Alarm root cause positioning method, device, equipment, medium and product

Abstract

The invention discloses an alarm root cause positioning method, device and equipment, a medium and a product. The method comprises the following steps: constructing a state space according to a to-be-positioned alarm data set; wherein the to-be-positioned alarm data set comprises a to-be-positioned alarm text set and a to-be-positioned alarm index set; constructing a root cause positioning tree according to the state space, and executing a root cause iterative search operation according to the root cause positioning tree; when an iteration ending condition is met, determining an alarm root cause result corresponding to the alarm text set to be positioned according to the root cause positioning tree at the end of iteration; wherein the state in the state space represents an index combination composed of at least one alarm index, and the nodes in the root cause positioning tree are the states in the state space. The problem that a traditional root cause positioning method is limited in processing capacity is solved, and the positioning efficiency and accuracy of the alarm root cause are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment, medium and product for locating an alarm root cause. Background Art

[0002] With the development of information technology, the scale and complexity of modern business systems are growing exponentially, and highly complex topology architectures will cause business systems to generate a large amount of alarm information during operation.

[0003] When faced with a large amount of alarm information, how to accurately and quickly find the root cause of the alarm is the key to maintaining the stable operation of the business system. At present, the main root cause location methods are rule-based or statistical-based root cause location methods.

[0004] In the process of implementing the present invention, it is found that there are at least the following technical problems in the prior art:

[0005] The above-mentioned traditional root cause location method has limited processing capability for complex alarm situations, resulting in low efficiency and poor accuracy of root cause location. Summary of the invention

[0006] The embodiments of the present invention provide a method, device, equipment, medium and product for locating the root cause of an alarm, so as to solve the problem of limited processing capability of the traditional root cause locating method and improve the efficiency and accuracy of locating the root cause of the alarm.

[0007] According to an embodiment of the present invention, a method for locating a root cause of an alarm is provided, the method comprising:

[0008] Constructing a state space according to the alarm data set to be located; wherein the alarm data set to be located includes an alarm text set to be located and an alarm indicator set to be located;

[0009] Constructing a root cause location tree according to the state space, and performing a root cause iterative search operation according to the root cause location tree;

[0010] Until the iteration end condition is met, the alarm root cause result corresponding to the alarm text set to be located is determined according to the root cause location tree at the end of the iteration;

[0011] Among them, the alarm text set to be located contains multiple alarm texts to be located, the alarm indicator set to be located contains an alarm indicator sequence corresponding to each alarm text to be located, the alarm indicator sequence contains indicator values ​​of at least two alarm indicators, the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space.

[0012] According to another embodiment of the present invention, a device for locating a root cause of an alarm is provided, the device comprising:

[0013] A state space construction module is used to construct a state space according to a set of alarm data to be located; wherein the set of alarm data to be located includes a set of alarm texts to be located and a set of alarm indicators to be located;

[0014] A root cause location tree iterative search module, used to construct a root cause location tree according to the state space, and perform a root cause iterative search operation according to the root cause location tree;

[0015] An alarm root cause result determination module is used to determine the alarm root cause result corresponding to the alarm text set to be located according to the root cause location tree at the end of the iteration until the iteration end condition is met;

[0016] Among them, the alarm text set to be located contains multiple alarm texts to be located, the alarm indicator set to be located contains an alarm indicator sequence corresponding to each alarm text to be located, the alarm indicator sequence contains indicator values ​​of at least two alarm indicators, the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space.

[0017] According to another embodiment of the present invention, there is provided an electronic device, the electronic device comprising:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for locating the root cause of the alarm described in any embodiment of the present invention.

[0021] According to another embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for locating the root cause of an alarm as described in any embodiment of the present invention when executed.

[0022] According to another embodiment of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method for locating the root cause of an alarm according to any embodiment of the present invention is implemented.

[0023] An embodiment of the above invention has at least the following advantages or beneficial effects:

[0024] By constructing a state space based on the alarm data set to be located, constructing a root cause location tree based on the state space, and performing a root cause iterative search operation based on the root cause location tree, wherein the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space, the purpose of locating the alarm root cause in the cross-indicator dimension is achieved, the problem of limited processing capacity of traditional root cause location methods is solved, and the efficiency and accuracy of locating the alarm root cause are improved.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 A flowchart of a method for locating a root cause of an alarm provided by an embodiment of the present invention;

[0028] Figure 2 A flowchart of another method for locating the root cause of an alarm provided by an embodiment of the present invention;

[0029] Figure 3 A flowchart of another method for locating the root cause of an alarm provided by an embodiment of the present invention;

[0030] Figure 4 A flowchart of a specific example of a method for locating an alarm root cause provided by an embodiment of the present invention;

[0031] Figure 5 A schematic diagram of the structure of a device for locating the root cause of an alarm provided by an embodiment of the present invention;

[0032] Figure 6 The present invention is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "to be located", "initial", "test", "reference", "target", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] Figure 1 This is a flow chart of a method for locating the root cause of an alarm provided by an embodiment of the present invention. This embodiment is applicable to the situation of locating the root cause of an alarm text generated within a period of time. The method can be executed by a device for locating the root cause of an alarm. The device for locating the root cause of an alarm can be implemented in the form of hardware and / or software. The device for locating the root cause of an alarm can be configured in a terminal device. Figure 1 As shown, the method includes:

[0036] S110: Construct a state space according to the alarm data set to be located.

[0037] In this embodiment, the alarm data set to be located includes an alarm text set to be located and an alarm indicator set to be located, the alarm text set to be located includes multiple alarm texts to be located, the alarm indicator set to be located includes an alarm indicator sequence corresponding to each alarm text to be located, and the alarm indicator sequence includes indicator values ​​of at least two alarm indicators.

[0038] Specifically, the alarm text set to be located represents a text set consisting of multiple alarm texts to be located generated within the alarm time period, and the alarm text to be located represents the descriptive information of the abnormal event occurring in the business system, usually presented in the form of natural language. Exemplarily, the alarm duration corresponding to the alarm time period can be 30 minutes or 60 minutes, and the alarm text to be located can be "The memory usage of server A has exceeded 90% for the past 5 minutes, please check in time", but is not limited to the example scenario.

[0039] In a specific embodiment, the indicator type of the alarm indicator is an environment indicator or a parameter indicator, wherein the environment indicator refers to an indicator of the operating environment to which the business system belongs, and the parameter indicator refers to an indicator used to describe the system operating status of the business system.

[0040] For example, when the indicator type of the alarm indicator is an environmental indicator, the alarm indicator can be a monitoring alarm application, an application version corresponding to the monitoring alarm application, an alarm system, a geographical area corresponding to the alarm system, a network operator or a system device type, etc., but is not limited to the example case. Among them, the monitoring alarm application represents a monitoring application for monitoring the system operation of the business system, and the alarm system represents a business system with abnormal system operation.

[0041] Exemplarily, when the indicator type of the alarm indicator is a parameter indicator, the alarm indicator is device temperature, power status, CPU usage, memory usage, disk read and write performance, network performance, process status, program error rate or database access status, etc., but is not limited to the example scenario.

[0042] In this embodiment, the state in the state space represents an indicator combination composed of at least one alarm indicator. For example, assuming that the alarm indicator set to be located includes alarm indicator sequence A and alarm indicator sequence B, and alarm indicator sequence A includes monitoring alarm application A, geographical area A, and memory usage of 85%, and alarm indicator sequence B includes monitoring alarm application B, alarm system B, and network delay exceeding 100ms, then the state space corresponds to 5 alarm indicators such as monitoring alarm application, geographical area, memory usage, alarm system, and network delay. Correspondingly, the state space covers 32 states. Among them, there are 5 states composed of 1 alarm indicator, 10 states composed of 2 alarm indicators, 10 states composed of 3 alarm indicators, 5 states composed of 4 alarm indicators, and 1 state composed of 5 alarm indicators.

[0043] S120: construct a root cause location tree according to the state space, and perform a root cause iterative search operation according to the root cause location tree.

[0044] In this embodiment, the nodes in the root cause localization tree are states in the state space.

[0045] In a specific embodiment, constructing a root cause location tree according to the state space includes: taking the state containing all alarm indicators in the state space as the root node of the root cause location tree.

[0046] In another specific embodiment, a root cause location tree is constructed based on the state space, including: obtaining at least two reference states corresponding to a preset number of indicators in the state space; determining the alarm frequencies corresponding to the at least two reference states respectively based on the alarm indicator set to be located; and taking the reference state with the highest alarm frequency as the root node of the root cause location tree.

[0047] Specifically, the number of preset indicators is less than the total number of indicators corresponding to the state space. Taking the above example, the number of preset indicators is less than 5, such as when the number of preset indicators is 4, the number of states of the reference state is 5, which is of course not limited to the example case.

[0048] In a specific embodiment, according to the alarm indicator set to be located, the alarm frequencies corresponding to at least two reference states are determined, including: according to the alarm indicator set to be located, the number of reference sequences corresponding to the at least two reference states are determined; the sum of the numbers of at least two reference sequences is used as the total number of sequences; for each reference state, the ratio of the number of reference sequences corresponding to the reference state to the total number of sequences is used as the alarm frequency corresponding to the reference state.

[0049] In this embodiment, the alarm frequency reflects the proportion of the reference state in the state category corresponding to the preset indicator quantity.

[0050] In another specific embodiment, according to the alarm indicator set to be located, the alarm frequencies corresponding to at least two reference states are determined, including: for each reference state, according to the alarm indicator set to be located, determining the number of reference sequences corresponding to the reference state; obtaining the alarm duration of the alarm time period corresponding to the alarm indicator set to be located; and taking the ratio of the number of reference sequences to the alarm duration as the alarm frequency corresponding to the reference state.

[0051] In this embodiment, the alarm frequency reflects the number of times the reference state occurs within a unit time.

[0052] In the above embodiment, specifically, for each reference state, an alarm indicator sequence matching the reference state in the alarm indicator set to be located is obtained, and the number of matching alarm indicator sequences is counted to obtain the number of reference sequences corresponding to the reference state. Wherein, the alarm indicator sequence matching the reference state represents an alarm indicator sequence containing indicator values ​​corresponding to each alarm indicator in the reference state.

[0053] The benefit of selecting the root node based on the alarm frequency of the status is that it helps the root cause location tree to quickly narrow the search scope in the root cause iterative search process, further improving the efficiency of locating the alarm root cause.

[0054] In another specific embodiment, constructing a root cause localization tree according to the state space includes: randomly sampling the state space, and using the sampled state as a root node of the root cause localization tree.

[0055] In a specific embodiment, a root cause iterative search operation is performed according to a root cause location tree, including: in each iteration process, node statistics of each node in the root cause location tree in the current iteration process are obtained, and a node to be expanded is selected from the root cause location tree according to the node statistics of each node; a child node corresponding to the node to be expanded is determined according to the state space and the state of the node to be expanded, and the root cause location tree is updated according to the child node; a node root cause score of the child node is determined according to the state of the child node; according to the node root cause score, node statistics of nodes in a node path containing the child node in the updated root cause location tree are updated; if the iteration end condition is not met, the step of obtaining node statistics of each node in the root cause location tree in the current iteration process is returned.

[0056] Exemplarily, the node statistics include but are not limited to the total reward value, average reward value, number of visits, number of times considered to be the root node, number of visits of the parent node and confidence interval, etc. In the first iteration, the node statistics of the root node are initialized to the default values.

[0057] In a specific embodiment, according to the node statistics of each node, a node to be expanded is selected from the root cause location tree, including: determining at least one scalability score according to at least one node statistics; wherein the node statistics data correspond to the scalability score one-to-one; and selecting the node with the highest scalability score in the root cause location tree as the node to be expanded.

[0058] In a specific embodiment, the score strategy used by the scalable score is the upper confidence interval strategy (UpperConfidence Bound for Trees, UCT). Exemplarily, the scalable score of the mth node adopts UCT m It means that it satisfies the following formula:

[0059]

[0060] in, represents the average reward value of the mth node, C represents a constant greater than 0, n represents the number of visits to the parent node of the mth node, n m Indicates the number of times the mth node has been visited.

[0061] Specifically, the number of child nodes may be one or more, and the state of each child node is different from the state of the node to be expanded. For example, the number of indicators of the indicator combination corresponding to the child node is different from the number of indicators of the indicator combination corresponding to the node to be expanded, or the number of indicators of the indicator combination corresponding to the child node is the same as the number of indicators of the indicator combination corresponding to the node to be expanded, but the alarm indicator of the indicator combination corresponding to the child node is different from the alarm indicator of the indicator combination corresponding to the node to be expanded.

[0062] For example, assuming that the indicator combination corresponding to the node to be expanded is alarm indicator AC, the indicator combination corresponding to the child node can be alarm indicator A, alarm indicator B and alarm indicator D, or alarm indicator AB, or alarm indicator AD.

[0063] Specifically, the node root cause score indicates the possibility that the child node belongs to the root cause node. In a specific embodiment, the node root cause score of the child node is determined according to the state of the child node, including: determining a reference alarm indicator set according to the alarm indicator set to be located and the state of the child node; inputting the reference alarm indicator set into a pre-trained root cause classification model to obtain the output node root cause score of the child node.

[0064] In a specific embodiment, the reference indicator sequence in the reference alarm indicator set is an alarm indicator sequence of indicator values ​​corresponding to each alarm indicator in the state of the child node included in the alarm indicator set to be located. Exemplarily, assuming that the state of the child node is alarm indicator AC, if alarm indicator sequence 1 includes the indicator value corresponding to alarm indicator AD, then alarm indicator sequence 1 is added to the reference alarm indicator set as a reference indicator sequence; if alarm indicator sequence 2 includes the indicator values ​​corresponding to alarm indicator A, alarm indicator B, and alarm indicator D, respectively, then the reference alarm indicator set does not include alarm indicator sequence 2.

[0065] In another specific embodiment, the reference alarm indicator set reflects the value distribution of the state of the child node, and the reference indicator sequence in the reference alarm indicator set only includes the indicator value corresponding to each alarm indicator in the state of the child node. Taking the above example, the alarm indicator D is deleted from the alarm indicator sequence 1 to obtain the reference indicator sequence 1, and the reference indicator sequence 1 is added to the reference alarm indicator set.

[0066] Specifically, the node path containing the child node in the updated root cause location tree represents the path formed by all nodes from the root node to the child node in the updated root cause location tree. Taking the upper confidence interval strategy as an example, the node root cause score is used as the current reward value of each node in the node path, and the number of visits of each node in the node path is increased by 1.

[0067] S130 , until the iteration end condition is met, determining the alarm root cause result corresponding to the alarm text set to be located according to the root cause location tree at the end of the iteration.

[0068] In a specific embodiment, the iteration end condition includes at least one of the following: the search depth of the root cause location tree in the current iteration process is equal to a depth threshold, the search time of the root cause iterative search reaches a time threshold, and a node appears in the root cause location tree in the current iteration process that has been visited more than a number of times.

[0069] Specifically, the alarm root cause result is a node or a node path in the root cause location tree at the end of the iteration.

[0070] In a specific embodiment, the alarm root cause result corresponding to the alarm text set to be located is determined according to the root cause location tree at the end of iteration, including: when the alarm root cause result is a node, the node evaluation score of each node is determined according to the node statistics of each node in the root cause location tree at the end of iteration; wherein the node statistics data correspond to the node evaluation score one-to-one; according to at least one node evaluation score, a target node is selected from the root cause location tree at the end of iteration as the alarm root cause result corresponding to the alarm text set to be located.

[0071] In a specific embodiment, based on at least one node evaluation score, a target node is selected from the root cause location tree at the end of an iteration as the alarm root cause result corresponding to the alarm text set to be located, including: taking the node with the highest node evaluation score in the root cause location tree at the end of the iteration as the target node, and taking the target node as the alarm root cause result corresponding to the alarm text set to be located.

[0072] In another specific embodiment, based on at least one node evaluation score, a target node is selected from the root cause location tree at the end of an iteration as the alarm root cause result corresponding to the alarm text set to be located, including: taking at least one node in the root cause location tree at the end of the iteration whose node evaluation score is greater than a node score threshold as the target node, and taking at least one target node as the alarm root cause result corresponding to the alarm text set to be located.

[0073] In another specific embodiment, the alarm root cause result corresponding to the alarm text set to be located is determined according to the root cause location tree at the end of iteration, including: when the alarm root cause result is a node path, the node evaluation score of each node is determined according to the node statistical data of each node in the root cause location tree at the end of iteration; wherein the node statistical data corresponds to the node evaluation score one-to-one; for each node path in the root cause location tree at the end of iteration, the path evaluation score of the node path is determined according to at least one node evaluation score corresponding to the node path; according to at least one path evaluation score, the target node path is selected from the root cause location tree at the end of iteration as the alarm root cause result corresponding to the alarm text set to be located.

[0074] In a specific embodiment, based on at least one path evaluation score, a target node path is selected from the root cause location tree at the end of an iteration as the alarm root cause result corresponding to the alarm text set to be located, including: taking the node path with the highest path evaluation score in the root cause location tree at the end of the iteration as the target node path, and taking the target node path as the alarm root cause result corresponding to the alarm text set to be located.

[0075] In another specific embodiment, based on at least one path evaluation score, a target node path is selected from the root cause location tree at the end of an iteration as the alarm root cause result corresponding to the alarm text set to be located, including: taking at least one node path in the root cause location tree at the end of the iteration whose path evaluation score is greater than a path score threshold as the target node path, and taking at least one target node path as the alarm root cause result corresponding to the alarm text set to be located.

[0076] On the basis of the above embodiment, specifically, the node evaluation score of each node is determined according to the node statistics of each node in the root cause localization tree at the end of iteration, including: adopting an upper confidence interval strategy to determine the node evaluation score of each node according to the node statistics of each node in the root cause localization tree at the end of iteration.

[0077] On the basis of the above embodiment, specifically, the node evaluation score of each node is determined according to the node statistics of each node in the root cause localization tree at the end of iteration, including: taking the number of visits of each node in the root cause localization tree at the end of iteration as the node evaluation score of each node.

[0078] The technical solution of this embodiment constructs a state space based on the alarm data set to be located, constructs a root cause location tree based on the state space, and performs a root cause iterative search operation based on the root cause location tree, wherein the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space, thereby achieving the purpose of locating the alarm root cause in the cross-indicator dimension, solving the problem of limited processing capacity of traditional root cause location methods, and improving the efficiency and accuracy of locating the alarm root cause.

[0079] Figure 2 This is a flow chart of another method for locating the root cause of an alarm provided by an embodiment of the present invention. This embodiment further refines the method for obtaining the alarm text set to be located in the above embodiment. Figure 2 As shown, the method includes:

[0080] S210: Obtain an initial alarm data set.

[0081] In this embodiment, the initial alarm data set includes an initial alarm text set and an initial alarm indicator set, the initial alarm text set includes multiple initial alarm texts, the initial alarm indicator set includes an alarm indicator sequence corresponding to each initial alarm text, and the alarm indicator sequence includes indicator values ​​of at least two alarm indicators.

[0082] Specifically, the initial alarm text set corresponds to the same or similar alarm text set to be located in the above embodiment, and the initial alarm indicator set corresponds to the same or similar alarm indicator set to be located in the above embodiment, which will not be repeated in this embodiment.

[0083] S220. According to the initial alarm indicator set, obtain at least two initial alarm texts matching a preset indicator sequence from the initial alarm text set.

[0084] In this embodiment, the preset indicator sequence includes an indicator value of at least one alarm indicator, which can be customized according to the actual alarm business scenario.

[0085] Specifically, according to the preset indicator sequence, the initial alarm indicator set is screened to obtain a screened alarm indicator set, and the initial alarm texts corresponding to each alarm indicator sequence in the screened alarm indicator set are used as at least two initial alarm texts matching the preset indicator sequence. Wherein, the alarm indicator sequence in the screened alarm indicator set includes the preset indicator sequence.

[0086] S230: When the alarm timestamps of at least two initial alarm texts satisfy a periodic rule, delete the at least two initial alarm texts from the initial alarm data set to obtain an alarm data set to be located.

[0087] In a specific embodiment, the method also includes: determining the time intervals corresponding to at least two groups of preset interval numbers of alarm timestamps, and determining the standard deviation corresponding to at least two time intervals; if the standard deviation is less than the standard deviation threshold, setting the alarm timestamps of at least two initial alarm texts to satisfy the periodic law; if the standard deviation is greater than or equal to the standard deviation threshold, setting the alarm timestamps of at least two initial alarm texts not to satisfy the periodic law.

[0088] Exemplarily, the number of preset intervals may be 0, 1 or 2. The number of preset intervals is not limited here and may be customized according to actual needs.

[0089] Specifically, at least two initial warning texts are deleted from the initial warning text set, and the warning indicator sequences respectively corresponding to the at least two initial warning texts are deleted from the initial warning indicator set to obtain the warning data set to be located.

[0090] On the basis of the above embodiment, specifically, the method further includes: when the alarm timestamps of at least two initial alarm texts do not satisfy the periodic rule, using the initial alarm data set as the alarm data set to be located.

[0091] It can be understood that this embodiment is exemplified by a preset indicator sequence. In other embodiments, multiple preset indicator sequences can be used to respectively execute the above S220-S230 to achieve the purpose of eliminating the initial alarm texts that meet the periodicity of different preset indicator sequences in the initial alarm data set.

[0092] S240: Construct a state space according to the alarm data set to be located.

[0093] S240 in this embodiment is similar to that in the above embodiment. Figure 1 The S110 shown corresponds to the same or similar steps, and will not be described in detail in this embodiment.

[0094] S250: construct a root cause location tree according to the state space, and perform a root cause iterative search operation according to the root cause location tree.

[0095] In a specific embodiment, a root cause iterative search operation is performed according to a root cause location tree, including: in each iteration process, node statistics of each node in the root cause location tree in the current iteration process are obtained, and a node to be expanded is selected from the root cause location tree according to the node statistics of each node; a child node corresponding to the node to be expanded is determined according to the state space and the state of the node to be expanded, and the root cause location tree is updated according to the child node; a node root cause score of the child node is determined according to the state of the child node; according to the node root cause score, node statistics of nodes in a node path containing the child node in the updated root cause location tree are updated; if the iteration end condition is not met, the step of obtaining node statistics of each node in the root cause location tree in the current iteration process is returned.

[0096] On the basis of the above embodiments, specifically, according to the status of the child node, the node root cause score of the child node is determined, including: according to the historical alarm data set and the status of the child node, the total periodic alarm attribute of the child node is determined; when the total periodic alarm attribute is the total periodic alarm, the node root cause score of the child node is determined to be a preset score.

[0097] In this embodiment, the total periodic alarm indicates that the total amount of historical alarms corresponding to the child node conforms to a periodic rule, and the preset score is a score less than the score threshold.

[0098] In a specific embodiment, the total amount periodic alarm attribute of the child node is determined based on the historical alarm data set and the status of the child node, including: dividing the historical alarm data set according to a preset total amount period to obtain at least two historical alarm data subsets; determining at least two historical alarm total amounts corresponding to the child node based on the at least two historical alarm data subsets and the status of the child node; wherein the historical alarm data subsets correspond to the historical alarm total amounts one-to-one; when at least two historical alarm total amounts are greater than the total amount threshold, the total amount periodic alarm attribute of the child node is set to the total amount periodic alarm.

[0099] For example, assuming that the historical alarm data set is an alarm data set within 7 days, the preset total amount period can be 1 day or 12 hours. assuming that the historical alarm data set is an alarm data set within 1 day, the preset total amount period can be 6 hours or 1 hour.

[0100] Specifically, the total amount of historical alarms may represent the number of alarm indicator sequences matching the state of the child node in the historical alarm data subset, wherein the alarm indicator sequence matching the state of the child node includes the indicator value of each alarm indicator in the state of the child node.

[0101] On the basis of the above embodiments, specifically, after determining at least two historical alarm totals corresponding to the child node based on at least two historical alarm data subsets and the status of the child node, the method also includes: when there is at least one historical alarm total that is less than or equal to the total threshold, setting the total periodic alarm attribute of the child node to a total non-periodic alarm.

[0102] On the basis of the above embodiments, specifically, after determining the total periodic alarm attribute of the child node according to the historical alarm data set and the status of the child node, the method also includes: when the total periodic alarm attribute is a total non-periodic alarm, using a pre-trained root cause classification model, according to the alarm indicator set to be located and the status of the child node, determining the node root cause score of the child node.

[0103] The advantage of this setting is that, from the dimension of periodic changes in the total number of alarms, it reduces the noise interference of the indicator combination that causes the periodic increase in the total number of alarms on the location process of the alarm root cause, and further improves the accuracy of locating the alarm root cause.

[0104] Based on the above embodiments, specifically, the method further includes: obtaining at least two node paths in the root cause location tree in the current iteration process; for each node path, determining the path root cause score of the node path according to the node root cause score corresponding to at least one node in the node path; and performing a pruning operation on the root cause location tree according to at least two path root cause scores.

[0105] Specifically, the path root cause score represents the weighted sum of the node root cause scores, and the weights of nodes at different levels in the root cause location tree may be the same or different.

[0106] Specifically, a pruning operation is performed on a node path with the smallest path root cause score in the root cause location tree, or a pruning operation is performed on at least one node path with a path root cause score less than a score threshold in the root cause location tree.

[0107] The advantage of this setting is that it reduces the search space of the root cause location tree and reduces the computing resources consumed by the root cause iterative search process, thereby further improving the efficiency of locating the alarm root cause.

[0108] S260: until the iteration end condition is met, determine the alarm root cause result corresponding to the alarm text set to be located according to the root cause location tree at the end of the iteration.

[0109] S260 in this embodiment is similar to that in the above embodiment. Figure 1 The S130 shown corresponds to the same or similar steps, and will not be described in detail in this embodiment.

[0110] The technical solution of this embodiment is to obtain at least two initial alarm texts matching a preset indicator sequence from an initial alarm text set in the initial alarm data set according to an initial alarm indicator set in the initial alarm data set, and when the alarm timestamps of the at least two initial alarm texts satisfy a periodic rule, delete the at least two initial alarm texts from the initial alarm data set to obtain an alarm data set to be located, and eliminate alarm texts with periodic interference from the dimension of periodic alarms of alarm indicators, thereby solving the problem of a huge amount of data in the alarm data set to be located and further improving the efficiency and accuracy of locating the root cause of the alarm.

[0111] Figure 3 This is a flow chart of another method for locating the root cause of an alarm provided by an embodiment of the present invention. This embodiment further refines the method for obtaining the alarm indicator set to be located in the above embodiment. Figure 3 As shown, the method includes:

[0112] S310: For each alarm text to be located, extract indicators from the alarm text to be located to obtain at least one alarm indicator.

[0113] In a specific embodiment, extracting indicators from the alarm text to be located to obtain at least one alarm indicator includes: using a regular expression to extract indicators from the alarm text to be located to obtain at least one alarm indicator.

[0114] In another specific embodiment, the alarm text to be located is subjected to indicator extraction to obtain at least one alarm indicator, including: inputting the alarm text to be located into a pre-trained indicator extraction model to obtain at least one alarm indicator as output.

[0115] Exemplarily, the indicator extraction model is a sequence labeling model or a text classification model, but is not limited to the example scenario.

[0116] In this embodiment, the alarm indicators extracted from the alarm text to be located are mostly parameter indicators. Specifically, the alarm indicators are one-dimensional indicators or multi-dimensional indicators. For example, assuming that the alarm text to be located is "the number of database connections exceeds 1000, and the normal threshold is 800", the alarm indicator "number of database connections" is a one-dimensional indicator. Assuming that the alarm text to be located is "the disk write speed is abnormal, only 10MB / s per second, which is lower than the normal threshold of 30MB / s, and the disk read speed is abnormal, only 5MB / s per second, which is lower than the normal threshold of 10MB / s", the alarm indicator "disk read and write status" is a two-dimensional indicator, which includes the disk write dimension and the disk read dimension.

[0117] Based on the above embodiment, specifically, before extracting indicators from the alarm text to be located and obtaining at least one alarm indicator, the method further includes: performing data cleaning on the alarm text to be located. Exemplarily, data cleaning includes but is not limited to removing irrelevant text content, correcting spelling errors, correcting grammatical errors, and removing stop words, etc.

[0118] The advantage of this setting is that it further ensures the accuracy of locating the root cause of the alarm.

[0119] S320: Obtain indicator values ​​corresponding to at least one alarm indicator from the alarm text to be located.

[0120] For example, assuming that the alarm text to be located is "the number of database connections exceeds 1000, and the normal threshold is 800", and the alarm indicator is "the number of database connections", the indicator value corresponding to the alarm indicator is greater than 1000.

[0121] S330: Add at least one indicator value to the alarm indicator sequence corresponding to the alarm text to be located in the alarm indicator set to be located.

[0122] On the basis of the above embodiments, specifically, the alarm indicators in the alarm indicator set to be located include alarm categories. Accordingly, the method also includes: for each alarm text to be located, inputting the alarm text to be located into a pre-trained text classification model to obtain the output alarm text to be located and the indicator value corresponding to the alarm category; adding the indicator value to the alarm indicator sequence corresponding to the alarm text to be located in the alarm indicator set to be located.

[0123] In a specific embodiment, specifically, the text classification model includes a feature extraction module, a feature fusion module and a classification output module; accordingly, the alarm text to be located is input into the pre-trained text classification model to obtain the output index value corresponding to the alarm text to be located and the alarm category, including: through the feature extraction module, at least one word segmentation alarm text corresponding to the alarm text to be located is feature embedded to obtain the word segmentation alarm feature; through the feature fusion module, according to at least one word segmentation alarm feature and part-of-speech weight data, a fused alarm feature is determined; wherein the part-of-speech weight data includes at least one weight corresponding to each text part of speech; through the classification output module, according to the fused alarm feature, the index value corresponding to the alarm text to be located and the alarm category is output.

[0124] Specifically, the alarm category may indicate the alarm classification scenario to which the alarm text to be located belongs. Exemplary indicator values ​​of the alarm category include, but are not limited to, database access failure, application to database problem, cache slow log, application to cache problem, jsf thread pool full, host problem, etc., which are not limited here.

[0125] In this embodiment, the method further includes: performing word segmentation processing and part-of-speech tagging on the alarm text to be located, and obtaining at least one word segmentation alarm text and text parts-of-speech corresponding to at least one word segmentation alarm text. The text parts-of-speech include but are not limited to nouns, verbs, adjectives, adverbs, pronouns, conjunctions, and auxiliary words, etc., which are not limited here.

[0126] In a specific embodiment, the text classification model is a bidirectional encoder based on the Transformer model (Bidirectional Encoder Representations from Transformers, BERT).

[0127] The advantage of this setting is that adding alarm categories further enriches the indicator dimensions of the root cause of the alarm, which is especially effective for application scenarios where the generated alarm text is rich in content but semantically ambiguous. In addition, the text classification model based on part-of-speech weights is adopted, so that the text classification model can capture the detailed semantics in the alarm text, thereby further improving the accuracy of locating the root cause of the alarm.

[0128] S340: Construct a state space according to the alarm data set to be located.

[0129] S350: construct a root cause location tree according to the state space, and perform a root cause iterative search operation according to the root cause location tree.

[0130] S360: until the iteration end condition is met, determine the alarm root cause result corresponding to the alarm text set to be located according to the root cause location tree at the end of the iteration.

[0131] S340-S360 in this embodiment are similar to those in the above embodiment. Figure 1 The S110-S130 shown in the figure correspond to the same or similar ones, or to the above-mentioned embodiments. Figure 2 The S240 - S260 shown correspond to the same or similar ones, and are not described in detail in this embodiment.

[0132] On the basis of the above embodiment, specifically, the method also includes: obtaining a test root cause result and a real root cause result corresponding to the test alarm text set; wherein the test root cause result is obtained by performing a root cause iterative search operation on a root cause location tree; determining a search performance result of the root cause location tree according to the test root cause result and the real root cause result; and when the search performance result does not meet the search performance condition, adjusting the hyperparameters of the root cause location tree to obtain an adjusted root cause location tree.

[0133] Specifically, the method for determining the test root cause result is the same or similar to the method for determining the alarm root cause result corresponding to the alarm text set to be located in the above embodiment, and will not be described in detail in this embodiment.

[0134] Exemplarily, the search performance conditions include, but are not limited to, at least one of a positioning error rate reaching an error rate threshold, a positioning error amount reaching an error amount threshold, and an evaluation score of a test root cause result being less than a score threshold.

[0135] The advantage of this setting is that it ensures the search performance of the root cause location tree, thereby helping to further improve the accuracy of locating the alarm root cause.

[0136] The technical solution of this embodiment, by extracting indicators from each alarm text to be located in the alarm text set to be located, obtains at least one alarm indicator, obtains indicator values ​​corresponding to at least one alarm indicator from the alarm text to be located, and adds at least one indicator value to the alarm indicator sequence corresponding to the alarm text to be located in the alarm indicator set to be located, thereby enriching the parameter indicator dimension of the alarm root cause, improving the comprehensiveness of the positioning dimension of the alarm root cause, and thus refining the positioning granularity of the alarm root cause.

[0137] Figure 4 A flowchart of a specific example of a method for locating the root cause of an alarm provided by an embodiment of the present invention. Specifically, from the dimension of periodic alarms of alarm indicators, the alarm texts in the initial alarm data set are removed to obtain a set of alarm texts to be located. A text classification model is used to determine the index values ​​corresponding to the alarm texts to be located and the alarm categories, and at least one alarm indicator and the index values ​​corresponding to at least one alarm indicator are extracted according to the alarm texts to be located, and an alarm indicator set to be located corresponding to the alarm text set to be located is constructed.

[0138] According to the set of alarm indicators to be located, a state space is constructed, and the root node in the root cause location tree is initialized according to the state space. In the root cause iterative search process of the root cause location tree, in each iteration, it is determined whether the iteration end condition is met. If so, the alarm root cause result corresponding to the alarm text set to be located is determined according to the root cause location tree at the end of the iteration.

[0139] If not, the root cause location tree in the current iteration is pruned, the node to be expanded is selected from the pruned root cause location tree, the child node corresponding to the node to be expanded is determined, and the root cause location tree is updated according to the child node. Combined with the periodic increase in the dimension of the total number of alarms, the node root cause score of the child node is determined according to the state of the child node, and the node statistics of the nodes in the node path containing the child node in the updated root cause location tree are updated according to the node root cause score.

[0140] The following is an embodiment of a device for locating the root cause of an alarm provided in an embodiment of the present invention. The device and the method for locating the root cause of an alarm in the above-mentioned embodiment belong to the same inventive concept. For details not described in detail in the embodiment of the device for locating the root cause of an alarm, reference may be made to the contents of the method for locating the root cause of an alarm in the above-mentioned embodiment.

[0141] Figure 5 A schematic diagram of the structure of a device for locating the root cause of an alarm provided by an embodiment of the present invention. Figure 5 As shown, the device includes: a state space construction module 410, a root cause location tree iterative search module 420 and an alarm root cause result determination module 430.

[0142] The state space construction module 410 is used to construct a state space according to the alarm data set to be located; wherein the alarm data set to be located includes an alarm text set to be located and an alarm indicator set to be located;

[0143] A root cause location tree iterative search module 420 is used to construct a root cause location tree according to the state space, and perform a root cause iterative search operation according to the root cause location tree;

[0144] The alarm root cause result determination module 430 is used to determine the alarm root cause result corresponding to the alarm text set to be located according to the root cause location tree at the end of the iteration until the iteration end condition is met;

[0145] Among them, the alarm text set to be located contains multiple alarm texts to be located, the alarm indicator set to be located contains an alarm indicator sequence corresponding to each alarm text to be located, the alarm indicator sequence contains indicator values ​​of at least two alarm indicators, the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space.

[0146] The technical solution of this embodiment constructs a state space based on the alarm data set to be located, constructs a root cause location tree based on the state space, and performs a root cause iterative search operation based on the root cause location tree, wherein the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space, thereby achieving the purpose of locating the alarm root cause in the cross-indicator dimension, solving the problem of limited processing capacity of traditional root cause location methods, and improving the efficiency and accuracy of locating the alarm root cause.

[0147] In a specific embodiment, the root cause location tree iterative search module 420 includes:

[0148] The node selection unit to be expanded is used to obtain the node statistics of each node in the root cause location tree in the current iteration process in each iteration process, and select the node to be expanded from the root cause location tree according to the node statistics of each node;

[0149] A child node determination unit, used to determine the child node corresponding to the node to be expanded according to the state space and the state of the node to be expanded, and update the root cause location tree according to the child node;

[0150] A node root cause score determination unit, used to determine the node root cause score of the child node according to the state of the child node;

[0151] A node statistics data updating unit, used for updating the node statistics data of the nodes in the node path containing the child nodes in the updated root cause location tree according to the node root cause score;

[0152] The iteration end condition judgment unit is used to return to the step of obtaining node statistics of each node in the root cause location tree in the current iteration process when the iteration end condition is not met.

[0153] In a specific embodiment, the node root factor score determination unit includes:

[0154] The total periodic alarm attribute determination subunit is used to determine the total periodic alarm attribute of the child node according to the historical alarm data set and the state of the child node;

[0155] The node root cause score determination subunit is used to determine the node root cause score of the child node as a preset score when the total amount periodic alarm attribute is the total amount periodic alarm;

[0156] Among them, the total periodic alarm indicates that the total amount of historical alarms corresponding to the child node conforms to the periodic law, and the preset score is a score less than the score threshold.

[0157] In a specific embodiment, the total amount periodic alarm attribute determination subunit is specifically used to:

[0158] According to a preset total amount period, the historical alarm data set is divided to obtain at least two historical alarm data subsets;

[0159] Determine at least two total historical alarm amounts corresponding to the child node according to at least two subsets of historical alarm data and the status of the child node; wherein the subsets of historical alarm data correspond to the total historical alarm amounts one-to-one;

[0160] When at least two historical alarm totals are greater than the total threshold, the total periodic alarm attribute of the child node is set to the total periodic alarm.

[0161] In a specific embodiment, the device further comprises:

[0162] A root cause location tree pruning module is used to obtain at least two node paths in the root cause location tree in the current iteration process;

[0163] For each node path, determining a path root factor score of the node path according to the node root factor score corresponding to at least one node in the node path;

[0164] A pruning operation is performed on the root cause location tree according to at least two path root cause scores.

[0165] In a specific embodiment, the device further comprises:

[0166] The module for determining the alarm data set to be located is used to obtain the initial alarm data set; wherein the initial alarm data set includes an initial alarm text set and an initial alarm indicator set;

[0167] According to the initial alarm indicator set, at least two initial alarm texts matching the preset indicator sequence are obtained from the initial alarm text set; wherein the preset indicator sequence includes an indicator value of at least one alarm indicator;

[0168] When the alarm timestamps of at least two initial alarm texts satisfy a periodic rule, the at least two initial alarm texts are deleted from the initial alarm data set to obtain an alarm data set to be located.

[0169] In a specific embodiment, the device comprises:

[0170] An alarm indicator extraction module is used to extract indicators from each alarm text to be located to obtain at least one alarm indicator;

[0171] Obtaining indicator values ​​corresponding to at least one alarm indicator from the alarm text to be located;

[0172] At least one indicator value is added to the alarm indicator sequence corresponding to the alarm text to be located in the alarm indicator set to be located.

[0173] In a specific embodiment, the alarm indicator in the alarm indicator set to be located includes an alarm category, and accordingly, the device further includes:

[0174] The alarm category classification module is used to input the alarm text to be located into a pre-trained text classification model for each alarm text to be located, and obtain the output index value corresponding to the alarm text to be located and the alarm category;

[0175] The indicator value is added to the alarm indicator sequence corresponding to the alarm text to be located in the alarm indicator set to be located.

[0176] In a specific embodiment, the text classification model includes a feature extraction module, a feature fusion module and a classification output module; correspondingly, the alarm category classification module is specifically used to:

[0177] Through the feature extraction module, feature embedding is performed on at least one word segmentation warning text corresponding to the warning text to be located, so as to obtain word segmentation warning features;

[0178] Determine a fused alarm feature through a feature fusion module according to at least one word segmentation alarm feature and part-of-speech weight data; wherein the part-of-speech weight data includes a weight corresponding to at least one text part-of-speech;

[0179] Through the classification output module, according to the fused alarm features, the alarm text to be located and the indicator value corresponding to the alarm category are output;

[0180] In a specific embodiment, the device further comprises:

[0181] A root cause location tree adjustment module is used to obtain a test root cause result and a real root cause result corresponding to the test alarm text set; wherein the test root cause result is obtained by performing a root cause iterative search operation on the root cause location tree;

[0182] Determine the search performance result of the root cause location tree according to the test root cause result and the real root cause result;

[0183] When the search performance result does not meet the search performance condition, the hyperparameters of the root cause localization tree are adjusted to obtain an adjusted root cause localization tree.

[0184] The device for locating the root cause of an alarm provided in the embodiment of the present invention can execute the method for locating the root cause of an alarm provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0185] Figure 6 A schematic diagram of the structure of an electronic device provided for one embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0186] like Figure 6As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor 11, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the ROM 12 or the computer program loaded from the storage unit 18 to the RAM 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0187] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information or data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0188] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSP), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the method for locating the root cause of the alarm provided in the above embodiments.

[0189] In some embodiments, the method for locating the root cause of the alarm provided in the above embodiments may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps in the method for locating the root cause of the alarm described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the method for locating the root cause of the alarm in any other appropriate manner (e.g., by means of firmware).

[0190] Various embodiments of the systems and techniques described above herein may be implemented in the following systems or combinations thereof: digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard parts (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0191] The computer program for implementing the method for locating the root cause of an alarm of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or the block diagram are implemented. The computer program can be executed completely on the machine, partially on the machine, partially on the machine and partially on a remote machine as an independent software package, or completely on a remote machine or server.

[0192] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable storage medium. Examples of machine readable storage media may include electrical connections based on at least one line, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM), flash memories, optical fibers, portable compact disc read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0193] To provide interaction with a user, the systems and techniques described herein may be implemented on a terminal device having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the user can provide input to the terminal device. Other types of devices may also provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0194] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a Local Area Network (LAN), a Wide Area Network (WAN), a blockchain network, and the Internet.

[0195] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0196] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0197] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for locating the root cause of an alarm, characterized in that: include: Constructing a state space according to the alarm data set to be located; wherein the alarm data set to be located includes an alarm text set to be located and an alarm indicator set to be located; Constructing a root cause location tree according to the state space, and performing a root cause iterative search operation according to the root cause location tree; Until the iteration end condition is met, the alarm root cause result corresponding to the alarm text set to be located is determined according to the root cause location tree at the end of the iteration; Among them, the alarm text set to be located contains multiple alarm texts to be located, the alarm indicator set to be located contains an alarm indicator sequence corresponding to each alarm text to be located, the alarm indicator sequence contains indicator values ​​of at least two alarm indicators, the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space.

2. The method according to claim 1, characterized in that The performing a root cause iterative search operation according to the root cause location tree comprises: In each iteration process, node statistics of each node in the root cause localization tree in the current iteration process are obtained, and according to the node statistics of each node, a node to be expanded is selected from the root cause localization tree; Determine, according to the state space and the state of the node to be expanded, a child node corresponding to the node to be expanded, and update the root cause location tree according to the child node; Determining a node root factor score of the child node according to a state of the child node; According to the node root cause score, updating the node statistics of the nodes in the node path including the child node in the updated root cause location tree; When the iteration end condition is not met, return to execute the step of obtaining node statistics of each node in the root cause location tree in the current iteration process.

3. The method according to claim 2, characterized in that The step of determining the node root factor score of the child node according to the state of the child node includes: Determine the total periodic alarm attribute of the child node according to the historical alarm data set and the state of the child node; In a case where the total amount periodic alarm attribute is a total amount periodic alarm, determining the node root cause score of the child node to be a preset score; The total periodic alarm indicates that the total amount of historical alarms corresponding to the child node conforms to a periodic rule, and the preset score is a score less than a score threshold.

4. The method according to claim 3, characterized in that The determining, according to the historical alarm data set and the state of the child node, the total periodic alarm attribute of the child node includes: According to a preset total amount period, the historical alarm data set is divided to obtain at least two historical alarm data subsets; Determine at least two total historical alarm amounts corresponding to the child node according to the at least two subsets of historical alarm data and the state of the child node; wherein the subsets of historical alarm data correspond to the total historical alarm amounts one-to-one; When the total amounts of the at least two historical alarms are both greater than the total amount threshold, the total amount periodic alarm attribute of the child node is set to a total amount periodic alarm.

5. The method according to claim 2, characterized in that: The method further comprises: Obtain at least two node paths in the root cause location tree during the current iteration; For each node path, determining a path root factor score of the node path according to the node root factor scores respectively corresponding to at least one node in the node path; A pruning operation is performed on the root cause location tree according to at least two path root cause scores.

6. The method according to claim 1, characterized in that The method further comprises: Acquire an initial alarm data set; wherein the initial alarm data set includes an initial alarm text set and an initial alarm indicator set; According to the initial alarm indicator set, at least two initial alarm texts matching a preset indicator sequence are obtained from the initial alarm text set; wherein the preset indicator sequence includes an indicator value of at least one alarm indicator; In the case where the alarm timestamps of the at least two initial alarm texts satisfy a periodic rule, the at least two initial alarm texts are deleted from the initial alarm data set to obtain an alarm data set to be located.

7. The method according to claim 1, characterized in that The method further comprises: For each alarm text to be located, extracting indicators from the alarm text to be located to obtain at least one alarm indicator; Acquire, from the alarm text to be located, indicator values ​​respectively corresponding to the at least one alarm indicator; At least one indicator value is added to the alarm indicator sequence corresponding to the alarm text to be located in the alarm indicator set to be located.

8. The method according to claim 1, characterized in that The alarm indicators in the alarm indicator set to be located include alarm categories. Accordingly, the method further includes: For each alarm text to be located, the alarm text to be located is input into a pre-trained text classification model to obtain an output index value corresponding to the alarm text to be located and the alarm category; The indicator value is added to the alarm indicator sequence corresponding to the alarm text to be located in the alarm indicator set to be located.

9. The method according to claim 8, characterized in that The text classification model includes a feature extraction module, a feature fusion module and a classification output module; Correspondingly, the step of inputting the alarm text to be located into a pre-trained text classification model to obtain the output index value corresponding to the alarm text to be located and the alarm category includes: By means of the feature extraction module, feature embedding is performed on at least one word segmentation warning text corresponding to the warning text to be located to obtain word segmentation warning features; Determine the fused alarm feature through the feature fusion module according to at least one word segmentation alarm feature and part-of-speech weight data; wherein the part-of-speech weight data includes at least one weight corresponding to each part-of-speech of the text; The classification output module outputs the indicator value corresponding to the alarm text to be located and the alarm category according to the fused alarm feature.

10. The method according to claim 1, characterized in that The method further comprises: Obtaining a test root cause result and a real root cause result corresponding to the test alarm text set; wherein the test root cause result is obtained by performing a root cause iterative search operation on a root cause location tree; Determining a search performance result of the root cause location tree according to the test root cause result and the real root cause result; When the search performance result does not meet the search performance condition, the hyper parameters of the root cause localization tree are adjusted to obtain an adjusted root cause localization tree.

11. A device for locating the root cause of an alarm, characterized in that: include: A state space construction module is used to construct a state space according to a set of alarm data to be located; wherein the set of alarm data to be located includes a set of alarm texts to be located and a set of alarm indicators to be located; A root cause location tree iterative search module, used to construct a root cause location tree according to the state space, and perform a root cause iterative search operation according to the root cause location tree; An alarm root cause result determination module is used to determine the alarm root cause result corresponding to the alarm text set to be located according to the root cause location tree at the end of the iteration until the iteration end condition is met; Among them, the alarm text set to be located contains multiple alarm texts to be located, the alarm indicator set to be located contains an alarm indicator sequence corresponding to each alarm text to be located, the alarm indicator sequence contains indicator values ​​of at least two alarm indicators, the state in the state space represents an indicator combination composed of at least one alarm indicator, and the nodes in the root cause location tree are the states in the state space.

12. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for locating the root cause of the alarm according to any one of claims 1-10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for locating the root cause of an alarm according to any one of claims 1 to 10 when executed.

14. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method for locating a root cause of an alarm according to any one of claims 1 to 10 is implemented.

Images