Abnormity collecting and processing system

Abstract

The invention relates to an exception collection and processing system, comprising an exception information collection module used for capturing exception information; the abnormal information standardization module is used for carrying out standardization processing on the abnormal information to obtain an abnormal message; the abnormal message storage module is used for storing abnormal messages; the abnormal message analysis module is used for deeply analyzing the abnormal message; the abnormal mode identification module automatically identifies abnormal modes; and the alarm and notification module is used for automatically triggering an alarm mechanism according to the severity of the abnormal message and sending an alarm notification to related personnel. Through centralized management, standardized processing and an automatic alarm mechanism, the system can centrally manage multi-source abnormal information, automatically trigger alarm according to abnormal severity, intelligently identify abnormal modes by using machine learning and an artificial intelligence algorithm, reduce manual intervention and realize a standardized processing flow, has high applicability and flexibility, and is suitable for popularization and application. And meanwhile, the safety and the reliability of the treatment process are ensured.

Description

Technical Field

[0001] The invention relates to the field of data processing, in particular to an abnormality collection and processing system. Background Art

[0002] With the increasing complexity of software systems and the widespread application of distributed architectures, the collection, processing and management of exception information has become an important part of system operation and development. Traditional exception handling methods often have the following problems:

[0003] Abnormal information is scattered in the log files of various business systems, lacking a unified collection and management mechanism, resulting in serious information island phenomenon.

[0004] Different business systems or applications handle abnormal information differently, lacking unified standards and processes, which increases the difficulty of operation and maintenance.

[0005] Since abnormal information is not collected and processed in a timely manner, the time for problem discovery and resolution is delayed, affecting the stability of the system and user experience.

[0006] Therefore, various applications and services will inevitably encounter various abnormal situations during operation. If they are not identified, recorded and processed in a timely and effective manner, they may seriously affect the stability of the system and user experience. How to build an efficient and reliable exception information collection and processing system has become a technical problem that needs to be solved urgently.

[0007] The information disclosed in this background technology section is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as acknowledging or suggesting in any form that the information constitutes the prior art already known to those skilled in the art. Summary of the invention

[0008] In view of the defects existing in the prior art, the purpose of the present invention is to provide an exception collection and processing system. Through centralized management, standardized processing and automated alarm mechanism, the system can centrally manage multi-source exception information, and automatically trigger alarms according to the severity of the exceptions. It uses machine learning and artificial intelligence algorithms to intelligently identify abnormal patterns, reduce manual intervention, and realize standardized processing procedures. It has high applicability and flexibility, while ensuring the safety and reliability of the processing process.

[0009] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0010] An abnormality collection and processing system, characterized by comprising:

[0011] The exception information collection module is used to capture the exception information, which comes from the following data sources: system log, application log, service interface call log;

[0012] The exception information standardization module is used to standardize the captured exception information according to the preset information format to obtain the exception message in a unified format;

[0013] The abnormal message storage module is used to store the abnormal message processed by the abnormal information standardization module;

[0014] The abnormal message analysis module is used to conduct in-depth analysis of abnormal messages, including at least trend analysis and root cause analysis; and is used to automatically identify abnormal patterns;

[0015] The alarm and notification module is used to automatically trigger the alarm mechanism according to the severity of the abnormal message and send alarm notifications to relevant personnel.

[0016] On the basis of the above technical solution, when capturing abnormal information, the Kafka message queue is used as the transmission channel to ensure the real-time and reliable transmission of abnormal information;

[0017] The Kafka producer encapsulates the exception information into a message and sends it to the Kafka queue. The Kafka consumer reads the message from the queue for processing.

[0018] Based on the above technical solution, capturing abnormal information from the system log refers to using a log collection tool to collect information from the system log file in real time or periodically;

[0019] Capturing exception information from application logs means outputting it to a specified location through the log framework;

[0020] Capturing exception information from service interface call logs means integrating with the API gateway where the service interface is located to capture all service call logs that pass through the gateway; using distributed tracing technology to build a service call chain to ensure that the complete path of each request can be traced;

[0021] The method to parse the exception information from the log is any of the following:

[0022] Parse system logs through regular expressions or custom scripts to identify abnormal events and related information;

[0023] An exception detection point is set in the service call chain. When an abnormal response is detected, the exception information and its related call chain data are recorded.

[0024] On the basis of the above technical solution, the captured abnormal information is standardized, specifically including:

[0025] Define specific parsing rules for each data source, and use the parsing rules to identify and record the key fields in each exception information, including at least timestamp, error code, error description, request ID, and user information;

[0026] Use a predefined template to define an exception message in a unified format, and map the fields in the captured exception information to the corresponding fields in the template through the template;

[0027] During the mapping process, the module will perform an integrity check on the data to ensure that all required fields are correctly filled in; the module will also perform a consistency check on the data to ensure that the mapped data is consistent with the predefined template;

[0028] The module uses concurrent processing technology to improve the overall throughput.

[0029] Based on the above technical solution, the abnormal message storage module uses Elasticsearch as the storage backend to provide efficient abnormal information retrieval and query functions.

[0030] Based on the above technical solution, the abnormal message is analyzed in depth, including:

[0031] Using time series analysis techniques, statistical analysis is performed on the timestamps of abnormal messages to identify the frequency, periodicity, and seasonality of abnormal occurrences; by identifying long-term trends and short-term fluctuations, a basis is provided for predicting and preventing future anomalies;

[0032] Combine system logs, application logs, service interface call logs and other multi-source data to conduct correlation analysis and context analysis on abnormal messages, and determine the root cause of the abnormality by tracing the preconditions and post-results of the abnormal message;

[0033] Using fault tree analysis technology, the abnormal message is taken as the top event, and the sub-events and basic events that may cause the abnormality are gradually decomposed. By building a fault tree model, the logical relationship and probability distribution between the events are clarified;

[0034] By simulating the expert's decision-making process and combining the knowledge and experience of domain experts, an expert system is constructed to assist in root cause analysis.

[0035] On the basis of the above technical solution, the automatic identification of abnormal patterns specifically includes:

[0036] Apply machine learning algorithms to perform pattern recognition on abnormal messages, and discover potential rules and correlations in abnormal messages through training models to improve the accuracy and efficiency of abnormality recognition;

[0037] Use unsupervised learning algorithms to automatically group and classify abnormal messages, and discover potential abnormal patterns by identifying the cluster centers and density distribution of abnormal messages;

[0038] The identified abnormal patterns are matched and compared with the known abnormal pattern library. If new abnormal patterns are found, they are added to the pattern library and the analysis model and algorithm are updated.

[0039] On the basis of the above technical solution, it also includes: an abnormal message visualization module, which is used to present abnormal messages based on visualization technology, to present abnormal messages based on abnormal patterns and to provide search and filtering functions.

[0040] On the basis of the above technical solution, the visualization technology is any one of the following:

[0041] Display the number, type, and distribution of exception messages through line graphs, bar graphs, or pie charts;

[0042] Design a dashboard with multiple panels to display key indicators and statistical information of exception messages. Each panel displays the corresponding type of exception message data. Obtain the latest exception message data through the real-time data interface and dynamically update it on the dashboard.

[0043] The distribution of exception messages related to geographic locations is displayed on a map, and the severity or number of exception messages is indicated by color depth or icon size.

[0044] On the basis of the above technical solution, it also includes: a processing flow management module, which is used to define the processing flow of abnormal messages based on the abnormal mode, and is used to match the corresponding abnormal message processing rules based on the analysis results of the abnormal message analysis module.

[0045] The abnormality collection and processing system described in the present invention has the following beneficial effects:

[0046] It can centrally manage abnormal information from different sources, automatically trigger alarm and notification mechanisms according to the severity of the abnormality, has intelligent abnormality recognition capabilities, and can automatically identify and classify abnormal patterns through machine learning and artificial intelligence algorithms, reducing reliance on manual intervention and achieving standardization of abnormality handling processes. The system has high applicability and flexibility, and meets security and reliability requirements in the collection, processing, analysis and response of abnormal information. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The present invention has the following accompanying drawings:

[0048] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0049] Figure 1 System architecture diagram of embodiment 1 of an exception collection and processing system described in the present invention.

[0050] Figure 2 System architecture diagram of embodiment 2 of an exception collection and processing system described in the present invention.

[0051] Figure 3 System architecture diagram of embodiment 3 of an exception collection and processing system described in the present invention. DETAILED DESCRIPTION

[0052] The present invention is further described in detail below in conjunction with the accompanying drawings. The detailed description is an explanation made in conjunction with the exemplary embodiments of the present invention, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0053] like Figure 1 As shown, the abnormality collection and processing system described in the present invention includes:

[0054] The exception information collection module is used to capture the exception information, which comes from the following data sources: system log, application log, service interface call log;

[0055] The exception information standardization module is used to standardize the captured exception information according to the preset information format to obtain the exception message in a unified format;

[0056] The abnormal message storage module is used to store the abnormal message processed by the abnormal information standardization module;

[0057] The abnormal message analysis module is used to conduct in-depth analysis of abnormal messages, including at least trend analysis and root cause analysis; and is used to automatically identify abnormal patterns;

[0058] The alarm and notification module is used to automatically trigger the alarm mechanism according to the severity of the abnormal message and send alarm notifications to relevant personnel.

[0059] By capturing and processing abnormal information from different data sources (such as system logs, application logs, and service interface call logs) in real time, this embodiment enables the system to promptly detect and respond to potential problems, preventing small problems from evolving into major failures, thereby effectively improving the stability and reliability of the system.

[0060] On the basis of the above technical solution, when capturing abnormal information, the Kafka message queue is used as the transmission channel to ensure the real-time and reliable transmission of abnormal information;

[0061] The Kafka producer encapsulates the exception information into a message and sends it to the Kafka queue. The Kafka consumer reads the message from the queue for processing.

[0062] In this embodiment, the Kafka message queue is used as a transmission channel for capturing exception information. Kafka is a distributed stream processing platform with high throughput characteristics and can process large-scale real-time data streams. When an exception occurs in the system, the Kafka producer can quickly send the packaged exception information to the Kafka queue. Due to Kafka's real-time processing capabilities, these exception information can be read and processed by Kafka consumers almost immediately, thereby ensuring the real-time nature of the exception information.

[0063] The introduction of Kafka message queue also has the beneficial effects of system decoupling and asynchronous communication. Through the Kafka message queue, the capture and processing of abnormal information can be separated into different system components, which makes the dependencies between system components clearer and controllable, helping to reduce the complexity of the system and improve maintainability; Kafka supports asynchronous communication, and producers can continue to send messages without waiting for consumers to respond. Asynchronous communication can significantly improve system throughput and reduce response time.

[0064] Based on the above technical solution, capturing abnormal information from system logs means using log collection tools (such as Logstash, Fluentd, etc.) to collect information from system log files (such as the / var / log / directory of the Linux system) in real time or regularly. System logs record the operating status of the operating system and underlying hardware, including key information such as system crashes and service failures. By collecting system logs in real time or regularly, system-level abnormalities can be discovered and responded to in a timely manner to ensure system stability and reliability.

[0065] Capturing exception information from application logs means outputting them to a specified location through a log framework (such as Log4j, Logback, etc.). Application logs record various events and states of applications during operation, including errors, warnings, information, etc. Application logs output to a specified location through a log framework can capture application-level exception information, providing developers with a basis for troubleshooting and performance optimization.

[0066] Capturing exception information from the service interface call log means integrating with the API gateway where the service interface is located to capture all service call logs that pass through the gateway; using distributed tracing technologies (such as OpenTracing, Zipkin, etc.) to build a service call chain to ensure that the complete path of each request can be traced; the service interface call log records the call relationship and call results between services, including request parameters, response status, call duration, etc. By integrating with the API gateway where the service interface is located and building a service call chain, the complete path of each request can be traced, thereby capturing exception information during the service call process and ensuring service availability and consistency;

[0067] The method to parse the exception information from the log is any of the following:

[0068] Parse system logs through regular expressions or custom scripts to identify abnormal events (such as system crashes, service failures, etc.) and their related information (such as timestamps, error codes, error descriptions, etc.); this parsing method is flexible and scalable and can be customized according to different log formats and exception types;

[0069] An exception detection point is set in the service call chain. When an abnormal response (such as 5xx error, timeout, etc.) is detected, the exception information and its related call chain data are recorded. This parsing method can realize comprehensive monitoring and anomaly detection of the service call process, and improve the reliability and maintainability of the system.

[0070] On the basis of the above technical solution, the captured abnormal information is standardized, specifically including:

[0071] Define specific parsing rules for each data source, and use the parsing rules to identify and record the key fields in each exception information, including at least timestamp, error code, error description, request ID, and user information;

[0072] Use a predefined template to define an exception message in a unified format, and map the fields in the captured exception information to the corresponding fields in the template through the template;

[0073] During the mapping process, the module will perform an integrity check on the data to ensure that all required fields are correctly filled in; the module will also perform a consistency check on the data to ensure that the mapped data is consistent with the predefined template;

[0074] The module uses concurrent processing techniques, such as multi-threading or multi-process processing, to improve the overall throughput.

[0075] By defining specific parsing rules for each data source, this embodiment enables the system to accurately identify and record key fields in each piece of exception information, such as timestamp, error code, error description, request ID, user information, etc., and uses predefined templates to define exception messages in a unified format, and maps the fields in the captured exception information to the corresponding fields in the template, thereby ensuring that the exception information generated by different data sources is consistent and comparable in format and content.

[0076] During the mapping process, the standardization processing module will perform an integrity check on the data to ensure that all required fields have been correctly filled in, avoiding abnormal information that lacks key information and causing deviations or misleading in subsequent analysis; the module will also perform a consistency check on the data to ensure that the mapped data is consistent with the predefined template; this double verification mechanism helps to enhance the integrity and reliability of the data and improve the stability and credibility of the system.

[0077] Based on the above technical solution, the abnormal message storage module uses Elasticsearch as the storage backend to provide efficient abnormal information retrieval and query functions.

[0078] Elasticsearch is selected as the storage backend of the exception message storage module. With its efficient indexing mechanism, a large amount of exception information can be quickly processed and stored. When new exception information is captured and stored in Elasticsearch, the system can index and search this information immediately or almost immediately.

[0079] Based on the above technical solution, the abnormal message is analyzed in depth, including:

[0080] Using time series analysis technology, statistical analysis is performed on the timestamps of abnormal messages to identify the frequency, periodicity, and seasonal changes of abnormal occurrences; by identifying long-term trends and short-term fluctuations, a basis is provided for predicting and preventing future abnormalities; statistical analysis of the timestamps of abnormal messages can reveal the frequency, periodicity, and seasonal changes of abnormal occurrences, which is crucial for understanding the distribution patterns and potential causes of abnormalities. Time series analysis can identify long-term trends and short-term fluctuations, providing a basis for predicting and preventing future abnormalities;

[0081] Combining multi-source data such as system logs, application logs, and service interface call logs, we can conduct correlation analysis and context analysis on abnormal messages, and identify the root cause of the abnormality by tracking the preconditions and post-results of the abnormal messages. Combining multi-source data with correlation analysis and context analysis on abnormal messages can provide a more comprehensive abnormal view, help track the preconditions and post-results of the abnormality, and identify the root cause of the abnormality. This is of great significance for solving complex problems and avoiding recurrence of problems.

[0082] By using the fault tree analysis technology, the abnormal message is taken as the top event, and the sub-events and basic events that may cause the abnormality are gradually decomposed. By building a fault tree model, the logical relationship and probability distribution between the events are clarified; the analysis technology helps to clarify the path and conditions for the occurrence of the abnormality, and can clarify the logical relationship and probability distribution between the events;

[0083] By simulating the expert decision-making process and combining the knowledge and experience of domain experts, an expert system is built to assist in root cause analysis, which can more accurately identify the causes of abnormalities and improve the efficiency and accuracy of analysis.

[0084] Through the above-mentioned in-depth analysis technology, the operation and maintenance team can identify and solve abnormal problems more quickly, improve response speed and efficiency; in-depth understanding of the causes of abnormalities will help to formulate targeted preventive measures and reduce the risk of abnormal recurrence.

[0085] On the basis of the above technical solution, the automatic identification of abnormal patterns specifically includes:

[0086] Apply machine learning algorithms (such as clustering algorithms, classification algorithms, association rule mining, etc.) to perform pattern recognition on abnormal messages, and discover potential laws and associations in abnormal messages through training models to improve the accuracy and efficiency of abnormal identification; this embodiment applies machine learning algorithms such as clustering algorithms, classification algorithms, and association rule mining, so that the system can automatically discover potential laws and associations from a large number of abnormal messages, which not only improves the accuracy of abnormal identification, but also significantly improves processing efficiency, so that the system can respond to and locate abnormalities more quickly;

[0087] Unsupervised learning algorithms (such as K-means clustering, DBSCAN density clustering, etc.) are used to automatically group and classify abnormal messages, and potential abnormal patterns are discovered by identifying the cluster centers and density distributions of abnormal messages. This embodiment uses unsupervised learning algorithms such as K-means clustering, DBSCAN density clustering, etc. to automatically group and classify abnormal messages without labeled data. By identifying the cluster centers and density distributions, the system can discover potential abnormal patterns, further enhancing the ability to identify abnormalities.

[0088] The identified abnormal patterns are matched and compared with the known abnormal pattern library. If a new abnormal pattern is found, it is added to the pattern library, and the analysis model and algorithm are updated. Through the mechanism of continuous learning and optimization, the system can continuously adapt to new abnormal situations and improve the comprehensiveness of identification, thereby continuously optimizing the pattern library and recognition algorithm, and improving the accuracy and reliability of analysis.

[0089] When automatically identifying abnormal patterns, parallel processing is achieved through distributed computing frameworks (such as Hadoop, Spark, etc.) to shorten the analysis time; a scalable architecture is designed to support abnormal message analysis needs of different scales and types; the abnormal message analysis process is continuously monitored and evaluated through real-time monitoring and feedback mechanisms, and the analysis strategy and algorithm parameters are dynamically adjusted according to the feedback results to improve the accuracy and reliability of the analysis.

[0090] Through the distributed computing framework, the system can respond to and locate anomalies more quickly, thereby shortening fault recovery time and improving operation and maintenance efficiency; through in-depth analysis and identification of abnormal patterns, the system can detect potential fault hazards in advance and provide strong support for prevention and maintenance work.

[0091] Based on the above technical solution, Figure 2 As shown, it also includes: an abnormal message visualization module, which is used to present abnormal messages based on visualization technology, and is used to present abnormal messages based on abnormal patterns and provide search functions and filtering functions.

[0092] Exemplarily, a powerful search function is provided, allowing users to search for abnormal messages based on multiple dimensions such as keywords, time range, and abnormality type.

[0093] Exemplarily, multiple filtering conditions are supported, such as exception type, severity, occurrence time, etc. Users can set filtering conditions as needed to quickly locate the exception message of interest.

[0094] On the basis of the above technical solution, the visualization technology is any one of the following:

[0095] Display the number, type, and distribution of exception messages through line graphs, bar graphs, or pie charts;

[0096] Design a dashboard with multiple panels to display key indicators and statistical information of exception messages. Each panel displays the corresponding type of exception message data. Obtain the latest exception message data through the real-time data interface and dynamically update it on the dashboard.

[0097] The distribution of exception messages related to geographic locations is displayed on a map, and the severity or number of exception messages is indicated by color depth or icon size.

[0098] Based on the above technical solution, Figure 3 As shown, it also includes: a processing flow management module, which is used to define the processing flow of abnormal messages based on the abnormal mode, and is used to match the corresponding abnormal message processing rules based on the analysis results of the abnormal message analysis module.

[0099] Exemplarily, machine learning or a rule engine is used to identify common abnormal patterns from historical abnormal data, including: specific error codes, log message keywords, and performance indicator threshold violations; the identified abnormal patterns are organized into a pattern library, each pattern containing a detailed description, examples, possible causes, and recommended preliminary processing steps; the identified abnormal patterns are organized into a pattern library, each pattern containing a detailed description, examples, possible causes, and recommended preliminary processing steps.

[0100] Exemplarily, based on the exception pattern library, corresponding processing rules are designed, and each rule should contain information such as trigger conditions (i.e., exception patterns), processing steps, responsible persons, expected results, etc.; according to the severity and urgency of the exception, a priority is set for each processing rule.

[0101] On the basis of the above technical solution, it also includes: a security and authority management module, which is used to set the authority control granularity of the processing flow management module to ensure that only authorized users can add or modify the processing flow and processing rules of abnormal messages.

[0102] For example, different user roles are defined, such as system administrators, operation and maintenance personnel, developers, etc., and each role is granted different permissions according to its responsibilities and needs; a role-based access control (RBAC) model is adopted to implement fine-grained permission control of the processing flow management module; for key operations, such as adding or modifying exception message processing rules, a multi-level approval mechanism is introduced; after the user passes the login verification, when the user tries to perform any operation, the system will check the user's permissions in real time. If the user does not have the corresponding permissions, the system will reject the operation and return a corresponding error prompt.

[0103] Exemplarily, by recording the operation logs of all users, including operation time, operation type, operation results, etc., it is used for subsequent auditing and troubleshooting.

[0104] For example, by monitoring the user's operating behavior, possible abnormal behavior (such as unauthorized access, attempts to unauthorized operation, etc.) is identified, and corresponding security measures are taken in a timely manner.

[0105] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

[0106] The above description is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiment. Any equivalent modifications or changes made by those skilled in the art based on the contents disclosed by the present invention should be included in the protection scope recorded in the claims.

Claims

1. An abnormality collection and processing system, characterized in that: include: The exception information collection module is used to capture the exception information, which comes from the following data sources: system log, application log, service interface call log; The exception information standardization module is used to standardize the captured exception information according to the preset information format to obtain the exception message in a unified format; The abnormal message storage module is used to store the abnormal message processed by the abnormal information standardization module; The abnormal message analysis module is used to conduct in-depth analysis of abnormal messages, including at least trend analysis and root cause analysis; Used to automatically identify abnormal patterns; The alarm and notification module is used to automatically trigger the alarm mechanism according to the severity of the abnormal message and send alarm notifications to relevant personnel.

2. The abnormality collection and processing system according to claim 1, characterized in that: When capturing abnormal information, Kafka message queue is used as the transmission channel to ensure the real-time and reliable transmission of abnormal information; The Kafka producer encapsulates the exception information into a message and sends it to the Kafka queue. The Kafka consumer reads the message from the queue for processing.

3. The abnormality collection and processing system according to claim 1, characterized in that: Capturing abnormal information from system logs means using log collection tools to collect information from system log files in real time or periodically; Capturing exception information from application logs means outputting it to a specified location through the log framework; Capturing exception information from service interface call logs means integrating with the API gateway where the service interface is located to capture all service call logs that pass through the gateway; using distributed tracing technology to build a service call chain to ensure that the complete path of each request can be traced; The method to parse the exception information from the log is any of the following: Parse system logs through regular expressions or custom scripts to identify abnormal events and related information; An exception detection point is set in the service call chain. When an abnormal response is detected, the exception information and its related call chain data are recorded.

4. The abnormality collection and processing system according to claim 1, characterized in that: The standardized processing of the captured abnormal information specifically includes: Define specific parsing rules for each data source, and use the parsing rules to identify and record the key fields in each exception information, including at least timestamp, error code, error description, request ID, and user information; Use a predefined template to define an exception message in a unified format, and map the fields in the captured exception information to the corresponding fields in the template through the template; During the mapping process, the module will perform an integrity check on the data to ensure that all required fields are correctly filled in; the module will also perform a consistency check on the data to ensure that the mapped data is consistent with the predefined template; The module uses concurrent processing technology to improve the overall throughput.

5. The abnormality collection and processing system according to claim 1, characterized in that: The abnormal message storage module uses Elasticsearch as the storage backend to provide efficient abnormal information retrieval and query functions.

6. The abnormality collection and processing system according to claim 1, characterized in that: The in-depth analysis of the abnormal message specifically includes: Using time series analysis techniques, statistical analysis is performed on the timestamps of abnormal messages to identify the frequency, periodicity, and seasonality of abnormal occurrences; by identifying long-term trends and short-term fluctuations, a basis is provided for predicting and preventing future anomalies; Combine system logs, application logs, service interface call logs and other multi-source data to conduct correlation analysis and context analysis on abnormal messages, and determine the root cause of the abnormality by tracing the preconditions and post-results of the abnormal message; Using fault tree analysis technology, the abnormal message is taken as the top event, and the sub-events and basic events that may cause the abnormality are gradually decomposed. By building a fault tree model, the logical relationship and probability distribution between the events are clarified; By simulating the expert's decision-making process and combining the knowledge and experience of domain experts, an expert system is constructed to assist in root cause analysis.

7. The abnormality collection and processing system according to claim 1, characterized in that: The automatic identification of abnormal patterns specifically includes: Apply machine learning algorithms to perform pattern recognition on abnormal messages, and discover potential rules and correlations in abnormal messages through training models to improve the accuracy and efficiency of abnormality recognition; Use unsupervised learning algorithms to automatically group and classify abnormal messages, and discover potential abnormal patterns by identifying the cluster centers and density distribution of abnormal messages; The identified abnormal patterns are matched and compared with the known abnormal pattern library. If new abnormal patterns are found, they are added to the pattern library and the analysis model and algorithm are updated.

8. The abnormality collection and processing system according to claim 1, characterized in that: Also includes: The exception message visualization module is used to present the exception message based on visualization technology, to present the exception message based on the exception mode and to provide search and filtering functions.

9. The abnormality collection and processing system according to claim 8, characterized in that: The visualization technique is any one of the following: Display the number, type, and distribution of exception messages through line graphs, bar graphs, or pie charts; Design a dashboard with multiple panels to display key indicators and statistical information of exception messages. Each panel displays the corresponding type of exception message data. Obtain the latest exception message data through the real-time data interface and dynamically update it on the dashboard. The distribution of exception messages related to geographic locations is displayed on a map, and the severity or number of exception messages is indicated by color depth or icon size.

10. The abnormality collection and processing system according to claim 1, characterized in that: Also includes: The processing flow management module is used to define the processing flow of the abnormal message based on the abnormal mode, and to match the corresponding abnormal message processing rules based on the analysis results of the abnormal message analysis module.

Images