Fault detection method and device, computer equipment and readable storage medium

Abstract

The invention relates to a fault detection method and device, computer equipment and a readable storage medium. The method comprises the following steps: acquiring alarm fault information and to-be-detected fault information of data resource information; converting the alarm fault information into a plurality of standard fault monitoring data arranged according to a first time sequence, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged according to a second time sequence; according to the first time sequence and the second time sequence, performing cross combination on the plurality of standard fault monitoring data and the plurality of to-be-detected monitoring data to obtain cross combination grid data; detecting the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid; and based on the fault information similarity, generating a fault detection result corresponding to the to-be-detected fault information. By adopting the method, fault detection can be accurately carried out.

Description

Technical Field

[0001] The present application relates to the field of operation and maintenance monitoring technology, and in particular to a fault detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In today's wave of digital transformation, enterprises are deploying their applications and services to multiple cloud service providers. Especially in a hybrid multi-cloud environment, enterprises need to integrate monitoring data from different cloud service providers to achieve fast and effective fault detection of monitoring data.

[0003] At present, a common fault detection method is a fault detection method based on a machine learning model. Specifically, historical monitoring data of faults occurring is obtained from a database, and a machine learning model is trained based on the historical monitoring data of faults occurring. Then, based on the trained machine learning model, fault detection is performed on the monitoring data collected in real time to determine whether the monitoring data is data of a fault occurring.

[0004] However, the current fault detection method is not accurate enough. Summary of the invention

[0005] Based on this, it is necessary to provide an accurate fault detection method, device, computer equipment, computer readable storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a fault detection method, comprising:

[0007] Acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information;

[0008] Converting the alarm fault information into a plurality of standard fault monitoring data arranged in a first time series, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time series;

[0009] According to the first time series and the second time series, a plurality of standard fault monitoring data and a plurality of monitoring data to be detected are cross-combined to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected;

[0010] According to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid, the similarity of the fault information between the alarm fault information and the fault information to be detected is detected;

[0011] Based on the similarity of the fault information, a fault detection result corresponding to the fault information to be detected is generated.

[0012] In one embodiment, according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid, detecting the fault information similarity between the alarm fault information and the fault information to be detected includes:

[0013] Select the monitoring data grid with the earliest time order from the cross-combined grid data as the starting alignment point, and select the monitoring data grid with the latest time order as the ending alignment point;

[0014] Detect path information from the starting alignment point to the ending alignment point according to distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid;

[0015] Based on the path information, the fault information similarity between the alarm fault information and the fault information to be detected is generated.

[0016] In one embodiment, detecting path information from a start alignment point to an end alignment point according to distance information between standard fault monitoring data and monitoring data to be detected in a monitoring data grid includes:

[0017] Path planning step: selecting a neighborhood monitoring data grid of the starting alignment point from the cross-combined grid data, and detecting the initial path information from the starting alignment point to each neighborhood monitoring data grid based on the distance information between the standard fault monitoring data and the monitoring data to be detected in the starting alignment point, and the distance information between the standard fault monitoring data and the monitoring data to be detected in the neighborhood monitoring data grid;

[0018] The shortest path information is selected from all the initial path information, and the neighborhood monitoring data grid corresponding to the shortest path information is used as the next alignment point of the starting alignment point;

[0019] Update the next alignment point to the starting alignment point, return to the path planning step until the next alignment point is the ending alignment point, and generate path information from the starting alignment point to the ending alignment point based on all initial path information.

[0020] In one embodiment, according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid, detecting the fault information similarity between the alarm fault information and the fault information to be detected includes:

[0021] For each monitoring data grid, a first estimated derivative of the standard fault monitoring data and a second estimated derivative of the monitoring data to be detected are detected, and distance information between the standard fault monitoring data and the monitoring data to be detected is detected according to the first estimated derivative and the second estimated derivative, wherein the first estimated derivative represents an estimated change speed of the standard fault monitoring data in a first time series, and the second estimated derivative represents an estimated change speed of the monitoring data to be detected in a second time series;

[0022] Based on the distance information of each monitoring data grid, the fault information similarity between the alarm fault information and the fault information to be detected is detected.

[0023] In one embodiment, after generating the fault detection result corresponding to the fault information to be detected based on the fault information similarity, the method further includes:

[0024] When it is determined that the fault detection result corresponding to the fault information to be detected is that a fault has occurred or is about to occur, a link detection tool is used to locate the target data resource information where the fault occurs.

[0025] In one embodiment, before acquiring the monitoring data of the data resource information in the plurality of monitoring time periods, the method further includes:

[0026] Configure the alarm triggering conditions and the required triggering duration of the alarm for data resource information;

[0027] When the data resource information meets the alarm triggering conditions and the required alarm triggering duration, alarm fault information is generated.

[0028] In a second aspect, the present application also provides a fault detection device, comprising:

[0029] A monitoring data acquisition module is used to acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information;

[0030] A time sequence processing module, used to convert the alarm fault information into a plurality of standard fault monitoring data arranged in a first time sequence, and to convert the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time sequence;

[0031] A data combination module, used for cross-combining a plurality of standard fault monitoring data with a plurality of monitoring data to be detected according to a first time series and a second time series to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected;

[0032] A similarity detection module is used to detect the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid;

[0033] The fault detection module is used to generate a fault detection result corresponding to the fault information to be detected based on the similarity of the fault information.

[0034] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0035] Acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information;

[0036] Converting the alarm fault information into a plurality of standard fault monitoring data arranged in a first time series, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time series;

[0037] According to the first time series and the second time series, a plurality of standard fault monitoring data and a plurality of monitoring data to be detected are cross-combined to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected;

[0038] According to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid, the similarity of the fault information between the alarm fault information and the fault information to be detected is detected;

[0039] Based on the similarity of the fault information, a fault detection result corresponding to the fault information to be detected is generated.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0041] Acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information;

[0042] Converting the alarm fault information into a plurality of standard fault monitoring data arranged in a first time series, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time series;

[0043] According to the first time series and the second time series, a plurality of standard fault monitoring data and a plurality of monitoring data to be detected are cross-combined to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected;

[0044] According to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid, the similarity of the fault information between the alarm fault information and the fault information to be detected is detected;

[0045] Based on the similarity of the fault information, a fault detection result corresponding to the fault information to be detected is generated.

[0046] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0047] Acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information;

[0048] Converting the alarm fault information into a plurality of standard fault monitoring data arranged in a first time series, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time series;

[0049] According to the first time series and the second time series, a plurality of standard fault monitoring data and a plurality of monitoring data to be detected are cross-combined to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected;

[0050] According to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid, the similarity of the fault information between the alarm fault information and the fault information to be detected is detected;

[0051] Based on the similarity of the fault information, a fault detection result corresponding to the fault information to be detected is generated.

[0052] In the above-mentioned fault detection method, apparatus, computer equipment, computer-readable storage medium and computer program product, during the whole process, data resource information is monitored, and the alarm fault information in the monitoring data is converted into a plurality of standard fault monitoring data arranged according to a first time series, and the fault information to be detected in the monitoring data is converted into a plurality of monitoring data to be detected arranged according to a second time series. According to the first time series and the second time series, the plurality of standard fault monitoring data are cross-combined with the plurality of monitoring data to be detected to obtain a plurality of two-dimensional monitoring data grids. Since the cross-combined grid data is composed of a plurality of monitoring data grids composed of standard fault monitoring data and monitoring data to be detected, the dimension of the cross-combined grid data is richer. According to the distance information between the standard fault monitoring data and the monitoring data to be detected in all monitoring data grids in the cross-combined grid data, the process of fault information similarity between the alarm fault information and the fault information to be detected is also more accurate. Furthermore, based on the accurate fault information similarity, accurate fault detection results for the fault information to be detected can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments of the present application or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0054] Figure 1 An application environment diagram of a fault detection method in an embodiment;

[0055] Figure 2 is a flow chart of a fault detection method in one embodiment;

[0056] Figure 3 A schematic diagram of the structure of a monitoring system in one embodiment;

[0057] Figure 4 is a flow chart of a fault detection method in another embodiment;

[0058] Figure 5 is a structural block diagram of a fault detection device in one embodiment;

[0059] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are used to explain the present application and are not used to limit the present application.

[0061] In today's wave of digital transformation, enterprises are deploying their applications and services to multiple cloud service providers to achieve higher business resilience, availability and cost-effectiveness. Although this strategy brings many advantages, it also brings challenges in monitoring and management. Especially in a hybrid multi-cloud environment, enterprises need to integrate and unify the monitoring data of different cloud service providers in order to achieve unified fault detection, etc.

[0062] In order to meet this challenge, a common fault detection method is a fault detection method based on a machine learning model. Specifically, by obtaining historical monitoring data of faults from a database, and training a machine learning model based on the historical monitoring data of faults, the real-time collected monitoring data is subjected to fault detection based on the trained machine learning model to determine whether the monitoring data is data of a fault. However, this fault detection method is not accurate enough.

[0063] Therefore, the present application aims to propose a fault detection method that can be applied in a hybrid multi-cloud platform to provide accurate fault detection of monitoring data when monitoring the hybrid multi-cloud platform, so as to improve the stability and reliability of the hybrid multi-cloud platform.

[0064] In this application, cross-platform monitoring tools such as Prometheus, Grafana, DataDog, etc. can be used to monitor the hybrid multi-cloud platform, where Prometheus is a combination of open source monitoring, alarm, and time series databases. These tools can not only collect, store, and visualize monitoring data from different cloud platforms, but also their seamless integration provides a solid foundation for the connection between monitoring and fault detection.

[0065] Fault detection tools play a vital role in hybrid multi-cloud monitoring. They not only provide fast and effective fault detection and diagnosis, but also help operations teams understand the complexity and root causes of problems through in-depth analysis of monitoring data. This in-depth insight enables enterprises to take more targeted measures, thereby improving the efficiency and effectiveness of problem solving.

[0066] Monitoring and fault detection complement each other in a hybrid multi-cloud environment. The monitoring system provides the data and information required for fault diagnosis, while fault detection tools use this data to provide in-depth analysis and solutions. This combination enables enterprises to maintain business continuity and stability in a complex hybrid multi-cloud environment, ensuring their competitiveness in a highly competitive market.

[0067] The fault detection method provided in the embodiment of the present application can be applied to Figure 1 The application environment shown includes a monitoring system 102 and a fault detection system 104. The monitoring system 102 communicates with the fault detection system 104 through a network, and the terminal 106 communicates with the fault detection system 104 through a network. The data storage system can store data that needs to be processed by the fault detection system 104. The data storage system can be integrated on the fault detection system 104, or it can be placed on the cloud or other network servers.

[0068] The monitoring system 102 is used to connect to the hybrid multi-cloud bottom layer, pull the monitoring data of the hybrid multi-cloud bottom layer within the monitoring time period, and receive the alarm fault information and fault information to be detected uploaded by the hybrid multi-cloud bottom layer, and send the monitoring data, alarm fault information and fault information to be detected to the fault detection system 104. The fault detection system 104 stores the monitoring data, alarm fault information and fault information to be detected, and displays them to the user through the terminal 106.

[0069] The user sends a fault detection request for monitoring data to the fault detection system 104 at the terminal 106, and the fault detection system 104 obtains the monitoring data of the data resource information from the database, wherein the monitoring data includes the alarm fault information and the fault information to be detected; converts the alarm fault information into a plurality of standard fault monitoring data arranged in a first time series, and converts the fault information to be detected into a plurality of monitoring data to be detected arranged in a second time series; cross-combines the plurality of standard fault monitoring data with the plurality of monitoring data to be detected according to the first time series and the second time series to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of standard fault monitoring data and monitoring data to be detected; detects the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid; generates the fault detection result corresponding to the fault information to be detected based on the fault information similarity. Further, the fault detection system 104 can also send the fault detection result to the terminal 106 to display it to the user.

[0070] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The monitoring system 102 and the fault detection system 104 may be independent physical servers, or server clusters or distributed systems consisting of multiple physical servers, or cloud servers that provide cloud computing services.

[0071] In an exemplary embodiment, Figure 2 As shown, a fault detection method is provided, which is applied to Figure 1 The fault detection system 104 in FIG. 1 is used as an example to illustrate.

[0072] S100, obtaining monitoring data of data resource information.

[0073] The data resource information includes several types of information. For example, the data resource information can be the utilization rate of the CPU (Central Processing Unit), or the utilization rate of other processors. The monitoring data includes alarm fault information and fault information to be detected. The monitoring data is the data generated after monitoring the data resource information. The monitoring time period can be defined by yourself. Generally, the monitoring time period is related to the monitoring frequency. When the monitoring frequency is f, the minimum time range of the monitoring time period is T=k / f, where 1<k≤5. For example, when the monitoring frequency is f=1min / 1, the minimum time range T of the monitoring time period can be 5min. That is to say, the acquired monitoring time period must be controlled within 5min.

[0074] Specifically, the Golang WEB framework is adopted in this application, including various types of public clouds, private clouds, and two systems: a monitoring system and a fault detection system, among which the Golang WEB framework is Gin.

[0075] The monitoring system includes the introduction of a scheduled task module to implement the function of asynchronous multi-threaded pulling of monitoring data. The monitoring system executes asynchronous scheduled tasks, pulls up the monitoring platform task executor, and the monitoring platform task executor reads the hybrid multi-cloud access configuration, and regularly executes the monitoring data pulling task of the specified data resource information, and converts the pulled monitoring data into monitoring data supported by the monitoring system according to the preset adaptive conversion logic, and obtains the type of monitoring data. According to the type of monitoring data, the monitoring data is stored in a data source that matches the type, such as a relational database, a non-relational database, etc. The fault detection system responds to the user's fault detection operation on the monitoring data, obtains the monitoring data of the data resource information from the data source, and performs fault detection on the monitoring data of the data resource information.

[0076] Furthermore, in order to realize the monitoring data calculation of the same dimension, when the monitoring data is obtained, a combination of open source monitoring, alarm, and time series database Prometheus can be used to define the monitoring data. The specific definition expression is:

[0077] <metric name> { <label name>= <label value>, ...}timestamp value

[0078] Where label name is the name of the data resource information of the alarm, timestamp value is the monitoring data value of the data resource information, label value is the type of the monitoring data value of the data resource information, and metric name represents the metric parameter. For example, avg_over_time(cpu_util{device_type="node"})[5m])>98%. When this expression is satisfied six times in a row, it means that the CPU usage of the host machine has been greater than 98% for half an hour.

[0079] Based on this definition, the monitoring data in the multi-cloud environment is similarly calculated on the same dimension according to this unified model, and time series data analysis is also performed based on the unified model.

[0080] In an exemplary embodiment, Figure 3 As shown in the figure, the hybrid multi-cloud bottom layer includes public cloud, private cloud and data center, etc. The monitoring system is used to monitor the data of the hybrid multi-cloud bottom layer. The monitoring system mainly includes: open API (Application Programming Interface) layer, data conversion layer and abstract data source layer:

[0081] Among them, the open API layer, also known as the open interface layer, is responsible for connecting to the hybrid multi-cloud underlying layer and the local data center. It is used to communicate with the multi-cloud underlying services through the SDK (Software Development Kit) or API provided by the multi-cloud underlying layer, and to pull the monitoring data of data resource information and the open service to receive the alarm fault information and the fault information to be detected pushed by the underlying layer. The monitoring data includes at least the monitoring indicator name, the unique identifier of the monitoring object, the indicator timestamp and the indicator value.

[0082] The data conversion layer adaptively converts the monitoring data obtained from the multi-cloud bottom layer into standardized data defined by the system;

[0083] The abstract data source layer stores the converted monitoring data into the specified data source according to the data source type of the monitoring data. It supports custom time granularity. The data sources include relational databases, non-relational databases, and time series databases.

[0084] In addition, resource usage can also be monitored through the real-time monitoring screen.

[0085] S200, converting the alarm fault information into a plurality of standard fault monitoring data arranged in a first time series, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time series.

[0086] Among them, the alarm fault information is the information that triggers the alarm event scanned by the alarm engine. Once the alarm fault information is received, it can be confirmed that the data resource information has a fault. The fault information to be detected refers to information that has not generated an alarm, but it is not certain whether a fault has occurred. The alarm fault information can be considered as a collection of multiple standard fault monitoring data in a time series, and the fault information to be detected can be considered as a collection of multiple monitoring data to be detected in a time series. Specifically, the alarm fault information that triggers the alarm event and the fault information to be detected that is uncertain whether a fault has occurred in the monitoring data are obtained, and since the alarm fault information and the fault information to be detected can be information occurring in different time series, therefore, from the monitoring data, the first time series corresponding to the alarm fault information and the second time series corresponding to the fault information to be detected are determined, and the standard fault monitoring time series data under the first time series and the monitoring time series data to be detected under the second time series are obtained. The standard fault monitoring time series data under the first time series and the monitoring time series data to be detected under the second time series can be time series data of unequal lengths.

[0087] Furthermore, based on the standard fault monitoring time series data in the first time series, a plurality of standard fault monitoring data arranged in the first time series is generated, and based on the suspicious monitoring time series data in the second time series, a plurality of monitoring data to be detected arranged in the second time series is generated.

[0088] Furthermore, the data similarity calculation scheme in the present application is implemented through an empirical model and DDTW (Derivative Dynamic Time Warping) algorithm.

[0089] Among them, when constructing the empirical model, according to the monitoring frequency f of the data resource information, the minimum time range T=k / f for data similarity calculation is determined, that is, the minimum monitoring time range, where 1<k≤5, and the maximum value Vmax, minimum value Vmin and average value Vavg of the monitoring data within the time range are extracted, and the fault threshold Vthreshold and the comparison symbol are determined. The reason why it is necessary to determine the maximum value Vmax, minimum value Vmin and average value Vavg of the monitoring data is that in some cases, when the maximum value Vmax of the monitoring data is less than or equal to the fault threshold, it is considered that a fault has occurred. In other cases, when the minimum value Vmax of the monitoring data is greater than the fault threshold, it is considered that a fault has occurred. In other cases, whether the monitoring data has a fault is also related to the average value Vavg. Therefore, according to different situations, the alarm fault information can be accurately detected. For example, when the fault threshold Vthreshold≥maximum value Vmax, the first monitoring time period where the alarm fault information is located is determined, and the standard fault monitoring time series data Q=q1, q2, q3, ..., q under the first time series is generated. i , ..., qn, n=k*T, k is an empirical integer value.

[0090] S300, cross-combining a plurality of standard fault monitoring data with a plurality of monitoring data to be detected according to a first time series and a second time series to obtain cross-combined grid data.

[0091] The cross-combined grid data includes a plurality of monitoring data grids composed of standard fault monitoring data and monitoring data to be detected.

[0092] Specifically, the data similarity calculation scheme in the present application is implemented through the empirical model and DDTW (Derivative Dynamic Time Warping) algorithm. Through the empirical model and the DDTW algorithm, the standard fault monitoring time series data and the suspicious monitoring time series data are aligned with each other to generate a monitoring time series alignment matrix.

[0093] Let the standard fault monitoring time series data in the first time series be Q, with a length of n, and the monitoring time series data to be detected in the second time series be C, with a length of m, m>n. Then Q=q1, q2, q3, ..., q i ,...,q n , C = c1, c2, c3, ..., c i , ..., c m .

[0094] For two time series data, DDTW is to find a continuous matching relationship that contains all the points in the two time series, and the set of these matching relationships together constitutes a regular path W, where the match can be the i-th point corresponding to the j-th point, and i and j can be equal or unequal. In layman's terms, according to the first time series and the second time series, multiple standard fault monitoring data in the standard fault monitoring time series data and multiple monitoring data to be detected in the monitoring time series data to be detected are cross-combined to obtain cross-combined grid data, where each grid obtained by the cross-combination is used as a monitoring data grid, and the cross-combined grid data includes multiple monitoring data grids composed of standard fault monitoring data and monitoring data to be detected.

[0095] For example, the standard fault monitoring time series data is a1, a2, a3, and the monitoring time series data to be detected is b1, b2. The monitoring data grid is (a1, b1), (a1, b2), (a2, b1), (a2, b2), (a3, b1), (a3, b2), and the generated cross-combination grid data is:

[0096] (a1, b1), (a1, b2)

[0097] (a2, b1), (a2, b2)

[0098] (a3, b1), (a3, b2)

[0099] The cross-combined grid data can be simplified as:

[0100] (1, 1), (1, 2)

[0101] (2, 1), (2, 2)

[0102] (3, 1), (3, 2)

[0103] S400 , detecting the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid.

[0104] Specifically, the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid is obtained, and based on the distance information corresponding to all the monitoring data grids, the fault information similarity between the alarm fault information and the fault information to be detected is detected.

[0105] In an exemplary embodiment, based on the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid, the fault information similarity between the alarm fault information and the fault information to be detected is detected, including: when the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid meets a preset condition, determining that the suspicious monitoring time series data is similar to the standard fault monitoring time series data.

[0106] S500: Generate a fault detection result corresponding to the fault information to be detected based on the fault information similarity.

[0107] Specifically, based on the similarity, a fault detection result of the fault information to be detected is generated. Based on the fault information similarity, it is determined whether the alarm fault information is similar to the fault information to be detected. If the alarm fault information is similar to the fault information to be detected, the fault detection result of the fault information to be detected is generated as a fault that has occurred or is about to occur.

[0108] Furthermore, the fault detection result can also be pushed to the terminal to be displayed to the user. In the above fault detection method, the data resource information is monitored, and the alarm fault information in the monitoring data is converted into a plurality of standard fault monitoring data arranged in a first time series, and the fault information to be detected in the monitoring data is converted into a plurality of monitoring data to be detected arranged in a second time series. According to the first time series and the second time series, the plurality of standard fault monitoring data and the plurality of monitoring data to be detected are cross-combined to obtain a plurality of two-dimensional monitoring data grids. Since the cross-combined grid data is composed of a plurality of monitoring data grids composed of standard fault monitoring data and monitoring data to be detected, the dimension of the cross-combined grid data is richer. According to the distance information between the standard fault monitoring data and the monitoring data to be detected in all monitoring data grids in the cross-combined grid data, the process of fault information similarity between the alarm fault information and the fault information to be detected is also more accurate. Therefore, based on the accurate fault information similarity, accurate fault detection results for the fault information to be detected can be achieved.

[0109] In an exemplary embodiment, Figure 4 As shown, S400 includes:

[0110] S420, selecting the monitoring data grid with the earliest time order from the cross-combined grid data as the starting alignment point, and selecting the monitoring data grid with the latest time order as the ending alignment point.

[0111] S440, detecting path information from the start alignment point to the end alignment point according to distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid.

[0112] S460: Generate fault information similarity between the warning fault information and the fault information to be detected based on the path information.

[0113] Among them, the monitoring data grid with the earliest time sorting refers to the grid corresponding to the cross-combination of the earliest standard fault monitoring data and the earliest monitoring data to be detected, and the monitoring data grid with the latest time sorting refers to the grid corresponding to the cross-combination of the latest standard fault monitoring data and the latest monitoring data to be detected.

[0114] Specifically, the starting alignment point and the ending alignment point in the cross-combined grid data are detected, and the grid corresponding to the cross-combination of the earliest standard fault monitoring data and the earliest monitoring data to be detected is selected from the cross-combined grid data as the starting alignment point, and the grid corresponding to the cross-combination of the latest standard fault monitoring data and the latest monitoring data to be detected is selected as the ending alignment point.

[0115] According to the distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid, the path information from the starting alignment point to the ending alignment point is detected.

[0116] It should be explained that the path information from the starting alignment point to the ending alignment point is not a straight line path, but a path from a starting alignment point to the next neighborhood monitoring data grid until reaching the ending alignment point. For example, starting from the starting alignment point (i, j), the next step can only move to one of (i+1, j), (i, j+1), (i+1, j+1), and so on until reaching the ending alignment point.

[0117] Since the path information from the starting alignment point to the ending alignment point is related to the distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid, and since the distance information of each monitoring data grid can be regarded as the similarity between the corresponding standard fault monitoring data and the monitoring data to be detected after the cross-combination, the path information can be regarded as the fault information similarity between the alarm fault information and the fault information to be detected. The shorter the path information, the higher the fault information similarity.

[0118] When the path information satisfies the preset path condition, it is determined that the warning fault information is similar to the fault information to be detected. When the warning fault information is similar to the fault information to be detected, a fault detection result of the fault information to be detected is generated as a fault having occurred or about to occur.

[0119] In this embodiment, by selecting the starting alignment point and the ending alignment point from all monitoring data grids, and detecting the path information from the starting alignment point to the ending alignment point based on the distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid, and then accurately judging whether the alarm fault information and the fault information to be detected are similar based on the path information, the process is accurate and efficient.

[0120] In an exemplary embodiment, detecting path information from a start alignment point to an end alignment point according to distance information between standard fault monitoring data and monitoring data to be detected in a monitoring data grid includes:

[0121] Path planning step: select the neighborhood monitoring data grid of the starting alignment point from the cross-combined grid data, and detect the initial path information from the starting alignment point to each neighborhood monitoring data grid based on the distance information between the standard fault monitoring data and the monitoring data to be detected in the starting alignment point, and the distance information between the standard fault monitoring data and the monitoring data to be detected in the neighborhood monitoring data grid; filter out the shortest path information from all the initial path information, and use the neighborhood monitoring data grid corresponding to the shortest path information as the next alignment point of the starting alignment point; update the next alignment point to the starting alignment point, return to the path planning step, until the next alignment point is the ending alignment point, and generate the path information from the starting alignment point to the ending alignment point based on all the initial path information.

[0122] Specifically, a path planning step is performed, and the path planning step includes: after obtaining the distance information between the standard fault monitoring data and the monitoring data to be detected in all monitoring data grids, starting from the starting alignment point, detecting the next alignment point of the starting alignment point, the next alignment point of the starting alignment point is the neighborhood monitoring data grid of the starting alignment point, and there are many possibilities for the neighborhood monitoring data grid of the starting alignment point, and it is subject to monotonicity restrictions. For example, starting from the starting alignment point (i, j), the next step can be to move to a point in (i+1, j), (i, j+1), (i+1, j+1), at this time, it is necessary to determine a next alignment point from multiple adjacent points so that the initial path information between the next alignment point and the starting alignment point is the shortest, that is, based on the distance information between the standard fault monitoring data and the monitoring data to be detected in the starting alignment point, and the distance information between the standard fault monitoring data and the monitoring data to be detected in multiple neighborhood monitoring data grids, all initial path information from the starting alignment point to the neighborhood monitoring data grids of all starting alignment points is filtered out to obtain the shortest initial path information.

[0123] Specifically, based on the distance information between the standard fault monitoring data and the monitoring data to be detected in the starting alignment point, and the distance information between the standard fault monitoring data and the monitoring data to be detected in the neighborhood monitoring data grid, the sum of the distance information corresponding to the starting alignment point and the distance information corresponding to each neighborhood monitoring data grid is obtained, that is, the initial path information from the starting alignment point to each neighborhood monitoring data grid is obtained, and the shortest path information is filtered out from all the initial path information, and the neighborhood monitoring data grid corresponding to the shortest path information is used as the next alignment point of the starting alignment point.

[0124] Update the next alignment point to the starting alignment point, and execute the path planning step again until the next alignment point is the ending alignment point. At this time, it is considered that the ending alignment point has been reached from the starting alignment point, and all the initial path information in the middle is the shortest initial path information. At this time, the shortest initial path information in each iteration process is summarized to generate the shortest path information from the starting alignment point to the ending alignment point. That is to say, the shortest path from the starting alignment point to the ending alignment point is the sum of all the shortest initial paths.

[0125] When the shortest path is less than the preset path threshold, that is, when the distance information between the standard fault monitoring data and the monitoring data to be detected is small, the alarm fault information and the fault information to be detected are similar, and since the data resource information corresponding to the alarm fault information is information that a fault has occurred, therefore, when the alarm fault information and the fault information to be detected are similar, it is determined that the fault detection result of the fault information to be detected is that a fault has occurred or is about to occur.

[0126] In the above embodiment, based on the distance information corresponding to the starting alignment point and the distance information corresponding to all neighborhood monitoring data grids adjacent to the starting alignment point, the shortest initial path is accurately screened out from all paths between the starting alignment point and all neighborhood monitoring data grids, and then the next alignment point of the starting alignment point is accurately determined, and a loop iteration is performed to measure the shortest path from the starting alignment point to the ending alignment point.

[0127] In an exemplary embodiment, detecting the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid includes:

[0128] For each monitoring data grid, the first estimated derivative of the standard fault monitoring data and the second estimated derivative of the monitoring data to be detected are detected, and the distance information between the standard fault monitoring data and the monitoring data to be detected is detected based on the first estimated derivative and the second estimated derivative; based on the distance information of each monitoring data grid, the fault information similarity between the alarm fault information and the fault information to be detected is detected. The first estimated derivative represents the estimated change speed of the standard fault monitoring data in the first time series, and the second estimated derivative represents the estimated change speed of the monitoring data to be detected in the second time series.

[0129] Specifically, the DDTW algorithm is an improved version of the DTW (Dynamic Time Warping) algorithm. DTW is an algorithm that uses a dynamic programming strategy to nonlinearly align two time series in the time domain in order to correctly calculate the similarity between the two.

[0130] In more detail, there are many paths W that satisfy the conditions from the starting alignment point to the ending alignment point. The DTW algorithm can be used to find the path with the minimum cost, that is, the shortest path. The expression of the DTW algorithm is as follows:

[0131] (1)

[0132] Among them, DTW (Q, C) is the regular path information between the standard fault monitoring time series data Q and the monitoring time series data to be detected C, k is the kth monitoring data grid, w k It is the square of the Euclidean distance between the standard fault monitoring data and the monitoring data to be detected corresponding to a monitoring data grid passed by the path, that is, w k =(q i -c j ) 2 , K is the length information of the path. By dividing by K, the influence of regular paths of different lengths can be eliminated. Finally, due to the monotonicity of path solving, the corresponding relationship between two time series data of unequal lengths can be solved by dynamic programming to obtain the following recursive formula:

[0133] (2)

[0134] Among them, D[i][j] represents the total distance of the path accumulated by the monitoring data grid in the i-th row and j-th column, that is, the shortest path from the starting alignment point to the ending alignment point.

[0135] The important feature of the DTW algorithm is to explain the Y-axis variables by "distorting" the X-axis to achieve the purpose of aligning the time series. However, simply distorting the X-axis by the Y-axis variable value will lead to "unintuitive" alignment, where a single point in one time series will be mapped to a part of another time series. We call this behavior that we don't expect to see a "singularity".

[0136] Therefore, this application adopts the improved DTW algorithm DDTW, which is a technology used to compare the similarity of two time series. It is widely used in data mining, speech processing, gesture recognition and other fields, and alleviates the "singularity" problem caused by the classic DTW algorithm.

[0137] The DTW algorithm calculates the distance between corresponding points in two time series based on the Euclidean distance, while DDTW calculates the distance between corresponding points in two time series based on the q i and c j The square of the estimated derivative difference between the two is used to replace the distance formula of the DTW algorithm. .

[0138] Specifically, the estimated derivative is obtained by taking the average of the slopes of the line through the point and its left neighbor and the slopes of the line through the left and right neighbors.

[0139] The first estimated derivative of the detection standard fault monitoring data is expressed as:

[0140] (3)

[0141] (4)

[0142] (5)

[0143] The second estimated derivative of the monitored data to be detected is expressed as:

[0144] (6)

[0145] (7)

[0146] (8)

[0147] Based on the first estimated derivative and the second estimated derivative, the shortest path from the starting alignment point to the ending alignment point is detected, that is, It is replaced by (Dq[i]-Dc[j])2, and the distance information of the monitoring data grid is generated based on the square value of the difference between the first estimated derivative and the second estimated derivative corresponding to each alignment point. The distance information represents the distance information between the standard fault monitoring time series data and the suspicious monitoring time series data corresponding to the monitoring data grid. Based on the distance information of all monitoring data grids, the shortest path from the starting alignment point to the ending alignment point is detected.

[0148] In this embodiment, by using the first-order derivative instead of the distance formula in the DTW algorithm, the interference of the "singularity" problem generated by the classic DTW algorithm can be alleviated, and the accuracy of detecting the shortest path from the starting alignment point to the ending alignment point can be improved.

[0149] In an exemplary embodiment, after generating the fault detection result corresponding to the fault information to be detected based on the fault information similarity, the method further includes:

[0150] When it is determined that the fault detection result of the fault information to be detected is that a fault has occurred or is about to occur, a link detection tool is used to locate the target data resource information where the fault occurs.

[0151] Specifically, link detection is a fault diagnosis tool for resource services that are not monitored or whose monitoring data is not reported. By performing accessibility detection on the device, status detection on the related links between device services, and health detection on each service, the purpose of narrowing the scope of the fault and accurately locating the fault can be achieved. The system provides network tools including ping, traceroute, SNMP, and various service site monitoring tools. By regularly detecting and maintaining network links, the host and service where the fault occurs can be quickly located.

[0152] When the fault detection result of the fault information to be detected is determined to be a fault that has occurred or is about to occur, the link detection tool of the relevant host or service is triggered to actively detect, and the upstream and downstream link detection points of the relevant host or service, that is, the target data resource information, such as http service or ntp service, are read from the CMDB (Configuration Management Database), and then the corresponding detection is performed according to the type of detection point. For example, the http service uses the curl tool to obtain the health check result, and the ntp service uses the ping tool to determine the service delay.

[0153] Furthermore, when it is determined that the fault detection result of the fault information to be detected is that a fault has occurred or is about to occur, the fault detection result can also be sent to the terminal, or the operation and maintenance personnel can be notified by SMS and email.

[0154] In this embodiment, by using a link detection tool, the scope of the fault is quickly reduced, the device or service causing the fault is accurately located, and accurate detection of data resource information is achieved. In an exemplary embodiment, before obtaining the monitoring data of the data resource information, it also includes:

[0155] The alarm triggering conditions and the required triggering duration of the alarm for the data resource information are configured, and when the data resource information meets the alarm triggering conditions and the required triggering duration of the alarm, alarm fault information is generated.

[0156] Specifically, the detection of alarm fault information is based on the alarm rules defined by the Prometheus system. After the system default configuration or user-defined configuration, the alarm engine will periodically scan and detect and determine whether to trigger an alarm event. For example, you can configure alarm trigger conditions and alarm trigger duration required alarm rules. When the data resource information meets the alarm trigger conditions and the alarm trigger duration required, alarm fault information is generated.

[0157] In a more specific embodiment, the alarm rules include the following:

[0158] Alert Name: Assign a unique name to each alert rule for easy identification and reference.

[0159] Trigger conditions: Use PromQL (Prometheus Query Language) expressions to define the conditions for triggering alarms. Prometheus will periodically evaluate whether these expressions are met. For example, the average CPU usage of the host machine is greater than 98% for half an hour.

[0160] Duration: A time window. The alarm is triggered only when the trigger condition is true continuously within this time window.

[0161] Tags: Add custom tags to alerts. These tags can be used to categorize monitoring data and organize alerts.

[0162] Annotation: Provides additional information about the alarm, such as a summary and detailed description of the alarm, which can be used in the alarm notification.

[0163] Alarm notification strategy: including alarm grouping, alarm suppression and alarm silencing. Among them, alarm grouping is to merge alarms of the same type, reduce the number of alarms received, and help operation and maintenance personnel quickly locate problems. For example, there are trigger conditions A and trigger conditions B. Trigger condition A is that the CPU usage is greater than 98%, and trigger condition B is that the CPU usage is less than 99%. The alarm fault information generated by trigger conditions A and trigger conditions B are merged into one group. Alarm suppression is a strategy set to avoid alarm flooding, which is generally used to reduce the spread of cascade alarms. Alarm silencing can meet the notification strategy of users for specific alarms in different scenarios, that is, temporarily invalidating the alarm function.

[0164] Through the above configuration of alarm rules, it is possible to formulate alarm rules suitable for different scenarios and different alarm levels for specific resource monitoring indicators, and to better determine the abnormal operation of resources, providing factual basis for subsequent fault diagnosis. Based on the event characteristics of alarm triggering, monitoring data at multiple event triggering can be extracted, providing data samples for the implementation of monitoring data comparison technology.

[0165] In this embodiment, by comprehensively configuring the alarm rules, alarm fault information can be generated more comprehensively, thereby providing data samples for the implementation of monitoring data comparison technology, thereby achieving accurate detection of whether a fault has occurred in the fault information to be detected. Furthermore, by combining alarms and monitoring data comparison, duplicate alarms can be effectively reduced and faults can be diagnosed quickly.

[0166] In an exemplary embodiment, the fault detection method will be described in detail below, specifically as follows:

[0167] 1. Set up a series of alarm rules on the multi-cloud management platform.

[0168] 2. Extract the empirical model of fault timing based on the monitoring timing curve at the time when the alarm event is triggered.

[0169] 3. Use the DDTW algorithm to compare any suspicious monitoring sequence with the empirical model, and determine the probability of failure based on the comparison results.

[0170] 4. When a suspected fault occurs, use link detection tools to locate the specific device or service where the fault occurred to facilitate rapid recovery.

[0171] Take the CPU usage rate, a common monitoring indicator of common equipment hosts in hybrid cloud scenarios, as an example. The collection frequency of this indicator is 1 minute / time, and the minimum time range is 5 minutes. Set the alarm rule PromQL, and the expression is avg_over_time(cpu_util{device_type="node"})[5m])>98%. When this expression is satisfied six times in a row, it means that the CPU usage rate of the host machine has been greater than 98% for half an hour, and the host machine is considered to have a fault. At this time, n=6*T.

[0172] The monitoring data within this half hour is extracted as the empirical model, that is, the standard fault monitoring time series data. When suspicious phenomena occur in the equipment monitoring but no alarm is generated, the suspicious monitoring time series data corresponding to the suspicious information is obtained from the monitoring data of the monitoring time period corresponding to the suspicious information.

[0173] The two pieces of monitoring data are used as the input of the DDTW algorithm, and the total distance of the accumulated path to the i-th row and j-th column of the distance matrix is ​​calculated using the above formula (2). Then, the first-order derivative calculation is used to replace the distance information d(q i , c j ).

[0174] That is to say, the first estimated derivative of the standard fault monitoring timing data is detected according to formula (3-5), and the second estimated derivative of the suspicious monitoring timing data is detected according to formula (6-8), and then the square of the difference between the first estimated derivative and the second estimated derivative (Dq[i]-Dc[j])2 is used as the distance information of the alignment point.

[0175] Based on the distance information of all alignment points, a path planning step is performed, that is, based on the distance information of the starting alignment point and the distance information of all adjacent points adjacent to the starting alignment point, the shortest initial path is screened out from all paths between the starting alignment point and all adjacent points, and the adjacent point corresponding to the initial path is determined to be the intermediate alignment point, and then the intermediate alignment point is updated as the starting alignment point, and the path planning step is returned until the intermediate alignment point is the ending alignment point, and based on all initial paths, the shortest path from the starting alignment point to the ending alignment point is generated.

[0176] When the shortest path is less than a preset path threshold, it is determined that the suspicious monitoring time series data is similar to the standard fault monitoring time series data, and then the fault detection result of the suspicious information is determined to be that a fault has occurred or is about to occur.

[0177] Finally, when the fault detection result of the suspicious information is determined to be a fault that has occurred or is about to occur, the link detection tool of the relevant host or service is triggered to actively detect, and the upstream and downstream link detection points of the relevant host or service, that is, the target resource information, such as http service or ntp service, are read from the CMDB (Configuration Management Database). Then, corresponding detection is performed according to the type of detection point. For example, the http service uses the curl tool to obtain the health check result, and the ntp service uses the ping tool to determine the service delay.

[0178] In addition, the fault detection results can be sent to the terminal and notified to the operation and maintenance personnel via SMS, email, enterprise WeChat, DingTalk, etc.

[0179] Based on the above method steps, compared with the existing technology, the current heterogeneous data source processing technology is more focused on entering data into this system, and does not involve monitoring data comparison or fault diagnosis scenarios, and the use of fault detection related tools does not involve multi-cloud monitoring scenarios. Therefore, the method proposed in this application introduces monitoring data comparison technology into the fault detection process for the first time, which can quickly diagnose and locate faults, which is conducive to reducing operation and maintenance costs and reducing the impact of faults.

[0180] Compared with the prior art, the main advantages of this application are:

[0181] 1. It provides a complete hybrid multi-cloud monitoring system design based on open source projects, which can effectively reduce investment and help to quickly build a data acquisition and data processing system with multi-source input and multi-output.

[0182] 2. It provides a complete fault detection system, including alarm configuration, fault detection and fault location, which provides fault warning and rapid fault location capabilities for various systems with monitoring capabilities, and can effectively reduce the labor cost of operation and maintenance.

[0183] 3. It provides real-time fault detection capability based on DDTW, which is the first time that the real-time monitoring data comparison technology based on DDTW is introduced into the field of fault diagnosis. It can diagnose and detect quickly and accurately, and provide early warning of faults.

[0184] 4. Combining active link detection and health check tools with predicted faults to quickly locate faults can effectively reduce the manpower input of operation and maintenance personnel.

[0185] In addition, the repayment application may also be applied in the following scenarios in the future, such as:

[0186] 1. The hybrid multi-cloud monitoring system provided in this application can be used as a monitoring system for various hybrid cloud management platforms, connecting to the original monitoring system and expanding its application scope.

[0187] 2. The fault detection system design provided in this application can also be applied to various monitoring and operation and maintenance systems, especially to early warning and early positioning of faults in integrated intelligent operation and maintenance, and can provide support for self-healing of faults.

[0188] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0189] Based on the same inventive concept, the embodiment of the present application also provides a fault detection device for implementing the fault detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more fault detection device embodiments provided below can refer to the limitations of the fault detection method above, and will not be repeated here.

[0190] In an exemplary embodiment, Figure 5 As shown, a fault detection device is provided, comprising: a monitoring data acquisition module 100, a time sequence processing module 200, a data combination module 300, a similarity detection module 400 and a fault detection module 500, wherein:

[0191] The monitoring data acquisition module 100 is used to acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information;

[0192] The time sequence processing module 200 is used to convert the alarm fault information into a plurality of standard fault monitoring data arranged in a first time sequence, and to convert the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time sequence;

[0193] The data combination module 300 is used to cross-combine the plurality of standard fault monitoring data with the plurality of monitoring data to be detected according to the first time series and the second time series to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected;

[0194] A similarity detection module 400 is used to detect the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid;

[0195] The fault detection module 500 is used to generate a fault detection result corresponding to the fault information to be detected based on the similarity of the fault information.

[0196] In one of the embodiments, the similarity detection module 400 is used to select the monitoring data grid with the earliest time sorting from the cross-combined grid data as the starting alignment point, and select the monitoring data grid with the latest time sorting as the ending alignment point; detect the path information from the starting alignment point to the ending alignment point based on the distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid; and generate the fault information similarity between the alarm fault information and the fault information to be detected based on the path information.

[0197] In one of the embodiments, the similarity detection module 400 is also used in the path planning step: selecting a neighborhood monitoring data grid of the starting alignment point from the cross-combined grid data, and detecting the initial path information from the starting alignment point to each neighborhood monitoring data grid based on the distance information between the standard fault monitoring data and the monitoring data to be detected in the starting alignment point, and the distance information between the standard fault monitoring data and the monitoring data to be detected in the neighborhood monitoring data grid; filtering out the shortest path information from all the initial path information, and using the neighborhood monitoring data grid corresponding to the shortest path information as the next alignment point of the starting alignment point; updating the next alignment point to the starting alignment point, returning to the path planning step, until the next alignment point is the ending alignment point, and generating the path information from the starting alignment point to the ending alignment point based on all the initial path information.

[0198] In one embodiment, the similarity detection module 400 is also used to detect, for each monitoring data grid, a first estimated derivative of the standard fault monitoring data and a second estimated derivative of the monitoring data to be detected, and detect the distance information between the standard fault monitoring data and the monitoring data to be detected based on the first estimated derivative and the second estimated derivative, wherein the first estimated derivative represents the estimated change rate of the standard fault monitoring data in the first time series, and the second estimated derivative represents the estimated change rate of the monitoring data to be detected in the second time series; based on the distance information of each monitoring data grid, the fault information similarity between the alarm fault information and the fault information to be detected is detected.

[0199] In one embodiment, the fault detection device further includes a positioning module, which is used to use a link detection tool to locate the target data resource information where the fault occurs when the fault detection result corresponding to the fault information to be detected is determined to have occurred or is about to occur. In one embodiment, the fault detection device further includes a configuration module, which is used to configure the alarm triggering condition and the required triggering duration of the alarm for the data resource information; when the data resource information meets the alarm triggering condition and the required triggering duration of the alarm, the alarm fault information is generated.

[0200] Each module in the above fault detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0201] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store monitoring data, etc. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a fault detection method is implemented.

[0202] Those skilled in the art will understand that Figure 6 The structure shown in the figure is a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0203] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0204] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0205] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0206] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0207] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0208] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0209] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.< / label> < / label>

Claims

1. A fault detection method, characterized in that: The method comprises: Acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information; Converting the alarm fault information into a plurality of standard fault monitoring data arranged in a first time series, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time series; According to the first time series and the second time series, the plurality of standard fault monitoring data are cross-combined with the plurality of monitoring data to be detected to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected; Detecting the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid; Based on the fault information similarity, a fault detection result corresponding to the fault information to be detected is generated.

2. The method according to claim 1, characterized in that The detecting the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid comprises: Selecting the monitoring data grid with the earliest time order from the cross-combined grid data as the starting alignment point, and selecting the monitoring data grid with the latest time order as the ending alignment point; Detecting path information from the starting alignment point to the ending alignment point according to distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid; Based on the path information, a fault information similarity between the warning fault information and the fault information to be detected is generated.

3. The method according to claim 2, characterized in that The detecting, according to the distance information between the standard fault monitoring data and the monitoring data to be detected in the monitoring data grid, the path information from the start alignment point to the end alignment point comprises: Path planning step: selecting a neighborhood monitoring data grid of the starting alignment point from the cross-combined grid data, and detecting initial path information from the starting alignment point to each of the neighborhood monitoring data grids based on distance information between the standard fault monitoring data and the monitoring data to be detected in the starting alignment point, and distance information between the standard fault monitoring data and the monitoring data to be detected in the neighborhood monitoring data grid; Filtering the shortest path information from all the initial path information, and using the neighborhood monitoring data grid corresponding to the shortest path information as the next alignment point of the starting alignment point; The next alignment point is updated to the starting alignment point, and the path planning step is returned until the next alignment point is the ending alignment point, and path information from the starting alignment point to the ending alignment point is generated based on all the initial path information.

4. The method according to claim 1, characterized in that: The detecting the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid comprises: For each of the monitoring data grids, a first estimated derivative of the standard fault monitoring data and a second estimated derivative of the monitoring data to be detected are detected, and distance information between the standard fault monitoring data and the monitoring data to be detected is detected according to the first estimated derivative and the second estimated derivative, wherein the first estimated derivative represents an estimated change speed of the standard fault monitoring data in the first time series, and the second estimated derivative represents an estimated change speed of the monitoring data to be detected in the second time series; Based on the distance information of each monitoring data grid, the fault information similarity between the warning fault information and the fault information to be detected is detected.

5. The method according to claim 1, characterized in that After generating the fault detection result corresponding to the fault information to be detected based on the fault information similarity, the method further includes: When it is determined that the fault detection result corresponding to the fault information to be detected is that a fault has occurred or is about to occur, a link detection tool is used to locate the target data resource information where the fault occurs.

6. The method according to claim 1, characterized in that Before acquiring the monitoring data of the data resource information, the method further includes: Configure the alarm triggering conditions and the required triggering duration of the alarm for data resource information; When the data resource information meets the alarm triggering condition and the alarm required triggering duration, alarm fault information is generated.

7. A fault detection device, characterized in that: The device comprises: A monitoring data acquisition module, used to acquire monitoring data of data resource information, wherein the monitoring data includes alarm fault information and to-be-detected fault information; A time sequence processing module, used for converting the alarm fault information into a plurality of standard fault monitoring data arranged in a first time sequence, and converting the to-be-detected fault information into a plurality of to-be-detected monitoring data arranged in a second time sequence; A data combination module, configured to cross-combine the plurality of standard fault monitoring data with the plurality of monitoring data to be detected according to the first time series and the second time series to obtain cross-combined grid data, wherein the cross-combined grid data includes a plurality of monitoring data grids composed of the standard fault monitoring data and the monitoring data to be detected; A similarity detection module, used to detect the fault information similarity between the alarm fault information and the fault information to be detected according to the distance information between the standard fault monitoring data and the monitoring data to be detected in each monitoring data grid; The fault detection module is used to generate a fault detection result corresponding to the fault information to be detected based on the similarity of the fault information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images