Alarm detection method, device, equipment, medium and product
Through matching detection of cache and cache alarm status based on preset rules, the redundancy and complexity of alarm rules in database monitoring are solved, efficient and accurate alarm detection is achieved, and the monitoring process of database table space is simplified.
Patent Information
- Application Number
- CN202411306356.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-19
- Publication Date
- 2025-01-07
AI Technical Summary
In the database monitoring operation and maintenance system, the existing alarm detection methods need to set independent alarm rules for each database table space, resulting in redundant rules and repeated configuration of rules when adding new table space, which increases monitoring complexity and inefficiency.
By caching the alarm rules that match the data to be detected based on the preset rule cache, detect whether the sub-data meets the rules in turn, determine the alarm status based on the cached alarm status and detection results, generate the first or restored alarm information, reduce the number of alarm rules and increase the number of alarm rules The accuracy of the alarm is achieved.
Automatic matching and reduction of alarm rules is achieved, the accuracy and efficiency of alarm detection is improved, the need to repeatedly configure rules for each table space is avoided, and the independence and flexibility of database monitoring is enhanced.
Smart Images
Figure CN119271508A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present disclosure relate to the field of database technology, and in particular to an alarm detection method, device, equipment, medium and product. Background Art
[0002] In the database monitoring and operation and maintenance system, the alarm function is a very core function. It can detect various unexpected states of database services in real time and notify the operation and maintenance personnel to handle them to ensure the stability of database services. The specific process is: the alarm function detects whether many data such as the number of database sessions and resource utilization are normal. Once abnormal data is found, the operation and maintenance personnel will be notified in real time by email, text message, etc. After receiving the alarm notification, the operation and maintenance personnel can handle the alarm problem in time. After the problem is handled, the alarm function detects that the data that previously generated the alarm has returned to normal, and will notify the operation and maintenance personnel again by email, text message, etc., so that the alarm problem has been solved.
[0003] In the alarm process, whether the alarm detects data and whether the detected data is normal is determined by the alarm rules pre-configured by the user. For example, if the user-configured rules include that the central processing unit (CPU) usage rate exceeds 80%, then the alarm function will detect the CPU data and alarm for data exceeding 80%. In database applications, alarm rules are often set for database table space usage. Separate rules need to be set for each table space to ensure the independence of the alarm so that the table space is not affected by other table space alarms. The problems with this method are: 1) When monitoring multiple table spaces of multiple databases, each table space needs to be set one by one for each database, and the rules will be redundant; 2) After adding a table space, the operation of adding a rule needs to be repeated. Summary of the invention
[0004] The embodiments of the present disclosure provide an alarm detection method, device, equipment, medium and product, which improve the accuracy of alarms.
[0005] In a first aspect, an alarm detection method is provided, comprising:
[0006] Determining an alarm rule matching the data to be detected based on a preset rule cache; the data to be detected includes at least one sub-data;
[0007] Check in turn whether each sub-data satisfies the alarm rule to obtain the latest alarm detection result;
[0008] Based on the cache alarm state and the latest alarm detection result, the alarm state of the sub-data is obtained; the alarm state includes: no alarm, repeated alarm, first alarm or recovery alarm; the cache alarm state includes: the alarmed sub-data and the alarm rules satisfied by the alarmed sub-data;
[0009] Alarm information is generated according to the alarm status of each sub-data, and an alarm is issued according to the alarm information; the alarm information includes initial alarm information and / or recovery alarm information.
[0010] In a second aspect, an alarm detection device is provided, comprising:
[0011] An alarm rule determination module, used to determine an alarm rule matching the data to be detected based on a preset rule cache; the data to be detected includes at least one sub-data;
[0012] A detection module, used to detect in turn whether each sub-data satisfies the alarm rule, and obtain the latest alarm detection result;
[0013] An alarm status determination module is used to obtain the alarm status of the sub-data based on the cache alarm status and the latest alarm detection result; the alarm status includes: no alarm, repeated alarm, first alarm or recovery alarm; the cache alarm status includes: the alarmed sub-data and the alarm rules satisfied by the alarmed sub-data;
[0014] An alarm module is used to generate alarm information according to the alarm status of each sub-data, and to issue an alarm according to the alarm information; the alarm information includes the first alarm information and / or the recovery alarm information.
[0015] In a third aspect, an electronic device is provided, including:
[0016] one or more processors;
[0017] a storage device for storing one or more programs,
[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement the alarm detection method as described in the first aspect above.
[0019] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the alarm detection method as described in the first aspect above is implemented.
[0020] In a fifth aspect, a computer program product is provided, the computer program product comprising a computer program, the computer program implementing the alarm detection method as described in the first aspect above when executed by a processor
[0021] The disclosed embodiment discloses an alarm detection method, device, equipment, medium and product, including: determining an alarm rule matching the data to be detected based on a preset rule cache; the data to be detected includes at least one sub-data; detecting each sub-data in turn whether it satisfies the alarm rule to obtain the latest alarm detection result; obtaining the alarm state of the sub-data based on the cache alarm state and the latest alarm detection result; the alarm state includes: no alarm, repeated alarm, first alarm or recovery alarm; the cache alarm state includes: the alarmed sub-data and the alarm rules satisfied by the alarmed sub-data; generating alarm information according to the alarm state of each sub-data, and alarming according to the alarm information; the alarm information includes the first alarm information and / or the recovery alarm information. The technical party uses the alarm rule matching the data to be detected to detect the data to be detected, obtains the latest alarm detection result, and determines the alarm state based on the cache alarm state and the latest alarm detection result, thereby reducing the number of alarm rules and improving the accuracy of the alarm.
[0022] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the embodiments of the present disclosure. Other features of the embodiments of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0024] Figure 1 is a flow chart of an alarm detection method provided in Embodiment 1 of the present disclosure;
[0025] Figure 2 It is a schematic diagram of a conversion process of a sub-data alarm state provided by the first embodiment of the present disclosure;
[0026] Figure 3 This is a schematic diagram of an alarm status determination process provided by Embodiment 1 of the present disclosure; Figure 4 This is a schematic diagram of an alarm detection process provided by Embodiment 1 of the present disclosure;
[0027] Figure 5 is a structural diagram of an alarm detection device provided in Embodiment 2 of the present disclosure;
[0028] Figure 6 It is a structural diagram of an electronic device provided in Embodiment 3 of the present disclosure. DETAILED DESCRIPTION
[0029] In order to enable those skilled in the art to better understand the solutions of the embodiments of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only embodiments of a part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the embodiments of the present disclosure.
[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the embodiments of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.
[0031] Embodiment 1
[0032] Figure 1 This is a flowchart of an alarm detection method provided in the first embodiment of the present disclosure. This embodiment is applicable to the case of alarm detection. The method can be executed by an alarm detection device. The alarm detection device can be implemented in the form of hardware and / or software. The alarm detection device can be configured in an electronic device, including but not limited to computers, computers, terminals, servers and other devices with data processing capabilities. Figure 1 As shown, the method includes:
[0033] S110. Determine an alarm rule that matches the data to be detected based on a preset rule cache; the data to be detected includes at least one sub-data.
[0034] In this embodiment, the preset rule cache can be a pre-configured rule cache, which may include: configuration information, resource information and / or notification user information, etc., wherein the configuration information may include: defined name and / or description, etc., and the configuration information may be uniquely identified by the unique identifier alertId; the resource information may include: database and / or physical machine, etc., and the resource information may be uniquely identified by the resource identifier resId; the rule information may include the content of the specific rule, and exemplarily, the rule information may include: "database table space utilization rate exceeds 80%", "physical machine disk utilization rate exceeds 80%", etc., and the rule information may be uniquely identified by the unique identifier ruleId of the rule; the notification user information may include: user email address and other information, and the notification user information may be uniquely identified by the user's unique identifier userId.
[0035] Continuing from the above description, the preset rule cache can adopt the data structure of a hash table and be stored in the background database table, and divided into four tables to store alarm configuration, resource information, rule information, and notification user information. Exemplarily, when the data structure of a hash table is used for storage, the key value is alertId+resId+ruleId in string format, and the value is the alarm rule object.
[0036] Specifically, the preset rule cache may contain multiple rules, and the alarm rule matching the data to be detected may be determined in the preset rule cache. In this embodiment, the data to be detected may include at least one sub-data. Exemplarily, the data to be detected may include a resource identifier of the data to be detected and a sub-data list, and the alarm rule matching the data to be detected may be determined by the resource identifier of the data to be detected and the resource identifier resId in the preset rule cache.
[0037] The sub-data list may include: sub-data tags, current detection content and / or timestamp. The sub-data tags may be used to distinguish each sub-data; the current detection content may be the detection content of the current sub-data. For example, the data to be detected may be the usage rate of all table spaces in a database. Then the sub-data here is a single table space data, which includes the table space number (unique tag) and the current usage rate (detection content); the timestamp may be the time when each sub-data is generated, and the storage structure of the sub-data may be multiple blocking concurrent detection queues.
[0038] S120 , detecting in turn whether each sub-data satisfies the alarm rule, and obtaining the latest alarm detection result.
[0039] Specifically, after the alarm rule is determined, for each sub-data in the data to be detected, it can be determined whether each sub-data satisfies the alarm rule, wherein the alarm rule can make an alarm judgment on the sub-data of the data to be detected. The latest alarm detection result can be obtained according to whether each sub-data satisfies the alarm rule, wherein the latest alarm detection result can be a detection result obtained by judging the sub-data using the alarm rule, and the latest alarm detection result can be classified as satisfying the alarm rule or not satisfying the alarm rule.
[0040] Exemplarily, the alarm rule may be "the usage rate of the database table space exceeds 80%". When the "database table space usage rate" of the sub-data is 60%, it can be considered that the sub-data does not meet the alarm rule.
[0041] S130. Based on the cache alarm status and the latest alarm detection result, the alarm status of the sub-data is obtained; the alarm status includes: no alarm, repeated alarm, first alarm or recovery alarm; the cache alarm status includes: the alarmed sub-data and the alarm rules satisfied by the alarmed sub-data.
[0042] In this embodiment, the cache alarm status may include information such as the rule information that triggers the alarm and the sub-data that has been alarmed. Based on the latest alarm detection result, it can be known whether the sub-data meets the alarm rule, and then the alarm status of the sub-data is determined based on the cache alarm status and the latest alarm detection result, where the alarm status may include: no alarm, repeated alarm, first alarm or recovery alarm. It should be noted that the cache alarm status also includes the alarm status of the sub-data that has been alarmed.
[0043] Figure 2 FIG. 1 is a schematic diagram of a conversion process of a sub-data alarm state provided in this embodiment, such as Figure 2 As shown, Figure 2 ①, ②, ③, and ④ represent four alarm states, namely no alarm, first alarm, repeated alarm, and recovery alarm. Figure 2The numbers on the one-way arrows in the figure correspond to nine state transitions. The starting end of the one-way arrow corresponds to the cache alarm state, and the end end of the one-way arrow corresponds to the alarm state of the sub-data. For the one-way arrow 1: it indicates that the cache alarm state is no alarm, and the alarm state of the sub-data is no alarm; for the one-way arrow 2: it indicates that the cache alarm state is no alarm, and the alarm state of the sub-data is the first alarm; for the one-way arrow 3: it indicates that the cache alarm state is the first alarm, and the alarm state of the sub-data is a repeated alarm; for the one-way arrow 4: it indicates that the cache alarm state is a repeated alarm, and the alarm state of the sub-data is a repeated alarm; for the one-way arrow 5: it indicates that the cache alarm state is a repeated alarm, and the alarm state of the sub-data is the first alarm; for the one-way arrow 6: it indicates that the cache alarm state is the first alarm, and the alarm state of the sub-data is a recovery alarm; for the one-way arrow 7: it indicates that the cache alarm state is a repeated alarm, and the alarm state of the sub-data is a recovery alarm; for the one-way arrow 8: it indicates that the cache alarm state is a recovery alarm, and the alarm state of the sub-data is no alarm; for the one-way arrow 9: it indicates that the cache alarm state is a recovery alarm, and the alarm state of the sub-data is the first alarm.
[0044] For the conversion process of the sub-data alarm state represented by the one-way arrow 1, when the cache alarm state does not contain the sub-data, there is no cache of the sub-data in the cache alarm state at this time, and the cache alarm state of the sub-data can be considered as no alarm; when the latest alarm detection result is that the alarm rule is not satisfied, the current sub-data is normal sub-data, and the alarm state of the sub-data can be considered as no alarm;
[0045] For the conversion process of the sub-data alarm state represented by the one-way arrow 2, when the cache alarm state does not contain the sub-data, there is no cache of the sub-data in the cache alarm state at this time, and the cache alarm state of the sub-data can be considered as no alarm. When the latest alarm detection result satisfies the alarm rule, the current sub-data is abnormal sub-data, and the alarm state of the sub-data can be considered as the first alarm.
[0046] For the conversion process of the sub-data alarm state represented by the one-way arrow 3, when the sub-data is included in the cache alarm state, the cache alarm state of the sub-data can be determined as the first alarm through the cache alarm state; when the latest alarm detection result satisfies the alarm rule, and the difference between the timestamp of the current alarm and the timestamp of the historical alarm is less than the silent time, the current sub-data is abnormal sub-data (but has not exceeded the set silent time), and the alarm state of the sub-data can be considered to be a repeated alarm; wherein, the silent time can mean that within the configured time period, for the sub-data that meets the alarm rule, notification is temporarily not sent. Exemplarily, the silent time is 5 minutes, the timestamp of the historical alarm of the sub-data is 11 o'clock, the timestamp of the current alarm is 11:02, and the difference between the timestamp of the current alarm and the timestamp of the historical alarm is less than the silent time, and an alarm notification may not be sent to the sub-data.
[0047] For the conversion process of the sub-data alarm state represented by the one-way arrow 4, when the cache alarm state contains sub-data, the cache alarm state of the sub-data can be determined as a repeated alarm through the cache alarm state. When the latest alarm detection result satisfies the alarm rule, and the difference between the timestamp of the current alarm and the timestamp of the historical alarm is less than the silent time, the current sub-data is abnormal sub-data (but does not exceed the set silent time), and the alarm state of the sub-data can be considered to be a repeated alarm.
[0048] For the conversion process of the sub-data alarm state represented by the one-way arrow 5, when the cache alarm state contains sub-data, the cache alarm state of the sub-data can be determined as a repeated alarm through the cache alarm state; when the latest alarm detection result satisfies the alarm rule, and the difference between the timestamp of the current alarm and the timestamp of the historical alarm is greater than or equal to the silent time, the current sub-data is abnormal sub-data (and the set silent time has been exceeded), and the alarm state of the sub-data can be considered to be the first alarm.
[0049] For the conversion process of the sub-data alarm state represented by the one-way arrow 6, when the cache alarm state contains sub-data, the cache alarm state of the sub-data can be determined as the first alarm through the cache alarm state; the latest alarm detection result is that the alarm rule is not satisfied, and it can be considered that the alarm state of the current sub-data is a recovery alarm, and the current sub-data is a normal sub-data. Among them, the recovery alarm can be the state when the alarm rule previously satisfied by the sub-data is no longer satisfied, and it can be an alarm that the problem encountered before has been solved.
[0050] For the conversion process of the sub-data alarm state represented by the one-way arrow 7, the cache alarm state of the sub-data can be determined as a repeated alarm through the cache alarm state; the latest alarm detection result is that the alarm rule is not satisfied, and the current sub-data is a normal sub-data, so the alarm state of the current sub-data can be considered to be a recovery alarm;
[0051] For the conversion process of the sub-data alarm state represented by the one-way arrow 8, the cache alarm state of the sub-data can be determined to be a recovery alarm through the cache alarm state; the latest alarm detection result is that the alarm rule is not met, and the current sub-data is normal sub-data, and it can be considered that the alarm state of the current sub-data is no alarm.
[0052] For the conversion process of the sub-data alarm state represented by the one-way arrow 9, the cache alarm state of the sub-data can be determined to be a recovery alarm through the cache alarm state; the latest alarm detection result is that the alarm rule is met, and the current sub-data is abnormal sub-data, and the alarm state of the current sub-data can be considered to be the first alarm.
[0053] S140, generating alarm information according to the alarm status of each sub-data, and issuing an alarm according to the alarm information; the alarm information includes the first alarm information and / or the recovery alarm information.
[0054] In this embodiment, after the alarm status of each sub-data is obtained, an alarm message may be generated for the sub-data with the same alarm status, and an alarm may be issued according to the alarm message, wherein the alarm message includes the first alarm message and / or the recovery alarm message.
[0055] It should be noted that, based on the cached alarm status and the latest alarm detection results, the alarm status of the sub-data can include: no alarm, repeated alarm, first alarm or recovery alarm. An alarm message can be generated for the sub-data whose alarm status is the first alarm; an alarm message can also be generated for the sub-data whose alarm status is the recovery alarm.
[0056] This embodiment provides an alarm detection method, including: determining an alarm rule that matches the data to be detected based on a preset rule cache; the data to be detected includes at least one sub-data; detecting each sub-data in turn whether it satisfies the alarm rule to obtain the latest alarm detection result; obtaining the alarm state of the sub-data based on the cached alarm state and the latest alarm detection result; the alarm state includes: no alarm, repeated alarm, first alarm or recovery alarm; the cached alarm state includes: the alarmed sub-data and the alarm rules satisfied by the alarmed sub-data; generating alarm information according to the alarm state of each sub-data, and giving an alarm according to the alarm information; the alarm information includes the first alarm information and / or recovery alarm information. The technical party uses the alarm rule that matches the data to be detected to detect the data to be detected, obtains the latest alarm detection result, and determines the alarm state based on the cached alarm state and the latest alarm detection result, thereby reducing the number of alarm rules and improving the accuracy of the alarm.
[0057] As an optional implementation of this embodiment, the alarm detection method provided in this embodiment may further include:
[0058] According to the alarm status of each sub-data, a target alarm rule is generated, and the target alarm rule is stored as a hash table structure.
[0059] It can be known that after obtaining the alarm status of each sub-data, a target alarm rule can be generated according to the alarm status of each sub-data. Among them, the target alarm rule can be a rule after the alarm rule is modified according to the alarm status. After obtaining the target alarm rule, the target alarm rule can be stored as a hash table structure. The hash table structure can provide fast data insertion and search functions, realizing efficient data access.
[0060] It should be explained that when the target alarm rule is stored, the cached alarm status of the sub-data that exists in the alarm rule but does not exist in the target alarm rule may be deleted.
[0061] As an optional implementation of this embodiment, the alarm detection method provided in this embodiment, after sequentially detecting whether each sub-data satisfies the alarm rule and obtaining the latest alarm detection result, further includes:
[0062] a1) When the sub-data does not meet the alarm rule, the sub-data is normal sub-data, and the sub-data is added to the normal sub-data set;
[0063] In this embodiment, when the sub-data does not satisfy the alarm rule, the sub-data is confirmed to be normal sub-data, and the sub-data is added to the normal sub-data set.
[0064] b1) When the sub-data meets the alarm rule, the sub-data is abnormal sub-data, and the sub-data is added to the abnormal sub-data set.
[0065] In this embodiment, when the sub-data meets the alarm rule, the sub-data is confirmed to be abnormal sub-data, and the sub-data is added to the abnormal sub-data set.
[0066] In one embodiment, determining an alarm rule matching the data to be detected based on a preset rule cache includes:
[0067] a2) searching the preset rule cache for a rule list containing a resource identifier of the data to be detected;
[0068] In this embodiment, a rule list containing a resource identifier of the data to be detected can be searched in the preset rule cache. Exemplarily, the resource identifier can be used to identify a specific database, and a rule list containing the resource identifier (the database) can be searched in the preset rule cache.
[0069] b2) Determine the alarm rule that matches the data to be detected in the rule list.
[0070] Following the above description, after finding the rule list, you can determine the alarm rule that matches the data to be detected in the rule list.
[0071] Exemplarily, the data to be detected is the table space usage rate of a certain database. Then the data to be detected matches the alarm rule "database table space usage rate exceeds 80%", but does not match the alarm rule "database table job execution fails". The determined alarm rule is "database table space usage rate exceeds 80%".
[0072] In one embodiment, detecting in sequence whether each sub-data satisfies the alarm rule includes:
[0073] Each sub-data is distributed to a different detection queue, so as to detect each sub-data using multiple parallel detection queues; wherein the queue number of the detection queue to which each sub-data is distributed is obtained by taking the modulo of the resource identifier of the sub-data and the number of detection queues.
[0074] In this embodiment, each sub-data can be distributed to different detection queues, so that multiple parallel detection queues can detect each sub-data, thereby improving the efficiency of the entire alarm detection and avoiding the situation where the detection queues have data to be detected.
[0075] In one embodiment, generating alarm information according to the alarm status of each sub-data includes:
[0076] a3) generating first alarm information for the sub-data in the abnormal sub-data set whose alarm status is the first alarm;
[0077] It can be known that after obtaining the abnormal sub-data set, the first alarm information can be generated for the sub-data in the abnormal sub-data set whose alarm status is the first alarm.
[0078] It should be noted that, for the sub-data in the abnormal sub-data set whose alarm status is repeated alarm, it can be combined with the sub-data of the first alarm to generate the first alarm information.
[0079] b3) For the sub-data in the normal sub-data set whose alarm status is recovery alarm, recovery alarm information is generated.
[0080] In this embodiment, after obtaining the abnormal sub-data set, recovery alarm information may be generated for the sub-data in the abnormal sub-data set whose alarm status is recovery alarm.
[0081] Figure 3 A schematic diagram of an alarm status determination process provided in this embodiment, such as Figure 3 As shown, based on the latest alarm detection result of the data to be detected (taking data 6 as an example) and the cached alarm status, the alarm status of the sub-data can be obtained, wherein data 6 includes 6 sub-data, and in the latest alarm detection result: sub-data 1 to sub-data 4 are abnormal sub-data, and sub-data 5 and sub-data 6 are normal sub-data; in the cached alarm status: sub-data 1 to sub-data 6 are abnormal sub-data (abnormal refers to sub-data whose alarm status is repeated alarm or first alarm). The sub-data of the first alarm in the alarm status of the sub-data are merged to generate alarm information, and an alarm notification is performed, and the sub-data of the first alarm and repeated alarm (sub-data 1, sub-data 2, sub-data 3, sub-data 4) are saved in the cached alarm status, and the abnormal sub-data of other data are also stored in the cached alarm status; and according to the alarm status of each sub-data, the target alarm rule is generated and saved in the background database.
[0082] Figure 4A schematic diagram of an alarm detection process provided in this embodiment, such as Figure 4 As shown, the alarm rules and cached alarm status can be obtained from the background database, and the data to be detected can be distributed to different detection queues for detection, so as to obtain the latest alarm detection results, and alarms can be issued for the data to be detected based on the cached alarm status and the latest alarm detection results.
[0083] This embodiment provides a data alarm detection method, which has the advantages of: reducing the number of alarm rules, and only needing to configure the rule value of the table space usage rate, without the need to specify each table space one by one; being able to detect a newly added table space, and detecting whether the newly added table space usage rate triggers an alarm based on the configured table space alarm rules, without the need to repeatedly manually add rules; and the alarms of different table spaces in different databases are independent of each other.
[0084] The technical solution provided in this embodiment is also applicable to alarm detection with sub-data such as database data file size, database job execution failure, and physical machine disk usage. The characteristics of sub-data are: the number of sub-data is adaptive to resources, such as different databases have different numbers of table spaces; sub-data are independent of each other, such as the usage rates of different table spaces in the database are independent.
[0085] Embodiment 2
[0086] Figure 5 is a structural diagram of an alarm detection device provided in Embodiment 2 of the present disclosure; Figure 5 As shown, the device includes: an alarm rule determination module 210, a detection module 220, an alarm state determination module 230, and an alarm module 240.
[0087] The alarm rule determination module 210 is used to determine the alarm rule matching the data to be detected based on the preset rule cache; the data to be detected includes at least one sub-data;
[0088] A detection module 220, used to detect in turn whether each sub-data satisfies the alarm rule, and obtain the latest alarm detection result;
[0089] The alarm state determination module 230 is used to obtain the alarm state of the sub-data based on the cache alarm state and the latest alarm detection result; the alarm state includes: no alarm, repeated alarm, first alarm or recovery alarm; the cache alarm state includes: the alarmed sub-data and the alarm rules satisfied by the alarmed sub-data;
[0090] The alarm module 240 is used to generate alarm information according to the alarm status of each sub-data, and to issue an alarm according to the alarm information; the alarm information includes the first alarm information and / or the recovery alarm information.
[0091] Embodiment 2 of the present disclosure provides an alarm detection device, which improves the accuracy of alarms.
[0092] Furthermore, the device may also include:
[0093] A normal sub-data determination module, configured to determine that when the sub-data does not satisfy the alarm rule, the sub-data is normal sub-data and add the sub-data to a normal sub-data set;
[0094] The abnormal sub-data determining module is used to determine that when the sub-data meets the alarm rule, the sub-data is abnormal sub-data and add the sub-data to the abnormal sub-data set.
[0095] Furthermore, the alarm module 240 is also used for:
[0096] For the sub-data in the abnormal sub-data set whose alarm status is the first alarm, generating the first alarm information;
[0097] For the sub-data in the normal sub-data set whose alarm status is a recovery alarm, recovery alarm information is generated.
[0098] Furthermore, the alarm rule determination module 210 is further configured to:
[0099] Searching the preset rule cache for a rule list containing a resource identifier of the data to be detected;
[0100] Determine in the rule list an alarm rule that matches the data to be detected.
[0101] Furthermore, the detection module 220 is further configured to:
[0102] Distributing each of the sub-data to different detection queues, so as to detect each of the sub-data using multiple parallel detection queues;
[0103] The queue number of the detection queue for each sub-data distribution is obtained by taking the modulo of the resource identifier of the sub-data and the number of detection queues.
[0104] Furthermore, the device also includes:
[0105] The storage module is used to generate a target alarm rule according to the alarm status of each sub-data, and store the target alarm rule as a hash table structure.
[0106] The alarm detection device provided in the embodiments of the present disclosure can execute the alarm detection method provided in any embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method.
[0107] Embodiment 3
[0108] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present disclosure described and / or claimed herein.
[0109] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0110] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0111] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microprocessor, etc. The processor 11 executes the various methods and processes described above, such as the alarm detection method.
[0112] In some embodiments, the alarm detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the alarm detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the alarm detection method in any other appropriate manner (e.g., by means of firmware).
[0113] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0114] The computer programs for implementing the methods of the embodiments of the present disclosure may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.
[0115] In the context of the disclosed embodiments, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0116] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0117] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0118] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0119] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in the embodiments of the present disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions of the embodiments of the present disclosure can be achieved, and this document does not limit this.
[0120] The above specific implementations do not constitute a limitation on the protection scope of the embodiments of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the embodiments of the present disclosure shall be included in the protection scope of the embodiments of the present disclosure.
[0121] The embodiments of the present disclosure also provide a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the alarm detection method provided in any embodiment of the present application.
[0122] In the process of implementation, the computer program product can be written in one or more programming languages or a combination thereof to write computer program codes for performing the operation of the disclosed embodiments, the programming languages including object-oriented programming languages, such as Java, Smalltalk, C++, and also including conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).
[0123] Note that the above are only preferred embodiments of the embodiments of the present disclosure and the technical principles used. Those skilled in the art will understand that the embodiments of the present disclosure are not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the embodiments of the present disclosure. Therefore, although the embodiments of the present disclosure are described in more detail through the above embodiments, the embodiments of the present disclosure are not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the embodiments of the present disclosure, and the scope of the embodiments of the present disclosure is determined by the scope of the attached claims.
Claims
1. An alarm detection method, characterized in that: include: Determining an alarm rule matching the data to be detected based on a preset rule cache; the data to be detected includes at least one sub-data; Check in turn whether each sub-data satisfies the alarm rule to obtain the latest alarm detection result; Based on the cache alarm status and the latest alarm detection result, obtaining the alarm status of the sub-data; The alarm status includes: no alarm, repeated alarm, first alarm or recovery alarm; the cache alarm status includes: alarmed sub-data and alarm rules satisfied by the alarmed sub-data; Alarm information is generated according to the alarm status of each sub-data, and an alarm is issued according to the alarm information; the alarm information includes initial alarm information and / or recovery alarm information.
2. The method according to claim 1, characterized in that After detecting in turn whether each sub-data satisfies the alarm rule and obtaining the latest alarm detection result, the method further includes: When the sub-data does not satisfy the alarm rule, the sub-data is normal sub-data, and the sub-data is added to the normal sub-data set; When the sub-data meets the alarm rule, the sub-data is abnormal sub-data, and the sub-data is added to the abnormal sub-data set.
3. The method according to claim 2, characterized in that The generating of alarm information according to the alarm status of each sub-data includes: For the sub-data in the abnormal sub-data set whose alarm status is the first alarm, generating the first alarm information; For the sub-data in the normal sub-data set whose alarm status is a recovery alarm, recovery alarm information is generated.
4. The method according to claim 1, characterized in that The step of determining the alarm rule matching the data to be detected based on the preset rule cache includes: Searching the preset rule cache for a rule list containing a resource identifier of the data to be detected; Determine in the rule list an alarm rule that matches the data to be detected.
5. The method according to claim 1, characterized in that The detecting in sequence whether each sub-data satisfies the alarm rule includes: Distributing each of the sub-data to different detection queues, so as to detect each of the sub-data using multiple parallel detection queues; The queue number of the detection queue for each sub-data distribution is obtained by taking the modulo of the resource identifier of the sub-data and the number of detection queues.
6. The method according to claim 1, characterized in that The method further comprises: According to the alarm status of each of the sub-data, a target alarm rule is generated, and the target alarm rule is stored as a hash table structure.
7. An alarm detection device, characterized in that: include: An alarm rule determination module, used to determine an alarm rule matching the data to be detected based on a preset rule cache; the data to be detected includes at least one sub-data; A detection module, used to detect in turn whether each sub-data satisfies the alarm rule, and obtain the latest alarm detection result; An alarm status determination module, configured to obtain the alarm status of the sub-data based on the cached alarm status and the latest alarm detection result; The alarm status includes: no alarm, repeated alarm, first alarm or recovery alarm; the cache alarm status includes: alarmed sub-data and alarm rules satisfied by the alarmed sub-data; An alarm module is used to generate alarm information according to the alarm status of each sub-data, and to issue an alarm according to the alarm information; the alarm information includes the first alarm information and / or the recovery alarm information.
8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the alarm detection method as described in any one of claims 1-6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the alarm detection method as described in any one of claims 1 to 6 is implemented.
10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the alarm detection method according to any one of claims 1 to 6.