Business log real-time alarm method and device

Abstract

The invention provides a service log real-time alarm method and device, and the method comprises the steps: generating an alarm rule which comprises a service custom alarm rule, and the custom alarm rule is generated in a manner of compiling a Groomy script; collecting log data reported by a service and transmitting the log data to a Kafka cluster, wherein themes of the Kafka cluster are distinguished according to the service; reading log data sent by the Kafka cluster by adopting an Flink stream processing component, configuring a window for a service needing real-time statistics, performing real-time streaming calculation on window data collected by the window, and filtering and aggregating the window data to obtain a preliminary screening result; performing rule matching on the preliminary screening result and the alarm rule, wherein the rule matching comprises text type matching and numerical value type matching; alarm notification is carried out on a specific service group in a diversified mode, service self-defined personalized strategy rules can be supported, potential risks of the service can be found in time, and service continuity and stability are improved.

Description

Technical Field

[0001] The present invention relates to the field of big data, and in particular to a business log real-time alarm method and device. Background Art

[0002] With the rapid development of information technology, business systems are becoming increasingly complex, and the amount of log data generated is also growing explosively. Traditional log analysis methods can no longer meet the requirements of real-time, accuracy, and efficiency, and real-time analysis of business log data is required.

[0003] Real-time analysis of business logs faces the following challenges: (1) The amount of log data generated by business systems is huge, which poses a challenge to data collection, storage, and analysis; (2) Real-time business log analysis requires real-time processing of log data, which poses a challenge to data processing capabilities; (3) The log data generated by business systems has diverse formats and complex content, which poses a challenge to data analysis.

[0004] How to provide a real-time alarm method for business logs that can support business customized personalized policy rules and timely discover potential business risks, which will have a positive effect on improving business continuity and stability. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a business log real-time alarm method and device, which can support business customized personalized policy rules and timely discover potential risks of the business.

[0006] In order to solve the above problems, the present invention provides a real-time alarm method for business logs, comprising: generating alarm rules, wherein the alarm rules include custom alarm rules, and the custom alarm rules are generated by writing Groovy scripts; collecting log data reported by the business and transmitting them to a Kafka cluster, wherein the topics of the Kafka cluster are differentiated according to the business; using a Flink stream processing component to read the log data sent via the Kafka cluster, configuring a window for the business that requires real-time statistics, performing real-time streaming calculations on the window data collected by the window, filtering and aggregating the window data, and obtaining a preliminary screening result, wherein the preliminary screening result contains log information; performing text type matching and / or numerical type matching on the preliminary screening result and the alarm rule, and triggering an alarm when the match is successful, wherein the text type matching matches the alarm The preset keywords and / or special placeholders in the alarm rule are matched with the log information of the preliminary screening result. If the preset keywords and / or special placeholders appear in the log information, an alarm is triggered. The numerical type matching includes: obtaining the actual number of special placeholders in the log information and comparing it with the standard number of special placeholders in the alarm rule to obtain a comparison result, or obtaining the actual data value from the log information through a regular expression and comparing it with the standard data value in the alarm rule to obtain a comparison result, and triggering an alarm according to the comparison result, wherein the keyword is a word or a phrase, and the special placeholder is a special character or a regular expression; alarm notification is performed for a specific business group in a variety of ways, and the various ways include one or more of email, SMS, DingTalk, and interface callback.

[0007] In some embodiments, in the step of generating alarm rules, the alarm rules are stored in a database, and correspondingly, in the step of performing text type matching and / or numerical type matching between the initial screening results and the alarm rules, the alarm rules are retrieved from the database.

[0008] In some embodiments, the alarm rules are classified according to functions, and the alarm rules include alarm association rules and alarm suppression rules, which are used to reduce duplicate alarms.

[0009] In some embodiments, the alarm association rules associate alarm events that have causal relationships or logical associations to reduce repeated alarms issued by associated alarm events; the alarm suppression rules suppress alarm events from issuing alarms according to specific business batches, specific alarm event trigger times, or specific alarm counts to reduce repeated alarms.

[0010] In some embodiments, in the step of generating alarm rules, an alarm trigger template is configured, and alarm rules are created or modified in batches through the alarm trigger template.

[0011] In some embodiments, the parameters used in the Groovy script are obtained through an external communication interface.

[0012] In some embodiments, in the step of using the Flink stream processing component to read the log data sent via the Kafka cluster and configuring a window for a business requiring real-time statistics, the window is a rolling window, and the window duration of the window is in minutes.

[0013] In some embodiments, the diversified methods include one or more of email, SMS, DingTalk, and interface callback.

[0014] In some embodiments, the business log real-time alarm method also includes displaying the triggered alarm through the alarm history page, and the displayed content of the triggered alarm includes alarm rules, alarm objects, alarm types, alarm trigger time, end time, and specific alarm content.

[0015] In order to solve the above problems, the present invention also provides a business log real-time alarm device, including: a log collection module, used to collect log data reported by the business, the log collection module is connected to each application business module, the log collection module includes a Kafka cluster, and the topic of the Kafka cluster is divided according to the business;

[0016] A log real-time statistics module is used to obtain the initial screening results of log data in real time. The log real-time statistics module is connected to the log collection module. The log real-time statistics module adopts the Flink framework, reads the log data sent via the Kafka cluster through the Flink stream processing component, configures a window for the business that needs real-time statistics, calculates the window data collected by the window in real-time streaming, filters and aggregates the window data, and obtains the initial screening results, which include log information;

[0017] A business alarm module is used to process alarm-related functions. The business alarm module is connected to the log real-time statistics module. The business alarm module includes:

[0018] An alarm rule unit, wherein the alarm rule unit generates alarm rules and stores the alarm rules in a database, wherein the alarm rules include business-defined alarm rules, and the defined alarm rules are generated by writing Groovy scripts;

[0019] An alarm triggering unit, wherein the alarm triggering unit matches the initial screening result with the alarm rule execution rule, wherein the rule matching includes text type matching and value type matching,

[0020] The text type matching matches the preset keywords and / or special placeholders in the alarm rule with the log information of the preliminary screening result. If the preset keywords and / or special placeholders appear in the log information, an alarm is triggered.

[0021] The numerical type matching includes: obtaining the actual number of special placeholders in the log information and comparing it with the standard number of special placeholders in the alarm rule to obtain a comparison result, or obtaining the actual data value from the log information through a regular expression and comparing it with the standard data value in the alarm rule to obtain a comparison result, and triggering an alarm according to the comparison result,

[0022] Wherein, the keyword is a word or a phrase, and the special placeholder is a special character or a regular expression;

[0023] An alarm notification unit is used to send alarm notifications to specific service groups in a variety of ways.

[0024] The above technical solution generates alarm rules, which include business-customized alarm rules, and the custom alarm rules are generated by writing Groovy scripts; log data reported by the business is collected and transmitted to the Kafka cluster, and the topics of the Kafka cluster are divided according to the business; the Flink stream processing component is used to read the log data sent via the Kafka cluster, a window is configured for the business that needs real-time statistics, and the window data collected by the window is calculated in real-time streaming. The window data is filtered and aggregated to obtain a preliminary screening result; the preliminary screening result is matched with the alarm rule execution rule, and the rule matching includes text type matching and numerical type matching; alarm notification is performed on specific business groups in a diversified manner, which can support business-customized personalized policy rules, and can timely discover potential risks of the business, thereby improving business continuity and stability.

[0025] It should be understood that the above general description and the detailed description below are exemplary and explanatory only and cannot limit the present invention. The techniques, methods and devices known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, the techniques, methods and devices should be considered as part of the authorization specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments of the present invention are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 It is a flow chart of a business log real-time alarm method provided by an embodiment of the present invention;

[0028] Figure 2 It is a schematic diagram of a business log real-time alarm device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] Figure 1 1 is a flow chart of a business log real-time alarm method provided by an embodiment of the present invention. Figure 1 The business log real-time alarm method includes: step S11, generating alarm rules, the alarm rules include business custom alarm rules, and the custom alarm rules are generated by writing Groovy scripts; step S12, collecting log data reported by the business and transferring it to the Kafka cluster, and the topics of the Kafka cluster are divided according to the business; step S13, using the Flink stream processing component to read the log data sent via the Kafka cluster, configuring a window for the business that needs real-time statistics, real-time streaming calculation of the window data collected by the window, filtering and aggregating the window data, and obtaining a preliminary screening result, the preliminary screening result contains log information; step S14, performing text type matching and / or numerical type matching on the preliminary screening result and the alarm rule, and triggering an alarm when the match is successful; step S15, performing alarm notification on a specific business group in a variety of ways.

[0031] The following is a detailed description of steps S11 to S15 in conjunction with the embodiments.

[0032] Referring to step S11, an alarm rule is generated, wherein the alarm rule includes a business-defined alarm rule, and the business-defined alarm rule is generated by writing a Groovy script.

[0033] In this step, the alarm rules include custom alarm rules, and the logical demands and complete rule personalization can be realized through Groovy scripts. In this embodiment, the alarm rules also include immediate alarm rules and function alarm rules. Among them, the immediate alarm rule triggers an alarm when the corresponding event occurs; the rule items of the function alarm rule are defined by the parameters of a specific function, and the alarm is triggered when the parameters of the corresponding event are calculated by a specific function and meet the characteristic results. When the immediate alarm rules and function alarm rules cannot meet the requirements, custom alarm rules can be implemented through Groovy scripts.

[0034] Groovy is a JVM-based scripting language that is concise, flexible and compatible with Java syntax. In this embodiment, alarm-related functions are integrated into a business alarm platform, and accordingly, a Groovy plug-in is integrated into the business alarm platform, and a Groovy script is developed through the business alarm platform.

[0035] In this step, the parameters used in the alarm rules are obtained through the external communication interface. In this embodiment, the business alarm platform is encapsulated with an external communication interface, and the parameters, logic rules, notification objects, etc. used in the Groovy script can be obtained through the external communication interface.

[0036] In this step, configure the alarm trigger template, and use the alarm trigger template to batch create or modify alarm rules. When configuring different alarm rules that need to use the same alarm trigger condition, you can configure the alarm trigger template. When creating a new alarm rule, you can reuse it with one click to avoid repeated settings. In addition, for alarm rules that use alarm trigger templates, users can modify the template, and the modification will be automatically applied to the corresponding alarm rules, improving the operation and maintenance efficiency of the alarm rules.

[0037] In this step, after the alarm rule is generated, the alarm rule is stored in a database. In this embodiment, the alarm rule is stored in MySql, and in another embodiment, the alarm rule is stored in Elasticsearch. Each time the alarm rule is updated, the database is updated synchronously.

[0038] Referring to step S12, log data reported by the business is collected and transmitted to a Kafka cluster, where the topics of the Kafka cluster are differentiated according to the business.

[0039] Kafka is a distributed messaging system with high throughput and high scalability, combining messaging, storage and stream processing functions. In the process of collecting logs, Kafka can be used as a message middleware to receive, store and forward large amounts of log data. The Kafka cluster contains multiple nodes, each of which is peer-to-peer. The topic of the Kafka cluster is used to group messages. In this step, the topics of the Kafka cluster are differentiated according to the business, and accordingly, each business corresponds to a message queue. Different components of the same business can publish logs to the same topic.

[0040] In this embodiment, the services include commodity services, order services, membership services, and search services. The number of services exceeds 100, and each service corresponds to a Kafka topic.

[0041] Referring to step S13, a Flink stream processing component is used to read the log data sent via the Kafka cluster, a window is configured for the business that requires real-time statistics, the window data collected by the window is calculated in real-time streaming, the window data is filtered and aggregated, and a preliminary screening result is obtained, which includes log information.

[0042] Flink is a distributed stream processing framework. The window function of the Flink stream processing component is similar to a bucket. When a window is created, the data in the data stream is distributed to different buckets. When the window ends, the data in each bucket can be calculated and processed, and then the business log data generated in real time can be statistically analyzed to understand the business operation status in a timely manner.

[0043] This step only configures windows on demand for services that require real-time statistics to save real-time computing resources. In this embodiment, the Flink data flow is 4.8 million records / minute. We use real-time stream dynamic windowing technology to configure windows only for services that require real-time statistics. The application runs stably, and the resource consumption is reduced from 16 CPU cores and 86 GB memory at the beginning to 8 CPU cores and 42 GB memory, and the actual resource usage is reduced by 50%.

[0044] This step uses the Flink framework, which supports multiple window types and can meet the statistical requirements of different business scenarios. In this embodiment, the window is a rolling window, and the window duration of the window is in minutes.

[0045] This step supports multiple statistical analyses. In this embodiment, the statistical analysis includes one or more of summing, totaling, averaging, maximum, minimum, filtering and aggregation.

[0046] Referring to step S14, the initial screening result is matched with the alarm rule in text type and / or value type, and an alarm is triggered when the match is successful.

[0047] In this embodiment, the alarm related functions are integrated into the business alarm platform, and the matching function is also implemented by the business alarm platform. Each time the initial screening result is matched with the alarm rule execution rule, the alarm rule is retrieved from the database, so that the alarm rule used in the matching is the latest.

[0048] Among them, the text type matching matches the preset keywords and / or special placeholders in the alarm rule with the log information of the initial screening result, and triggers an alarm when the preset keywords and / or special placeholders are matched in the log information.

[0049] The keyword is a word or a phrase, and the special placeholder is a special character or a regular expression. For example, if the keyword is "Fail" and the special placeholder is a curly bracket "{", when the text type is matched, an alarm is triggered when the keyword "Fail" or the special placeholder "{" is matched in the log information.

[0050] The numerical type matching includes: obtaining the actual number of special placeholders in the log information and comparing it with the standard number of special placeholders in the alarm rule to obtain a comparison result, or obtaining the actual data value from the log information through a regular expression and comparing it with the standard data value in the alarm rule to obtain a comparison result, and triggering an alarm according to the comparison result. In this step, the comparison includes but is not limited to: greater than, less than, equal to, and not equal to.

[0051] For example: the value of the service interface status code obtained from the log information through the regular expression is 400, while the status code of the corresponding service interface under normal conditions is 200. Correspondingly, the standard data value of the interface status code set in the alarm rule is 200. Therefore, the value of the service interface status code obtained from the log information is not equal to the standard data value of the corresponding interface status code 200, thereby triggering an alarm. Another example: the number of retries of the service interface obtained from the log information is 5, while the maximum number of retries of the corresponding interface under normal service conditions is 3. Correspondingly, the standard number of retries of the interface set in the alarm rule is 3. The number of retries of the service interface obtained from the log information is greater than the standard number of retries of the interface 3, thereby triggering an alarm.

[0052] In this embodiment, the alarm rules are divided according to functions, and the alarm rules include alarm association rules and alarm suppression rules. The alarm association rules associate alarm events with causal relationships or logical associations to reduce duplicate alarms issued by associated alarm events. For example: an application system will issue an alarm notification when a failure occurs, and the application system is associated with multiple business units. When the application system fails, it may cause the associated business units to fail and trigger alarms, with duplicate alarms as high as 90%. By using alarm association rules, when the application system triggers an alarm, the associated business units can be suppressed from issuing the same alarm.

[0053] The alarm suppression rule suppresses the alarm event to issue an alarm according to a specific business batch, a specific alarm event trigger time, or a specific alarm number to reduce repeated alarms. For example, different businesses are sorted according to the primary key, and the business batches are silenced according to the sorting order to prevent repeated alarms from being issued multiple times.

[0054] Referring to step S15, an alarm notification is sent to a specific service group in a variety of ways, including one or more of email, SMS, DingTalk, and interface callback.

[0055] In this embodiment, alarm-related functions are integrated into the business alarm platform, and alarm notifications can be pushed to DingTalk groups, DingTalk individuals, personal mobile phone text messages, and personal emails through the business alarm platform.

[0056] In this embodiment, the business log real-time alarm method further includes displaying the triggered alarm, and the display content of the triggered alarm includes the alarm rule, the alarm object, the alarm type, the alarm trigger time, the end time, and the specific alarm content. Wherein, the alarm rule includes the alarm rule name and the alarm rule id.

[0057] In this embodiment, the business alarm platform supports page interaction, and the triggered alarms can be displayed through the alarm history page. On the alarm history page, the triggered alarms are displayed on the page in the form of a table, and each row in the table displays an alarm. The table also has filtering and searching functions, supporting filtering the contents in the table according to the alarm rule ID, alarm trigger time, end time, alarm type, and alarm object, and supporting searching the alarm rule name and keywords in the specific alarm content.

[0058] Based on the same inventive concept, an embodiment of the present invention further provides a business log real-time alarm device.

[0059] Figure 2 It is a schematic diagram of a business log real-time alarm device provided by an embodiment of the present invention.

[0060] like Figure 2 As shown, the business log real-time alarm device includes a log collection module 11, a log real-time statistics module 12, and a business alarm module 13.

[0061] The log collection module 11 is used to collect log data reported by the business. The log collection module is connected to each application business module. The log collection module 11 includes a Kafka cluster, and the topics of the Kafka cluster are divided according to the business.

[0062] The log real-time statistics module 12 is used to obtain the initial screening results of the log data in real time. The log real-time statistics module is connected to the log collection module. The log real-time statistics module 12 adopts the Flink framework, reads the log data sent via the Kafka cluster through the Flink stream processing component, configures a window for the business that requires real-time statistics, calculates the window data collected by the window in real-time streaming, filters and aggregates the window data, and obtains the initial screening results, which include log information.

[0063] The service alarm module 13 is used to process alarm-related functions. The service alarm module is connected to the log real-time statistics module. The service alarm module includes an alarm rule unit 131, an alarm trigger unit 132, and an alarm notification unit 133.

[0064] The alarm rule unit 131 generates alarm rules and stores the alarm rules in a database. The alarm rules include business-defined alarm rules, and the defined alarm rules are generated by writing Groovy scripts.

[0065] The alarm triggering unit 132, the alarm triggering unit 132 matches the preliminary screening result with the alarm rule execution rule, and the rule matching includes text type matching and value type matching. The text type matching matches the preset keywords and / or special placeholders in the alarm rule with the log information of the preliminary screening result, and if the preset keywords and / or special placeholders are matched in the log information, an alarm is triggered. The value type matching includes: obtaining the actual number of special placeholders in the log information and comparing it with the standard number of special placeholders in the alarm rule to obtain a comparison result, or obtaining the actual data value from the log information through a regular expression and comparing it with the standard data value in the alarm rule to obtain a comparison result, and triggering an alarm according to the comparison result, wherein the keyword is a word or a phrase, and the special placeholder is a special character or a regular expression.

[0066] The alarm notification unit 133 performs alarm notification on a specific service group in a variety of ways, including one or more of email, SMS, DingTalk, and interface callback.

[0067] In this embodiment, the business alarm module 13 is a business alarm platform, and the alarm rule unit 131, the alarm trigger unit 132, and the alarm notification unit 133 are microservices integrated with the business alarm platform. The logs reported by the alarm rule unit 131, the alarm trigger unit 132, and the alarm notification unit 133 can also be collected by the log collection module 11 and processed by the log real-time statistics module 12 before entering the business alarm module 13.

[0068] In this embodiment, the business alarm module 13 also includes an alarm display unit, which displays the triggered alarm through the alarm history page. The display content of the triggered alarm includes alarm rules, alarm objects, alarm types, alarm trigger time, end time, and specific alarm content.

[0069] The above technical solution generates alarm rules, which include business-customized alarm rules, and the custom alarm rules are generated by writing Groovy scripts; log data reported by the business is collected and transmitted to the Kafka cluster, and the topics of the Kafka cluster are divided according to the business; the Flink stream processing component is used to read the log data sent via the Kafka cluster, a window is configured for the business that needs real-time statistics, and the window data collected by the window is calculated in real-time streaming. The window data is filtered and aggregated to obtain a preliminary screening result; the preliminary screening result is matched with the alarm rule execution rule, and the rule matching includes text type matching and numerical type matching; alarm notification is performed on specific business groups in a diversified manner, which can support business-customized personalized policy rules, and can timely discover potential risks of the business, thereby improving business continuity and stability.

[0070] It should be noted that, in this document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion. The various embodiments in this specification are described in a related manner, and the same and similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0071] The above is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. It should be noted that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be regarded as the protection scope of the present invention.

Claims

1. A business log real-time alarm method, characterized in that: include: Generate alarm rules, wherein the alarm rules include custom alarm rules, and the custom alarm rules are generated by writing Groovy scripts; Collect log data reported by the business and transfer it to the Kafka cluster, where the topics of the Kafka cluster are divided according to the business; A Flink stream processing component is used to read the log data sent via the Kafka cluster, a window is configured for the business that requires real-time statistics, window data collected by the window is calculated in real-time streaming, and the window data is filtered and aggregated to obtain a preliminary screening result, which includes log information; The preliminary screening result is matched with the alarm rule in text type and / or numerical type, and an alarm is triggered when the match is successful. The text type matching matches the preset keywords and / or special placeholders in the alarm rule with the log information of the preliminary screening result. If the preset keywords and / or special placeholders are matched in the log information, an alarm is triggered. The numerical type matching includes: obtaining the actual number of special placeholders in the log information and comparing it with the standard number of special placeholders in the alarm rule to obtain a comparison result, or obtaining the actual data value from the log information through a regular expression and comparing it with the standard data value in the alarm rule to obtain a comparison result, and triggering an alarm according to the comparison result, Wherein, the keyword is a word or a phrase, and the special placeholder is a special character or a regular expression; Provide alarm notifications to specific business groups in a variety of ways.

2. The method according to claim 1, characterized in that In the step of generating the alarm rules, the alarm rules are stored in a database; Correspondingly, in the step of performing text type matching and / or value type matching between the initial screening result and the alarm rule, the alarm rule is retrieved from the database.

3. The method according to claim 1, characterized in that The alarm rules are classified according to functions, and the alarm rules include alarm association rules and alarm suppression rules, which are used to reduce repeated alarms.

4. The method according to claim 3, characterized in that The alarm association rule associates alarm events with causal relationships or logical associations to reduce duplicate alarms issued by associated alarm events; The alarm suppression rule suppresses the alarm event from issuing an alarm according to a specific business batch, or a specific alarm event triggering time, or a specific alarm number, so as to reduce repeated alarms.

5. The method according to claim 1, characterized in that In the step of generating alarm rules, an alarm trigger template is configured, and alarm rules are created or modified in batches through the alarm trigger template.

6. The method according to claim 1, characterized in that In the step of generating an alarm rule, the parameters used in the Groovy script are obtained through an external communication interface.

7. The method according to claim 1, characterized in that In the step of using the Flink stream processing component to read the log data sent via the Kafka cluster and configuring a window for the business requiring real-time statistics, the window is a rolling window, and the window duration of the window is at the minute level.

8. The method according to claim 1, characterized in that The diversified methods include one or more of email, SMS, DingTalk, and interface callback.

9. The method according to claim 1, characterized in that: The method further comprises: The triggered alarm is displayed through the alarm history page, and the displayed content of the triggered alarm includes the alarm rule, alarm object, alarm type, alarm trigger time, end time, and specific alarm content.

10. A business log real-time alarm device, characterized in that: include: A log collection module is used to collect log data reported by the business. The log collection module is connected to each application business module. The log collection module includes a Kafka cluster. The topics of the Kafka cluster are divided according to the business. A log real-time statistics module is used to obtain the initial screening results of log data in real time. The log real-time statistics module is connected to the log collection module. The log real-time statistics module adopts the Flink framework, reads the log data sent via the Kafka cluster through the Flink stream processing component, configures a window for the business that needs real-time statistics, calculates the window data collected by the window in real-time streaming, filters and aggregates the window data, and obtains the initial screening results, which include log information; A business alarm module is used to process alarm-related functions. The business alarm module is connected to the log real-time statistics module. The business alarm module includes: An alarm rule unit, wherein the alarm rule unit generates alarm rules and stores the alarm rules in a database, wherein the alarm rules include business-defined alarm rules, and the defined alarm rules are generated by writing Groovy scripts; An alarm triggering unit, wherein the alarm triggering unit matches the initial screening result with the alarm rule execution rule, wherein the rule matching includes text type matching and value type matching, The text type matching matches the preset keywords and / or special placeholders in the alarm rule with the log information of the preliminary screening result. If the preset keywords and / or special placeholders are matched in the log information, an alarm is triggered. The numerical type matching includes: obtaining the actual number of special placeholders in the log information and comparing it with the standard number of special placeholders in the alarm rule to obtain a comparison result, or obtaining the actual data value from the log information through a regular expression and comparing it with the standard data value in the alarm rule to obtain a comparison result, and triggering an alarm according to the comparison result, Wherein, the keyword is a word or a phrase, and the special placeholder is a special character or a regular expression; An alarm notification unit is used to send alarm notifications to specific service groups in a variety of ways.

Images