Abnormal data collection method and system

Abstract

The invention relates to an abnormal data collection method and system, and belongs to the technical field of data processing, and the method comprises the steps: obtaining alarm information, analyzing the alarm information, and extracting key information of the alarm information, the key information comprising an IP address, node information and alarm content information; intelligent agents are constructed according to user requirements and construction elements, the construction elements comprise prompt function design and execution function design, and the types of the intelligent agents comprise node extraction intelligent agents and abnormal data extraction intelligent agents; and performing abnormal data extraction of a preset period on the key information based on the intelligent agent to obtain target abnormal data. According to the method, the collection efficiency and accuracy of abnormal data are improved, and manual participation is not needed.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and in particular relates to an abnormal data collection method and system. Background Art

[0002] With the development of AI technology, intelligent operation and maintenance has become a hot technology for major IT companies to research, especially common AIOps tasks such as anomaly detection of operation and maintenance data and alarm convergence. Operation and maintenance data is a kind of time series data, which is generated in real time and has a huge amount of data, reaching tens of terabytes of data per day, including a large amount of normal data and a small amount of abnormal data. The traditional method of collecting abnormal data is generally to actively collect various indicator time series data, and then mark them according to different tasks. Most of the data collected by this method is normal indicator data, which is heavily dependent on manual work, with a huge workload and low efficiency. It often takes a lot of time to collect enough abnormal data to train AI models, which seriously delays the progress of work. Therefore, how to better realize the collection of abnormal data has become an urgent problem to be solved. Summary of the invention

[0003] In view of the above shortcomings of the prior art, the purpose of the invention is to provide a method and system for collecting abnormal data. The method improves the efficiency and accuracy of collecting abnormal data without manual intervention.

[0004] In the first aspect of the present invention, a method for collecting abnormal data is proposed, comprising: S1, obtaining alarm information, analyzing the alarm information, and extracting key information of the alarm information, wherein the key information includes an IP address, node information, and alarm content information; S2, constructing an intelligent agent according to user needs and construction elements, wherein the construction elements include prompt function design and execution function design, and the types of the intelligent agent include node extraction intelligent agent and abnormal data extraction intelligent agent; S3, extracting abnormal data of the key information at a preset period based on the intelligent agent to obtain target abnormal data.

[0005] Furthermore, the alarm level of the alarm information is determined based on the alarm information, wherein the alarm information is analyzed to extract key information of the alarm information, including: determining whether there is a title field in the alarm information; and when it is determined that the title field exists and the alarm level is the target alarm level, obtaining the IP address of the alarm information, the node information and the alarm content information based on the title field.

[0006] Furthermore, it also includes: when it is determined that the title field does not exist and the alarm level is the target alarm level, obtaining the target format corresponding to the alarm information; obtaining the instance information string from the target format, and obtaining the IP address from the instance information string; obtaining the label string from the target format, and obtaining the node information from the label string; obtaining the summary string from the target format, and obtaining the target content from the summary string, and using the target content as the alarm content information.

[0007] Furthermore, based on the agent, abnormal data extraction of a preset period of the key information is performed, including: determining the node information whose information status is not missing; analyzing the alarm content information based on the abnormal data extraction agent to obtain the target function for obtaining the abnormal data; using the IP address and the node information as input parameters of the target function, calling the target interface, and obtaining the abnormal data within a preset time; repeating the above steps until the abnormal data of the preset period is obtained.

[0008] Further, obtaining target abnormal data includes: taking the abnormal data of the preset period as the target abnormal data.

[0009] Further, determining that the information status of the node information is not missing includes: judging whether the status of the node information is missing; when the status of the node information is missing, obtaining the target host information of the IP address; and filling the node information based on the target host information.

[0010] Further, the node information is filled based on the target host information, including: determining the number of hosts based on the target host information; when it is determined that the number of hosts is a preset number, obtaining a first host and using the first host as the node information; when it is determined that the number of hosts is greater than the preset number, obtaining a second host, the second host being all hosts corresponding to the number of hosts; analyzing the alarm content information and the information of the second host based on the node extraction agent to determine the node information, wherein the alarm content information is used as input information and the information of the second host is used as reference information.

[0011] The second aspect of the present invention proposes an abnormal data collection system, including: an acquisition module, used to obtain alarm information, analyze the alarm information, and extract key information of the alarm information, wherein the key information includes IP address, node information and alarm content information; a construction module, used to construct an intelligent agent according to user needs and construction elements, wherein the construction elements include prompt function design and execution function design, and the types of the intelligent agent include node extraction intelligent agent and abnormal data extraction intelligent agent; a collection module, used to extract abnormal data of the key information at a preset period based on the intelligent agent to obtain target abnormal data.

[0012] According to a third aspect of the present invention, an electronic device is proposed, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the methods described in the first aspect of the present invention.

[0013] According to a fourth aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any one of the methods according to the first aspect of the present invention.

[0014] The beneficial effects of the present invention are as follows:

[0015] The abnormal data collection method and system of the present invention obtains alarm information, analyzes the alarm information, extracts key information of the alarm information, and the key information includes IP address, node information and alarm content information; constructs an intelligent agent according to user needs and construction elements, and the construction elements include prompt function design and execution function design. The types of the intelligent agent include node extraction intelligent agent and abnormal data extraction intelligent agent; based on the intelligent agent, the key information is extracted for abnormal data of a preset period to obtain target abnormal data. The method improves the efficiency and accuracy of abnormal data collection without manual participation. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0017] Figure 1 is a flow chart of an abnormal data collection method according to an embodiment of the present invention;

[0018] Figure 2 is a flow chart of an abnormal data collection method according to a specific embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of an abnormal data collection system according to an embodiment of the present invention;

[0020] Figure 4 It is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.

[0022] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.

[0023] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the orientation or position relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.

[0025] The present invention proposes an abnormal data collection method, system and related equipment. Specifically, the abnormal data collection method, system and related equipment of an embodiment of the present invention are described below with reference to the accompanying drawings.

[0026] Figure 1 1 is a flow chart of an abnormal data collection method according to an embodiment of the present invention. It should be noted that the abnormal data collection method according to the embodiment of the present invention can be applied to the abnormal data collection system according to the embodiment of the present invention. The abnormal data collection system can be configured on an electronic device or in a server. This embodiment of the present application does not limit this.

[0027] like Figure 1 As shown, the abnormal data collection method includes:

[0028] S110, obtaining alarm information, analyzing the alarm information, and extracting key information of the alarm information, the key information including IP address, node information and alarm content information.

[0029] In the embodiment of the present invention, the alarm level of the alarm information may be determined according to the alarm information.

[0030] In an embodiment of the present invention, it is determined whether there is a title field in the alarm information; if it is determined that there is a title field and the alarm level is the target alarm level, the IP address, node information and alarm content information of the alarm information are obtained based on the title field.

[0031] In an embodiment of the present invention, when it is determined that there is no title field and the alarm level is the target alarm level, the target format corresponding to the alarm information is obtained; the instance information string is obtained from the target format, and the IP address is obtained from the instance information string; the label string is obtained from the target format, and the node information is obtained from the label string; the summary string is obtained from the target format, and the target content is obtained from the summary string, and the target content is used as the alarm content information.

[0032] S120, constructing an intelligent body according to user needs and construction elements, the construction elements including prompt function design and execution function design.

[0033] In an embodiment of the present invention, the types of agents include node extraction agents and abnormal data extraction agents.

[0034] In an embodiment of the present invention, the prompt function is designed as follows: its core function is to guide the big model to understand how to handle the request problem, which is equivalent to giving the big model clear task instructions and telling it what goals to achieve. For example, the prompt of the node extraction agent tells the big model that its role is the computer room node extraction assistant, and its task is to extract node information from the reference information; the prompt of the abnormal data extraction agent lets the big model know that it is an abnormal data extraction assistant, and it needs to choose the appropriate tool to obtain data according to the user's problem. Through such clear prompts, the big model knows the content of the work.

[0035] For execution function design: it is used to define the tools that can be used by large models, and describes in detail all the function parameters and function functions. For large models, these descriptions can help them know what each function can do and how to call the corresponding parameters to perform operations, so as to accurately select the appropriate tool function to carry out work according to specific requests.

[0036] In an embodiment of the present invention, design building elements may be customized.

[0037] In an embodiment of the present invention, the large model used by the intelligent agent can select a model with function calling capabilities, such as glm4, qwen series, InternLM series, etc., collectively referred to as LLM models.

[0038] In the embodiment of the present invention, the standard openAI interface method is used when constructing the intelligent agent, using the two parameters of history (historical session parameters) and tools (tool parameters). When processing a request, the designed prompt function is inserted into history, and the execution function is described in a unified dictionary format as the input parameter of tools, so that the large model can carry out subsequent work according to this setting.

[0039] S130, extracting abnormal data of a preset period from key information based on the intelligent agent to obtain target abnormal data.

[0040] In the embodiment of the present invention, when extracting key information of the alarm information and constructing an intelligent agent, abnormal data of a preset period can be extracted from the key information based on the intelligent agent to obtain target abnormal data. The specific implementation method can refer to the subsequent embodiments.

[0041] According to the abnormal data collection method of the embodiment of the present invention, the alarm information is obtained, and the alarm information is analyzed to extract the key information of the alarm information, the key information includes the IP address, the node information and the alarm content information; the intelligent agent is constructed according to the user's needs and the construction elements, the construction elements include the prompt function design and the execution function design, and the types of the intelligent agent include the node extraction intelligent agent and the abnormal data extraction intelligent agent; based on the intelligent agent, the abnormal data of the key information is extracted in a preset period to obtain the target abnormal data. The method improves the efficiency and accuracy of abnormal data collection without human intervention.

[0042] In order to make it easier for those skilled in the art to understand the present invention, Figure 2 is an abnormal data collection method according to a specific embodiment of the present invention, such as Figure 2 As shown, the abnormal data collection method includes:

[0043] S210, obtaining alarm information, analyzing the alarm information, and extracting key information of the alarm information, the key information including IP address, node information and alarm content information.

[0044] S220, constructing an intelligent agent according to user needs and construction elements, the construction elements including prompt function design and execution function design.

[0045] In an embodiment of the present invention, the types of agents include node extraction agents and abnormal data extraction agents.

[0046] Among them, the node extraction agent means that when encountering a situation where the node information is incomplete, this agent comes into play. It can extract accurate node information from the alarm content information and the CMDB (configuration management database, which usually contains a lot of equipment-related configuration and management information) interface response information. For example, when dealing with some abnormal alarm situations, when the content about the node part in the alarm data is missing or not clear and accurate enough, it can analyze the relevant information and sort out the accurate computer room node name in the format of "company name->place name and number", providing accurate location pointing for subsequent in-depth troubleshooting.

[0047] Among them, the abnormal data extraction agent means that based on the given IP address, node information and alarm content information, the agent can extract the time series data of specific indicators from the specified machine. For example, the data of the host memory usage, CPU usage or disk usage corresponding to the target host can be obtained over time, so that the specific performance of the machine with abnormal alarm in various key indicators can be understood in more detail, which is helpful for accurate analysis and location of the cause of the abnormality.

[0048] In an embodiment of the present invention, the specific steps of constructing an intelligent agent include (for two types of intelligent agents respectively):

[0049] Node extraction agent: S1. Prompt function design: Set the prompt as "You are a computer room node extraction assistant. Your task is to extract node information related to the user's question from the reference information" to make the big model clear about its own role and node extraction task. S2. Execution function design: Describe the node extraction function according to the openAI interface standard, including function type, name, function (matching host information according to IP address and product name and extracting computer room nodes in the specified format) and parameter requirements (defining required node parameters, etc.), and the way to pass it to the big model is relatively flexible, which can be passed directly according to the description or after conversion.

[0050] Abnormal data extraction agent: S1. Prompt function design: The designed prompt is "You are an abnormal data extraction assistant. Your task is to select the appropriate tool to obtain data based on the user's question", which guides the big model to know the task direction of selecting tools to obtain data based on the user's question. S2. Execution function design: Multiple execution functions are designed, respectively for querying the target host memory, CPU, disk usage and other functions. Each function has a similar structural description, including function type, name, function description (query the corresponding indicator usage based on the computer room node name and IP address) and the required IP address and node parameter requirements, which are also flexible when passed to the big model.

[0051] S230, determining that the information status is not missing node information.

[0052] In an embodiment of the present invention, it is determined whether the state of the node information is missing; if the state of the node information is missing, the target host information of the IP address is obtained; and the node information is filled based on the target host information.

[0053] Herein, judging whether the state of the node information is missing may be understood as judging whether the node information is empty.

[0054] In an embodiment of the present invention, the number of hosts is determined based on target host information; when the number of hosts is determined to be a preset number, a first host is obtained and the first host is used as node information; when the number of hosts is determined to be greater than the preset number, a second host is obtained, and the second host is all hosts corresponding to the number of hosts; based on the node extraction agent method, the alarm content information and the information of the second host are analyzed to determine the node information, wherein the alarm content information is used as input information and the information of the second host is used as reference information.

[0055] Among them, the alarm content information and the information of the second host are analyzed based on the node extraction agent to determine the node information. It can be understood as: taking the alarm content information as the user question, taking the information of all hosts corresponding to the number of hosts found by the IP address as the reference information, and the prompt of the node extraction agent, to build a complete large model input. For example, "You are a computer room node extraction assistant. Your task is to extract the node information related to the user question from the reference information. \nThe user question is: {}\nThe reference information is: {}".format (alarm content information, all host information corresponding to the number of hosts found by the IP address), insert this string into history, and describe the execution function in a unified dictionary format as the tools input parameter. At this time, the large model will select an execution function from the tools to process the current request, and extract the parameters required by the execution function from the input information. Of course, the node extraction agent is special. There is only one execution function in the tools, and the parameter of the execution function is the node. In this way, the node information is extracted. The advantage of doing this is that the output of the large model can be standardized and the node information can be directly extracted.

[0056] S240, analyzing the alarm content information based on the abnormal data extraction agent to obtain the target function for obtaining abnormal data.

[0057] For example, the alarm content information is used as the user question, and the prompt sentence designed by the abnormal data extraction agent is "You are an abnormal data extraction assistant. Your task is to select the appropriate tool to obtain data based on the user question." Through such clear and straightforward prompts, the objective function for obtaining abnormal data can be obtained.

[0058] S250, taking the IP address and node information as input parameters of the target function, calling the target interface, and obtaining abnormal data within a preset time.

[0059] In an embodiment of the present invention, the above steps S230 - S250 are repeated until abnormal data of a preset period is obtained.

[0060] S260, obtaining target abnormal data.

[0061] In an embodiment of the present invention, abnormal data of a preset period is used as target abnormal data.

[0062] According to the abnormal data collection method of the embodiment of the present invention, the method can automatically obtain and analyze the alarm information, extract the key IP address, the node information and the alarm content information. This not only improves the efficiency of information extraction, but also ensures the accuracy and integrity of the information. Use intelligent agents (such as node extraction intelligent agents and abnormal data extraction intelligent agents) to further process the information. These intelligent agents design and execute the function design intelligent agents through clear prompt functions. The types include node extraction intelligent agents and abnormal data extraction intelligent agents, which can guide the large model to accurately understand the task requirements and select appropriate tools for data processing, thereby improving the intelligent level of data processing. The method ensures the integrity of the node information by judging the state of the node information and filling it with the target host information when the information is missing. This helps to further investigate and locate subsequent problems. Through the abnormal data extraction intelligent agent and calling the target interface, the method can obtain abnormal data within a preset time for specific IP addresses and node information. This helps to accurately analyze and locate the causes of abnormalities and improve the efficiency of problem solving. By repeatedly executing steps S230-S250, the method can continuously collect abnormal data of a preset period, providing reliable data support for long-term monitoring and analysis without manual participation. The design of this method has high scalability and flexibility. By adjusting the prompt function design and execution function design, it can adapt to the data processing requirements in different scenarios, improving the versatility and practicality of the method.

[0063] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0064] According to one aspect of an embodiment of the present invention, a system for collecting abnormal data is also provided. Figure 3 is a schematic diagram of an abnormal data collection system according to an embodiment of the present invention; Figure 3 As shown, including:

[0065] The acquisition module 310 is used to acquire the alarm information, analyze the alarm information, and extract the key information of the alarm information, wherein the key information includes the IP address, the node information, and the alarm content information;

[0066] A construction module 320, for constructing an agent according to user requirements and construction elements, wherein the construction elements include prompt function design and execution function design, and the types of the agent include node extraction agent and abnormal data extraction agent;

[0067] The collection module 330 is used to extract abnormal data of a preset period from the key information based on the intelligent agent to obtain target abnormal data.

[0068] According to the abnormal data collection system of the embodiment of the present invention, the alarm information is obtained, and the alarm information is analyzed to extract the key information of the alarm information, the key information includes the IP address, the node information and the alarm content information; the intelligent agent is constructed according to the user's needs and construction elements, the construction elements include prompt function design and execution function design, and the types of the intelligent agent include node extraction intelligent agent and abnormal data extraction intelligent agent; based on the intelligent agent, the key information is extracted for a preset period of abnormal data to obtain the target abnormal data. The method improves the efficiency and accuracy of abnormal data collection without manual participation.

[0069] Optionally, the alarm level of the alarm information is determined based on the alarm information, wherein the acquisition module 310 is specifically used to determine whether there is a title field in the alarm information; when it is determined that the title field exists and the alarm level is the target alarm level, the IP address, the node information and the alarm content information of the alarm information are acquired based on the title field.

[0070] Optionally, the acquisition module 310 is specifically used to obtain the target format corresponding to the alarm information when it is determined that the title field does not exist and the alarm level is the target alarm level; obtain the instance information string from the target format, and obtain the IP address from the instance information string; obtain the label string from the target format, and obtain the node information from the label string; obtain the summary string from the target format, and obtain the target content from the summary string, and use the target content as the alarm content information.

[0071] Optionally, the collection module 330 is specifically used to determine the node information whose information status is not missing; analyze the alarm content information based on the abnormal data extraction agent to obtain the target function for obtaining the abnormal data; use the IP address and the node information as input parameters of the target function, call the target interface, and obtain the abnormal data within a preset time; repeat the above steps until the abnormal data of the preset period is obtained.

[0072] Optionally, the collection module 330 is specifically configured to use the abnormal data of the preset period as the target abnormal data.

[0073] Optionally, the collection module 330 is specifically used to determine whether the status of the node information is missing; if the status of the node information is missing, obtain the target host information of the IP address; and fill in the node information based on the target host information.

[0074] Optionally, the collection module 330 is specifically used to determine the number of hosts based on the target host information; when it is determined that the number of hosts is a preset number, obtain a first host and use the first host as the node information; when it is determined that the number of hosts is greater than the preset number, obtain a second host, and the second host is all hosts corresponding to the number of hosts; based on the node extraction agent method, the alarm content information and the information of the second host are analyzed to determine the node information, wherein the alarm content information is used as input information and the information of the second host is used as reference information.

[0075] According to one aspect of an embodiment of the present invention, an electronic device is provided.

[0076] Figure 4 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 4 As shown, the electronic device may include one or more ( Figure 4 Only one is shown in the figure) processor 102 (processor 102 may include but is not limited to a microprocessor (Microprocessor Unit, referred to as MPU) or a programmable logic device (Programmable logic device, referred to as PLD)) and a memory 104 for storing data. In an exemplary embodiment, the electronic device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 4 The structure shown is for illustration only and does not limit the structure of the above terminal device. Figure 4 More or fewer components as shown, or with Figure 4 Equivalent functions or comparisons shown Figure 4 A different configuration with more features is shown.

[0077] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormal data collection method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the terminal device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0078] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the switching device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0079] The present invention provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute an abnormal data collection method.

[0080] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

[0081] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0082] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for collecting abnormal data, characterized in that: include: S1, obtaining alarm information, analyzing the alarm information, and extracting key information of the alarm information, wherein the key information includes an IP address, node information, and alarm content information; S2, constructing an agent according to user needs and construction elements, wherein the construction elements include prompt function design and execution function design, and the types of the agent include node extraction agent and abnormal data extraction agent; S3, extracting abnormal data of a preset period from the key information based on the intelligent agent to obtain target abnormal data.

2. The abnormal data collection method according to claim 1, characterized in that: Determining an alarm level of the alarm information according to the alarm information, wherein analyzing the alarm information to extract key information of the alarm information includes: Determining whether there is a title field in the alarm information; When it is determined that the title field exists and the alarm level is the target alarm level, the IP address, the node information and the alarm content information of the alarm information are acquired based on the title field.

3. The abnormal data collection method according to claim 2, characterized in that: Also includes: When it is determined that the title field does not exist and the alarm level is the target alarm level, obtaining a target format corresponding to the alarm information; Obtaining an instance information string from the target format, and obtaining the IP address from the instance information string; Acquire a label string from the target format, and acquire the node information from the label string; A summary character string is obtained from the target format, and a target content is obtained from the summary character string, and the target content is used as the alarm content information.

4. The abnormal data collection method according to claim 1, characterized in that: Extracting abnormal data of a preset period from the key information based on the intelligent agent includes: Determine the node information whose information status is not missing; Analyze the alarm content information based on the abnormal data extraction agent to obtain an objective function for obtaining the abnormal data; Using the IP address and the node information as input parameters of the target function, calling the target interface, and obtaining the abnormal data within a preset time; Repeat the above steps until the abnormal data of the preset period is obtained.

5. The abnormal data collection method according to claim 4, characterized in that: Get target abnormal data, including: The abnormal data of the preset period is used as the target abnormal data.

6. The abnormal data collection method according to claim 4, characterized in that: Determining that the information status is the node information that is not missing includes: Determine whether the state of the node information is missing; When the state of the node information is missing, obtaining the target host information of the IP address; The node information is filled based on the target host information.

7. The abnormal data collection method according to claim 6, characterized in that: Filling the node information based on the target host information includes: Determine the number of hosts based on the target host information; When it is determined that the number of hosts is a preset number, obtaining a first host, and using the first host as the node information; When it is determined that the number of hosts is greater than the preset number, obtaining second hosts, where the second hosts are all hosts corresponding to the number of hosts; The alarm content information and the information of the second host are analyzed based on the node extraction agent to determine the node information, wherein the alarm content information is used as input information and the information of the second host is used as reference information.

8. An abnormal data collection system, characterized in that: include: An acquisition module is used to acquire alarm information, analyze the alarm information, and extract key information of the alarm information, wherein the key information includes an IP address, node information, and alarm content information; A construction module, used to construct an intelligent agent according to user needs and construction elements, wherein the construction elements include prompt function design and execution function design, and the types of the intelligent agent include node extraction intelligent agent and abnormal data extraction intelligent agent; The collection module is used to extract abnormal data of a preset period from the key information based on the intelligent agent to obtain target abnormal data.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

Images