Time series data abnormity alarm system and method and computer readable storage medium

Abstract

The invention is suitable for the technical field of data, provides a time series data abnormity alarm system and method and a computer readable storage medium, realizes automatic monitoring of data change in combination with change of a timestamp and an attribute value, triggers an alarm under an abnormal condition, and has practicability and usability. The system comprises a data middle table and a TD engine time sequence database, the TD engine time sequence database comprises a first data table, the data middle table is used for obtaining incremental data from the TD engine time sequence database and storing the incremental data and a current timestamp into the first data table when a monitoring task is started, and the incremental data comprises fields and attribute values; the monitoring task obtains a first attribute value, corresponding to the current timestamp, of the preset field and a second attribute value, corresponding to the previous timestamp, of the preset field from the first data table; if the difference value between the first attribute value and the second attribute value exceeds a preset attribute value threshold value, the data intermediate station displays alarm information, and the alarm information is used for reminding a user that the incremental data is abnormal.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a time series data abnormality alarm system, method and computer-readable storage medium. Background Art

[0002] At present, with the rapid development of technologies such as big data, the Internet of Things, and cloud computing, the amount of enterprise data is growing explosively, especially time series data, which is increasingly widely used in the fields of the Internet of Things, smart manufacturing, and smart cities. In the process of building a data middle platform, how to effectively monitor and analyze time series data and promptly discover and handle abnormal conditions has become an important challenge in the digital transformation of enterprises. Traditional anomaly detection methods often rely on manually set thresholds, and have problems such as slow response speed, high false alarm rate, and difficulty in adapting to dynamic changes. Summary of the invention

[0003] The embodiments of the present application provide a time series data anomaly alarm system, method and computer-readable storage medium, which can solve the problem of failure to timely discover data anomalies in the TDengine time series database.

[0004] In a first aspect, an embodiment of the present application provides a time series data abnormality alarm system, including a data middle station and a TDengine time series database, wherein the TDengine time series database includes a first data table:

[0005] The data middle station is used to obtain incremental data from the TDengine time series database when the monitoring task is started, and store the incremental data and the current timestamp in the first data table, wherein the incremental data includes fields and attribute values;

[0006] The monitoring task obtains, from the first data table, a first attribute value of a preset field corresponding to a current timestamp and a second attribute value of the preset field corresponding to a previous timestamp;

[0007] If the difference between the first attribute value and the second attribute value exceeds a preset attribute value threshold, the data center displays an alarm message, and the alarm message is used to remind the user that the incremental data is abnormal.

[0008] In a second aspect, an embodiment of the present application provides a method for a time series data abnormality alarm system as described above, which is applied to a data middle station of the time series data abnormality alarm system, and the method includes:

[0009] When the monitoring task is started, incremental data is obtained from the TDengine time series database, and the incremental data and the current timestamp are stored in a first data table, wherein the incremental data includes fields and attribute values;

[0010] The monitoring task obtains, from the first data table, a first attribute value of a preset field corresponding to a current timestamp and a second attribute value of the preset field corresponding to a previous timestamp;

[0011] If the difference between the first attribute value and the second attribute value exceeds a preset attribute value threshold, the data center displays an alarm message, and the alarm message is used to remind the user that the incremental data is abnormal.

[0012] In a third aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device executes the time series data abnormality alarm system described in the first aspect above.

[0013] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0014] Compared with the prior art, the embodiments of the present application have the following beneficial effects: the data center of the embodiments of the present application is used to obtain incremental data from the TDengine time series database when the monitoring task is started, and to store the incremental data and the current timestamp in the first data table, wherein the incremental data includes fields and attribute values; the monitoring task obtains the first attribute value of the preset field corresponding to the current timestamp and the second attribute value of the preset field corresponding to the previous timestamp from the first data table; if the difference between the first attribute value and the second attribute value exceeds the preset attribute value threshold, the data center displays an alarm message, and the alarm message is used to remind the user that the incremental data is abnormal. By creating a monitoring task through the data center and then obtaining the attribute values ​​of the preset fields in different time periods, combined with the changes in timestamps and attribute values, automatic monitoring of data changes is achieved, and warnings can be triggered under abnormal circumstances. The present application is practical and easy to use. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 This is a first schematic diagram of a time series data abnormality alarm system provided by an embodiment of the present application;

[0017] Figure 2 This is a second schematic diagram of a time series data abnormality alarm system provided by an embodiment of the present application;

[0018] Figure 3It is a structural diagram of the data middle platform and TDengine time series database provided in one embodiment of the present application;

[0019] Figure 4 It is a flowchart of a method for abnormal alarm of time series data provided by an embodiment of the present application; DETAILED DESCRIPTION

[0020] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0021] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0022] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0023] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0024] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0025] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0026] The present invention can be used in a distributed architecture and modular design based on a distributed time series database (TDengine time series database). As an open source, cloud-native TDengine time series database, TDengine has been widely used in the industry for its high performance, high reliability, and high scalability. TDengine not only supports efficient data reading, writing, and storage, but also integrates functions such as caching, streaming computing, and data subscription, providing a one-stop solution for the processing of time series data, focusing on the following two capabilities: (1) Data collection and storage: The TDengine time series database can receive data from IoT devices, sensors, etc. in real time through its efficient data writing and storage capabilities, and store it in a distributed cluster to ensure data integrity and consistency. (2) Data subscription function: The TDengine time series database supports a data subscription (Publisher / Subscriber) mechanism, allowing users to subscribe to data of specific types or conditions according to business needs, providing a basis for real-time monitoring and anomaly detection.

[0027] Figure 1 1 is a first schematic diagram of a time series data abnormality alarm system provided in an embodiment of the present application. The system includes a data middle station 10 and a TDengine time series database 11, and the TDengine time series database 11 includes a first data table.

[0028] In one embodiment, the data middle station 10 is used to obtain incremental data from the TDengine time series database 11 when the monitoring task is started, and store the incremental data and the current timestamp in the first data table, wherein the incremental data includes fields and attribute values;

[0029] The monitoring task obtains, from the first data table, a first attribute value of a preset field corresponding to a current timestamp and a second attribute value of the preset field corresponding to a previous timestamp;

[0030] If the difference between the first attribute value and the second attribute value exceeds the preset attribute value threshold, the data center 10 displays an alarm message, which is used to remind the user that there is an abnormality in the incremental data.

[0031] Optionally, the first data table may be a sub-table in a super table.

[0032] The time series data anomaly alarm system improves data processing efficiency: through TDengine's time series data optimization storage and query mechanism, the speed and efficiency of data processing are greatly improved, ensuring low latency and high throughput in a massive data environment. And, more efficient anomaly detection: combined with TDengine's subscription capabilities, through the task mechanism of elastic time intervals, real-time data streams are acquired, and quickly analyzed and processed, abnormal patterns or trends in the data are discovered and identified in a timely manner, and timely and accurate anomaly alarm services are provided for enterprise operations. Furthermore, the scalability and flexibility of the system are enhanced: based on TDengine's distributed architecture and modular design, this system has good scalability and flexibility, and can easily cope with the growth of data volume and changes in business needs. The time series data anomaly alarm system creates a monitoring task through the data middle station to obtain the attribute values ​​of preset fields in different time periods, combines the changes in timestamps and attribute values, realizes automatic monitoring of data changes, and can trigger warnings under abnormal circumstances. This application is practical and easy to use.

[0033] In some embodiments, the data middle platform 10 is used to configure the update mode of the incremental data before acquiring the incremental data from the TDengine time series database 11.

[0034] In some embodiments, the data middle platform 10 is used to obtain the table name of the super table, the table name of the first data table, and the preset fields;

[0035] Generate a data query instruction according to the table name of the super table, the table name of the first data table, and the preset fields;

[0036] According to the data query instruction, incremental data is obtained from the TDengine time series database 11.

[0037] Among them, the TDengine time series database 11 includes a super table, and the super table includes a first data table.

[0038] Optionally, the data query instruction may be SELECT*FROM <super table>.<first data table> WHERE timestamp>'last_queried_timestamp'.

[0039] The time series data anomaly alarm system uses the automatic arrangement and execution of SQL instructions: after the user selects the super table, subtable and field through the interface, the system automatically arranges them into SQL query instructions and creates corresponding task records. This process simplifies user operations and improves the degree of automation of data acquisition. In addition, it reduces the complexity of operations and user thresholds: the functions of automatically arranging SQL instructions and creating task records allow users to easily achieve data acquisition and monitoring without having deep database knowledge. This greatly reduces the complexity of operations, broadens the user group, and allows more people with non-technical backgrounds to participate in data management and analysis.

[0040] In some embodiments, the data center 10 further includes a device timestamp table; when the monitoring task is started, after the data center 10 obtains the incremental data from the TDengine time series database 11, the data center 10 stores the current timestamp in the device timestamp table. Optionally, the device timestamp table may be a device_timestamp table.

[0041] Specifically, each time data is successfully obtained, the corresponding last_queried_timestamp value in the divice_timestamp table is updated for use in the next query. Each time data is obtained, the last obtained lasttimestemp is recorded in the divice_timestemp table associated with the data center business table.

[0042] The time series data anomaly alarm system implements timestamp tracking of incremental data: a table (such as device_timestamp) that records the last query timestamp is maintained in the database, which is used as a filter condition in subsequent queries to ensure that only incremental data is obtained. This method effectively avoids repeated acquisition of data. The time series data anomaly alarm system enhances data consistency and accuracy: By maintaining a table that records the last query timestamp, this technical solution ensures accurate acquisition of incremental data, avoids data duplication or omission, and thus improves data consistency and accuracy.

[0043] In one embodiment, the data middle station 10 also includes a second data table; the data middle station 10 is used to store the startup information into the second data table when the monitoring task is started, wherein the startup information includes the number of startups and the startup status.

[0044] Furthermore, the data middle station 10 is used to store the incremental information of the incremental data into the second data table after obtaining the incremental data from the TDengine time series database 11 when the monitoring task is started, wherein the incremental information includes the start time, execution duration, and data volume of the incremental data.

[0045] Optionally, the second data table may be a connection_job task table.

[0046] The time series data anomaly alarm system adopts execution record and performance monitoring: a detailed execution record table is designed in the system to record the execution time, interval, duration and other information of each task, which is convenient for subsequent performance analysis and troubleshooting.

[0047] Figure 2 1 is a second schematic diagram of a time series data anomaly alarm system provided in an embodiment of the present application, which is provided as an example and not as a limitation. The system further includes an anomaly analysis module 12 and / or a solution recommendation module 13. Figure 2 As shown, the system further specifically includes an abnormality analysis module 12 and a solution recommendation module 13. The alarm information includes a first attribute value, a current timestamp corresponding to the first attribute value, a second attribute value, and a previous timestamp corresponding to the second attribute value.

[0048] In some embodiments, the abnormality analysis module 12 is used to perform machine learning based on the first attribute value, the current timestamp, the second attribute value, and the previous timestamp to obtain an abnormality analysis model. The first attribute value, the current timestamp, the second attribute value, and the previous timestamp are input into the abnormality analysis model to output abnormality information, wherein the abnormality information includes an abnormality name and an abnormality cause.

[0049] In some embodiments, the system also includes a solution recommendation module 13, which is used to perform machine learning based on exception information to obtain a solution recommendation model; wherein, the exception name and the cause of the exception are input into the solution recommendation model, and a reference solution can be output.

[0050] For example, in some specific implementations, the following may be used: Figure 1 The specific implementation scheme of the abnormal alarm system of time series data shown is as follows:

[0051] 1. System architecture and components: The system involved in the implementation of this technology mainly includes a data middle platform and a TDengine database. The data middle platform is responsible for the creation, scheduling, execution, and result display and alarm of tasks. The TDengine database provides data storage and query interfaces as a data source.

[0052] 2. Incremental update and elastic acquisition: The user checks the "Incremental update" option and selects the "Elastic acquisition" mode. At this time, the system automatically generates a launcher for the task, which has a built-in algorithm to adjust the execution frequency according to the incremental data ratio.

[0053] 3. Data change monitoring: Process the acquired data and monitor the value changes of the specified fields. Calculate the extent of attribute value changes by comparing the attribute values ​​and timestamps.

[0054] 4. Alarm triggering: According to the preset alarm rules (such as attribute value changes exceeding the threshold), the alarm mechanism is triggered. The alarm information can be sent to relevant personnel via email, SMS, system notification, etc.

[0055] 5. Data analysis: Combined with the natural language big model, conduct in-depth analysis of abnormal situations to understand the meaning and possible causes behind the data.

[0056] 6. Solution provision: Based on the analysis results, the natural language big model generates reference solutions or suggestions to help users quickly respond to problems.

[0057] The time series data anomaly alarm system adopts data change monitoring and alarm: combined with the changes in timestamps and attribute values, it realizes real-time monitoring of data changes and can trigger alarms under abnormal circumstances. This function enhances the system's responsiveness and fault prevention capabilities. In addition, the time series data anomaly alarm system promotes intelligent decision-making and business optimization: combined with natural language large models for anomaly analysis and solution recommendations, this technical solution not only provides data support, but also helps users better understand the meaning behind the data through intelligent means, providing strong support for business decisions. At the same time, through in-depth analysis of data changes, users can promptly discover problems and opportunities in the business, optimize business processes, and improve business performance.

[0058] Figure 3 It is a structural diagram of a data middle station 10 and a TDengine time series database 11 provided in an embodiment of the present application. The data middle station 10 is used to create a monitoring task, and, when creating a monitoring task, to generate a launcher matching the monitoring task, and the launcher is used to start the monitoring task.

[0059] In one embodiment, the initiator starts the monitoring task at the start time; wherein,

[0060] When the launcher starts the monitoring task for the first time, the startup time is 1 minute;

[0061] When the launcher starts the monitoring task for the second time, the startup time is 5 minutes;

[0062] When the launcher starts the monitoring task for the second time, if the incremental data ratio is greater than the preset threshold, the startup time will be shortened; if the incremental data ratio is greater than the preset threshold, the startup time will be extended; where the incremental data ratio is:

[0063]

[0064] The time series data anomaly alarm system adopts a dynamic and adaptive incremental data pulling mechanism: it introduces a mechanism to dynamically adjust the data pulling time interval based on the ratio of the previous two incremental data. This mechanism not only ensures the timeliness of the data, but also reduces unnecessary system load through intelligent adjustment and improves the efficiency of data processing.

[0065] Further, when the launcher starts the monitoring task for the second time, if the incremental data ratio is greater than the preset threshold, the start time is 10 seconds to 1 minute; and / or, when the launcher starts the monitoring task for the second time, if the incremental data ratio is greater than the preset threshold, the start time is 1 minute to 5 minutes.

[0066] The time series data anomaly alarm system improves data processing efficiency and real-time performance: by dynamically adjusting the time interval for pulling data, the system can flexibly adjust the data processing frequency according to the actual data growth situation when it is unable to pull the stream in real time. This ensures the real-time performance of the data while improving the timeliness and timeliness of data acquisition, and avoids unnecessary waste of system resources. It significantly improves data processing efficiency while ensuring real-time monitoring of time series data.

[0067] For example, in some specific implementations, the following may be used: Figure 3 The specific implementation scheme of the abnormal alarm system of time series data shown is as follows:

[0068] 1. System architecture and components: The system involved in the implementation of this technology mainly includes a data middle platform (data platform), a TDengine database (TDengine time series database), and possible data processing and analysis modules (such as a large natural language model). The data middle platform is responsible for the creation, scheduling, execution, and display and alarm of tasks. The TDengine database provides data storage and query interfaces as a data source, and the data processing and analysis module is used to further process and analyze the acquired data. When creating a new monitoring task in the data middle platform, you cannot directly choose the real-time update method.

[0069] 2. Task creation: On the data center platform, users create new monitoring tasks through the graphical interface. During the task configuration process, users need to select the data source (i.e. the service port of the TDengine database), super table, sub table, and fields to be monitored. When the data center adds a new monitoring task, the data center will obtain the table structure of the TDengine database under the corresponding service port through the database connection, and the user will select the super table, sub table, and field.

[0070] 3. Incremental update and elastic acquisition: The user checks the "Incremental update" option and selects the "Elastic acquisition" mode. At this time, the system automatically generates a launcher for the task, which has a built-in algorithm to adjust the execution frequency according to the incremental data ratio. After checking the incremental update, do not enter the cron expression, and select elastic acquisition. At this time, the data center will configure a launcher for this task.

[0071] 4. SQL command arrangement: Based on the table structure and fields selected by the user, the data middle platform automatically arranges SQL query instructions. This instruction is used to retrieve data within a specified time range from the TDengine database. After the user selects the super table, sub-table, and field, it will be automatically arranged into a SQL instruction.

[0072] 5. Task table and records: The system creates a new data in the connection_job task table to record the execution information of the task, including the number of executions, execution status, etc. At the same time, a subtable is associated to record the time interval, execution duration, amount of incremental data obtained, and other detailed information for each SQL execution. Create a new connection_job task table data, the table will record the number of executions, and the table will also be associated with a subtable to record the time interval, execution duration, and other information for each SQL execution.

[0073] 6. Scheduled execution: The launcher triggers the task execution according to the preset rules (1 minute for the first time, 5 minutes for the first two times, and then dynamically adjusted according to the incremental data ratio). The first time the task is started, the default is a scheduled task once every 1 minute. The first two times will be executed at an interval of 5 minutes, but after the second time, each execution will be synchronized with the ratio of the incremental data obtained in the previous two times, and the execution time interval will be expanded and reduced synchronously. The default minimum is once every 10 seconds and the maximum is once every 5 minutes. If the last incremental data is 0, the interval is adjusted to 1 minute this time.

[0074] 7. Data query: When executing SQL query instructions, use the last_queried_timestamp of the previous record as the filtering condition, and use the "WHERE timestamp>'last_queried_timestamp'" statement to obtain incremental data. When executing the next task, SQL compilation will bring the timestamp into "WHERE timestamp>'last_queried_timestamp';" to achieve the requirement of only obtaining incremental data.

[0075] 8. Timestamp update: After each successful acquisition of data, the corresponding last_queried_timestamp value in the divice_timestamp table is updated for use in the next query. After each acquisition of data, the last acquired lasttimestemp is recorded in the divice_timestemp table associated with the data center business table.

[0076] 9. Data change monitoring: Process the acquired data and monitor the value changes of the specified fields. Calculate the extent of attribute value changes by comparing the previous attribute values ​​and timestamps. After acquiring the data, by monitoring the data changes of the corresponding fields, combining the previous attribute values ​​with the timestamps in the associated subtable of the acquired data, you can know the extent of attribute value changes within the interval.

[0077] 10. Alarm triggering: According to the preset alarm rules (such as attribute value changes exceeding the threshold), the alarm mechanism is triggered. The alarm information can be sent to relevant personnel through email, SMS, system notification, etc. Combined with the timestamp in the data association subtable, the extent of the attribute value change within the interval can be known, so as to trigger whether to alarm.

[0078] 11. Data analysis: Combined with the natural language big model, in-depth analysis of abnormal situations, understanding the meaning and possible reasons behind the data. Combined with the natural language big model, analysis of abnormal situations and provide reference solutions.

[0079] 12. Solution provision: Based on the analysis results, the natural language big model generates reference solutions or suggestions to help users quickly respond to problems.

[0080] The time series data anomaly alarm system makes full use of the high performance, high reliability and high scalability of the TDengine time series database, as well as its powerful data subscription, through flexible scheduled tasks and data analysis, to perform pseudo real-time, precise monitoring and anomaly detection of massive time series data. Specifically, the purposes of the present invention include but are not limited to the following aspects: (1) Improving data processing efficiency: By optimizing the storage and query mechanism of TDengine's time series data, the speed and efficiency of data processing are greatly improved, ensuring low latency and high throughput in a massive data environment. (2) More efficient anomaly detection: In combination with TDengine's subscription capabilities, through the task mechanism with flexible time intervals, real-time data streams are acquired, quickly analyzed and processed, and abnormal patterns or trends in the data are discovered and identified in a timely manner, providing timely and accurate anomaly alarm services for enterprise operations. (3) Enhance the scalability and flexibility of the system: Based on the distributed architecture and modular design of TDengine, this system has good scalability and flexibility, and can easily cope with the growth of data volume and changes in business needs.

[0081] Figure 4 1 is a flow chart of a method for abnormal alarm of time series data provided by an embodiment of the present application. The method is applied to the data middle station of the abnormal alarm system of time series data. Figure 4 As shown, the method includes:

[0082] S401: when the monitoring task is started, obtaining incremental data from the TDengine time series database, and storing the incremental data and the current timestamp in a first data table, wherein the incremental data includes fields and attribute values;

[0083] S402: The monitoring task obtains, from the first data table, a first attribute value of a preset field corresponding to a current timestamp and a second attribute value of a preset field corresponding to a previous timestamp;

[0084] S403: If the difference between the first attribute value and the second attribute value exceeds a preset attribute value threshold, an alarm message is displayed, and the alarm message is used to remind the user that an abnormality occurs in the incremental data.

[0085] In one embodiment, when creating a monitoring task, an initiator matching the monitoring task is generated, and the initiator is used to start the monitoring task.

[0086] Optionally, the launcher starts the monitoring task at the start time; wherein,

[0087] When the launcher starts the monitoring task for the first time, the startup time is 1 minute;

[0088] When the launcher starts the monitoring task for the second time, the startup time is 5 minutes;

[0089] When the launcher starts the monitoring task for the second time, if the incremental data ratio is greater than the preset threshold, the startup time will be shortened; if the incremental data ratio is greater than the preset threshold, the startup time will be extended; where the incremental data ratio is:

[0090]

[0091] Optionally, when the initiator starts the monitoring task for the second time or later, if the incremental data ratio is greater than a preset threshold, the start time is 10 seconds to 1 minute;

[0092] and / or,

[0093] When the launcher starts the monitoring task for the second time, if the incremental data ratio is greater than the preset threshold, the startup time is 1 minute to 5 minutes.

[0094] In one embodiment, when the monitoring task is started, the start information is stored in the second data table, wherein the start information includes the start times and the start status.

[0095] Optionally, when the monitoring task is started, after obtaining the incremental data from the TDengine time series database, the incremental information of the incremental data is stored in the second data table, wherein the incremental information includes the start time, execution duration, and data volume of the incremental data.

[0096] In one embodiment, the table name of the super table, the table name of the first data table, and preset fields are obtained; a data query instruction is generated according to the table name of the super table, the table name of the first data table, and the preset fields; and incremental data is obtained from the TDengine time series database according to the data query instruction.

[0097] In one embodiment, when the monitoring task is started, after obtaining incremental data from the TDengine timing database, the current timestamp is stored in the device timestamp table.

[0098] In one embodiment, before the monitoring task is started, the update mode of the incremental data is configured.

[0099] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0100] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0101] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0102] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the embodiments of the method of the time series data abnormality alarm system as described above can be implemented.

[0103] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0105] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0106] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0107] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0108] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0109] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A time series data abnormality alarm system, characterized in that: It includes a data center and a TDengine time series database, and the TDengine time series database includes a first data table: The data middle station is used to obtain incremental data from the TDengine time series database when the monitoring task is started, and store the incremental data and the current timestamp in the first data table, wherein the incremental data includes fields and attribute values; The monitoring task obtains, from the first data table, a first attribute value of a preset field corresponding to a current timestamp and a second attribute value of the preset field corresponding to a previous timestamp; If the difference between the first attribute value and the second attribute value exceeds a preset attribute value threshold, the data center displays an alarm message, and the alarm message is used to remind the user that the incremental data is abnormal.

2. The time series data abnormality alarm system according to claim 1, characterized in that: The data middle platform is used to create the monitoring task, and, when creating the monitoring task, to generate a launcher that matches the monitoring task, wherein the launcher is used to start the monitoring task.

3. The time series data abnormality alarm system according to claim 2, characterized in that: The initiator starts the monitoring task at the start time; wherein, When the launcher starts the monitoring task for the first time, the startup time is 1 minute; When the launcher starts the monitoring task for the second time, the start time is 5 minutes; When the launcher launches the monitoring task for the second time, if the incremental data ratio is greater than a preset threshold, the launch time is shortened; if the incremental data ratio is greater than a preset threshold, the launch time is extended; wherein the incremental data ratio is:

4. The time series data abnormality alarm system according to claim 3, characterized in that: When the initiator starts the monitoring task for the second time, if the incremental data ratio is greater than a preset threshold, the start time is 10 seconds to 1 minute; and / or, When the initiator initiates the monitoring task for the second time, if the incremental data ratio is greater than a preset threshold, the initiation time is 1 minute to 5 minutes.

5. The time series data abnormality alarm system according to claim 1, characterized in that: The data center also includes a second data table; the data center is used to store startup information in the second data table when the monitoring task is started, wherein the startup information includes the number of startups and the startup status.

6. The time series data abnormality alarm system according to claim 5, characterized in that: The data middle station is used to store the incremental information of the incremental data into the second data table after obtaining the incremental data from the TDengine time series database when the monitoring task is started, wherein the incremental information includes the start time, execution duration, and data volume of the incremental data.

7. The time series data abnormality alarm system according to claim 1, characterized in that: The data middle platform is used to obtain the table name of the super table, the table name of the first data table, and the preset field; Generate a data query instruction according to the table name of the super table, the table name of the first data table, and the preset field; According to the data query instruction, the incremental data is obtained from the TDengine time series database.

8. The time series data abnormality alarm system according to claim 1, characterized in that: The data center also includes a device timestamp table; when the monitoring task is started, after the data center obtains incremental data from the TDengine time series database, the data center stores the current timestamp in the device timestamp table.

9. A method for the time series data abnormality alarm system according to claim 1, characterized in that: The data middle platform applied to the time series data abnormality alarm system, the method includes: When the monitoring task is started, incremental data is obtained from the TDengine time series database, and the incremental data and the current timestamp are stored in a first data table, wherein the incremental data includes fields and attribute values; The monitoring task obtains, from the first data table, a first attribute value of a preset field corresponding to a current timestamp and a second attribute value of the preset field corresponding to a previous timestamp; If the difference between the first attribute value and the second attribute value exceeds a preset attribute value threshold, an alarm message is displayed, and the alarm message is used to remind the user that the incremental data is abnormal.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to claim 9 is implemented.

Images