data is input into the streaming computing component Flink for streaming computing to obtain various performance indicator data of the business system.

[0014] In one embodiment, the step of inputting the calling interface data into the stream computing component Flink for stream computing to obtain multiple performance indicator data of the business system includes:

[0015] Setting a time window of a preset time period based on the stream computing component Flink;

[0016] Based on the interface call start time, the call interface data is merged according to the interface level through the time window to obtain the performance indicator data of each interface in the business system after the preset time period is merged;

[0017] Accordingly, the step of pushing the multiple performance indicator data to the time series database includes:

[0018] The performance indicator data after merging the preset time periods is pushed to the time series database through the distributed publish-subscribe message system.

[0019] In one embodiment, the step of performing application performance analysis and method performance analysis on the multiple performance indicator data through the time series database to obtain abnormal floating data includes:

[0020] Based on the time series database, application performance analysis is performed on the multiple performance indicator data according to the application field dimension to obtain abnormal floating data of application performance in the business system;

[0021] The method performance analysis is performed on the multiple performance indicator data based on the combined dimensions of application, service, method and interface to obtain abnormal floating data of the method performance in the business system.

[0022] In one embodiment, the step of performing application performance analysis on the multiple performance indicator data according to the application field dimension to obtain abnormal floating data of application performance in the business system includes:

[0023] Grouping and calculating the multiple performance indicator data according to the application field dimension to obtain indicator data of each application in the business system, wherein the indicator data includes multiple historical indicator data of the same period;

[0024] Performing average floating processing on the multiple historical index data of the same period to obtain a historical floating reference index;

[0025] Queue processing is performed according to the indicator data of each application and the historical floating reference indicator to obtain abnormal floating data of application performance in the business system.

[0026] In one embodiment, the step of performing queue processing according to the indicator data of each application and the historical floating reference indicator to obtain abnormal floating data of application performance in the business system includes:

[0027] Assemble the indicator data of each application and the historical floating reference indicator to obtain json format data;

[0028] Cache the JSON format data into a key-value pair storage database according to the preset queue length, and extract historical values ​​from each queue;

[0029] If the historical value exceeds a preset threshold value within a preset continuous time period, the abnormal indicator duration minute data is recorded, and the abnormal indicator duration minute data is used as abnormal floating data of application performance in the business system.

[0030] In one embodiment, when the abnormal floating data meets the preset alarm condition, after the step of performing a differentiated alarm on the interface corresponding to the preset alarm condition, the method further includes:

[0031] Obtaining the interface traffic of each interface in the business system;

[0032] Sort the interfaces according to the interface traffic and the abnormal index duration data in minutes to obtain a sorted interface;

[0033] Filter the sorting interface through the APM call chain to determine the end interface of the sorting interface;

[0034] The terminal interface is analyzed and located to determine the slow interface in the service system.

[0035] In addition, to achieve the above purpose, the present application also proposes a service system performance alarm device, the device comprising:

[0036] A stream processing module is used to perform stream processing on the APM interface call chain log of the business system to obtain various performance indicator data of the business system;

[0037] A data push module, used to push the multiple performance indicator data to a time series database;

[0038] A performance analysis module, used to perform application performance analysis and method performance analysis on the multiple performance indicator data through the time series database to obtain abnormal floating data;

[0039] The abnormal alarm module is used to, when the abnormal floating data meets the preset alarm condition, issue a differentiated alarm to the interface corresponding to the preset alarm condition.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a business system performance alarm device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the business system performance alarm method described above.

[0041] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the business system performance alarm method described above are implemented.

[0042] One or more technical solutions proposed in this application have at least the following technical effects: this application first performs streaming processing on the APM interface call chain log of the business system to obtain a variety of performance indicator data of the business system; then pushes the various performance indicator data to the time series database; then performs application performance analysis and method performance analysis on the various performance indicator data through the time series database to obtain abnormal floating data; finally, when the abnormal floating data meets the preset alarm conditions, a differentiated alarm is issued for the interface corresponding to the preset alarm conditions. Since this application performs streaming processing on the APM interface call chain log to obtain a variety of performance indicator data, the abnormal floating data in the business system can be quickly analyzed based on the various performance indicator data, avoiding the situation where the traditional alarm based on a single request call chain needs to rely on manual analysis, thereby quickly realizing differentiated alarms for the interfaces of the business system, greatly improving the effect of service governance, and improving the automation and efficiency of operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1 A schematic diagram of the framework serving the traditional APM call chain;

[0046] Figure 2 A flowchart of the first embodiment of the method for alarming the performance of a business system of the present application is provided;

[0047] Figure 3 The overall design diagram for alarming based on call chain data provided in Example 1;

[0048] Figure 4 A flowchart of the second embodiment of the method for alerting the performance of a business system in this application;

[0049] Figure 5 A schematic diagram of the flow chart of the indicator calculation provided in Example 2 of the present application;

[0050] Figure 6 This is a schematic diagram of the module structure of the business system performance alarm device according to an embodiment of the present application;

[0051] Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the business system performance alarm method in the embodiment of the present application.

[0052] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] refer to Figure 1 , Figure 1 A schematic diagram of the framework serving the traditional APM call chain. Figure 1 Java is used as the standard development language and the call chain framework of the APM server is used as the standard framework of its call chain service. The APM server is connected to the business system (such as application 1, application 2, application 3, application 4 and javaagent agent in the figure), and the APM server stores the collected information in logs. The specific implementation process is as follows:

[0056] 1. Use bytecode instrumentation to monitor the JVM virtual machine.

[0057] 2. When a request arrives, a global TraceID (an identifier used for distributed tracing) is generated. The entire call chain can be connected in series through the TraceID. One TraceID represents one request. In addition to the TraceID, the parent-child relationship of the call can also be recorded through the SpanID.

[0058] 3. During the entire call process, each request must return the TraceID and SpanID. Each service records the TraceID and SpanID attached to the request as a parent-child relationship, and also records the SpanID it generates.

[0059] 4. To view a complete call, just find all call records based on TraceID, and then organize the entire call parent-child relationship through SpanID. The APM server provides call retrieval and call chain details functions, but it cannot provide alarms and locate the source when the application is slow.

[0060] As can be seen from the above, the traditional APM call chain service is based on a chain of single requests (such as applications, services, methods), and lacks monitoring and alarming of various indicators of interface performance (such as average time consumption, TP50, TP90, TP99 failure, maximum time consumption, call volume, availability, etc.). The chain of a single request shows a chain of a large number of requests, lacking an intuitive display after effective analysis. The source of the slowness of the application system requires a lot of manual analysis, resulting in low operation and maintenance efficiency.

[0061] To solve the above problems, this application derives a variety of performance indicators based on the system's interface detailed data. With the help of alarms and large screens, the system's operation status can be perceived in real time. Not only can the interface that causes slowness be quickly located during a fault, but it is also convenient for checking system changes during daily inspections.

[0062] It should be noted that the execution subject of this embodiment can be a computing service device with streaming processing, performance analysis and differentiated alarm functions, such as a personal computer, a server, etc., or an electronic device capable of realizing the above functions, a business system performance alarm device (hereinafter referred to as an alarm device) that executes the business system performance alarm method of this application, etc., and this embodiment does not limit this. The following takes the alarm device as an example to illustrate this embodiment and the following embodiments.

[0063] Based on this, the embodiment of the present application provides a business system performance alarm method, referring to Figure 2 , Figure 2 A flowchart of the first embodiment of the business system performance alarm method of the present application is provided.

[0064] In this embodiment, the service system performance alarm method includes steps S10 to S40:

[0065] Step S10: Streaming the APM interface call chain log of the business system to obtain various performance indicator data of the business system.

[0066] It should be noted that the business system is an information system that is built by calling chains of applications and businesses based on the microservice design concept in order to realize business functions and processes.

[0067] It should be noted that the APM (Application Performance Management) interface call chain log is a log used to record and track the detailed information and sequence of calls between various interfaces during the request processing process of various applications in the business system.

[0068] The APM interface call chain log shows in detail the various links that a request goes through from entering the system to the final processing completion, including the specific interface involved, the time point of the call, the call parameters, the return result, etc. By analyzing the APM interface call chain log, you can perform troubleshooting and implement performance alerts for the business system.

[0069] It should be noted that the various performance indicator data are indicators about interface service quality obtained by streaming the APM interface call chain log (for example, deleting redundant data and extracting called interface data in order of interface level).

[0070] Exemplarily, the various performance indicator data may include the average time consumption, maximum time consumption, call volume, TP50, TP90, TP99, etc. of the interface, which is not limited in this embodiment. Among them, TP50, TP90, and TP99 are indicators for evaluating the performance of the business system or the quality of service. TP50 represents the response time ranked in the top 50% within a time period; TP90 represents the response time ranked in the top 90%; and TP99 represents the response time ranked in the top 99%.

[0071] In one embodiment, the alarm device may first perform streaming processing on the APM interface call chain log of the business system, such as deleting redundant data and extracting the called interface data in order of interface level, so as to obtain various performance indicator data of each interface of the business system, such as the average time consumption, maximum time consumption, call volume, TP50, TP90, TP99, etc. of the interface.

[0072] Step S20: Pushing the various performance indicator data to a time series database.

[0073] It should be noted that the time series database is a database used to process time series data, such as sensor data, the various performance indicator data mentioned above, etc.

[0074] Exemplarily, the time series database may include an Apache Druid time series database, a TimescaleDB time series database, etc., which is not limited in this embodiment.

[0075] In one implementation, considering that the data flow of various performance indicator data is too large, the various performance indicator data can be pushed to a time series database through a distributed publish-subscribe messaging system (eg, Kafka, ActiveMQ, etc.).

[0076] Step S30: performing application performance analysis and method performance analysis on the various performance indicator data through the time series database to obtain abnormal floating data.

[0077] It should be noted that the abnormal floating data is data in abnormal conditions among multiple performance indicator data, such as abnormal floating value of time consumption, abnormal floating value of call volume, abnormal floating value of TP50, abnormal floating value of TP90, abnormal floating value of TP99, number of minutes of abnormal time consumption, number of minutes of abnormal call volume, number of minutes of abnormal TP50, number of minutes of abnormal TP90, number of minutes of abnormal TP99, etc. This embodiment does not limit this.

[0078] It should be noted that, considering that in the business system, there are certain differences between applications and methods in the call chain service, application performance analysis and method performance analysis can be performed separately to prevent the method performance data from being averaged in the application performance analysis or the application performance data from being averaged in the method performance analysis, thereby improving the accuracy of the business system performance alarm of this embodiment.

[0079] Step S40: When the abnormal floating data meets the preset alarm condition, a differentiated alarm is issued to the interface corresponding to the preset alarm condition.

[0080] It should be noted that the preset alarm condition is a pre-set condition for performance abnormality alarm. For example, the above-mentioned abnormal duration in minutes can be limited by a threshold. If the duration in minutes of abnormal fluctuation exceeds the threshold, or other indicators exceed the threshold (for example, the abnormal fluctuation percentage, the number of requests, and the average time consumption exceed the corresponding threshold), differentiated alarms are issued for different services or applications. The specific configuration rules can be set according to the actual situation, and this embodiment does not limit this.

[0081] In this embodiment, the alarm device can first perform streaming processing on the APM interface call chain log of the business system, such as deleting redundant data, extracting the called interface data in the order of interface level, so as to obtain various performance indicator data of each interface of the business system, such as the average time consumption, maximum time consumption, call volume, TP50, TP90, TP99, etc. of the interface. Then, the above-mentioned various performance indicator data are pushed to the time series database through the distributed publish-subscribe message system. Then, the application performance analysis and method performance analysis are performed on the various performance indicator data respectively through the time series database to prevent the method performance data from being averaged out in the application performance analysis or the application performance data from being averaged out in the method performance analysis, so as to obtain more accurate abnormal floating data. Finally, when the abnormal floating data meets the preset alarm condition, the interface corresponding to the preset alarm condition is subjected to differentiated alarm. At this time, the above-mentioned various performance indicator data and the above-mentioned differentiated alarm information can also be sorted in combination with the display large screen to display the currently slow applications and interfaces in the business system, and the source can be found in combination with the APM call chain. Therefore, various performance indicator data can be derived from the interface detail data of the business system, which can quickly locate the interface that causes slowness during a failure, greatly improving the effectiveness of service management and enhancing the automation and efficiency of operation and maintenance.

[0082] In a feasible implementation, after step S40 of this embodiment, the steps may also be included: obtaining the interface traffic of each interface in the business system; sorting the interfaces according to the interface traffic and the abnormal indicator duration minute data to obtain a sorted interface; filtering the sorted interface through the APM call chain to determine the terminal interface of the sorted interface; analyzing and locating the terminal interface to determine the slow interface in the business system.

[0083] It should be noted that interface traffic is the amount of data transmitted by the application interface in the business system. The size of interface traffic can reflect the frequency of interface use and the amount of data transmission.

[0084] It should be noted that the abnormal indicator duration in minutes is the duration of the abnormality of the above-mentioned various performance indicator data, such as the duration of the abnormal time consumption in minutes, the duration of the abnormal call volume in minutes, the duration of the abnormal TP50 in minutes, the duration of the abnormal TP90 in minutes, the duration of the abnormal TP99 in minutes, etc., which are not limited in this embodiment.

[0085] It should be noted that the terminal interface is the interface at the end of the call chain process or system, such as the interface at the outermost layer that directly connects to the user's operation or other external systems. Slow interface refers to the interface with a long response time and slow processing speed in the business system.

[0086] In this embodiment, for ease of understanding, refer to Figure 1 and Figure 3 , Figure 3 This is the overall design diagram for alarming based on call chain data provided in Example 1. Based on the framework of the traditional APM call chain service, service governance components and slow interface analysis components are added, and connected to the time series database, which can realize slow interface alarm, root cause analysis, call chain details, slow interface query and other functions. Specifically, the functions are implemented as follows:

[0087] 1. Call chain data collection. The call chain data can be collected and output to Kafka, and data can be directly extracted from Kafka for streaming calculation to obtain relevant indicator data (such as average time consumption monitoring, maximum time consumption monitoring, call volume monitoring, TP50, TP90, TP99, etc.) and stored in the time series database.

[0088] 2. Further clean the above indicator data to obtain more derivative indicators. The above indicator data can be further calculated and compared with the data of the same period last week to obtain more derivative indicators (such as abnormal floating values, abnormal duration, etc.).

[0089] 3. Configure alarm rules. Configure differentiated alarms for applications and methods based on the above multiple indicators. For example, configure multi-indicator settings for general interface monitoring when the average time monitoring exceeds a certain threshold, the call volume exceeds a certain threshold, and the average time monitoring exceeds a 30% threshold.

[0090] Specifically, for example, the average time monitoring indicator exceeds 5000 milliseconds and the call volume reaches more than 10 calls per minute, for example, the average time monitoring exceeds the seven-day moving average by 30% and the call volume reaches more than 10 calls per minute, for example, the average time monitoring deviation in the same direction exceeds 30% duration and the call volume reaches more than one call per minute.

[0091] 4. Large screen alarm. Combine the above indicator information and the above alarm information to sort by alarm duration and interface traffic, and display the currently slow applications and interfaces. At the same time, filter out redundant interface data through the APM call chain (the link diagram can be obtained according to different scenarios or multiple entrances), determine the terminal interface (that is, the interface that has no subsequent calls in the call chain), and perform business impact analysis to capture the slow interface.

[0092] By deriving a variety of performance indicator data from the interface detail data of the above business systems, the interface that causes slowness can be quickly located during a failure, greatly improving the effectiveness of service governance and enhancing the automation and efficiency of operation and maintenance.

[0093] This embodiment provides a performance alarm method for a business system. The alarm device can first perform streaming processing on the APM interface call chain log of the business system, such as deleting redundant data and extracting the called interface data in order of interface level, so as to obtain a variety of performance indicator data of each interface of the business system, such as the average time consumption, maximum time consumption, call volume, TP50, TP90, TP99, etc. of the interface. Then, the above-mentioned various performance indicator data are pushed to the time series database through the distributed publish-subscribe message system. Then, the various performance indicator data are respectively subjected to application performance analysis and method performance analysis through the time series database to prevent the method performance data from being averaged out in the application performance analysis or the application performance data from being averaged out in the method performance analysis, so as to obtain more accurate abnormal floating data. Finally, when the abnormal floating data meets the preset alarm conditions, the interface corresponding to the preset alarm conditions will be subjected to differentiated alarms. Since this embodiment performs streaming processing on the APM interface call chain log to obtain a variety of performance indicator data, the abnormal floating data in the business system can be quickly analyzed based on the various performance indicator data, avoiding the situation where the traditional alarm based on the call chain of a single request needs to rely on manual analysis, thereby quickly realizing differentiated interface alarms of the business system, greatly improving the effect of service governance, and enhancing the automation and efficiency of operation and maintenance.

[0094] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 and Figure 4 , Figure 4 A flow chart of the second embodiment of the business system performance alarm method of the present application is provided.

[0095] In this example, step S10 includes steps S11 to S13:

[0096] Step S11: Collect the APM interface call chain log of the business system.

[0097] Step S12: Process the APM interface call chain log through a distributed publish-subscribe message system to obtain call interface data.

[0098] It should be noted that the calling interface data is the relevant information or parameters generated when the interface is called, such as average time consumption, maximum time consumption, call volume, TP50, TP90, TP99, etc.

[0099] Step S13: Input the calling interface data into the stream computing component Flink for stream computing to obtain various performance indicator data of the business system.

[0100] It should be noted that the streaming computing component Flink is an open source stream processing framework and distributed processing engine that can efficiently process real-time call interface data and achieve low-latency data processing and response.

[0101] In this implementation, the alarm device can first collect the APM interface call chain log of the business system; then process the APM interface call chain log through the distributed publish-subscribe message system to obtain the call interface data. Finally, the call interface data is input into the streaming computing component Flink for streaming computing to obtain various performance indicator data of the business system. Thus, the call interface data is efficiently processed by the streaming computing component Flink, thereby improving the efficiency of data processing.

[0102] In a feasible implementation, step S13 of this embodiment may include the steps of: setting a time window of a preset time period based on the streaming computing component Flink; taking the interface call start time as a benchmark, merging the calling interface data according to the interface level through the time window to obtain the performance indicator data of each interface in the business system after the preset time period is merged; correspondingly, step S20 includes: pushing the performance indicator data after the preset time period is merged to the time series database through the distributed publish-subscribe message system.

[0103] It should be noted that the preset time period is a fixed time period set in advance, such as 1 minute, 2 minutes, etc. The time window is a method of aggregating and outputting the calling interface data.

[0104] For example, a 1-minute time window is set. During the continuous flow of data from the calling interface, such a window will be formed every 1 minute, and the data in this window will be analyzed as a whole. In this way, continuous streaming data can be divided into regular time periods for processing, reducing the amount of data and improving data processing efficiency.

[0105] It should be noted that the interface level is the hierarchical level of the interface in the business system. The first sorting is performed based on the APM link end interface attributes, and then sorted based on the alarm duration of each indicator at the interface level and the interface traffic to find the interface that is most likely to cause slowness.

[0106] In this implementation, for ease of understanding, one-minute data merging is used as an example for illustration, but this solution is not limited. The APM call chain component generates an interface call chain log, including timestamps, applications, services, methods, interfaces and other data. The processing flow is as follows: First, the APM interface call chain log is collected, and then streaming computing is performed through the streaming computing component Flink. One-minute merging is performed according to the APM interface call chain log to obtain the one-minute merged performance indicator data of each interface in the business system.

[0107] The calculation logic of stream computing is as follows: the call interface data is continuously transmitted to the stream computing middleware Flink through Kafka as the data source, and then a time window is set as 1 minute. The interface information coming in for 1 minute (based on the start time of the interface call) is merged according to the interface level to calculate the average time consumption, maximum time consumption, call volume, TP50, TP90, TP99 and other indicators. Since the same interface will only have one interface data containing multiple indicators in the same minute, the output is the indicator data of one interface of the same interface in this minute, which can greatly reduce the amount of data and lay the foundation for subsequent analysis performance.

[0108] In another feasible implementation, step S30 of this embodiment may include the steps of: based on the time series database, performing application performance analysis on the multiple performance indicator data according to the application field dimension to obtain abnormal floating data of application performance in the business system; performing method performance analysis on the multiple performance indicator data according to the combined dimension of application, service, method and interface to obtain abnormal floating data of method performance in the business system.

[0109] It should be noted that the application field dimension is a dimension for analyzing application performance based on the "application" field.

[0110] It should be noted that the calculation logic of method performance analysis is consistent with that of application performance analysis, but the dimensions are different. The corresponding indicator data (average time consumption, maximum time consumption, call volume, TP50, TP90, TP99 and corresponding derived indicators, etc.) are obtained by combining the four fields of application + service + method + interface as dimensions for performance analysis.

[0111] In this implementation, considering that in the business system, there are certain differences between applications and methods in the call chain service, application performance analysis and method performance analysis can be performed separately to prevent the method performance data from being averaged out in the application performance analysis or the application performance data from being averaged out in the method performance analysis, thereby improving the accuracy of the business system performance alarm of this embodiment.

[0112] In another feasible implementation manner, the step of performing application performance analysis on the multiple performance indicator data according to the application field dimension to obtain abnormal floating data of application performance in the business system described in this embodiment includes: grouping and calculating the multiple performance indicator data according to the application field dimension to obtain indicator data of each application in the business system, the indicator data including multiple historical indicator data of the same period; performing average floating processing on the multiple historical indicator data of the same period to obtain historical floating reference indicators; performing queue processing according to the indicator data of each application and the historical floating reference indicators to obtain abnormal floating data of application performance in the business system.

[0113] It should be noted that the indicator data business system includes the basic indicators of each application, such as the actual average time consumption, maximum time consumption, call volume, TP50, TP90, TP99, etc. of each application, where the average application time consumption = ∑ (average interface time consumption * number of calls) / ∑ number of calls.

[0114] It should be noted that the multiple historical index data are the index data of the multiple historical periods corresponding to the current minute time point, such as four periods last week, or ten periods last week. The more historical periods there are, the more accurate the data is.

[0115] According to multiple historical indicator data for the same period, the historical floating reference indicator can be averaged to form a new indicator, such as the average time consumption abnormal floating value, the maximum time consumption abnormal floating value, the call volume abnormal floating value, the TP50 abnormal floating value, the TP90 abnormal floating value, the TP99 abnormal floating value, historical floating reference indicators, etc. This embodiment does not limit this.

[0116] In this implementation, the alarm device can query the indicator data of one-minute interfaces from the time series database, group them according to the application field dimension, and calculate the indicator data of all interfaces of a single application in the current 1 minute. Then, the indicator data of the four same periods last week are averaged to obtain the historical floating reference indicator, forming a new indicator. Finally, queue processing is performed based on the indicator data of each application and the historical floating reference indicator to obtain abnormal floating data of application performance in the business system. Therefore, floating reference can be made through multiple historical indicator data of the same period to improve the accuracy of the alarm.

[0117] In another feasible implementation, the step of performing queue processing according to the indicator data of each application and the historical floating reference indicator to obtain abnormal floating data of application performance in the business system described in this embodiment includes: assembling the indicator data of each application and the historical floating reference indicator to obtain json format data; caching the json format data to a key-value pair storage database according to a preset queue length, and extracting historical values ​​from each queue; if the historical value exceeds a preset threshold within a preset continuous time period, recording the abnormal indicator duration minute data, and using the abnormal indicator duration minute data as the abnormal floating data of application performance in the business system.

[0118] It should be noted that JSON format data is a lightweight data exchange format that uses a key-value pair structure with a concise and clear data structure.

[0119] It should be noted that the key-value pair storage database is a database for caching queue data and can support multiple data structures, such as strings, lists, sets, hashes, etc. The preset queue length is the pre-set data length for caching JSON format data into the key-value pair storage database.

[0120] It should be noted that the historical value corresponds to the value of the above-mentioned multiple historical indicator data of the same period. The preset threshold is a threshold set in advance for determining whether the historical value is abnormal.

[0121] It should be noted that the abnormal indicator duration data is the number of minutes of abnormality recorded when the historical value exceeds the preset threshold, such as the average duration of abnormality, the maximum duration of abnormality, the call volume abnormality, the TP50 abnormality, the TP90 abnormality, the TP99 abnormality, etc. This embodiment does not limit this.

[0122] In this embodiment, the index data of each application and the historical floating reference index can be assembled into json format data; in order to store a large amount of real-time data with high performance, redis middleware can be used as a cache medium, and the orderliness uses a queue (the queue length can be set to 60 minutes) as a stored data structure to be cached in redis. Then take out the historical value from the queue, the average time-consuming abnormal floating value, the maximum time-consuming abnormal floating value, the call volume abnormal floating value, the TP50 abnormal floating value, the TP90 abnormal floating value, and the TP99 abnormal floating value obtained from each queue, and judge whether it exceeds the threshold (for example, 30%, the threshold can be personalized according to different applications). If the threshold is exceeded for 5 consecutive minutes, the abnormal index continues to record the minute data, and the abnormal index continues to use the minute data as the abnormal floating data of the application performance in the business system. If it is not exceeded for 5 consecutive minutes, the duration is reset to 0. Thus, the interface that causes slowness can be quickly located by the abnormal index continuous minute data.

[0123] The alarm device of this embodiment can first collect the APM interface call chain log of the business system; then process the APM interface call chain log through the distributed publish-subscribe message system to obtain the call interface data. Finally, the call interface data is input into the streaming computing component Flink for streaming computing to obtain various performance indicator data of the business system. Thus, the call interface data is efficiently processed by the streaming computing component Flink, thereby improving the efficiency of data processing. Furthermore, considering that there are certain differences between applications and methods in the call chain service in the business system, application performance analysis and method performance analysis can be performed separately to prevent the method performance data from being averaged out in the application performance analysis or the application performance data from being averaged out in the method performance analysis, thereby improving the accuracy of the performance alarm of the business system of this embodiment.

[0124] For example, to help understand the implementation process of the service system performance alarm method obtained by combining the above-mentioned embodiment 1 and embodiment 2, please refer to Figure 5 , Figure 5 The following is a flow chart of the indicator calculation provided in Example 2 of the present application, specifically:

[0125] 1. Collect the interface request details in the APM interface call chain log and perform streaming calculations to obtain one-minute merged indicator data, including: average time consumption, maximum time consumption, call volume, TP50, TP90, TP99, etc.

[0126] 2. The above one-minute merged indicator data is pushed to the time series database by sending Kafka.

[0127] 3. Set two scheduled tasks (application performance analysis and method performance analysis) that are triggered every 1 minute to analyze the one-minute indicator data of the time series database. Compare the one-minute application-level indicator with the four historical floating reference indicators of the same period last week, and compare the one-minute interface-level indicator with the four historical floating reference indicators of the same period last week, and perform redis queue caching.

[0128] 4. Then, the average time consumption abnormal floating value, maximum time consumption abnormal floating value, call volume abnormal floating value, TP50 abnormal floating value, TP90 abnormal floating value, and TP99 abnormal floating value obtained from each queue are judged whether they exceed the threshold (for example, 30%, which can be configured according to different applications). If the calculation exceeds the threshold for 5 consecutive minutes, the calculation of the application-level abnormal indicator lasting minute data and the calculation of the interface-level abnormal indicator lasting minute data are started. Among them, the calculation logic of the interface method performance analysis is consistent with the application calculation logic.

[0129] 5. The results of the above calculations are pushed to the time series database again by sending Kafka.

[0130] 6. Finally, configure the alarm rules, personalize the abnormal indicator duration data and other reference indicators (such as abnormal floating percentage, number of requests, average time), and issue alarms for different businesses. At the same time, the large screen combines the indicator information and alarm information to sort, display the current slow applications and interfaces, and find the source through the APM call chain.

[0131] This enables interface troubleshooting, troubleshooting, and analysis, greatly improving the efficiency and effectiveness of service governance (operation and maintenance fault location), while reducing development and operation and maintenance costs and improving automation levels and operation and maintenance efficiency.

[0132] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the business system performance alarm method of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0133] This application also provides a business system performance alarm device, please refer to Figure 6 , Figure 6 This is a schematic diagram of the module structure of the business system performance alarm device of the embodiment of the present application; the business system performance alarm device includes:

[0134] The stream processing module 601 is used to perform stream processing on the APM interface call chain log of the business system to obtain various performance indicator data of the business system;

[0135] A data push module 602 is used to push the various performance indicator data to a time series database;

[0136] The performance analysis module 603 is used to perform application performance analysis and method performance analysis on the various performance indicator data through the time series database to obtain abnormal floating data;

[0137] The abnormal alarm module 604 is used to issue a differentiated alarm to the interface corresponding to the preset alarm condition when the abnormal floating data meets the preset alarm condition.

[0138] The business system performance alarm device provided by the present application adopts the business system performance alarm method in the above embodiment, which can solve the problem that the traditional alarm is based on a call chain of a single request, cannot provide support for operation and maintenance personnel to find problems in advance, and needs to rely on the experience of operation and maintenance personnel and a large amount of manual analysis to achieve alarm positioning, resulting in a technical problem of low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the business system performance alarm device provided by the present application are the same as the beneficial effects of the business system performance alarm method provided by the above embodiment, and the other technical features in the business system performance alarm device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0139] The present application provides a business system performance alarm device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the business system performance alarm method in the above-mentioned embodiment one.

[0140] Reference below Figure 7 , Figure 7 The schematic diagram of the device structure of the hardware operating environment involved in the business system performance alarm method in the embodiment of the present application shows a schematic diagram of the structure of the business system performance alarm device suitable for implementing the embodiment of the present application. The business system performance alarm device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The business system performance alarm device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0141] like Figure 7As shown, the business system performance alarm device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM) 1004. Various programs and data required for the operation of the business system performance alarm device are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 may allow the business system performance alarm device to communicate wirelessly or by wire with other devices to exchange data. Although the figure shows a business system performance alarm device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0142] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0143] The business system performance alarm device provided by the present application adopts the business system performance alarm method in the above embodiment, which can solve the problem that the traditional alarm is based on a single request call chain, cannot provide support for operation and maintenance personnel to find problems in advance, and needs to rely on the experience of operation and maintenance personnel and a large amount of manual analysis to achieve alarm positioning, resulting in a technical problem of low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the business system performance alarm device provided by the present application are the same as the beneficial effects of the business system performance alarm method provided in the above embodiment, and the other technical features in the business system performance alarm device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0144] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0145] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0146] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the service system performance alarm method in the above-mentioned embodiment.

[0147] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0148] The computer-readable storage medium mentioned above may be included in the business system performance alarm device; or may exist independently without being assembled into the business system performance alarm device.

[0149] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the business system performance alarm device, the business system performance alarm device: performs streaming processing on the APM interface call chain log of the business system to obtain various performance indicator data of the business system; pushes the various performance indicator data to a time series database; performs application performance analysis and method performance analysis on the various performance indicator data through the time series database to obtain abnormal floating data; when the abnormal floating data meets the preset alarm conditions, a differentiated alarm is issued for the interface corresponding to the preset alarm conditions.

[0150] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0151] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0152] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0153] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned business system performance alarm method, and can solve the problem that the traditional alarm is based on a call chain of a single request, and cannot provide support for operation and maintenance personnel to find problems in advance, and needs to rely on the experience of operation and maintenance personnel and a large amount of manual analysis to achieve alarm positioning, resulting in a technical problem of low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the business system performance alarm method provided by the above-mentioned embodiment, and will not be repeated here.

[0154] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned business system performance alarm method when executed by a processor.

[0155] The computer program product provided by the present application can solve the technical problem that the traditional alarm is based on a call chain of a single request, which cannot provide support for operation and maintenance personnel to find problems in advance, and needs to rely on the experience of operation and maintenance personnel and a large amount of manual analysis to realize alarm positioning, resulting in low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the business system performance alarm method provided by the above embodiment, which will not be repeated here.

[0156] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A business system performance alarm method, characterized in that: The method includes: Perform streaming processing on the APM interface call chain log of the business system to obtain various performance indicator data of the business system; Pushing the multiple performance indicator data to a time series database; Performing application performance analysis and method performance analysis on the various performance indicator data through the time series database to obtain abnormal floating data; When the abnormal floating data meets the preset alarm condition, a differentiated alarm is issued to the interface corresponding to the preset alarm condition.

2. The method according to claim 1, characterized in that The step of performing streaming processing on the APM interface call chain log of the business system to obtain various performance indicator data of the business system includes: Collect the APM interface call chain log of the business system; Process the APM interface call chain log through a distributed publish-subscribe message system to obtain call interface data; The calling interface data is input into the streaming computing component Flink for streaming computing to obtain various performance indicator data of the business system.

3. The method according to claim 2, characterized in that The step of inputting the calling interface data into the stream computing component Flink for stream computing to obtain various performance indicator data of the business system includes: Setting a time window of a preset time period based on the stream computing component Flink; Based on the interface call start time, the call interface data is merged according to the interface level through the time window to obtain the performance indicator data of each interface in the business system after the preset time period is merged; Accordingly, the step of pushing the multiple performance indicator data to the time series database includes: The performance indicator data after merging the preset time periods is pushed to the time series database through the distributed publish-subscribe message system.

4. The method according to claim 1, characterized in that The step of performing application performance analysis and method performance analysis on the various performance indicator data through the time series database to obtain abnormal floating data includes: Based on the time series database, application performance analysis is performed on the multiple performance indicator data according to the application field dimension to obtain abnormal floating data of application performance in the business system; The method performance analysis is performed on the multiple performance indicator data based on the combined dimensions of application, service, method and interface to obtain abnormal floating data of the method performance in the business system.

5. The method according to claim 4, characterized in that The step of performing application performance analysis on the multiple performance indicator data according to the application field dimension to obtain abnormal floating data of application performance in the business system includes: Grouping and calculating the multiple performance indicator data according to the application field dimension to obtain indicator data of each application in the business system, wherein the indicator data includes multiple historical indicator data of the same period; Performing average floating processing on the multiple historical index data of the same period to obtain a historical floating reference index; Queue processing is performed according to the indicator data of each application and the historical floating reference indicator to obtain abnormal floating data of application performance in the business system.

6. The method according to claim 5, characterized in that The step of performing queue processing according to the indicator data of each application and the historical floating reference indicator to obtain abnormal floating data of application performance in the business system includes: Assemble the indicator data of each application and the historical floating reference indicator to obtain json format data; Cache the JSON format data into a key-value pair storage database according to the preset queue length, and extract historical values ​​from each queue; If the historical value exceeds a preset threshold value within a preset continuous time period, the abnormal indicator duration minute data is recorded, and the abnormal indicator duration minute data is used as abnormal floating data of application performance in the business system.

7. The method according to claim 6, characterized in that After the step of performing a differentiated alarm on the interface corresponding to the preset alarm condition when the abnormal floating data meets the preset alarm condition, the method further includes: Obtaining the interface traffic of each interface in the business system; Sort the interfaces according to the interface traffic and the abnormal index duration data in minutes to obtain a sorted interface; Filter the sorting interface through the APM call chain to determine the end interface of the sorting interface; The terminal interface is analyzed and located to determine the slow interface in the service system.

8. A business system performance alarm device, characterized in that: The device comprises: A stream processing module is used to perform stream processing on the APM interface call chain log of the business system to obtain various performance indicator data of the business system; A data push module, used to push the multiple performance indicator data to a time series database; A performance analysis module, used to perform application performance analysis and method performance analysis on the multiple performance indicator data through the time series database to obtain abnormal floating data; The abnormal alarm module is used to, when the abnormal floating data meets the preset alarm condition, issue a differentiated alarm to the interface corresponding to the preset alarm condition.

9. A business system performance alarm device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the service system performance alarm method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the service system performance alarm method according to any one of claims 1 to 7 are implemented.

Images