Service alarm method, device, equipment, medium and product

Abstract

The invention discloses a service alarm method, device and equipment, a medium and a product, and the method comprises the steps: reading a performance log of a current collection time period in response to a condition that an error judgment condition is satisfied; according to a preset regular expression group and the performance log, error code information of each transaction is determined, and the error code information comprises error codes and error information; determining a business error type to which each error code belongs according to a pre-training classification model and the error code information; and based on the business failure transaction volume belonging to the business error and a preset alarm threshold, determining whether to carry out business alarm. According to the method, error information is screened through the preset regular expression group in response to the error judgment condition, the type of an error code is determined, and whether service warning is carried out or not is determined through the service failure transaction volume. According to the invention, the error code can be updated in time, the false alarm caused by the error of the service failure type can be avoided, the timely emergency of the service alarm can be ensured, and the stability of the service system can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a service alarm method, device, equipment, medium and product. Background Art

[0002] The payment system in a bank is of high importance because it involves account movement, and there are many types of payments and transactions. In order to ensure the normal operation of the payment system, it is necessary to monitor the payment system.

[0003] Existing technologies usually set alarms for indicators such as the success rate, response time, and transaction volume of each transaction. When the set threshold is exceeded, an alarm text message will be sent to the operation and maintenance personnel to remind them that the system operation may be at risk. Based on the content of the alarm text message, the operation and maintenance personnel will query the log content of the transaction when the alarm occurs in the log center to determine whether there is a problem with the transaction and whether the system is running normally.

[0004] However, this alarm method has problems. Payment transactions often fail due to business errors, such as "wrong password input", "insufficient account balance" and "exceeding the card transaction limit". Such errors often do not require the attention of operation and maintenance personnel, but they appear frequently, resulting in a large number of invalid alarms, which greatly wastes the time of operation and maintenance personnel. In addition, due to the large number of payment system-related systems, business error codes are often increasing, making it difficult to manually collect and maintain them. Summary of the invention

[0005] The present invention provides a service alarm method, device, equipment, medium and product to realize accurate alarm of service errors.

[0006] According to a first aspect of the present invention, there is provided a service alarm method, comprising:

[0007] In response to meeting the error judgment condition, reading the performance log of the current collection time period;

[0008] Determine error code information of each transaction according to a preset regular expression group and the performance log, wherein the error code information includes an error code and error information;

[0009] Determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, where the business error type includes a business error and a non-business error;

[0010] Based on the business failure transaction volume belonging to the business error and a preset alarm threshold, it is determined whether to issue a business alarm.

[0011] According to a second aspect of the present invention, there is provided a service alarm device, comprising:

[0012] A log reading module, configured to read the performance log of the current collection time period in response to meeting the error judgment condition;

[0013] An information determination module, used to determine error code information of each transaction according to a preset regular expression group and the performance log, wherein the error code information includes an error code and error information;

[0014] A type determination module, used to determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, wherein the business error type includes a business error and a non-business error;

[0015] The alarm judgment module is used to determine whether to issue a business alarm based on the business failure transaction volume belonging to the business error and a preset alarm threshold.

[0016] According to a third aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the service alarm method described in any embodiment of the present invention.

[0020] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the service alarm method described in any embodiment of the present invention when executed.

[0021] According to a fifth aspect of the present invention, an embodiment of the present invention further provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the service alarm method of any embodiment of the present invention is implemented.

[0022] The technical solution of the embodiment of the present invention is to read the performance log of the current collection time period in response to the error judgment condition being met; determine the error code information of each transaction according to the preset regular expression group and the performance log, the error code information includes the error code and the error information; determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, the business error type includes business error and non-business error; determine whether to issue a business alarm based on the business failure transaction volume belonging to the business error and the preset alarm threshold. In response to the error judgment condition, the error information is screened with the preset regular expression group, and the type of the error code is determined, and whether to issue a business alarm is determined by the business failure transaction volume. It ensures that the error code is updated in a timely manner, avoids false alarms caused by errors of the business failure type, and thus ensures timely emergency response to business alarms, and improves the stability of the business system.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a service alarm method provided according to Embodiment 1 of the present invention;

[0026] Figure 2 is a flow chart of a service alarm method provided according to Embodiment 2 of the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of a service alarm device provided according to Embodiment 3 of the present invention;

[0028] Figure 4 It is a schematic diagram of the structure of an electronic device implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 A flowchart of a service alarm method is provided for the first embodiment of the present invention. This embodiment can be applied to alarming transaction services. The method can be executed by a service alarm device. The service alarm device can be implemented in the form of hardware and / or software. The service alarm device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0033] S110 . In response to satisfying an error judgment condition, reading a performance log of a current collection time period.

[0034] In this embodiment, the error judgment condition can be understood as a condition that triggers the judgment on whether to issue a business alarm, for example, it can be a preset time interval (such as running once a day), or receiving a request to be judged. The current collection time period can be understood as the interval time period set for each collection, and the current collection time period is the time period between the last collection and the current collection. The performance log can be understood as a log file that records data related to the transaction system.

[0035] Specifically, in response to the error judgment condition being met, the processor can read all performance logs of the current collection time period from the log center according to the time of the last collection as the starting time, and can also query all performance logs of the corresponding transaction through the input transaction code and other information. Among them, each transaction-related system sends the generated logs to the log center, so that the log center can provide log storage and log query services to the operation and maintenance personnel of each system.

[0036] Exemplarily, in response to the error judgment condition being met, the processor may use the Python requests library to send a request and use the json library to parse the returned data. When requesting the log center, the number of log entries each time is the maximum number of paging entries in the log center, and the request interval is 2 seconds.

[0037] Among them, logs are generally divided into application logs and performance logs. Application logs generally print information that needs to be recorded or viewed during the transaction process. Performance logs are generally printed after the transaction is completed, generally including the transaction time, transaction code, return code, etc.

[0038] S120. Determine error code information of each transaction according to a preset regular expression group and a performance log, where the error code information includes an error code and error information.

[0039] In this embodiment, the preset regular expression group can be understood as a screening condition set for screening out error information. Transactions can be understood as all transactions occurring in the current collection time period, and can be distinguished according to transaction types and the like.

[0040] In this embodiment, the error code information can be understood as being used to characterize the error situation under each transaction, and may include an error code and error information, wherein the return code generally includes a return code representing success and a return code representing failure. There is generally only one return code representing success for a transaction, such as 0 or 0000, etc. The return code representing failure is the error code. Since payment transactions generally have many checks, there are error codes representing different failure modes within the system, and there are many related parties and related systems. When calling the related system, the error code of the system will also be returned, so there are generally many error codes.

[0041] Specifically, the processor can parse the performance log, extract the error code contained therein, and then use the error code as an index to request the application log in the current collection time period from the log center. Since the log center collects application logs from different sources and systems, the log format of each source may be different. Different strings and symbols will be used to represent error information in different log formats. The processor can extract the required error information from application logs in different formats according to the preset regular expression group, obtain the error information of each transaction, and associate the error code with the error information to obtain the error code information.

[0042] It is understandable that since performance logs generally only send information such as transaction codes, error codes, transaction times, etc. to the log center, specific error information is generally not sent to the log center. Therefore, it is necessary to use performance logs to determine the specific error information corresponding to the erroneous transaction.

[0043] For example, take a performance log as an example: 2019-08-05 09:40:35,152dealCode=xx||cost=13||flag=1. It can be seen that the performance log only includes transaction time, error code, transaction code and identifier. It is necessary to further query the corresponding error information through the error code.

[0044] Furthermore, the preset regular expression group includes at least two preset regular expressions, and the preset regular expression includes: a non-capturing group and a capturing group, the non-capturing group includes at least two preset matching strings representing the error information title, and the capturing group includes preset symbol characters representing the referenced error content. The non-capturing group is used to represent the unwanted content, and the capturing group is used for the wanted content. The preset matching string is a string used to represent the error information title. The preset symbol character can be understood as a symbol that references the error content.

[0045] Exemplarily, a specific preset regular expression group is used for illustration. The preset regular expression group includes seven preset regular expressions, which are shown in the following table:

[0046] Table 1 Preset regular expression groups:

[0047]

[0048]

[0049] For example, let's take the first preset regular expression as an example to explain, where (?:...) represents a non-capturing group. Its function is to group but not capture the matched content, that is, this group will not appear as an independent capturing group in the final matching result.

[0050] MidReturnMsg|midReturnM|ErrorMsg|errorMsg|ErrorMessage|errorMessage|returnMessage|ReturnMessage|returnMsg|ReturnMsg: This is a group of options separated by a vertical bar |, indicating that any of these preset match strings can be matched.

[0051] :"([^"]+)": This part matches a colon : followed by a pair of double quotes "". The capture group is represented as ([^"]+). The capture group ([^"]+) will match and capture all characters between double quotes until the next double quote is encountered. The specific explanation is as follows: ([^"]+): This is a capture group that matches and captures one or more characters that are not double quotes. [^"] represents "non-double quote" characters, and + means matching one or more such characters.

[0052] The second preset regular expression also matches a colon first. The (.+?) part is a capture group, which is used to capture all characters after the colon until the first period. or the end of the string $ is encountered. The (?:\.|$) part is also a non-capture group, which is used to match the period. or the end of the string $. This non-capture group is to avoid using the period or the end of the string as a separate capture group. The difference in the third preset regular expression is that the non-capture group is used to match a comma or $. The difference between the fourth to sixth preset regular expressions and the above is that the first match is an equal sign, and the rest are the same.

[0053] S130. Determine the service error type to which each error code belongs according to the pre-trained classification model and the error code information. The service error type includes a service error and a non-service error.

[0054] In this embodiment, the pre-trained classification model can be understood as a model for determining the type of business error. For example, the BERT model can be used. BERT is a pre-trained language model based on the Transformers architecture, which can simultaneously consider the left and right context information of a word, rather than just the previous unidirectional model that only considers the left or right context. This two-way training method enables BERT to better understand the meaning of words in different contexts. Transformer is a neural network architecture based on the self-attention mechanism, which can effectively capture the global dependencies of the input sequence. BERT uses a multi-layer Transformer encoder, each layer of which consists of a multi-head self-attention mechanism and a feedforward neural network layer, which is used to map the input sequence to the context representation. Error code types can be divided into business error codes and non-business error codes. For example, business error codes can include "password error" and "insufficient balance", etc., which operation and maintenance personnel generally do not need to pay attention to. For example, non-business error codes can include "database abnormality" and "network abnormality", etc., which are generally what operation and maintenance personnel need to pay attention to.

[0055] Specifically, the processor may input the error code information into a pre-trained classification model, determine the classification result of the pre-trained classification model, and determine the business error type to which each error code belongs, where the business error type includes business errors and non-business errors.

[0056] S140: Determine whether to issue a business alarm based on the volume of business failure transactions that are business errors and a preset alarm threshold.

[0057] In this embodiment, the business failure transaction volume can be understood as the transaction volume of the business error type generated in the current collection time period. The preset alarm threshold can be understood as a threshold indicator for determining whether to issue an alarm.

[0058] Specifically, the processor can obtain the total number of successful transactions and the total number of failed transactions in the current collection time period. Since the business failure transaction volume under the business failure type is not an item that requires an alarm, the transaction success rate in the current collection time period can be determined based on the business failure transaction volume and the total number of successful transactions, and then the transaction success rate is compared with the preset alarm threshold to determine whether to issue a business alarm.

[0059] The technical solution of the embodiment of the present invention is to read the performance log of the current collection time period in response to the error judgment condition being met; determine the error code information of each transaction according to the preset regular expression group and the performance log, the error code information includes the error code and the error information; determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, the business error type includes business error and non-business error; determine whether to issue a business alarm based on the business failure transaction volume belonging to the business error and the preset alarm threshold. In response to the error judgment condition, the error information is screened with the preset regular expression group, and the type of the error code is determined, and whether to issue a business alarm is determined by the business failure transaction volume. It ensures that the error code is updated in a timely manner, avoids false alarms caused by errors of the business failure type, and thus ensures timely emergency response to business alarms, and improves the stability of the business system.

[0060] As a first optional embodiment of the first embodiment, based on the above embodiment, the training steps of the pre-trained classification model include:

[0061] Obtain an initial classification model and a labeled error code sample data set; generate new sample data based on a preset oversampling algorithm and the error code sample data set and combine the error code sample data set to obtain a sample set to be trained; train the initial classification model based on the sample set to be trained to obtain a pre-trained classification model after training.

[0062] In this embodiment, the initial classification model can be understood as an untrained classification model. The error code sample data set can be understood as a sample data set containing annotated error codes and error information. The preset oversampling algorithm can be understood as an algorithm for balancing sample types, such as the Borderline-SMOTE algorithm. The new sample data can be understood as sample data generated by the preset oversampling algorithm. The sample set to be trained can be understood as a sample set containing new samples of balanced sample types.

[0063] Specifically, the business error code can be annotated manually or by machine. In order to reduce the errors caused by subjective judgment, different operation and maintenance personnel annotate the summary of the error information, summarize the annotated results, and record the data with the same results. Discuss and re-annotate the data with different results. If it is difficult to determine whether it is a business error code or a non-business error code, it is identified as a non-business error code, that is, it is ensured that the screened business error codes are not of concern to the operation and maintenance personnel. The annotated data can be used as benchmark data and as a business error code optimization alarm to reduce false alarms. After completing the annotation of the error code data, the error information text corresponding to the error code needs to be converted into the format for classification model training. Feature extraction is performed on the text and the text is saved in the form of a vector. The processor can first randomly divide the data into a training set and a test set, with the training set accounting for 80% and the test set accounting for 20%. Then, BERT BertTokenizer is used to complete the vectorization work and convert the error information corresponding to the error code into vectors of equal length.

[0064] Specifically, since there are more business error codes than non-business error codes in the error code sample data set, there is a problem of data imbalance, so the processor can use a preset oversampling algorithm (such as Borderline-SMOTE algorithm) to process the error code sample data set to generate new sample data. The preset oversampling algorithm is an improved synthetic minority sample algorithm, which increases the diversity of minority class samples by generating new samples and makes the new samples closer to the decision boundary. Then the sample set to be trained is obtained. The initial classification model is trained with the sample set to be trained, wherein the initial classification model can use the Bert method of adding a fully connected layer to construct a classifier, set a 768*2 fully connected layer, and map the output space of the model to the probability distribution of whether it is a business error code to make a classification decision. To prevent overfitting, the Dropout regularization technology is used to randomly set the output of a part of the neurons to 0 during the training process to reduce the model's dependence on specific neurons, thereby improving the model's generalization ability and anti-overfitting ability. During the training process, the cross entropy loss is set as the loss function of the model, and the Adam optimizer is used to update the model parameters according to the set gradient and learning rate, gradually reducing the loss value until the maximum number of iterations is reached. After that, the accuracy, precision, recall and F1 value of the model are calculated using the test set to evaluate the model. If it does not meet the expectations, the model will continue to be trained and optimized until it meets the expectations, and the pre-trained classification model will be obtained.

[0065] In the first optional embodiment of the first embodiment, by such a setting, the error code can be classified by establishing an initial classification model based on the BERT text classification method, which can quickly distinguish between business error codes and non-business error codes. The types of error code sample data sets are balanced by the preset oversampling algorithm, thereby ensuring the accuracy of the classification of the pre-trained classification model.

[0066] As a second optional embodiment of the first embodiment, after determining whether to issue a service alarm based on the service failure transaction volume belonging to the service error and the preset alarm threshold, the method further includes:

[0067] When it is determined to issue a service alarm, alarm information is generated according to the error code information and the occurrence frequency of each error code to issue a service alarm.

[0068] In this embodiment, the warning information can be understood as information indicating the cause of the error. The occurrence frequency can be understood as the frequency of occurrence of each error code in the current collection time period.

[0069] Specifically, when it is determined to issue a business alarm, since the alarm is generally caused by a small number of error codes, the processor can send the top N error codes with the highest frequency of occurrence and the corresponding error information as alarm information to the terminals of relevant operation and maintenance personnel for business alarm. N can be set according to the system. If there are provinces, cities or channels in the performance log, the TopN information can also be aggregated and sent to the operation and maintenance personnel to help them eliminate positioning problems. For example, the error code and its error information can be sent to the operation and maintenance personnel by automatically generating alarm information in the form of a table.

[0070] The second optional embodiment of the first embodiment of the present invention, through such a setting, generates an alarm message from the error code and error information when the alarm occurs to the operation and maintenance personnel, thereby reducing the time for the operation and maintenance personnel to locate the problem, quickly determine whether there is a risk in the current system, respond in time, and reduce the risk of system operation.

[0071] Embodiment 2

[0072] Figure 2 This is a flow chart of a service alarm method provided by Embodiment 2 of the present invention. This embodiment is a further refinement of the above embodiment. Figure 2 As shown, the method includes:

[0073] S201: In response to an error judgment condition being met, reading a performance log of a current collection time period.

[0074] S202. Determine error codes of all transactions generated in the current collection time period according to the performance log.

[0075] Specifically, the processor may parse the performance log to determine the error codes of all transactions generated during the current collection time period.

[0076] S203: Query the application log of the error code in the current collection time period in the log center.

[0077] In this embodiment, the log center can be understood as a platform for storing logs generated by different systems and providing log query services.

[0078] Specifically, the processor may query the log center within the current collection time period and request application logs using the error code as an index.

[0079] S204: Extract error information of error codes from application logs based on a preset regular expression.

[0080] Specifically, since there are many impurities in the application log, it is necessary to use information extraction technology to extract the corresponding error information. Information extraction technology is generally divided into three categories: rule-based, statistical-based sequence labeling, and deep learning. Among them, the rule-based method with the highest accuracy is selected for extraction, that is, a preset regular expression is used to extract the error information of the error code in the application log.

[0081] S205. Determine the service error type to which each error code belongs based on the pre-trained classification model and the error code information. The service error type includes a service error and a non-service error.

[0082] S206: Obtain the successful transaction volume and the total failed transaction volume in the current collection time period.

[0083] In this embodiment, the successful transaction volume can be understood as the number of successful transactions. The total failed transaction volume can be understood as the number of transactions judged to be failed, which generally includes business failures and non-business failures.

[0084] Specifically, the processor may collect statistics on all transactions within the current collection time period to determine the successful transaction volume and the total failed transaction volume.

[0085] S207: Determine the transaction success rate based on the volume of failed business transactions due to business errors, the volume of successful transactions, and the total volume of failed transactions.

[0086] In this embodiment, the transaction success rate can be understood as representing the success probability of the transaction in the current collection time period.

[0087] Specifically, since transactions of the business error type generally do not require attention, that is, when making an early warning judgment, the processor can judge transactions of the business error type as successful transactions, that is, the processor can determine the transaction success rate based on the business failure transaction volume, successful transaction volume and total failed transaction volume that belong to business errors. For example, the transaction success rate can be determined by (successful transaction volume + business failure transaction volume) / (successful transaction volume + total failed transaction volume).

[0088] S208: If the transaction success rate is lower than the preset alarm threshold, a business alarm is issued.

[0089] Specifically, the processor may compare the transaction success rate with a preset alarm threshold, and if the transaction success rate is lower than the preset alarm threshold, a service alarm is issued.

[0090] S209: Otherwise, no service alarm is issued.

[0091] Specifically, if the transaction success rate is higher than or equal to the preset alarm threshold, no business alarm is issued.

[0092] According to the technical solution of the embodiment of the present invention, in response to the error judgment condition being met, the performance log is extracted from the log center, and the error code included therein is obtained. The application log is determined by the error code, and then the error information is filtered out in the application log by the preset regular expression. Only the log center needs to be requested, and the payment system does not need to be modified, so the monitoring and alarm capabilities can be improved non-invasively. The error code information is classified by the pre-trained classification model to determine the business error type to which the error code belongs. The successful transaction volume is balanced by the business failure transaction volume belonging to the business error, and then the transaction success rate in the current collection time period is determined, and then whether to issue a business alarm is determined based on the transaction success rate and the preset alarm threshold. The alarm judgment method is optimized by using the business error code, the occurrence of false alarms is reduced, and the time and energy spent by the operation and maintenance personnel on false alarms is reduced. Non-business error codes can be discovered in time, and the operation and maintenance personnel can be reminded when new non-business error codes appear, so that the potential hidden dangers of the system can be discovered, and the system stability can be improved. The error code information is collected and analyzed from the log, so that when the alarm occurs, the error code and error information at this time are sent to the operation and maintenance personnel, thereby reducing the time for the operation and maintenance personnel to locate the problem, quickly determining whether there is a risk in the current system, and responding to emergencies in time.

[0093] Embodiment 3

[0094] Figure 3 This is a schematic diagram of the structure of a service alarm device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a log reading module 31, an information determination module 32, a type determination module 33 and an alarm judgment module 34.

[0095] The log reading module 31 is used to read the performance log of the current collection time period in response to meeting the error judgment condition;

[0096] An information determination module 32, used to determine the error code information of each transaction according to a preset regular expression group and the performance log, wherein the error code information includes an error code and error information;

[0097] A type determination module 33, used to determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, wherein the business error type includes a business error and a non-business error;

[0098] The alarm determination module 34 is used to determine whether to issue a business alarm based on the business failure transaction volume belonging to the business error and a preset alarm threshold.

[0099] The technical solution of the embodiment of the present invention is to read the performance log of the current collection time period in response to the error judgment condition being met; determine the error code information of each transaction according to the preset regular expression group and the performance log, the error code information includes the error code and the error information; determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, the business error type includes business error and non-business error; determine whether to issue a business alarm based on the business failure transaction volume belonging to the business error and the preset alarm threshold. In response to the error judgment condition, the error information is screened with the preset regular expression group, and the type of the error code is determined, and whether to issue a business alarm is determined by the business failure transaction volume. It ensures that the error code is updated in a timely manner, avoids false alarms caused by errors of the business failure type, and thus ensures timely emergency response to business alarms, and improves the stability of the business system.

[0100] Among them, the preset regular expression group includes at least two preset regular expressions, and the preset regular expression includes: a non-capturing group and a capturing group, the non-capturing group includes at least two preset matching strings representing the error information title, and the capturing group includes preset symbol characters representing the reference error content.

[0101] Furthermore, the information determination module 32 is specifically used for:

[0102] Determine, based on the performance log, error codes of all transactions generated during the current collection time period;

[0103] Query the application log of the error code in the current collection time period in the log center;

[0104] Based on a preset regular expression, error information of the error code is extracted from the application log.

[0105] Furthermore, the alarm determination module 34 is specifically used for:

[0106] Obtain the successful transaction volume and the total failed transaction volume during the current collection time period;

[0107] Determining a transaction success rate based on the business failure transaction volume attributable to the business error, the successful transaction volume, and the total failed transaction volume;

[0108] If the transaction success rate is lower than the preset alarm threshold, a business alarm is issued;

[0109] Otherwise, the service alarm is not issued.

[0110] Optionally, the device further comprises:

[0111] Model training module, used to obtain the initial classification model and the labeled error code sample data set;

[0112] According to a preset oversampling algorithm and the error code sample data set, new sample data is generated and combined with the error code sample data set to obtain a sample set to be trained;

[0113] The initial classification model is trained according to the sample set to be trained to obtain a trained pre-trained classification model.

[0114] Optionally, the device further comprises:

[0115] The business alarm module is used to determine whether to issue a business alarm based on the business failure transaction volume belonging to the business error and the preset alarm threshold. When it is determined to issue a business alarm, the business alarm is generated based on the error code information and the frequency of occurrence of each error code.

[0116] The service alarm device provided in the embodiment of the present invention can execute the service alarm method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0117] Embodiment 4

[0118] Figure 4 A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0119] like Figure 4 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0120] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 41 executes the various methods and processes described above, such as a service alarm method.

[0122] In some embodiments, the service alarm method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the service alarm method described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to perform the service alarm method in any other appropriate manner (e.g., by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] In one embodiment, the embodiment of the present invention further includes a computer program product, the computer program product includes a computer program, and the computer program implements the service alarm method of any embodiment of the present invention when executed by a processor.

[0130] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0131] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0132] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A service alarm method, characterized in that: include: In response to meeting the error judgment condition, reading the performance log of the current collection time period; Determine error code information of each transaction according to a preset regular expression group and the performance log, wherein the error code information includes an error code and error information; Determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, where the business error type includes business error and non-business error; Based on the business failure transaction volume belonging to the business error and a preset alarm threshold, it is determined whether to issue a business alarm.

2. The method according to claim 1, characterized in that Determining error code information of each transaction according to the preset regular expression group and the performance log includes: Determine, based on the performance log, error codes of all transactions generated during the current collection time period; Query the application log of the error code in the current collection time period in the log center; Based on a preset regular expression, error information of the error code is extracted from the application log.

3. The method according to claim 1, characterized in that The preset regular expression group includes at least two preset regular expressions, and the preset regular expression includes: a non-capturing group and a capturing group. The non-capturing group includes at least two preset matching strings representing the error information title, and the capturing group includes preset symbol characters representing the reference error content.

4. The method according to claim 1, characterized in that: The training steps of the pre-trained classification model include: Obtain the initial classification model and the annotated error code sample dataset; According to a preset oversampling algorithm and the error code sample data set, new sample data is generated and combined with the error code sample data set to obtain a sample set to be trained; The initial classification model is trained according to the sample set to be trained to obtain a trained pre-trained classification model.

5. The method according to claim 1, characterized in that The determining whether to issue a service alarm based on the service failure transaction volume belonging to the service error and a preset alarm threshold comprises: Obtain the successful transaction volume and the total failed transaction volume during the current collection time period; Determining a transaction success rate based on the business failure transaction volume attributable to the business error, the successful transaction volume, and the total failed transaction volume; If the transaction success rate is lower than the preset alarm threshold, a business alarm is issued; Otherwise, the service alarm is not issued.

6. The method according to claim 1, characterized in that After determining whether to issue a service alarm based on the service failure transaction volume belonging to the service error and the preset alarm threshold, the method further includes: When it is determined to issue a service alarm, alarm information is generated according to the error code information and the occurrence frequency of each error code to issue a service alarm.

7. A service alarm device, characterized in that: include: A log reading module, configured to read the performance log of the current collection time period in response to meeting the error judgment condition; An information determination module, used to determine error code information of each transaction according to a preset regular expression group and the performance log, wherein the error code information includes an error code and error information; A type determination module, used to determine the business error type to which each error code belongs according to the pre-trained classification model and the error code information, wherein the business error type includes a business error and a non-business error; The alarm judgment module is used to determine whether to issue a business alarm based on the business failure transaction volume belonging to the business error and a preset alarm threshold.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the service alarm method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the service alarm method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the service alarm method according to any one of claims 1 to 6.

Images