Operation and maintenance monitoring information processing method, equipment and medium

Abstract

The embodiment of the invention discloses an operation and maintenance monitoring information processing method, equipment and a medium. The method comprises the following steps: acquiring a plurality of alarm messages from a monitored server; filtering exemption alarm messages in the plurality of alarm messages according to alarm item names; if corresponding operation and maintenance scripts exist in the remaining alarm messages, the operation and maintenance scripts are automatically executed in the monitored server; if the corresponding operation and maintenance script does not exist in the residual alarm message, extracting information related to the residual alarm message from the monitored server and the log server; and sending the related information and the residual alarm message to operation and maintenance personnel together. According to the embodiment, the accuracy of the alarm message is improved, and time waste of operation and maintenance personnel is reduced.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of operation and maintenance monitoring technology, and in particular to an operation and maintenance monitoring information processing method, device and medium. Background Art

[0002] The main task of operation and maintenance is to maintain the stability of the business. After receiving the alarm information, it is necessary to be able to analyze and repair the fault as quickly as possible. In actual operation and maintenance, a monitoring tool, such as Zabbix, can be deployed in the monitored server. When the CPU of the monitored server exceeds the preset threshold, a text is sent to Feishu or DingTalk and other software to the operation and maintenance personnel. The operation and maintenance personnel cannot determine whether it is normal or abnormal. They can only log in to the relevant server through the computer to connect to the production environment, check the process, and judge whether it is an abnormal process for processing; if it is a normal business with a large number of visits, it does not need to be processed; if it cannot be judged, further analysis and judgment are required to find the cause. If there are many servers and many false alarms, the workload and time of the operation and maintenance personnel will be greatly wasted. If the CPU threshold of the monitoring tool is adjusted to avoid false alarms, the real fault problem may be missed. In addition, the management and configuration of sending information for multiple monitoring tools is cumbersome. There may be multiple sending channels, especially when the alarm channel is changed or the sending needs to be closed, they need to log in and close one by one, which is cumbersome. Summary of the invention

[0003] Embodiments of the present invention provide a method, device and medium for processing operation and maintenance monitoring information to solve at least one of the above problems.

[0004] In a first aspect, an embodiment of the present invention provides a method for processing operation and maintenance monitoring information, comprising:

[0005] Get multiple alarm messages from the monitored server;

[0006] Filtering the exempted alarm messages among the multiple alarm messages according to the alarm item name;

[0007] If there are corresponding operation and maintenance scripts for the remaining alarm messages, the operation and maintenance scripts are automatically executed in the monitored server;

[0008] If there is no corresponding operation and maintenance script for the remaining alarm messages, information related to the remaining alarm messages is extracted from the monitored server and the log server; and the related information and the remaining alarm messages are sent together to the operation and maintenance personnel.

[0009] In a second aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0010] one or more processors;

[0011] a memory for storing one or more programs,

[0012] When the one or more programs are executed by the one or more processors, the one or more processors implement the operation and maintenance monitoring information processing method described in any embodiment.

[0013] In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the operation and maintenance monitoring information processing method described in any embodiment.

[0014] Embodiments of the present invention provide a method for processing operation and maintenance monitoring information, which can achieve the following beneficial effects:

[0015] 1) In the prior art, the alarm SMS false alarms are too high, wasting the time of the operation and maintenance administrator, and adjusting the index threshold may result in insensitive monitoring and missing the real fault. In this embodiment, the monitoring information that is not important but cannot be closed can be shielded, and a trace is left, which is convenient for repair and statistical adjustment.

[0016] 2) In the prior art, only a single text message alarm is used, and the operation and maintenance personnel cannot immediately obtain more parameter information. They can only log in to the computer to view the monitoring tool flow chart and other indicators, wasting business recovery processing time. In this embodiment, after an indicator alarm message of a server is generated, other related information of the alarm message is sent together, so that the administrator can view it on the mobile phone in time and conduct preliminary analysis of the problem.

[0017] 3) In the prior art, after the monitoring tool generates an alarm, it cannot perform simple subsequent operations. However, in this embodiment, for problems with repeated alarms and existing solutions, a repair script is written to automatically perform subsequent repair operations on the server, reducing the workload of operation and maintenance personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a schematic diagram of a unified management platform for operation and maintenance monitoring information provided by an embodiment of the present invention;

[0020] Figure 2 is a flow chart of a method for processing operation and maintenance monitoring information provided by an embodiment of the present invention;

[0021] Figure 3A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0023] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0024] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] The embodiment of the present invention provides an operation and maintenance monitoring information processing method, which realizes the reception, processing and sending of operation and maintenance information of different servers through a unified operation and maintenance monitoring information management platform, improves the accuracy of operation and maintenance alarms, and reduces the workload and time waste of operation and maintenance personnel. In order to illustrate the method, the unified operation and maintenance monitoring information management platform is first introduced. Figure 1 Schematic diagram of a unified management platform for operation and maintenance monitoring information provided by an embodiment of the present invention. Figure 1 As shown in the figure, the platform includes multiple monitored servers (i.e., server-side) and platform servers, wherein each monitored server is respectively deployed with an operation and maintenance monitoring program, such as Zabbix, Promethues, etc., and the platform server is deployed with a monitoring information processing service. The monitoring information processing service is jointly completed by the API receiving interface, the information processing module, and the information sending module. Figure 1 The functions of each module are explained with the specific data processing flow.

[0026] Figure 2 1 is a flow chart of a method for processing operation and maintenance monitoring information provided by an embodiment of the present invention. The method can be executed by various parts of the above-mentioned unified management platform for operation and maintenance monitoring information, or by other electronic devices. Figure 2 As shown, the method specifically includes:

[0027] S110. Obtain multiple alarm messages from the monitored server.

[0028] This step uses monitoring tools deployed in different monitored servers to obtain multiple alarm messages from each monitored service as the data source of the entire method. The monitoring tools in each monitored server are not exactly the same. After receiving the alarm message, each alarm message can be converted into a unified standardized format according to the message format of each monitoring tool for subsequent processing.

[0029] by Figure 1 For example, commonly used monitoring tools generate alarm information and send it to the API receiving interface, which then enters the information preprocessing and converts it into a standard format.

[0030] S120: Filter the exemption alarm messages among the multiple alarm messages according to the alarm item name.

[0031] Among them, exempted alarm messages refer to alarm messages that are exempt from processing. This step performs the operation of not processing or sending unimportant information, and the unimportant information can be flexibly controlled according to the alarm item name, time range, quantity range, etc. For example, the alarm item name "high process quantity alarm" does not require any operation and can be directly set to be blocked, but the number of blocking times is counted.

[0032] S130: If there is a corresponding operation and maintenance script for the remaining alarm message, the operation and maintenance script is automatically executed in the monitored server.

[0033] Among them, the operation and maintenance script is written in advance to complete specific actions, which can conveniently and flexibly meet various requirements and support cross-platform operations (Linux, Windows). This step is mainly for alarm messages that occur repeatedly and have solutions. For example, if the alarm message "Zabbix monitoring agent program often shuts down by itself" occurs repeatedly and the solution is to restart the program, you can write a script in advance to automatically restart the program in the monitored server.

[0034] Further, combined with Figure 1In order to complete the function of automatic execution of operation and maintenance scripts, the Linux execution interface can be deployed in the information processing module in advance to execute the script on the Linux server. After receiving the alarm information, the information processing module sends the command to the execution interface. After the interface service uploads the specified script to the monitored server (faulty server), it executes the script and returns the information. Similarly, the Windows execution interface can be deployed in advance to execute the script on the Windows server. After receiving the alarm information, the information processing module uploads the execution script through the Windows System Remote Management (WinRM) service and returns the information.

[0035] S140. If there is no corresponding operation and maintenance script for the remaining alarm messages, extract information related to the remaining alarm messages from the monitored server and the log server; and send the related information and the remaining alarm messages together to the operation and maintenance personnel.

[0036] This type of alarm message is usually complex and requires more information to determine whether it is abnormal and take corresponding measures. Therefore, this embodiment provides two ways to extract other information related to the alarm message:

[0037] The first approach is to extract relevant information from the monitored server. In this approach, it is first necessary to determine the server component that is being alarmed from the remaining alarm messages, where the server component includes server hardware and software. Then, log in to the monitored server and extract other monitoring messages of the server component that is being alarmed from the monitoring program of the server as a kind of relevant information; at the same time, extract the monitoring messages of other server components in the monitored server, and calculate the similarity between the content of each message and the remaining alarm messages, and use the monitoring messages with a similarity greater than a set threshold as another kind of relevant information; at the same time, the historical change curve of the alarm items of each server component in the above-mentioned relevant information can also be used as another kind of relevant information.

[0038] For example, when the alarm message to be processed is "CPU usage is too high" of a certain server, and the server component that is alarmed is the CPU, you can log in to the server and extract other monitoring messages of the CPU from the monitoring program as a related information; at the same time, you can extract monitoring messages of other server components such as memory, disk IO, and network card traffic, and use monitoring messages with the most similar content such as "memory occupancy is too high", "disk IO occupancy is too high", and "network card traffic is too large" as another related message; at the same time, the historical curve graphs of the server components CPU, memory, disk IO, network card traffic, etc. involved in the above-mentioned related messages can be used as the third related message.

[0039] The second approach is to extract relevant information from the log server. Optionally, log information related to the business type of the monitored server can be extracted from the log server as the fourth type of information related to the alarm message. For example, if the monitored server is a web server, the number of business connection accesses to the monitored server can be extracted from the log server, and the number of connections in and out of the firewall of this machine can also be obtained.

[0040] Finally, several or all of the above four types of relevant information are sent to the operation and maintenance personnel for further judgment. Optional. Different channels can be used to send various types of information to the operation and maintenance personnel according to the types of information included in the relevant information and the remaining alarm messages. For example, the relevant information and the text information in the remaining alarm messages are sent to the operation and maintenance personnel through a text message APP; the relevant information and the image information in the remaining alarm messages are sent to the operation and maintenance personnel via email.

[0041] Combination Figure 1 The information sending module is responsible for sending messages to different groups of users and realizing the connection between Feishu, DingTalk and mailbox. For example, if the CPU of a server increases, the text information of CPU high will be sent to the user group through Feishu, and other related picture information (historical curves of memory, disk IO, network card traffic, etc.) will be sent from email. Operation and maintenance personnel can directly see the CPU alarm from the Feishu group and see other information in the mailbox to prevent the mobile phone from viewing a message that is too long and confusing.

[0042] It should be noted that, although the filtered alarm messages and the return messages after the automatic execution of the operation and maintenance script in this embodiment can be exempted from being sent to the operation and maintenance personnel, their traces are still retained to facilitate further query and tracing.

[0043] In summary, the embodiments of the present invention provide a unified management platform for operation and maintenance monitoring information and a method for processing operation and maintenance monitoring information, which can achieve the following beneficial effects:

[0044] 1) In the prior art, the alarm SMS false alarms are too high, wasting the time of the operation and maintenance administrator, and adjusting the index threshold may result in insensitive monitoring and missing the real fault. In this embodiment, the monitoring information that is not important but cannot be closed can be shielded, and a trace is left, which is convenient for repair and statistical adjustment.

[0045] 2) In the prior art, only a single text message alarm is used, and the operation and maintenance personnel cannot immediately obtain more parameter information. They can only log in to the computer to view the monitoring tool flow chart and other indicators, wasting business recovery processing time. In this embodiment, after an indicator alarm message of a server is generated, other related information and historical process of the alarm message are Figure 1 The information is sent together so that the administrator can check it on the mobile phone in time and make a preliminary analysis of the problem.

[0046] 3) In the prior art, after the monitoring tool generates an alarm, it cannot perform simple subsequent operations, such as restarting a service in the server, and cannot attempt to start it. However, in this embodiment, for problems with repeated alarms and solutions, a repair script is written to automatically perform subsequent repair operations on the server, reducing the workload of operation and maintenance personnel.

[0047] 4) In the prior art, the alarm information of multiple alarm tools can only be sent, and linkage operations cannot be performed. However, in this embodiment, a unified receiving and sending processing platform is implemented, which can connect to multiple monitoring tools in the front and transmit multiple information channels in the back, such as Feishu, WeChat for Enterprise, DingTalk, and email, and then statistically analyze the received and sent information; at the same time, it can centrally manage information sending and realize one-click closing and opening of information sending.

[0048] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the device includes a processor 60, a memory 61, an input device 62 and an output device 63; the number of processors 60 in the device can be one or more. Figure 3 A processor 60 is taken as an example; the processor 60, the memory 61, the input device 62 and the output device 63 in the device can be connected by a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0049] The memory 61 is a computer-readable storage medium that can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the operation and maintenance monitoring information processing method in the embodiment of the present invention. The processor 60 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 61, that is, realizing the above-mentioned operation and maintenance monitoring information processing method.

[0050] The memory 61 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may further include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0051] The input device 62 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 63 may include a display device such as a display screen.

[0052] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the operation and maintenance monitoring information processing method of any embodiment is implemented.

[0053] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, a device or a device or used in combination with it.

[0054] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0055] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0056] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing operation and maintenance monitoring information, characterized in that: include: Get multiple alarm messages from the monitored server; Filtering the exempted alarm messages among the multiple alarm messages according to the alarm item name; If there are corresponding operation and maintenance scripts for the remaining alarm messages, the operation and maintenance scripts are automatically executed in the monitored server; If there is no corresponding operation and maintenance script for the remaining alarm messages, information related to the remaining alarm messages is extracted from the monitored server and the log server; and the related information and the remaining alarm messages are sent together to the operation and maintenance personnel.

2. The method according to claim 1, characterized in that The obtaining of multiple alarm messages from the monitored server includes: Obtain multiple alarm messages through monitoring tools deployed in different monitored servers, wherein the monitoring tools in each monitored server are not exactly the same; According to the message format of each monitoring tool, each alarm message is converted into a unified standardized format.

3. The method according to claim 1, characterized in that The filtering of the exemption alarm messages in the plurality of alarm messages according to the alarm item name includes: According to at least one of the set alarm item name, time range, and quantity range, exempted alarm messages among the multiple alarm messages are filtered, wherein the exempted alarm messages refer to alarm messages that are exempt from processing.

4. The method according to claim 1, characterized in that: The extracting information related to the remaining alarm messages from the monitored server and the log server includes: Extracting the server components that are alarmed in the remaining alarm messages, wherein the server components include server hardware and software; Extracting other monitoring messages of the server component that is alarmed from the monitored server, and determining the similarity between the monitoring messages of other server components in the monitored server and the remaining alarm messages; The monitoring message with a similarity greater than a set threshold and the other monitoring messages are taken together as information related to the remaining alarm messages.

5. The method according to claim 4, characterized in that The monitoring message with a similarity greater than a set threshold and the other monitoring messages are taken together as information related to the remaining alarm messages, including: The historical change curves of the alarm items of the server components in the monitoring messages with similarity greater than the set threshold and the other monitoring messages, as well as the monitoring messages with similarity greater than the set threshold and the other monitoring messages, are taken together as information related to the remaining alarm messages.

6. The method according to claim 1, characterized in that The extracting information related to the remaining alarm messages from the monitored server and the log server includes: Log information related to the service type of the monitored server is extracted from the log server as information related to the remaining alarm messages.

7. The method according to claim 1, characterized in that The sending of the relevant information and the remaining alarm messages to the operation and maintenance personnel includes: According to the related information and the information types included in the remaining alarm messages, different channels are used to send various types of information to operation and maintenance personnel.

8. The method according to claim 1, characterized in that According to the types of information included in the related information and the remaining alarm messages, different channels are used to send various types of information to the operation and maintenance personnel, including: Send the relevant information and the text information in the remaining alarm messages to the operation and maintenance personnel via the text message APP; The relevant information and the image information in the remaining alarm message are sent to the operation and maintenance personnel via email.

9. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the operation and maintenance monitoring information processing method described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by a processor, the operation and maintenance monitoring information processing method described in any one of claims 1-8 is implemented.

Images