Alarm analysis method and device, equipment and storage medium

Abstract

The invention discloses an alarm analysis method and device, equipment and a storage medium, and belongs to the technical field of cloud services. The method comprises the following steps: acquiring alarm information used for prompting that a cache service has a cache delay exception, wherein the cache delay is used for representing the speed of responding to a service object by the cache service; according to the alarm information, an alarm analysis rule of the cache service is determined, the alarm analysis rule is used for indicating at least one analysis atom corresponding to the cache service, the analysis atom is used for analyzing the cache delay abnormity from the aspect of the atom, and the atom is an independent factor with the capacity of causing the cache delay abnormity; according to the at least one analysis atom, an analysis result of the cache delay abnormity is generated, and the analysis result is used for representing the reason for the cache delay abnormity obtained through analysis; and sending the analysis result to an operation and maintenance terminal used for processing the cache delay exception. According to the method, after the alarm is given, the process analysis of the cache delay exception is realized, and the exception can be quickly solved.

Description

Technical Field

[0001] The present application relates to the field of cloud service technology, and in particular to an alarm analysis method, device, equipment and storage medium. Background Art

[0002] In the process of the cache service providing cache services to service users, certain factors may cause abnormal situations such as cache delay timeout. In this case, it is necessary to promptly remind the operation and maintenance personnel to handle the cache delay exception.

[0003] In the related art, after the detection system detects the cache delay anomaly, it immediately sends an alarm message to the operation and maintenance terminal. The operation and maintenance terminal prompts the operation and maintenance personnel with the alarm message so that the operation and maintenance personnel can analyze the cache delay anomaly based on their experience. During the analysis process, the operation and maintenance personnel select indicator data under different indicators to find the cause of the cache delay anomaly based on the indicator data, so as to take corresponding remedial measures in time to solve the cache delay anomaly.

[0004] However, there are many reasons for cache delay anomalies. This method relies too much on manual experience and is not conducive to efficiently solving cache delay anomalies. Summary of the invention

[0005] The present application provides an alarm analysis method, device, equipment and storage medium. The technical solution is as follows:

[0006] According to one aspect of an embodiment of the present application, a method for analyzing an alarm is provided, the method comprising:

[0007] Acquire alarm information for prompting a cache service of cache delay anomaly, where the cache delay is used to characterize the speed at which the cache service responds to a service object;

[0008] Determine, according to the alarm information, an alarm analysis rule for the cache service, wherein the alarm analysis rule is used to indicate at least one analysis atom corresponding to the cache service, wherein the analysis atom is used to analyze the cache delay anomaly from an atomic perspective, and the atom is an independent factor capable of causing the cache delay anomaly;

[0009] generating, according to the at least one analysis atom, an analysis result of the cache delay anomaly, wherein the analysis result is used to characterize a cause of the cache delay anomaly obtained through analysis;

[0010] The analysis result is sent to an operation and maintenance terminal for processing the cache delay exception.

[0011] According to one aspect of an embodiment of the present application, there is provided an alarm analysis device, the device comprising:

[0012] An information acquisition module, used to acquire alarm information for prompting a cache service of cache delay anomaly, wherein the cache delay is used to characterize the speed at which the cache service responds to a service object;

[0013] an atom determination module, configured to determine an alarm analysis rule of the cache service according to the alarm information, wherein the alarm analysis rule is used to indicate at least one analysis atom corresponding to the cache service, wherein the analysis atom is used to analyze the cache delay anomaly from an atomic perspective, and the atom is an independent factor capable of causing the cache delay anomaly;

[0014] A result generating module, used for generating an analysis result of the cache delay anomaly according to the at least one analysis atom, wherein the analysis result is used for characterizing a cause of the cache delay anomaly obtained through analysis;

[0015] The result sending module is used to send the analysis result to the operation and maintenance terminal used to process the cache delay exception.

[0016] According to one aspect of an embodiment of the present application, a computer device is provided, the computer device comprising a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the alarm analysis method as described above.

[0017] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the alarm analysis method as described above.

[0018] According to one aspect of an embodiment of the present application, a computer program product is provided, which includes a computer program stored in a computer-readable storage medium, and a processor reads and executes the computer program from the computer-readable storage medium to implement the alarm analysis method as described above.

[0019] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0020] When a cache delay anomaly occurs in a cache service, an alarm analysis rule matching the cache service is determined by matching, at least one analysis atom for analyzing the cache delay anomaly is determined by the alarm analysis rule, and an analysis result of the cache delay anomaly is determined by the at least one analysis atom.

[0021] On the one hand, it standardizes and streamlines the analysis process of alarm anomalies, reduces the subjectivity of manual analysis in the analysis results, and helps to reduce the workload of operation and maintenance personnel.

[0022] On the other hand, the analysis results can provide reference information for operation and maintenance personnel in the process of solving cache delay anomalies, which helps to improve the efficiency of solving cache delay anomalies and thus reduce the risks brought by cache delay anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a schematic diagram of a solution implementation environment provided by an exemplary embodiment of the present application;

[0024] Figure 2 It is a schematic diagram of the inventive concept of the present application provided by an exemplary embodiment of the present application;

[0025] Figure 3 It is a schematic diagram of a solution implementation environment provided by an exemplary embodiment of the present application;

[0026] Figure 4 is a flow chart of an alarm analysis method provided by an exemplary embodiment of the present application;

[0027] Figure 5 It is a schematic diagram of cache service access alarm analysis provided by an exemplary embodiment of the present application;

[0028] Figure 6 It is a schematic diagram of a cache service configuration alarm analysis rule provided by an exemplary embodiment of the present application;

[0029] Figure 7 is a schematic diagram of the interaction between various modules in an analysis system provided by an exemplary embodiment of the present application;

[0030] Figure 8 is a schematic diagram of a method for determining an analysis result provided by an exemplary embodiment of the present application;

[0031] Fig. 9 is a schematic diagram of a method for determining an analysis result provided by another exemplary embodiment of the present application;

[0032] Fig.10 is a schematic diagram of a first notification interface provided by an exemplary embodiment of the present application;

[0033] Fig.11 is a schematic diagram of an analysis result provided by an exemplary embodiment of the present application;

[0034] Fig.12 is a schematic diagram of the fourth part results provided by an exemplary embodiment of the present application;

[0035] Fig.13 is a schematic diagram of alarm number statistics provided by an exemplary embodiment of the present application;

[0036] Fig.14is a schematic diagram of root cause statistics provided by an exemplary embodiment of the present application;

[0037] Fig.15 is a schematic diagram of statistics of deactivation times provided by an exemplary embodiment of the present application;

[0038] Fig.16 is a schematic diagram of an alarm analysis process provided by an exemplary embodiment of the present application;

[0039] Fig.17 is a block diagram of an alarm analysis device provided by an exemplary embodiment of the present application;

[0040] Fig.18 It is a structural block diagram of a computer device provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0042] First, the terms involved in this application are introduced and explained.

[0043] Cloud technology: refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing.

[0044] Cloud storage: is a new concept extended and developed from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of different types of storage devices (storage devices are also called storage nodes) in the network through application software or application interfaces to work together and provide external data storage and business access functions.

[0045] At present, the storage method of the storage system is: create a logical volume, and when creating a logical volume, allocate physical storage space for each logical volume. The physical storage space may be composed of disks of a storage device or several storage devices. The client stores data on a logical volume, that is, stores the data on the file system. The file system divides the data into many parts, each of which is an object. The object contains not only data but also additional information such as data identification (ID, ID entity). The file system writes each object into the physical storage space of the logical volume, and the file system records the storage location information of each object, so that when the client requests to access the data, the file system can allow the client to access the data according to the storage location information of each object.

[0046] Content Delivery Network (CDN): A content delivery coverage network composed of a group of distributed servers, used to accelerate user access to network content. In layman's terms, CDN distributes content from the source site to the edge of the network closer to the service user, allowing service users to obtain these content data with lower latency and larger, cheaper download bandwidth. CDN can be understood as a file porter, and the servers in CDN only cache files in binary form.

[0047] Edge cloud: It is the product of a comprehensive transformation of CDN services using container-based cluster management platform (Kubernetes, k8s) containerization technology. Edge cloud connects the original CDN services with the entire cloud-native system, and converts some common functions into application programming interfaces (APIs). These interfaces are provided through service interfaces (Service Mesh), which enables full integration and utilization of CDN resources, and facilitates component version management and device lifecycle management. Edge cloud allows business developers to no longer need to pay attention to the hardware status of the device and the operation of the components, but only need to focus on business indicators and platform capacity.

[0048] Cache service: It is the core component of CDN. The cache algorithm, storage utilization efficiency, and performance of the cache service affect the equipment cost, back-to-source cost, and response quality of CDN. CDN servers are responsible for access, cache, back-to-source, and other functions. The computing and storage resources are coupled, and the elastic expansion and contraction capabilities of access are limited. In the process of CDN evolving to edge cloud architecture, it is necessary to service the cache, decouple the business logic, separate computing and storage, and achieve stateless CDN access services to release elasticity.

[0049] The cache service is the core of CDN. In the edge cloud mode, platforms with similar characteristics can share the same cache cluster, that is, the computer room is used to provide overall cache capabilities to the outside world. For cache services, you only need to pay attention to the speed of reading and writing. Its core indicator is the processing delay. When the processing delay increases, the service recipient will intuitively feel the "stuttering" phenomenon. Especially in the edge cloud system, when the processing delay of the computer room or a single machine exceeds 100ms, it is very likely to be perceived by the service recipient, resulting in a bad user experience and even complaints. Therefore, in the case of cache delay anomalies in the cache service, it is necessary to analyze the cache delay anomalies in a timely manner and take corresponding measures.

[0050] Figure 1 It is a schematic diagram of an alarm analysis method in the related art.

[0051] In related technologies, the detection system directly notifies the operation and maintenance terminal of the alarm information. The operation and maintenance personnel receive the alarm information through the operation and maintenance terminal, analyze the dimensions and indicators required for the cache delay alarm, and manually view the data under these indicators and dimensions in the detection system. Figure 1 In the , the operation and maintenance personnel select the corresponding indicator, view the performance data under the indicator, and analyze the cache delay anomaly.

[0052] Indicators refer to phenomena that are easily observed by humans. After the operation and maintenance personnel select a specific indicator, they select the dimension under the specific indicator and determine the analysis result by analyzing the data under the dimension.

[0053] After obtaining the analysis results, the operation and maintenance personnel restore the cache delay extension by issuing scripts or operating the corresponding operation and maintenance system, and observe whether the cache delay anomaly disappears through the detection system.

[0054] However, this method is highly dependent on the experience and judgment of the operation and maintenance personnel. Different operation and maintenance personnel may have different analysis results for the same cache delay anomaly. After receiving the alarm information, the operation and maintenance personnel need to check the data under multiple indicators and dimensions on various CDN operation and maintenance websites, analyze various possible scenarios for comprehensive diagnosis, and determine the root cause of the cache delay anomaly. The steps to determine the root cause of the cache delay anomaly are time-consuming and not conducive to efficiently solving the cache delay anomaly.

[0055] With the development of cache services and businesses, in order to adapt to more business scenarios and detect increasingly complex faults, the number of indicators and dimensions used in the manual analysis process has inevitably expanded. For cache services, although the core indicator of cache services is cache delay, the increase in the number of other indicators means that after receiving alarm information, operation and maintenance personnel need to combine more dimensional data for comprehensive analysis. At the same time, with the increase in the number of computer rooms and equipment supporting cache services, there are more and more computer rooms and equipment that may trigger alarm information, and the burden on operation and maintenance personnel continues to grow.

[0056] Moreover, there are many reasons that lead to abnormal cache delays. When operation and maintenance personnel first start to analyze alarms, they need to learn from scratch. The early learning of operation and maintenance personnel is very risky. Due to lack of proficiency, the processing time may be too long, which may cause greater failures.

[0057] Figure 2 It is a schematic diagram of the inventive concept of the present application provided by an exemplary embodiment of the present application.

[0058] In response to the problems existing in the related art, an embodiment of the present application provides an alarm analysis method, which is completed by an analysis system. By pre-configuring alarm analysis rules for the cache service, after the cache delay exception occurs, the analysis system determines the analysis logic of the cache delay alarm according to the alarm analysis rules of the cache service, and the analysis logic may include at least one independent analysis atom. The analysis system analyzes the cache delay exception from different atomic angles through analysis atoms, automatically generates the analysis results of the cache delay alarm, and sends the analysis results to the operation and maintenance terminal.

[0059] This method can automatically determine the cause of the cache delay alarm, which helps operation and maintenance personnel to efficiently resolve the cache delay alarm.

[0060] Figure 3 1 is a schematic diagram of a solution implementation environment provided by an exemplary embodiment of the present application. The solution implementation environment may include: a server 10, a terminal 20, a detection system 30, an analysis system 40 and an operation and maintenance terminal 50.

[0061] The server 10 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server 10 is used to provide cache services. The server 10 can refer to any device in the computer room, or it can refer to all devices in the computer room.

[0062] The terminal 20 is a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a car terminal, a virtual reality device, a mixed reality device, etc., but is not limited thereto. The terminal 20 and the server 10 can be directly or indirectly connected through wired or wireless communication to achieve data transmission. Exemplarily, the terminal 20 requests the server 10 to obtain data, the server 10 finds the data from the cache data, and sends the data to the terminal 20. The server 10 provides a cache service to the terminal 20, so that the terminal 20 can obtain data from the server 10 or upload data to the server 10 with less overhead. When the user uses the domain name to access the obtained cached resources, the cached resources are transmitted from the server 10 to the terminal 20.

[0063] The detection system 30 is a device with logic analysis capability such as a smart phone, a tablet computer, a laptop computer, a desktop computer, a vehicle terminal, an Internet of Things terminal, etc. The detection system 30 is used to detect whether the server 10 has a cache delay anomaly. There is data transmission between the detection system 30 and the server 10. Exemplarily, the detection system 30 obtains indicator data related to cache delay and detects whether these indicator data are abnormal.

[0064] Optionally, the detection system 30 and the analysis system 40 may be directly or indirectly connected via wired or wireless communication to achieve data transmission. When the detection system 30 determines that the indicator data is abnormal, the detection system 30 sends an alarm message to the analysis system 40.

[0065] The analysis system 40 includes devices with logic analysis capabilities such as smart phones, tablet computers, laptop computers, desktop computers, vehicle-mounted terminals, and Internet of Things terminals. The analysis system 40 is used to analyze the cause of the cache delay anomaly based on the alarm information and generate analysis results.

[0066] The operation and maintenance terminal 50 is a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc. The operation and maintenance terminal 50 is used to prompt the operation and maintenance personnel that the cache service is abnormal, such as displaying alarm information and analysis results to the operation and maintenance personnel. Exemplarily, there is data transmission between the analysis system 40 and the operation and maintenance terminal 50, and the analysis system 40 sends the analysis results and alarm information to the operation and maintenance terminal 50.

[0067] Exemplarily, there is data transmission between the detection system 30 and the operation and maintenance terminal 50 , and the analysis system 40 forwards the analysis result to the detection system 30 , and the analysis result is sent to the operation and maintenance terminal 50 through the detection system 30 .

[0068] Figure 4 is a flowchart of an alarm analysis method provided by an exemplary embodiment of the present application. For example, the execution subject of the method may be Figure 4 The analysis system 10 in the present invention is used as the execution subject to introduce the alarm analysis method. Figure 4 As shown, the method may include the following steps (410-440):

[0069] Step 410: Acquire alarm information for prompting the cache service of cache delay anomaly. The cache delay is used to represent the speed at which the cache service responds to the service object.

[0070] In some embodiments, the cache service is used to provide efficient data interaction services for service objects. The cache service can shorten the time it takes for service objects to obtain data. The cache service can be understood as a function for implementing request responses, or as a physical device for providing cache services, such as a computer room, equipment in the computer room, etc. The computer room includes at least one device, and the applications and business types served by different devices can be the same or different.

[0071] In some implementations, the cache service is a data download service provided based on a content distribution network, and the cache service may also be referred to as a gateway cache. Optionally, the cache service includes, but is not limited to, the following categories: file cache, browser cache, database cache, and network application layer cache. Different cache services are used to cache different types of data, and the data types of cached data are generally divided into several categories: static, on-demand, download, and live. Among them, static data has the largest amount of data, and static data includes, but is not limited to, various JS (JavaScript, script programs) that need to be loaded when the website is opened, PNG (Portable Network Graphic Format, portable network graphics format), JPG (Joint Photographic Experts Group) files, etc. It should be noted that the specific details of the cache service are set according to technical needs, and this application does not limit them here.

[0072] The service object refers to the user who uses the cache service.

[0073] Cache latency is an important indicator for measuring cache service performance. In some embodiments, cache latency is used to characterize the time it takes for a service object to request a certain data from a cache service and for the service object to obtain the data from the cache service. Optionally, when a cache service provides data cache services to multiple service objects, cache latency is the average time it takes for at least one service object to request data from a cache service and obtain the data.

[0074] In some embodiments, the alarm information is used to characterize an abnormality in the cache delay of the cache service. Cache delay anomalies include, but are not limited to: the cache delay is in a continuously rising state for a period of time, and the cache delay is greater than or equal to a first threshold. Optionally, objects for detecting cache delay anomalies include: equipment and computer rooms. For equipment, the cache delay is used to characterize the speed at which the equipment responds to data requests from service objects; for computer rooms, the cache delay is used to characterize the average response speed of each device included in the computer room to data requests. Exemplarily, the cache delay of a computer room is calculated by the cache delay of at least one device included in the computer room.

[0075] In some embodiments, the alarm analysis method detects the cache delay of the cache service through a detection system so as to promptly discover cache delay anomalies.

[0076] Exemplarily, the detection system obtains the cache delay of the cache service from the cache service through the interface, and determines whether the cache delay abnormality occurs in the cache service by comparing the cache delay with the first threshold. If the cache delay is less than the first threshold, the detection system determines that the cache delay abnormality does not occur in the cache service. If the cache delay is greater than or equal to the first threshold, the detection system determines that the cache delay abnormality occurs in the cache service. In this case, the detection system generates an alarm message. The first threshold is preset, for example, the first threshold is equal to 200ms (milliseconds).

[0077] Exemplarily, the detection system determines whether the cache service has a cache delay anomaly based on the change trend of the cache delay. If the cache delay is in a continuous upward trend over a period of time, the detection system determines that the cache service has a cache delay anomaly.

[0078] In some embodiments, when it is determined that an alarm delay anomaly occurs in the cache service, the detection system generates alarm information, and the alarm information is used to describe the cache delay anomaly.

[0079] Optionally, the alarm information includes at least one of the following: identification information, abnormal time period, cache delay change in the second time period, and a first threshold. The identification information is used to characterize the cache service with an abnormality. Exemplarily, the identification information includes at least one of the following: a type identification and a device identification; the device identification is used to characterize the device with the cache service abnormality, and the type identification is used to characterize the computer room to which the cache service belongs. The abnormal time period is the time period when the cache duration is abnormal; the second time period includes the abnormal time period, for example, the abnormal time period is the median time period in the second time period.

[0080] In some embodiments, the operation and maintenance personnel connect the cache service to the analysis system through configuration. After the cache service is connected to the analysis system, if the cache service has a cache delay exception, the analysis system will analyze the cache delay alarm.

[0081] Figure 5 It is a schematic diagram of cache service access alarm analysis provided by an exemplary embodiment of the present application.

[0082] The operation and maintenance personnel opens the "Add Analysis" column in the alarm analysis interface 500, and the operation and maintenance terminal responds to the click operation on the trigger access control 510, and displays the cache service addition form 520. The operation and maintenance personnel adds relevant information about a cache service in the cache service addition form 520 to enable the cache service to access the analysis system.

[0083] Step 420, based on the alarm information, determine the alarm analysis rule of the cache service, the alarm analysis rule is used to indicate at least one analysis atom corresponding to the cache service, the analysis atom is used to analyze the cache delay anomaly from an atomic perspective, and the atom is an independent factor that has the ability to cause the cache delay anomaly.

[0084] In some embodiments, the analysis atom refers to processing logic for analyzing cache delay anomalies from a corresponding atomic perspective, and the analysis atom is used to determine whether its corresponding atomic perspective and cache delay anomalies are managed. Optionally, different analysis atoms correspond to atomic perspectives.

[0085] In some embodiments, the atomic perspective refers to the factors that affect the cache latency performance of the cache service during the operation of the cache service. Optionally, the atomic perspective is related to the hardware that implements the cache service, or the atomic perspective is related to the operation of the cache service. Exemplarily, analysis atoms include but are not limited to at least one of the following: transmission analysis atoms, computational analysis atoms, scheduling analysis atoms, memory analysis atoms, and cache analysis atoms. For the specific content of this section, please refer to the embodiments below.

[0086] There is no correlation between different atomic angles, which makes different analysis atoms independent of each other, that is, different analysis atoms can be executed in parallel without interfering with each other. Exemplarily, the analysis atom obtains performance data related to the atomic angle and analyzes the performance data to determine whether the cache delay anomaly is associated with the atomic angle. Different analysis atoms can independently obtain the performance data required for their respective analysis processes; the analysis system runs at least one analysis atom in parallel within the same period of time. This method helps to speed up the determination of the analysis results of cache delay anomalies.

[0087] In some embodiments, the alarm analysis rule includes at least one analysis atom, that is, the alarm analysis rule is used to indicate which analysis atoms are used and from which atomic perspectives to analyze the buffer delay alarm.

[0088] Optionally, the alarm analysis rules are pre-configured. For example, the operation and maintenance personnel pre-configure the alarm analysis rules for the cache service in the analysis system. After obtaining the alarm information, the analysis system determines the alarm analysis rules for the cache service based on the alarm information.

[0089] Exemplarily, the alarm analysis rules are divided into: alarm analysis rules corresponding to equipment and alarm analysis rules corresponding to the computer room; wherein, the alarm analysis rules corresponding to the equipment are used to indicate at least one analysis atom for analyzing the equipment when the equipment triggers alarm information; the alarm analysis rules corresponding to the computer room are used to indicate at least one analysis atom for analyzing the computer room when the computer room triggers alarm information.

[0090] Figure 6 It is a schematic diagram of a cache service configuration alarm analysis rule provided by an exemplary embodiment of the present application.

[0091] The operation and maintenance personnel opens the "Rule Addition" column 600 in the alarm analysis rule configuration interface; the operation and maintenance terminal responds to the click operation on editing 610, and the operation and maintenance terminal displays the alarm analysis rule matching information 620; the operation and maintenance personnel edits the alarm analysis rule of the cache service in the analysis rule matching information 620.

[0092] Optionally, the alarm analysis rule can be implemented as an instance, which includes at least one analysis interface or analysis script, and the analysis interface (or analysis script) corresponds to the analysis atom indicated by the alarm analysis rule, that is, the analysis interface (or analysis script) is used to run the analysis atom.

[0093] In this case, the alarm analysis rules corresponding to different devices are the same, and the alarm analysis rules corresponding to different computer rooms are the same. Optionally, the alarm analysis rules corresponding to the device are different from the alarm analysis rules corresponding to the computer room. In this way, it is convenient to configure the alarm analysis rules, and the pressure on the analysis system to maintain the corresponding relationship between the alarm analysis rules and the cache service is reduced. In this way, it is convenient to configure the alarm analysis rules, and the pressure on the analysis system to maintain the corresponding relationship between the alarm analysis rules and the cache service is reduced.

[0094] Exemplarily, the alarm analysis rules include: an alarm analysis rule corresponding to at least one device, and an alarm analysis rule corresponding to at least one computer room. That is, for two different devices, the two devices correspond to different alarm analysis rules, and for two different computer rooms, the two computer rooms correspond to different alarm analysis rules.

[0095] This method enables personalized configuration of alarm analysis rules for different devices and computer rooms. In the case that different computer rooms and devices support different services, it is convenient to configure alarm analysis rules according to the specific services and functions of the cache service, making the alarm analysis rules closer to the cache service and helping to improve the efficiency of determining the analysis results.

[0096] Step 430: Generate an analysis result of the cache delay anomaly based on at least one analysis atom, where the analysis result is used to characterize the analyzed cause of the cache delay anomaly.

[0097] In some embodiments, the analysis result refers to the preliminary result of the cache delay anomaly determined by the analysis system. The analysis result can provide reference information to the operation and maintenance personnel to help the operation and maintenance personnel provide directions for solving the cache delay anomaly.

[0098] Optionally, the analysis result is related to the atomic angle corresponding to at least one analysis atom. For example, if an analysis of a certain analysis atom determines that its corresponding atomic angle is associated with the cache delay anomaly, the analysis result includes the atomic angle of the analysis atom.

[0099] Step 440: Send the analysis result to the operation and maintenance terminal used to handle cache delay exceptions.

[0100] In some embodiments, the operation and maintenance terminal refers to a terminal used by the operation and maintenance personnel. The operation and maintenance terminal includes multiple types, such as the operation and maintenance terminal includes a component operation and maintenance terminal and a platform operation and maintenance terminal; wherein the component operation and maintenance terminal is used to maintain the equipment and computer room carrying the cache service, and the platform operation and maintenance terminal is used to maintain the business in the cache service.

[0101] In one example, a communication connection mode, such as a group, address book, etc., is established between the analysis system and the operation and maintenance terminal, and the analysis system sends the analysis results to the operation and maintenance terminal through the communication connection mode. For example, a notification group is established between the analysis system and the operation and maintenance terminal, and the analysis system sends the analysis results to the notification group, so that the operation and maintenance personnel can obtain the analysis results through the operation and maintenance terminal.

[0102] In another example, in the related technology, the detection system directly provides alarm information to the operation and maintenance terminal, that is, there is a communication connection between the detection system and the operation and maintenance terminal, and the step of sending the analysis results to the operation and maintenance terminal can be implemented with the assistance of the detection system. For example, after determining the analysis result of the cache delay anomaly, the analysis system sends the analysis result of the cache delay anomaly to the detection system, and the detection system forwards the analysis result to the operation and maintenance terminal. This method enables the alarm analysis method provided in this application to be seamlessly integrated into the related technology, reducing the impact of introducing the alarm analysis method on other devices and systems.

[0103] There are many reasons for causing cache delay anomalies. For example, the cause of the cache delay anomaly is related to the physical equipment and computer room corresponding to the cache service. For another example, the cause of the cache delay anomaly is related to the application and business carried by the cache service. For different types of cache delay anomalies, the operation and maintenance personnel who handle the cache delay anomaly may be different, that is, in step 440, the analysis system can select a target operation and maintenance terminal from at least one type of operation and maintenance terminal based on the analysis results of the cache delay anomaly, and send the analysis results to the target operation and maintenance terminal. For the specific content of this step, please refer to the following embodiment.

[0104] In some embodiments, in order to improve the ability of the analysis system to face risks, the analysis system includes multiple modules, and the multiple modules divide the functions of the analysis system for alarm analysis, and the above steps 410-430 are completed by different modules. These modules can be deployed on the same device or on different devices, that is, the analysis system can include multiple devices, which have different functions, and the multiple devices cooperate with each other to complete the alarm analysis process. This method helps to avoid the failure of the analysis system to continue all the steps of the alarm analysis, which helps to improve the stability of the analysis system.

[0105] Optionally, the analysis system includes a central control module, an analysis module and a policy module; wherein the central control module is used to obtain alarm information and match alarm analysis rules for cache services according to the alarm information. The analysis module includes analysis logic for analyzing cache delay, that is, analysis atoms. The analysis module analyzes cache delay anomalies according to at least one analysis atom included in the alarm analysis rule, and generates analysis results of cache delay anomalies. The policy module is used to visualize the analysis results and obtain analysis results for sending to the operation and maintenance terminal.

[0106] To sum up, when a cache delay anomaly occurs in a cache service, an alarm analysis rule matching the cache service is determined by matching, at least one analysis atom used to analyze the cache delay anomaly is determined by the alarm analysis rule, and the analysis result of the cache delay anomaly is determined by at least one analysis atom.

[0107] On the one hand, it standardizes and streamlines the analysis process of alarm anomalies, reduces the subjectivity of manual analysis in the analysis results, and helps to reduce the workload of operation and maintenance personnel.

[0108] On the other hand, the analysis results can provide reference information for operation and maintenance personnel in the process of solving cache delay anomalies, which helps to improve the efficiency of solving cache delay anomalies and thus reduce the risks brought by cache delay anomalies.

[0109] The following is an introduction to several examples of how to determine alarm analysis rules.

[0110] Example 1:

[0111] In some embodiments, step 420 includes the following steps:

[0112] In sub-step 420-a, the analysis system determines identification information of the cache service based on the alarm information, where the identification information includes at least one of the following: an identity identifier and a category identifier; based on the identification information, the analysis system determines the alarm analysis rule preconfigured for the cache service as the alarm analysis rule for the cache service from at least one candidate alarm analysis rule.

[0113] In some embodiments, the device identifier is used to identify the device where the cache delay anomaly occurs, and the category identifier is used to identify the computer room where the cache delay anomaly occurs. Optionally, the alarm information includes the identifier information of the cache service, and the analysis system obtains the identifier information from the alarm information.

[0114] Optionally, the analysis system includes at least two preconfigured alarm analysis rules. The analysis system determines the alarm analysis rule preconfigured for the cache service based on the identification information, and obtains the alarm analysis rule to be used in the analysis process of the cache delay anomaly.

[0115] Exemplarily, the analysis system searches at least one candidate alarm analysis rule based on the identification information to see whether there is an alarm analysis rule corresponding to the identification information. If there is an alarm analysis rule corresponding to the identification information, it is determined that the alarm analysis rule is the alarm analysis rule for the cache service. If there is no alarm analysis rule corresponding to the identification information, the analysis system does not perform steps 430 and 440 for the cache service.

[0116] Optionally, the analysis system includes: alarm analysis rules corresponding to the device and alarm analysis rules corresponding to the computer room; the analysis system determines the category of the cache delay anomaly according to the identification information, and determines the alarm analysis rule of the cache service from the above alarm analysis rules according to the category of the cache delay anomaly. For example, if the identification information of a cache service indicates that the cache service is a device, the analysis system uses the alarm analysis rule corresponding to the device as the alarm analysis rule of the cache service.

[0117] In one example, the step of determining the alarm analysis rule for the cache service is completed by the central control module of the analysis system. After the central control module obtains the alarm information, it determines the identification information of the cache service from the alarm information; the central control module determines whether there is an alarm analysis rule configured for the cache service based on the identification information of the cache service. If there is no alarm analysis rule configured for the cache service, it means that there is no need to analyze the cache delay anomaly occurring in the cache service, and the analysis system stops the alarm analysis process. If there is an alarm analysis rule configured for the cache service, it means that the cache delay anomaly occurring in the cache service needs to be analyzed, and the alarm analysis rule configured by the central control module for the cache service is used as the alarm analysis rule for the cache service. After determining the alarm analysis rule for the cache service, the central control module indicates the alarm analysis rule to the analysis module, so that the analysis module determines the analysis result of the cache delay anomaly based on at least one analysis atom included in the alarm analysis rule.

[0118] Through this method, it is possible to configure corresponding alarm analysis rules for different cache services, so that the process of analyzing the cache delay anomalies generated by the cache service is more appropriate to the type of the cache service, so that the analysis system can analyze the cache delay anomalies in a targeted manner, avoiding unnecessary analysis processes for the analysis system, helping to save computing resources and achieve efficient determination of analysis results.

[0119] Example 2:

[0120] In some embodiments, step 420 includes the following steps:

[0121] In sub-step 420-b, the analysis system determines identification information of the cache service based on the alarm information, where the identification information includes at least one of the following: an identity identifier and a category identifier; the analysis system determines multiple alarm analysis rules that match the cache service based on the identification information; the analysis system determines, from the multiple alarm analysis rules, an alarm analysis rule whose usage frequency is greater than a threshold as an alarm analysis rule for the cache service.

[0122] For specific instructions on identification information, please refer to Example 1, which will not be repeated here.

[0123] In some embodiments, when the cache delay alarm is a device alarm, the device belongs to a certain computer room, and the alarm analysis rules configured for multiple devices included in the computer room are not completely the same. The analysis system determines the computer room to which the cache service belongs based on the category information of the cache service; the analysis system uses the alarm analysis rules configured for all devices in the computer room as multiple alarm analysis rules that match the cache service; and the business device selects the alarm analysis rule for the cache service from the multiple alarm analysis rules that match the cache service.

[0124] Optionally, the analysis system selects an alarm analysis rule for the cache service from multiple alarm analysis rules according to the usage frequency of the alarm analysis rule.

[0125] Exemplarily, the analysis system determines at least one alarm analysis rule whose usage frequency is greater than a threshold from multiple alarm analysis rules; the analysis system randomly selects one from the at least one alarm analysis rule as the alarm analysis rule for the cache service. The threshold is determined according to actual needs and is not set in this application.

[0126] Exemplarily, the analysis system selects an alarm analysis rule with the highest usage frequency from multiple alarm analysis rules as the alarm analysis rule for the cache service.

[0127] Exemplarily, the analysis system selects a newly configured alarm analysis rule from multiple alarm analysis rules as the alarm analysis rule for the cache service.

[0128] It is only necessary to pre-configure alarm analysis rules for some devices in the same computer room, and all devices in the computer room can share these alarm analysis rules. This method helps to simplify the tediousness of configuring alarm analysis rules for cache services. It not only eliminates the need to configure alarm analysis rules for each device separately, but also improves the richness of alarm analysis rules. Since the cache services supported by the devices in a computer room are likely to be similar, managing alarm analysis rules by computer room helps to reduce the difficulty of the analysis system maintaining the correspondence between alarm analysis rules and cache services.

[0129] The method for generating analysis results is described below through several embodiments.

[0130] After determining at least one analysis atom, the analysis system starts to analyze the cause of the cache duration anomaly, and this process is mainly completed by at least one analysis atom.

[0131] In some embodiments, in step 430, the system generates an analysis result of cache delay anomaly according to at least one analysis atom, which may include the following sub-steps (not shown in the drawings of the specification):

[0132] Sub-step 432, for the first analysis atom in at least one analysis atom, the analysis system sends a data call request to the cache service through the first analysis atom, and the data call request is used to call the performance data of the first atomic angle during the operation of the cache service. The first atomic angle is the atomic angle used for analysis by the first analysis atom.

[0133] In some embodiments, at least one analysis atom is executed separately by multiple work threads, that is, the analysis system creates corresponding work threads for at least one analysis atom, and multiple work threads can be executed in parallel, which helps to improve the speed of determining the analysis results.

[0134] Optionally, the data call request is used to call the performance data related to the first atomic angle in the cache service during the period when the cache delay exception occurs. Exemplarily, the data call request includes at least one of the following: an analysis atom identifier, a performance data identifier, and an abnormal period.

[0135] The analysis atom identifier is used to identify the identity of the first analysis atom.

[0136] The performance data identifier is used to identify the performance data related to the first atomic angle. In the case where the performance data of the first atomic angle includes multiple items, the data call request includes multiple performance data identifiers.

[0137] The abnormal period refers to the period when the cache service has a cache delay alarm. Exemplarily, the abnormal period refers to the time period from the moment when the cache service is found to have a cache delay alarm to before the data call request is sent.

[0138] Exemplarily, the first analysis atom determines the abnormal time period when the cache delay abnormality occurs based on the alarm information; the first analysis atom generates a data call request based on the abnormal time period. After the first analysis atom generates the data call request, the first analysis atom sends the data call request to the cache service through the data acquisition interface in the cache service.

[0139] Sub-step 434, after receiving the performance data of the first atomic angle sent by the cache service, the analysis system determines the atomic result of the first atomic angle based on the performance data of the first atomic angle through the first analysis atom, and the atomic result is used to characterize the correlation between the first atomic angle and the cache delay anomaly.

[0140] In some embodiments, the atomic result includes at least one of the following: result type and performance data; wherein the result type is used to characterize whether there is a correlation between the atomic perspective and the cache latency anomaly, and the performance data refers to data related to the atomic perspective obtained by the analysis atom from the cache service. Exemplarily, a certain atomic result includes the result type and performance data.

[0141] Optionally, the content of the atomic result can be configured by the operation and maintenance personnel, who send result configuration information to the analysis system, and the result configuration information is used to indicate the content that needs to be carried in the atomic result. This method makes it convenient for the operation and maintenance personnel to configure the content included in the atomic result according to factors such as the processing pressure and storage pressure of the analysis system, which helps to improve the adaptability of the alarm analysis method to analysis systems with different hardware conditions.

[0142] In some embodiments, the first analysis atom determines the atomic result of the first atomic angle by comparing the performance data of the first atomic angle with the performance threshold. Optionally, the performance threshold is preset for the cache service, or the performance threshold is an average value determined based on the performance data of at least one cache service in the existing network.

[0143] Exemplarily, if the performance data from the first atomic perspective does not exceed the performance threshold, it means that from the first atomic perspective, the cache service runs normally during the abnormal period; that is, there is no correlation between the first atomic perspective and the cache delay abnormality. If the performance data from the first atomic perspective exceeds the performance threshold, it means that from the first atomic perspective, the cache service runs abnormally during the abnormal period; that is, there may be a correlation between the first atomic perspective and the cache delay abnormality.

[0144] In sub-step 436, the analysis system generates an analysis result of the cache delay anomaly according to the atomic results respectively determined by at least one analysis atom.

[0145] Usually, the cache delay exception is caused by a main reason, which is called the root cause of the cache delay exception. After at least one analysis atom determines the atomic result, the analysis system needs to determine the root cause according to the atomic result determined by at least one analysis atom, so as to generate the analysis result of the cache delay exception. For the specific content of this embodiment, please refer to the following embodiment.

[0146] Since the analysis result is related to the atomic result determined by at least one analysis atom respectively, independently executing each analysis atom in parallel helps to align the moment when each analysis atom determines the atomic result, helps to reduce the time consumption of determining the analysis result, and improves the timeliness of the analysis result.

[0147] The following describes several methods for generating abnormal analysis results through several embodiments.

[0148] In some embodiments, sub-step 436, the analysis system generates an analysis result of cache delay anomaly according to the atomic result determined by at least one analysis atom, and may further include the following sub-steps:

[0149] In sub-step 436-a, the analysis system determines the root cause of the cache delay anomaly from the atomic results determined by at least one analysis atom, where the root cause refers to the atomic angle resulting from the analysis that causes the cache delay anomaly.

[0150] In some embodiments, the root cause is the cause of the cache delay anomaly in the cache service. The root cause is also called the root cause. Optionally, the performance data from the atomic angle corresponding to the root cause is the performance data with anomalies. In the alarm analysis method provided in the present application, there is only one root cause for the cache delay warning. Therefore, after at least one analysis atom determines the atomic result, it is necessary to determine the atomic angle as the root cause from the atomic angles corresponding to each of the at least one analysis atom according to the atomic result.

[0151] In some embodiments, the atomic results include: existence of association and no association, the existence of association is used to characterize that the atomic angle used for analysis by the analysis atom is associated with the cache delay anomaly, and the no association is used to characterize that the atomic angle used for analysis by the analysis atom is irrelevant to the cache delay anomaly; from the atomic results determined separately by at least one analysis atom, determining the root cause of the cache delay anomaly includes: determining the analysis atom that has an existence of association as an abnormal analysis atom; if there is an abnormal analysis atom, determining the atomic angle used for analysis by the abnormal analysis atom as the root cause; if there are multiple abnormal analysis atoms, selecting an abnormal analysis atom from the multiple abnormal analysis atoms according to the priority of the analysis atom, and determining the atomic angle used for analysis by the selected abnormal analysis atom as the root cause.

[0152] In some embodiments, the priorities of the analysis atoms are used to rank the likelihood that the atomic angles used for analysis by the analysis atoms can cause cache latency anomalies.

[0153] Exemplarily, the priorities of the analysis atoms are pre-set, and the operation and maintenance personnel indicate the priority between at least one analysis atom to the analysis system in advance, so that the root cause can be determined later according to the priorities of the analysis atoms.

[0154] Exemplarily, the priority of the analysis atom is determined by the analysis system, which counts the root causes of the cache delay anomalies that occurred in the cache service during the second time period, and determines the priority of the analysis atom according to the frequency of different atomic angles as the root cause. For example, during the second time period, the frequency of atomic angle 1 as the root cause is 3 times, the frequency of atomic angle 2 as the root cause is 9 times, and the frequency of atomic angle 3 as the root cause is 1 time, then the priority of the analysis atom used to analyze atomic angle 2 is the highest, the priority of the analysis atom used to analyze atomic angle 1 is the lowest, and the priority of the analysis atom used to analyze atomic angle 1 is between the two.

[0155] Optionally, the priority of the analysis atom is positively correlated with the possibility of causing cache delay anomalies from an atomic perspective, that is, the higher the priority of the analysis atom, the greater the possibility of causing cache delay anomalies, and the lower the priority of the analysis atom, the smaller the possibility of causing cache delay anomalies.

[0156] Optionally, the priority of the analysis atom is negatively correlated with the possibility of causing cache delay anomalies from an atomic perspective, that is, the higher the priority of the analysis atom, the smaller the possibility of causing cache delay anomalies, and the lower the priority of the analysis atom, the greater the possibility of causing cache delay anomalies.

[0157] In an example, the alarm analysis rules of a cache service include four analysis atoms, among which the atomic result determined by one analysis atom, such as analysis atom 4, is associated, and the atomic results determined by the remaining three analysis atoms (analysis atom 1, analysis atom 2, and analysis atom 3) are unrelated. Then, analysis atom 4 is an abnormal analysis atom, and the analysis system uses the atomic angle used for analysis by analysis atom 4 as the root cause of the cache delay abnormality.

[0158] In another example, the alarm analysis rules of a cache service include five analysis atoms, among which the atomic results determined by three analysis atoms (analysis atom 1, analysis atom 2, and analysis atom 3) are associated, and the atomic results determined by the remaining two analysis atoms (analysis atom 4 and analysis atom 5) are unrelated. Then, analysis atom 1, analysis atom 2, and analysis atom 3 are abnormal analysis atoms, and the priorities of the three analysis atoms from high to low are: analysis atom 1, analysis atom 3, analysis atom 2. Then the analysis system uses the atomic angle used for analysis by analysis atom 1 as the root cause of the cache delay exception.

[0159] By setting priorities between analysis atoms, when multiple abnormal analysis atoms are identified, it helps to simplify the processing logic for determining the root cause and improve the speed of determining the analysis results.

[0160] In sub-step 436 - b , the analysis system generates an analysis result of the cache delay anomaly based on the root cause and the atomic results determined by at least one analysis atom.

[0161] In some embodiments, the analysis result of the cache delay anomaly includes atomic results determined by the analysis system according to the root cause and at least one analysis atom. The analysis system carries the atomic results determined by the root cause and at least one analysis atom in the analysis result, and displays the analysis process of the cache delay anomaly by the analysis system in the analysis result, thereby providing more reference information for operation and maintenance personnel, facilitating the operation and maintenance personnel to check the analysis results and find measures to solve the cache delay anomaly.

[0162] In some embodiments, the analysis results include a first part of the results and a second part of the results; the first part of the results is used to characterize the root cause, and the second part of the results is used to characterize the correlation between the atomic angle corresponding to at least one analysis atom and the cache delay anomaly; the analysis system generates an analysis result delay of the cache delay anomaly based on the root cause and the atomic results determined respectively by at least one analysis atom, including: the analysis system performs rendering processing based on the root cause to generate the first part of the results; the analysis system performs rendering processing based on the atomic results determined respectively by at least one analysis atom to generate the second part of the results.

[0163] Rendering processing is performed based on the root cause, which can be understood as displaying the root cause in the form of text or icon in the first part of the results, and rendering processing is performed based on the atomic results determined respectively by at least one analysis atom, which can be understood as displaying the atomic results determined respectively by at least one analysis atom in the second part of the results.

[0164] Optionally, in order to make the analysis results more comprehensive and to facilitate operation and maintenance personnel to refer to the reliability of the analysis results, the second part of the results may also include performance data of at least one atomic angle. For example, the second part of the results includes the atomic results determined by the first analysis atom analysis and the performance data of the first atomic angle obtained during the analysis of the first analysis atom on the first atomic angle. The atomic results of a certain atomic angle and the performance data of the atomic angle can be displayed in adjacent positions in the second part of the results. For example, in the second part of the results, the atomic results of atomic angle 1 are displayed above the performance data of atomic angle 1, or the atomic results of atomic angle 1 are displayed to the right of the performance data of atomic angle 1. It should be noted that the display style of the atomic results and performance data in the second part of the results is set according to actual needs, and this application is not limited here.

[0165] By carrying performance data in the second part of the results, the complexity of operations for operation and maintenance personnel to obtain performance data is reduced, which helps to speed up the resolution of cache delay anomalies.

[0166] In some embodiments, when the cache service corresponds to multiple analysis atoms, the analysis results respectively determined by the multiple analysis atoms need to be displayed in the second result part, and the analysis system determines the order of at least one analysis result in the second part of the results according to the first order. For example, the analysis system performs rendering processing based on the atomic results respectively determined by the multiple analysis atoms to generate the second part of the results, including: sorting the atomic results respectively determined by the multiple analysis atoms according to the priority of the analysis atoms, so that the atomic results respectively determined by the multiple analysis atoms are displayed in the second part of the results in order from high to low priority.

[0167] Since the root cause is of great reference value for operation and maintenance personnel to determine the treatment measures for cache delay anomalies, carrying the root cause in the analysis results helps to improve the information carrying capacity of the analysis results and also helps to improve the efficiency of solving cache delay anomalies.

[0168] In order to facilitate the location of the cache delay anomaly corresponding to the analysis result, the analysis result may further include a third part of the result for describing the cache delay anomaly.

[0169] In some implementations, the analysis results include a third part of the results, which is used to locate the cache delay anomaly; the method also includes: the analysis system determines the attribute information of the cache delay anomaly based on the alarm information, and the attribute information is used to describe the cache delay anomaly; the analysis system performs rendering processing based on the attribute information to generate the third part of the results.

[0170] Optionally, the attribute information of the cache delay anomaly includes at least one of the following: identification information of the cache service, the second time period, and the cache delay of the cache service in the second time period, wherein the cache delay includes at least one of the following: write traffic and read traffic.

[0171] Exemplarily, when the cache service is a computer room, the attribute information of the cache delay anomaly also includes the cache delay of at least n devices in the computer room, where n is a positive integer.

[0172] The following describes a method for maintaining the timeliness of analysis results through several embodiments.

[0173] After the cache delay alarm occurs, it is necessary to promptly process the cache delay alarm within a short period of time to reduce the service object's perception of excessive cache delay and data transmission service jams. Therefore, it is necessary to set a time limit for the process of the analysis system determining the analysis results to avoid the analysis system consuming a lot of time to determine the analysis results, resulting in the analysis results not being reported to the operation and maintenance terminal in a timely manner, causing the cache delay anomaly to exist for too long.

[0174] In some embodiments, the alarm analysis method also includes: the analysis system records the working time of the first analysis atom; the analysis system determines the limited time of the first analysis atom, and the limited time of the first analysis atom refers to the upper limit of the time consumed by the first analysis atom to determine the analysis result; when the working time of the first analysis atom is greater than or equal to the limited time of the first analysis atom, the analysis system controls the first analysis atom to stop determining the atomic result of the first atomic angle; in the process of generating the analysis result of the cache delay exception, the atomic result determined by the first analysis atom is not used.

[0175] In some embodiments, the first analysis atom is any one of the at least one analysis atom, and the limited duration of the first analysis atom is used to limit the maximum time consumed by the first analysis atom to determine an atomic result.

[0176] Optionally, the time limits corresponding to at least one analysis atom are the same, that is, at least one analysis atom needs to complete the step of determining the atomic result within the same time limit. Exemplarily, the time limit of the first analysis atom is preset, and the analysis system uses the preset time limit as the time limit of the first analysis atom.

[0177] Optionally, there are at least two analysis atoms that have different corresponding limited durations. Exemplarily, the limited duration of the first analysis atom is related to other analysis atoms. For the method of determining the limited duration of the first analysis atom in this case, please refer to the next embodiment.

[0178] After the first analysis atom is created, the analysis system records the working time of the first analysis atom, and the analysis system compares the relationship between the working time of the first analysis atom and the limited time of the first analysis atom, and determines that the first analysis atom can continue to execute. Optionally, if the working time of the first analysis atom is less than the limited time of the first analysis atom, the first analysis atom can continue to determine the atomic result of the first atomic angle. If the working time of the first analysis atom is greater than or equal to the limited time of the first analysis atom, the analysis system determines that the first analysis atom stops determining the atomic result of the first atomic angle; in this case, the analysis system does not need to continue to wait for the analysis result determined by the analysis atom, and the analysis system generates a root cause based on the atomic results determined by other analysis atoms in at least one analysis atom except the first analysis atom.

[0179] Through this method, in order to avoid wasting too much time waiting for the atomic results determined by the analysis atoms, which slows down the speed of determining the analysis results based on the atomic results and leads to untimely feedback of the analysis results, when the working time of the analysis atom exceeds the specified time, the analysis process of the first analysis atom is stopped in time, and the analysis results are generated using other already generated atomic results. This helps to control the working time of the analysis atoms and improve the timeliness of the analysis results, and also helps to avoid unnecessary calculation processes after the working time of the analysis atoms times out, thereby helping to save computing resources of the analysis system.

[0180] The method for determining the limited duration of the first analysis atom is introduced and explained below through several embodiments.

[0181] In some embodiments, the analysis system determines a limited duration of a first analysis atom, including: the analysis system counts the obtained analysis results determined by at least one second analysis atom before reaching the first limited duration, the second analysis atom is different from the first analysis atom, and the first limited duration refers to the limited duration of a target analysis atom in the at least one second analysis atom; if the analysis system has obtained analysis results that meet a waiting condition, the analysis system updates the first limited duration to obtain an updated first limited duration, and the waiting condition is related to at least one of the following: the priority of the second analysis atom, the number of obtained atomic results; the analysis system determines the updated limited duration as the limited duration of the first analysis atom.

[0182] Optionally, the target analysis atom is any one of the at least one second analysis atom, that is, when there is only one limited time duration, the first limited time duration is a preset limited time duration.

[0183] Optionally, the target analysis atom is the analysis atom closest to the priority of the first analysis atom among at least one second analysis atom, and the first limited duration is the limited duration of the target analysis atom. Exemplarily, the priorities among the analysis atoms are the first analysis atom, the second analysis atom 1, the second analysis atom 2, and the second analysis atom 3, then the second analysis atom 1 is the analysis atom closest to the priority of the first analysis atom, and the second analysis atom 1 is the target analysis atom.

[0184] Optionally, the target analysis atom is the analysis atom with the longest limited duration among at least one second analysis atom. For example, if the limited duration of the second analysis atom 1 is 1.5 minutes and the limited duration of the second analysis atom 2 is 2 minutes, then the second analysis atom 2 is the target analysis atom.

[0185] After the analysis system determines the limited time length of the first analysis atom, the analysis system determines whether the obtained analysis atom satisfies the waiting condition.

[0186] If the obtained analysis atom meets the waiting condition, the analysis system does not update the first limited duration. In this case, the analysis duration of the first analysis atom is the preset initial analysis duration.

[0187] If the obtained analysis atom satisfies the waiting condition, the analysis system updates the first limited time length, obtains an updated first limited time length, and uses the updated first limited time length as the limited time length of the first analysis atom.

[0188] Optionally, the time span of the updated first limited duration is greater than the unupdated first limited duration. Exemplarily, the updated first limited duration is 10 seconds longer than the unupdated first limited duration.

[0189] In some embodiments, the waiting condition includes at least one of the following: the number of atomic results obtained is less than or equal to the first number, and the priority of the first analysis atom is less than or equal to the first level. Optionally, the first number is preset, and the first level is related to at least one second analysis atom. For example, the first level refers to the highest priority level among the at least one second analysis atom.

[0190] Exemplarily, the waiting condition is that the number of atomic results obtained is less than or equal to the first number; if the number of atomic results obtained is greater than the first number, the first analysis atom does not meet the waiting condition, and the analysis system uses the first limited time as the limited time of the first analysis atom; if the number of atomic results obtained is less than or equal to the first number, the first analysis atom meets the waiting condition, and the analysis system updates the first limited time to obtain an updated first limited time; the analysis system uses the updated first limited time as the limited time of the first analysis atom.

[0191] Exemplarily, the waiting condition is that the priority of the first analysis atom is less than or equal to the first level.

[0192] If the priority of the first analysis atom is less than the first level, the first analysis atom does not meet the waiting condition, and the analysis system uses the first limited time as the limited time of the first analysis atom; if the priority of the first analysis atom is greater than or equal to the first level, the analysis system updates the first limited time to obtain an updated first limited time; the analysis system uses the updated first limited time as the limited time of the first analysis atom.

[0193] In one example, the waiting condition is that the number of atomic results obtained is less than or equal to the first number, the first number is equal to 3, the limited time for the second analysis atom 1 is 1 minute, and the limited time for the second analysis atom 2 is 1 minute, then the first limited time is equal to 1 minute, the number of atomic results obtained is 2, and the number of atomic results obtained: 2, is less than the first number: 3, then the analysis system updates the first limited time, and illustratively, the updated first limited time is equal to 1.25 minutes.

[0194] In one example, the waiting condition is that the priority of the first analysis atom is less than or equal to the first level. The first level is equal to level 2, and the priority of the first analysis atom is equal to level 3, then the first analysis atom meets the waiting condition, and the analysis system updates the first limited time.

[0195] The time limit for analyzing atoms is set according to the number of atomic results obtained or the priority of the analyzed atoms. While avoiding wasting too much time waiting for the atomic results of the analyzed atoms, a strategy for determining the time limit is formulated according to the actual situation. Since analysis atoms with higher priorities are more likely to be associated with extended cache delays, and the small number of atomic results obtained is not conducive to generating an accurate analysis process, setting the time limit through the above method can help improve the flexibility of setting the time limit on the one hand, and help maintain the accuracy of the analysis results while taking into account the timeliness of the analysis results on the other hand.

[0196] The following describes several embodiments of the emergency response settings after an alarm occurs.

[0197] In some embodiments, the alarm analysis method also includes: obtaining traffic information of the cache service from the cache service, the traffic information is used to characterize the pressure of data transmission between the cache service and the service object; obtaining capacity information of the cache service from the cache service, the capacity information is used to characterize the ability of the cache service to carry the service object; generating an application decision of the cache service based on the traffic information and the capacity information, the application decision is used to indicate the usage status of the cache service after a cache delay exception occurs; indicating the usage status of the cache service through the application decision; rendering based on the application decision to obtain a fourth part of the results included in the analysis results, the fourth part of the results is used to characterize the usage status of the cache service after a cache delay exception occurs.

[0198] In some embodiments, the capacity information is used to characterize the maximum capacity of the cache service for providing data transmission, and the traffic information is used to characterize the capacity currently carried by the cache service.

[0199] Optionally, the analysis system generates an application decision for the cache service based on the traffic information and the capacity information, including: the analysis system calculates a ratio between the traffic information and the capacity information. If the ratio is greater than or equal to a second threshold, the analysis system determines that the application decision for the cache service is to deactivate the cache service; if the ratio is less than the second threshold, the analysis system determines that the application decision for the cache service is to continue to use the cache service.

[0200] In the case of a device corresponding to a cache service, the traffic information and capacity information are both data for the device. The second threshold is the ratio between the traffic information and capacity information of other devices. If the ratio between the traffic information and capacity information of a device is greater than the second threshold, the application decides to deactivate the device.

[0201] Optionally, when the application decision is to stop using the cache service, the analysis system will also detect the cache delay of other devices in the computer room to which the device belongs. For the first other device in the computer room to which the device belongs, if the cache delay of the other device is higher than the cache delay of the device, the analysis system generates an application decision for the first other device, and the application decision of the first other device is used to deactivate the first other device.

[0202] Optionally, in the case where the application decision is to stop using the cache service device, the method also includes: the analysis system counts the number of devices disabled in the cache service, and if the number of devices disabled in the cache service is less than or equal to the fourth threshold, the analysis system sends the application decision to the management system; if the number of devices disabled in the cache service is greater than the fourth threshold, the analysis system modifies the application decision to continue using the cache service, and the management system sends the modified application decision. This method helps to keep devices greater than or equal to the fourth threshold in use, ensures the normal operation of the cache service, and helps to improve the stability of the cache service. Exemplarily, the fourth threshold is a preset positive integer, and the fourth threshold is set according to the technical implementation, and this application is not limited here.

[0203] In the case where the cache service corresponds to a computer room, the flow information and the capacity information are data for all devices in the computer room. If the ratio between the flow information and the capacity information of the first proportion of devices in the computer room is greater than the second threshold, the application decision is to deactivate all devices in the computer room. Optionally, the first proportion is preset, such as the first proportion is equal to 70%.

[0204] In some embodiments, in order to ensure the safe operation of the cache service, the analysis system cannot directly control the deactivation of the cache service through application decisions. The analysis system sends the application decision to the management system, and the management system determines whether to deactivate the cache service based on the application decision; wherein the management system is used to manage the operation process of the cache service.

[0205] In order to make the operation and maintenance personnel clear about the current operation status of the cache service, the analysis system will also send the application decision to the operation and maintenance terminal. That is, the analysis system generates the fourth part of the result based on the application decision, and the business system sends the fourth part of the result to the operation and maintenance terminal.

[0206] Optionally, the analysis system directly sends the fourth part of the results to the operation and maintenance terminal, or the analysis system forwards the fourth part of the results to the detection system, and the detection system sends the fourth part of the results to the operation and maintenance terminal.

[0207] In some embodiments, the fourth partial results can be sent bundled with other partial results included in the analysis results, or the fourth partial results can be sent separately. The method of sending the fourth partial results is determined according to actual needs and is not limited in this application.

[0208] It should be noted that after generating the application decision, the execution order of the two steps of "indicating the usage status of the cache service through the application decision" and "rendering based on the application decision to obtain the fourth part of the results included in the analysis results" can be interchanged or executed simultaneously, and this application does not limit this.

[0209] Optionally, the analysis system sends the fourth part of the analysis results and other parts of the analysis results to the operation and maintenance terminal simultaneously. Optionally, the analysis system sends the fourth part of the analysis results to the operation and maintenance terminal alone.

[0210] The following is a detailed description of the analysis system and an introduction to the process of determining the analysis results. Figure 7 It is a schematic diagram of the interaction between various modules in an analysis system provided by an exemplary embodiment of the present application.

[0211] As can be seen from the above introduction, the analysis system includes a central control module, an analysis module and a policy module. The detection system sends alarm information to the analysis system, and the central control module obtains the alarm information. Then the central control module determines the alarm analysis rules of the cache service according to the alarm information.

[0212] The central control module indicates at least one analysis atom corresponding to the cache service to the analysis module through the alarm analysis rule.

[0213] At least one working thread corresponding to each analysis atom is created in the analysis module, performance data of the corresponding atomic angle is obtained from the cache service through at least one analysis atom, the performance data is analyzed through the analysis atom, and an atomic result of at least one atomic angle is generated.

[0214] Subsequently, the analysis module determines the root cause of the cache delay anomaly according to the atomic result determined by the at least one analysis atom, and generates an analysis result of the cache delay anomaly using the root cause and the atomic result determined by the at least one analysis atom. Optionally, the analysis result includes the root cause, attribute information of the cache delay anomaly, and at least one atomic result.

[0215] The analysis module sends the analysis result to the strategy module. Optionally, the strategy module renders the root cause, the attribute information of the cache delay anomaly, and at least one atomic result respectively to obtain the first part result, the second part result, and the third part result in the analysis atom. The strategy module sends the rendered analysis result to the operation and maintenance terminal.

[0216] Optionally, after receiving the analysis results through the operation and maintenance terminal, the operation and maintenance personnel determine recovery measures with reference to the analysis results. The operation and maintenance terminal sends the recovery measures to the policy module, and the policy module forwards the recovery measures to the analysis module. The analysis module forwards the forwarded recovery measures to the cache service, and the cache service executes the recovery measures to alleviate or resolve the cache delay anomaly.

[0217] The types of analyzed atoms are introduced and explained below through several embodiments.

[0218] In some embodiments, analysis atoms include at least one of the following: transmission analysis atoms, computational analysis atoms, scheduling analysis atoms, memory analysis atoms and cache analysis atoms; transmission analysis atoms are used to analyze cache delay anomalies from the atomic perspective of network transmission; computational analysis atoms are used to analyze cache delay anomalies from the atomic perspective of the number of working threads in the cache service; scheduling analysis atoms are used to analyze cache delay anomalies from the atomic perspective of the traffic carried by the cache service; memory analysis atoms are used to analyze cache delay anomalies from the atomic perspective of storage space; cache analysis atoms are used to analyze cache delay anomalies from the atomic perspective of storage performance.

[0219] Optionally, the transmission analysis atom is used to analyze the cache delay from the perspective of data transmission. The transmission analysis atom is related to the network transmission situation during data transmission. The transmission analysis factor can be called a network analysis factor. Exemplarily, the atomic angles used by the transmission analysis atom to analyze include at least one of the following: cluster splitting and intranet packet loss.

[0220] Among them, cluster fragmentation refers to the interruption of the communication connection between a cache service and other cache services, resulting in the inability to share the data cached by the two cache services; intranet packet loss refers to the loss of data packets in the same computer room, which triggers the retry logic, resulting in the inability to transmit the data packets to the service object in time, that is, the need for retry after intranet packet loss will cause the cache delay to increase. Performance data related to cluster fragmentation include: whether the data transmission path between cache services is disconnected. Performance data related to intranet packet loss include intranet packet loss rate (equal to the ratio between the total number of data packets sent and the total number of data packets lost).

[0221] Optionally, the calculation analysis atom analyzes the cache delay anomaly from the perspective of the calculation pressure of the cache service. Exemplarily, the calculation analysis atom is used to analyze the atomic perspective including: the number of worker threads, and the performance data related to the number of worker threads is the number of worker threads established in the cache service.

[0222] Optionally, the scheduling analysis atom is used to analyze cache delay anomalies from the perspective of service traffic scheduling, and the atomic perspectives used by the scheduling analysis atom for analysis include scheduling overrun. Performance data related to scheduling overrun include: cache service capacity and cache service traffic.

[0223] Optionally, the memory analysis atom is used to analyze cache delay anomalies from the perspective of the memory margin of the cache service. The memory analysis atom includes the core binding judgment perspective. Core binding can be understood as fixing a thread to run on a specific core in the central processor. The more threads that are bound to the core, the greater the memory space occupied, which is likely to cause the device running the cache service to freeze. The performance data related to the core binding judgment includes the device's page cache ratio (Pagecache Ratio) and page cache capacity (Pagecache Size).

[0224] Optionally, cache analysis atoms are used to analyze cache delay anomalies from the perspective of storage performance. Cache analysis atoms are used to analyze at least one of the following atomic perspectives: CPU data, traffic balancing, hot files, number of hard disks (SATA), and single disk performance. Among them, CPU data is used to characterize the load of the CPU, and traffic balancing is used to analyze whether there is an unbalanced load on the equipment in the computer room due to an error in the hash rule; wherein, the hash rule refers to a set of rules defined in the hash function for mapping input data to a hash value. The hash rule is used to determine how to calculate the hash value and how to handle conflicts.

[0225] In some embodiments, the analysis atoms also include read-write analysis atoms, which are used to analyze cache delay anomalies from the atomic perspective of data read and write speeds.

[0226] By setting up independent analysis atoms, each analysis atom can be executed concurrently, which helps to analyze the speed of determining the analysis results and ensure the timeliness of the analysis results.

[0227] In some embodiments, different analysis atoms have priorities; among them, different analysis atoms are ranked from high to low in priority: transmission analysis atoms, computing analysis atoms, scheduling analysis atoms, memory analysis atoms, cache analysis atoms and read-write analysis atoms.

[0228] As can be seen from the above, when determining that the abnormal analysis atom is an atomic result with an associated existence, the analysis system determines the root cause of the cache delay anomaly based on the priority of the analysis atom, that is, the analysis system selects the analysis atom with the highest priority from at least one abnormal analysis atom; the analysis system uses the atomic angle corresponding to the abnormal analysis atom as the root cause of the cache delay anomaly. In the embodiment provided in the present application, the transmission analysis atom has the highest priority, that is, the cluster split and intranet packet loss included in the transmission analysis atom are the most common reasons for triggering alarm information. If the atomic result of cluster split or intranet packet loss is associated, the cluster split or intranet packet loss can be directly used as the root cause.

[0229] By setting priorities between analysis atoms, when there are multiple abnormal analysis atoms, it is helpful to quickly determine the root cause based on the priority, which helps to simplify the logic of determining the root cause and improve the speed of determining the root cause.

[0230] The following describes a process of determining the analysis result by the analysis module through an embodiment.

[0231] Figure 8 : is a schematic diagram of a method for determining an analysis result provided by an exemplary embodiment of the present application. In this embodiment, the abnormal alarm information is device alarm information, that is, the device mentioned here corresponds to the cache service in the above embodiment. This embodiment mainly includes the following steps:

[0232] Step A10: The central control module sends the device alarm information to the analysis module. Optionally, the central control module also sends at least one analysis atom determined in the device alarm analysis rule to the analysis module.

[0233] The at least one analysis atom corresponding to the device includes: transmission analysis atoms, computing analysis atoms, scheduling analysis atoms, memory analysis atoms and cache analysis atoms; wherein, the atomic angles used for analysis of the transmission analysis atom include: cluster fragmentation and intranet packet loss, the atomic angles used for analysis of the computing analysis atom include the number of working threads, the atomic angles used for analysis of the scheduling analysis atom include scheduling overrun, the atomic angles used for analysis of the memory analysis atom include: core binding judgment, and the atomic angles used for analysis of the cache analysis atom include: central processing unit data and hot files.

[0234] Step A20, for any first analysis atom among the at least one analysis atom mentioned above, the analysis module sends a data call request to the cache service through the first analysis atom, and the data call request is used to call the performance data of the first atomic angle during the operation of the cache service. The first atomic angle is the atomic angle used for analysis by the first analysis atom.

[0235] For example, the memory analysis atom is used to analyze the correlation between the core binding judgment and the cache delay exception. The memory analysis atom obtains the device's page cache ratio and the device's page cache capacity through the data call request.

[0236] It should be noted that, for analysis atoms used to analyze multiple atomic angles, the analysis module can establish multiple work threads related to the analysis atom, and different work threads are used to analyze different analysis atoms. In this way, the multiple atomic angles corresponding to the analysis atom can be analyzed in parallel. For example, for the transmission analysis atom, the transmission analysis atom needs to analyze the cache delay anomaly from two atomic angles: cluster split and intranet packet loss. The analysis module then establishes two work threads for the transmission analysis atom. The first work thread is used to analyze the cache delay anomaly from the atomic angle of cluster split, and the second work thread is used to analyze the cache delay anomaly from the atomic angle of intranet packet loss.

[0237] Step A30, after receiving the performance data of the first atomic angle sent by the cache service, the analysis module determines the atomic result of the first atomic angle according to the performance data of the first atomic angle through the first analysis atom, and the atomic result is used to characterize the correlation between the first atomic angle and the cache delay anomaly.

[0238] For example, for the memory analysis atom, the memory analysis atom determines the atomic result of the core binding judgment by comparing whether the page cache ratio exceeds the third threshold.

[0239] Step A40: The analysis module determines the root cause of the cache delay exception based on the atomic results determined by at least one analysis atom.

[0240] Optionally, if the analysis atoms determined by the above five analysis atoms include multiple atomic results belonging to abnormalities, the analysis module uses the abnormal analysis atom with the highest priority for the atomic angle of analysis as the root cause according to the priority of the abnormal analysis atom. If the abnormal analysis atom with the highest priority is used to analyze the cache delay abnormality from at least two atomic angles, the analysis module selects the atomic angle with the atomic results associated from the above at least two atomic angles as the root cause.

[0241] For example, in this embodiment, the atomic angles used for analysis by the cache analysis atom include: CPU data and hotspot files. If the cache analysis atom has the highest priority among the abnormal analysis atoms, the policy module selects an atomic angle from the two atomic angles of CPU data and hotspot files as the root cause. If the atomic result of the CPU data atomic angle is that there is a correlation, and the atomic result of the hotspot file atomic angle is that there is no correlation, the CPU data is taken as the root cause of the cache delay abnormality.

[0242] In step A50, the analysis module generates an analysis result according to the root cause and the atomic result of at least one atomic angle.

[0243] Optionally, the generated analysis result includes two result parts, namely, the first part of the result and the second part of the result; the analysis module uses the root cause as the first part of the result, and uses the atomic result of at least one atomic angle as the second part of the result. Exemplarily, the analysis module sends the analysis results determined by the root cause and at least one analysis atom to the strategy module, and the strategy module renders based on the root cause to obtain the first part of the result, and renders based on the analysis results determined by at least one analysis atom to obtain the second part of the result.

[0244] Optionally, the analysis result also includes a third part of the results, wherein the analysis module determines the attribute information of the cache delay anomaly according to the alarm information, and sends the attribute information to the policy module, and the policy module performs rendering processing based on the attribute information to generate the third part of the results.

[0245] In some embodiments, the analysis result is composed of a first part result, a second part result and a third part result. Optionally, after generating the above three partial results, the policy module sends the above three partial results to the operation and maintenance terminal synchronously. Optionally, the policy module sends the above three parts to the operation and maintenance terminal separately.

[0246] Step A60, the analysis module obtains the flow information of the cache service from the cache service; obtains the capacity information of the cache service from the cache service; and the analysis module generates an application decision of the cache service according to the flow information and the capacity information.

[0247] Optionally, the analysis module obtains traffic information from the cache service through scheduling analysis atoms; and obtains capacity information from the cache service through cache analysis atoms.

[0248] Exemplarily, based on the traffic information and capacity information, an application decision for the cache service is generated, including: if the traffic information is greater than or equal to the product of the capacity information and a first ratio, the application decision is to deactivate the cache service; if the traffic information is less than the product of the capacity information and the first ratio, the application decision is to continue using the cache service; wherein the first ratio is a decimal in the range of 0 to 1.

[0249] It should be noted that the execution order of step A30 and step A60 can be swapped, or step A30 and step A60 can be executed in parallel. In one example, in the process of the scheduling analysis atom analyzing the scheduling overrun, the performance data of the scheduling overrun includes traffic information, and in the process of the cache analysis atom analyzing the load balancing angle, the performance data of the load balancing includes capacity information. Therefore, step A30 and step A60 can be performed simultaneously. However, in this embodiment, the atomic angle used for analysis by the cache analysis atom does not include load balancing, so the cache analysis atom needs to additionally determine the capacity information, so step A30 can occur before step A60. Of course, step A30 can also occur after step A60.

[0250] Step A70: the analysis module indicates the usage status of the cache service through application decision.

[0251] Optionally, in this step, the analysis module sends the application decision to the management device, and the management device controls the operation of the cache service where the cache delay exception occurs according to the application decision.

[0252] Step A80, the analysis results include a fourth part of results, which are used to characterize the usage status of the cache service after the cache delay exception occurs; the analysis module renders based on the application decision to obtain the fourth part of the analysis results.

[0253] Optionally, the analysis module sends the application decision to the policy module, and the policy module performs rendering based on the application decision to obtain the fourth part of results.

[0254] Exemplarily, the strategy module combines the first part result, the second part result, the third part result and the fourth part result to obtain a complete analysis result, and sends the analysis result to the operation and maintenance terminal at one time.

[0255] Exemplarily, the policy module combines the first part of the results, the second part of the results, and the third part of the results to obtain a first analysis result, uses the fourth part of the results as a second analysis result, and sends the first analysis result and the second analysis result respectively.

[0256] Step A90: The analysis module determines a target operation and maintenance terminal from at least one type of operation and maintenance terminals according to the root cause; and sends the analysis result to the target operation and maintenance terminal.

[0257] Optionally, at least one operation and maintenance terminal includes: a first operation and maintenance terminal and a second operation and maintenance terminal. If the root cause is scheduling overrun, the second operation and maintenance terminal is determined as the target terminal; if the root cause is other atomic angles except scheduling overrun, the first operation and maintenance terminal is determined as the target operation and maintenance terminal.

[0258] In one example, the analysis module indicates the target operation and maintenance terminal to the policy module, for example, the analysis module sends the identification information of the target operation and maintenance terminal to the policy module; wherein the identification information of the target operation and maintenance terminal includes but is not limited to at least one of the following: the name, number, IP address, etc. of the target operation and maintenance terminal. The policy module then sends the analysis result to the target operation and maintenance terminal.

[0259] Exemplarily, the policy module sends the first part of the result, the second part of the result, and the third part of the result to the detection system, and the detection system forwards the first part of the result, the second part of the result, and the third part of the result to the target operation and maintenance terminal. For example, after receiving the analysis result, the detection system generates an alarm notification according to the alarm information and the analysis result, and sends the alarm notification to the target operation and maintenance terminal.

[0260] Optionally, the policy module sends the fourth part of results to the first operation and maintenance terminal and the second operation and maintenance terminal through a contact group established between the policy module and the first operation and maintenance terminal.

[0261] The following describes a method for obtaining alarm information through several embodiments.

[0262] Fig. 9 is a schematic diagram of a method for determining an analysis result provided by another exemplary embodiment of the present application. In this embodiment, the abnormal alarm information is the alarm information of the computer room, that is, the computer room has a cache delay abnormality. The computer room mentioned here corresponds to the cache service in the above embodiment. This embodiment mainly includes the following steps:

[0263] Step B10: The central control module sends the device alarm information to the analysis module. Optionally, the central control module also sends at least one analysis atom determined in the device alarm analysis rule to the analysis module.

[0264] The at least one analysis atom corresponding to the computer room includes: transmission analysis atoms, computing analysis atoms, scheduling analysis atoms and cache analysis atoms; among them, the atomic angles used for analysis of the transmission analysis atom include: cluster fragmentation and intranet packet loss, the atomic angles used for analysis of the computing analysis atom include the number of working threads, the atomic angles used for analysis of the scheduling analysis atom include scheduling overrun, and the atomic angles used for analysis of the cache analysis atom include: load balancing.

[0265] Step B20, for any first analysis atom among the at least one analysis atom mentioned above, the analysis module sends a data call request to the cache service through the first analysis atom, and the data call request is used to call the performance data of the first atomic angle during the operation of the cache service. The first atomic angle is the atomic angle used for analysis by the first analysis atom.

[0266] Step B30, after receiving the performance data of the first atomic angle sent by the cache service, the analysis module determines the atomic result of the first atomic angle according to the performance data of the first atomic angle through the first analysis atom, and the atomic result is used to characterize the correlation between the first atomic angle and the cache delay anomaly.

[0267] Optionally, for a computer room, the performance data at the first atomic angle includes the performance data at the first atomic angle of each device in the computer room. Exemplarily, if the performance data at the first atomic angle of devices greater than or equal to the second proportion in the computer room is abnormal, the atomic result at the first atomic angle is determined to be associated with the cache delay abnormality; if the performance data at the first atomic angle of devices less than the second proportion in the computer room is abnormal, the atomic result at the first atomic angle is determined to be unrelated to the cache delay abnormality.

[0268] Step B40: The analysis module determines the root cause of the cache delay exception based on the atomic results determined by at least one analysis atom.

[0269] Step B50: the analysis module generates an analysis result according to the root cause and the atomic result of at least one atomic angle.

[0270] Step B60, the analysis module obtains the flow information of the cache service from the cache service; obtains the capacity information of the cache service from the cache service; and the analysis module generates an application decision for the cache service based on the flow information and the capacity information.

[0271] Step B70: The analysis module indicates the usage status of the cache service through application decision.

[0272] Optionally, in this step, the analysis module sends the application decision to the management device, and the management device controls the operation of the cache service where the cache delay exception occurs according to the application decision.

[0273] Step B80, the analysis results include a fourth part of results, which are used to characterize the usage status of the cache service after the cache delay exception occurs; the analysis module renders based on the application decision to obtain the fourth part of the analysis results.

[0274] Step B90: The analysis module determines a target operation and maintenance terminal from at least one type of operation and maintenance terminals according to the root cause; and sends the analysis result to the target operation and maintenance terminal.

[0275] For details not described in this embodiment, please refer to the above embodiments and will not be described in detail here.

[0276] By matching the alarm analysis rules for the cache service, on the one hand, when the cache triggers a cache delay exception, the analysis system will call each analysis atom to automatically generate analysis results, which will help provide reference information for operation and maintenance personnel and assist them in finding solutions to cache delay exceptions more quickly. On the other hand, the analysis process of each analysis atom is independent, which helps to shorten the waiting time for generating analysis results, speed up the speed at which operation and maintenance personnel solve exceptions, and help reduce the risks of the existing network and the possibility of failures.

[0277] Unifying and empirically analyzing the analysis process for generating analysis results will help promote the alarm analysis method to different scenarios, help improve the universality of alarm analysis, and improve the efficiency of operation and maintenance. Moreover, the alarm analysis method provided by this application helps reduce the learning cost of operation and maintenance personnel to solve cache delay anomalies.

[0278] The following describes a method for obtaining alarm information through several embodiments.

[0279] In some embodiments, step 410, obtaining an alarm for prompting a cache service that a cache delay exception occurs, may include the following sub-steps:

[0280] In sub-step 412, the analysis system obtains the alarm information sent by the detection system to the first operation and maintenance terminal; the detection system is used to detect abnormal conditions of cache delay of the cache service, and the first operation and maintenance terminal is used to maintain the cache service; after the alarm information is intercepted, the detection system suspends sending the alarm information to the first operation and maintenance terminal.

[0281] The first operation and maintenance terminal refers to a terminal used by operation and maintenance personnel for maintaining the cache service. Optionally, the central control module in the analysis system obtains the alarm information by intercepting the alarm information sent by the detection system to the first operation and maintenance terminal.

[0282] Exemplarily, the alarm information has an emergency level, which includes the first level, the second level and the third level, among which the first level has the lowest urgency and the third level has the highest urgency. After the central control module intercepts the alarm information, the central control module lowers the emergency level of the alarm information, so that the detection system stops sending the alarm information to the first operation and maintenance terminal.

[0283] After the analysis system determines the analysis result of the cache delay anomaly, the analysis system can synchronously send the analysis result and the alarm information to the operation and maintenance terminal.

[0284] By analyzing the alarm information first in this way, it is helpful to avoid the first operation and maintenance terminal frequently receiving alarm information due to the high emergency level of the alarm information device caused by the detection system, and it is helpful to reduce the interference of the alarm information to the first operation and maintenance personnel.

[0285] The following describes the method for sending the analysis results through several embodiments.

[0286] In some embodiments, the analysis result of the cache delay anomaly includes a first result part, and the first result part is used to characterize the root cause of the cache delay anomaly; step 440 may include the following sub-steps (not shown in the drawings of the specification):

[0287] In sub-step 442, the analysis system determines a target operation and maintenance terminal from at least one type of operation and maintenance terminal according to the root cause, and the target operation and maintenance terminal has the ability to handle the root cause.

[0288] In sub-step 444, the analysis system sends the analysis results to the target operation and maintenance terminal.

[0289] In some embodiments, at least one type of operation and maintenance terminal is a terminal used by operation and maintenance personnel related to the cache service. Optionally, at least one type of operation and maintenance terminal includes at least one of the following: a first operation and maintenance terminal and a second operation and maintenance terminal. The first operation and maintenance terminal refers to a terminal device used by the operation and maintenance personnel responsible for maintaining the cache service, and the second operation and maintenance terminal refers to a terminal device used by the operation and maintenance personnel responsible for maintaining the business carried in the cache service.

[0290] Optionally, the analysis system selects one of the first operation and maintenance terminal and the second operation and maintenance terminal as a target operation and maintenance terminal. The analysis system sends the analysis result to the target operation and maintenance terminal. Exemplarily, the target operation and maintenance terminal may be the first operation and maintenance terminal, or the target operation and maintenance terminal may be the second operation and maintenance terminal, or the target operation and maintenance terminal may include the first operation and maintenance terminal and the second operation and maintenance terminal.

[0291] Exemplarily, when the root cause is scheduling overrun, the analysis system determines that the target operation and maintenance terminal includes the second operation and maintenance terminal; when the root cause is other atomic angles other than scheduling overrun, the analysis system determines that the target operation and maintenance terminal includes the first operation and maintenance terminal.

[0292] In some embodiments, when the application decision is to stop using the cache service, the process of determining the target operation and maintenance terminal is also related to the application decision of the cache service. Optionally, when the application decision is to stop using the cache service, the analysis system determines that the target operation and maintenance terminal includes the first operation and maintenance terminal, that is, the analysis system sends at least the fourth part of the results to the first operation and maintenance terminal.

[0293] For example, when the root cause of the cache delay exception is scheduling overrun, and the application decision is to stop using the cache service, the target operation and maintenance terminal includes the first operation and maintenance terminal and the second operation and maintenance terminal.

[0294] For another example, when the root cause of the cache delay exception is scheduling overrun, and the application decides to continue using the cache service, the target operation and maintenance terminal includes the second operation and maintenance terminal.

[0295] For another example, when the root cause of the cache delay exception is other reasons besides scheduling overrun, the target operation and maintenance terminal includes the first operation and maintenance terminal.

[0296] Since different operation and maintenance personnel have different permissions, sending analysis results to an operation and maintenance terminal that can handle the root cause of the cache delay anomaly helps reduce the interference of the analysis results on other operation and maintenance terminals.

[0297] In some embodiments, sub-step 444, the analysis system sends the analysis results to the target operation and maintenance terminal, including: sending the analysis results to the detection system, the detection system is used to detect abnormal conditions of cache delays of the cache service, so that after receiving the analysis results, the detection system generates an alarm notification based on the alarm information and the analysis results, and sends the alarm notification to the target operation and maintenance terminal.

[0298] In some embodiments, the alarm notification is displayed in the target operation and maintenance terminal through a first notification interface and a second notification interface. The first notification interface is used to display alarm information, and the second notification interface is used to display analysis results. The first notification interface displays a display control for triggering display of the second notification interface.

[0299] Fig.10 It is a schematic diagram of a first notification interface provided by an exemplary embodiment of the present application.

[0300] like Fig.10 The first notification interface 1000 shown in the figure includes warning information and a display control 1010. The analysis result can be displayed by triggering the display control 1010.

[0301] Fig.11 It is a schematic diagram of the analysis results provided by an exemplary embodiment of the present application.

[0302] On trigger Fig.10 After the display control 1010 in the target operation and maintenance terminal is displayed, the second notification interface 1100 includes the analysis results. In this embodiment, the analysis results include the first part of the results 1100, the second part of the results 1120 and the third part of the results 1130.

[0303] Fig.12 1200 is a schematic diagram of the fourth part of the results provided by an exemplary embodiment of the present application. The display effect of the fourth part of the results 1200 is as follows: Fig.12 shown.

[0304] In some embodiments, the alarm analysis method further includes: the analysis system generates alarm data based on the analysis results of at least one cache delay alarm occurring in the cache service within the first time period, and the alarm data is used to record the cache delay anomalies occurring in the cache service within the first time period.

[0305] In some embodiments, the first time period is a period for counting alarm information. For example, the first time period is one day, one week, etc. The first operation and maintenance terminal is used to maintain the cache service; after the alarm information is intercepted, the detection system stops sending the alarm information to the first operation and maintenance terminal.

[0306] In some embodiments, the alarm data includes at least one of the following: alarm count statistics, root cause statistics, and cache service deactivation count statistics, wherein the alarm count statistics refer to the number of times the cache delay anomaly occurs within the first time period, the root cause statistics are used to characterize the root cause of the cache delay anomaly within the first time period, and the cache service deactivation count statistics are used to characterize the number of times the cache service is deactivated due to the cache delay anomaly within the first time period. Optionally, in order to improve the intuitiveness of the alarm data, the alarm data includes at least one of the following: text, numbers, and charts. The root cause distribution can better refine the current analysis logic and conduct inspections and repairs on the current equipment in the existing network.

[0307] Fig.13 It is a schematic diagram of alarm number statistics provided by an exemplary embodiment of the present application.

[0308] Fig.13 It is shown that the alarm count statistics include equipment alarm count statistics and computer room alarm count statistics.

[0309] Fig.14 It is a schematic diagram of root cause statistics provided by an exemplary embodiment of the present application.

[0310] Fig.14 The root cause statistics shown in FIG. 1 include equipment root cause statistics and computer room root cause statistics.

[0311] Fig.15 It is a schematic diagram of the deactivation count provided by an exemplary embodiment of the present application.

[0312] Fig.15 It is a schematic diagram of an alarm analysis method provided by an exemplary embodiment of the present application.

[0313] In one example, the analysis system generates alarm data based on the alarm information, the analysis results corresponding to the alarm information, and the application decision within the first time period. Optionally, the analysis system sends the alarm data to the first operation and maintenance terminal.

[0314] Fig.16This is a schematic diagram of an alarm analysis process provided by an exemplary embodiment of the present application. Fig.16 The alarm analysis method is introduced and explained through an embodiment:

[0315] Step C10: Obtain the alarm information sent by the detection system to the first operation and maintenance terminal.

[0316] This step corresponds to Fig.16 The alarm information includes at least one of the following: abnormal time period (i.e., the second time period in the above embodiment), identification information, and cache delay. Exemplarily, if the detection system detects that the cache delay of a cache service is greater than 200ms, the detection system generates an alarm message for the cache service. After the alarm message is intercepted, the detection system stops sending the alarm message to the first operation and maintenance terminal.

[0317] Step C20: Determine an alarm analysis rule for the cache service according to the alarm information.

[0318] This step corresponds to Fig.16 Optionally, steps C10 and C20 are performed by a central control module in the analysis system. Step C20 can be implemented in at least two ways, for details, please refer to sub-step 420-a and sub-step 420-b.

[0319] After determining the alarm analysis rules of the cache service, the central control module alerts the analysis module of at least one analysis atom included in the alarm analysis rules, and the analysis module implements the logical operations in the analysis atom through the analysis interface or analysis script corresponding to the at least one analysis atom.

[0320] Step C30: For a first analysis atom in the at least one analysis atom, a data call request is sent to a cache service through the first analysis atom.

[0321] This step corresponds to Fig.16 The first analysis atom is any one of the at least one analysis atom. Since each analysis atom is independent of each other, the analysis system can execute multiple analysis atoms in parallel. Here, only the first analysis atom is taken as an example to introduce the working process of the analysis atom.

[0322] Optionally, the analysis module generates a data call request, sends the data call request to the first analysis atom, and sends the data call request to the corresponding cache service through the first analysis atom.

[0323] Step C40: The first analysis atom obtains the performance data of the first atom angle sent by the cache service.

[0324] This step corresponds to Fig.16 The “4, 5” in the figure.

[0325] Step C50, after receiving the performance data of the first atomic angle sent by the cache service, determine the atomic result of the first atomic angle according to the performance data of the first atomic angle through the first analysis atom.

[0326] This step corresponds to Fig.16 "6" in the figure. Optionally, the working time of the first analysis atom can also be controlled during the execution of step C50. Exemplarily, the analysis system records the working time of the first analysis atom; determines the limited time of the first analysis atom; when the working time of the first analysis atom is greater than or equal to the limited time of the first analysis atom, controls the first analysis atom to stop determining the atomic result of the first atomic angle; in the process of generating the analysis result with the cache delay exception, does not use the atomic result determined by the first analysis atom. This method helps to avoid consuming a long time waiting for the analysis atom to determine the analysis result.

[0327] Step C60: generating an analysis result of the cache delay anomaly according to the atomic results respectively determined by at least one analysis atom.

[0328] Optionally, after the analysis atom obtains the analysis result determined by at least one analysis atom respectively, the root cause is determined, and the analysis result is generated according to the root cause and the analysis result determined by at least one analysis atom respectively. For the specific content of this step, please refer to the above embodiment.

[0329] Generating alarm data through the above method helps operation and maintenance personnel to better discover risks in the cache service.

[0330] Step C70: the analysis module obtains the flow information and capacity information of the cache service, generates an application decision for the cache service based on the flow information and capacity information, and indicates the usage status of the cache service through the application decision. Fig.16 The “7-10” in the video is shown in the figure.

[0331] Step C80, sending the analysis result to the alarm data generation module, the alarm data generation module generates alarm data according to the analysis result of at least one cache delay alarm occurring in the cache service in the first time period, the alarm data is used to record the cache delay anomaly occurring in the cache service in the first time period.

[0332] Steps corresponding Fig.16 After the alarm data is generated, the analysis system sends the alarm data to the operation and maintenance terminal.

[0333] Step C90: The analysis module sends the analysis results to the strategy module, and the strategy module generates a visible analysis result. Fig.16 The “12” in the picture.

[0334] The present application provides two methods of sending analysis results to the operation and maintenance terminal, namely step C100-a and step C100-b; wherein:

[0335] Step C100-a, the policy module sends the analysis result to the detection system. The detection system generates an alarm notification based on the alarm information and the analysis result, and sends the alarm notification to the target operation and maintenance terminal.

[0336] This step corresponds to Fig.16 In "14, 15", the target operation and maintenance is selected from the first operation and maintenance terminal and the second operation and maintenance terminal according to the root cause.

[0337] Step C100-b: The policy module sends the analysis results to the target operation and maintenance terminal. Fig.16 In an exemplary embodiment, the policy module sends the analysis result to the target operation and maintenance terminal through the notification group.

[0338] Fig.17 A block diagram of an alarm analysis device provided by an exemplary embodiment of the present application is shown. The device can be implemented as all or part of an analysis system through software, hardware, or a combination of both. The device 1700 may include: an information acquisition module 1710, an atom determination module 1720, a result generation module 1730, and a result sending module 1740.

[0339] The information acquisition module 1710 is used to acquire alarm information for prompting the cache service of cache delay anomaly, where the cache delay is used to represent the speed at which the cache service responds to the service object.

[0340] The atomic determination module 1720 is used to determine the alarm analysis rule of the cache service based on the alarm information, and the alarm analysis rule is used to indicate at least one analysis atom corresponding to the cache service. The analysis atom is used to analyze the cache delay exception from an atomic perspective, and the atom is an independent factor that has the ability to cause the cache delay exception.

[0341] The result generation module 1730 is used to generate an analysis result of the cache delay exception according to the at least one analysis atom, wherein the analysis result is used to characterize the analyzed cause of the cache delay exception.

[0342] The result sending module 1740 is used to send the analysis result to the operation and maintenance terminal used to process the cache delay exception.

[0343] In some embodiments, the atomic determination module 1720 is used to determine the identification information of the cache service based on the alarm information; based on the identification information, determine the alarm analysis rule preconfigured for the cache service as the alarm analysis rule of the cache service from at least one candidate alarm analysis rule, or, the atomic determination module 1720 is used to determine the identification information of the cache service based on the alarm information; based on the identification information, determine multiple alarm analysis rules that match the cache service; from the multiple alarm analysis rules, determine the alarm analysis rule with a usage frequency greater than a threshold as the alarm analysis rule of the cache service; wherein, the identification information includes at least one of the following: an identity identifier and a category identifier.

[0344] In some embodiments, the result generation module 1730 includes: a data request unit, which is used to send a data call request to the cache service through the first analysis atom for a first analysis atom in the at least one analysis atom, and the data call request is used to call the performance data of the first atomic angle during the operation of the cache service, and the first atomic angle is the atomic angle used for analysis by the first analysis atom; a result analysis unit, which is used to determine the atomic result of the first atomic angle through the first analysis atom according to the performance data of the first atomic angle after receiving the performance data of the first atomic angle sent by the cache service, and the atomic result is used to characterize the correlation between the first atomic angle and the cache delay anomaly; a result generation unit, which is used to generate the analysis result of the cache delay anomaly according to the atomic results respectively determined by the at least one analysis atom.

[0345] In some embodiments, the device 1700 also includes: a duration recording module, used to record the working duration of the first analysis atom; a duration limitation module, used to determine the limited duration of the first analysis atom, the limited duration of the first analysis atom refers to the upper limit of the time consumed by the first analysis atom to determine the analysis result; a stop execution module, used to control the first analysis atom to stop determining the atomic result of the first atomic angle when the working duration of the first analysis atom is greater than or equal to the limited duration of the first analysis atom; in the process of generating the analysis result of the cache delay exception, the atomic result determined by the first analysis atom is not used.

[0346] In some embodiments, the duration limitation module is used to count the obtained analysis results determined by at least one second analysis atom before reaching a first limited duration, where the second analysis atom is different from the first analysis atom, and the first limited duration refers to the limited duration of a target analysis atom in the at least one second analysis atom; if the obtained analysis results meet a waiting condition, the first limited duration is updated to obtain an updated first limited duration, and the waiting condition is related to at least one of the following: the priority of the second analysis atom, the number of the obtained atomic results; the updated limited duration is determined as the limited duration of the first analysis atom.

[0347] In some embodiments, the result generation unit includes: a root cause determination subunit, used to determine the root cause of the cache delay exception from the atomic results determined by the at least one analysis atom, wherein the root cause refers to the atomic angle resulting in the cache delay exception obtained through analysis; and a result generation subunit, used to generate an analysis result of the cache delay exception based on the root cause and the atomic results determined by the at least one analysis atom.

[0348] In some embodiments, the atomic results include: existence association and no association, the existence association is used to characterize that the atomic angle used by the analysis atom for analysis is associated with the cache delay exception, and the no association is used to characterize that the atomic angle used by the analysis atom for analysis is irrelevant to the cache delay exception; the root cause determination subunit is used to determine the analysis atom belonging to the existence association as the abnormal analysis atom; if there is one abnormal analysis atom, the atomic angle used by the abnormal analysis atom for analysis is determined as the root cause; if there are multiple abnormal analysis atoms, an abnormal analysis atom is selected from the multiple abnormal analysis atoms according to the priority of the analysis atoms, and the atomic angle used by the selected abnormal analysis atom for analysis is determined as the root cause.

[0349] In some embodiments, the analysis results include a first part of the results and a second part of the results; the first part of the results is used to characterize the root cause, and the second part of the results is used to characterize the correlation between the atomic angle corresponding to each of the at least one analysis atom and the cache delay exception; the result generation subunit is used to: perform rendering processing based on the root cause to generate the first part of the results; perform rendering processing based on the atomic results corresponding to the at least one atomic angle to generate the second part of the results; the device 1700 also includes: an attribute result generation module, which is used to determine the attribute information of the cache delay exception according to the alarm information, and the attribute information is used to describe the cache delay exception; perform rendering processing based on the attribute information to generate a third part of the results included in the analysis results, and the third part of the results is used to locate the cache delay exception.

[0350] In some embodiments, the device 1700 also includes: a state strategy module, used to obtain traffic information of the cache service from the cache service, the traffic information is used to characterize the pressure of data transmission between the cache service and the service object; obtain capacity information of the cache service from the cache service, the capacity information is used to characterize the ability of the cache service to carry the service object; generate an application decision of the cache service based on the traffic information and the capacity information, the application decision is used to indicate the usage status of the cache service after the cache delay exception occurs; indicate the usage status of the cache service through the application decision; the result generation module 1730 is also used to render based on the application decision to obtain a fourth part of the analysis result, and the fourth part of the result is used to characterize the usage status of the cache service after the cache delay exception occurs.

[0351] In some embodiments, the analysis result of the cache delay anomaly includes a first result part, which is used to characterize the root cause of the cache delay anomaly; the result sending module 1740 includes: a terminal determination unit, used to determine the target operation and maintenance terminal from at least one type of operation and maintenance terminal according to the root cause, and a result sending unit, used to ensure that the target operation and maintenance terminal has the ability to handle the root cause; and sending the analysis result to the target operation and maintenance terminal.

[0352] In some embodiments, the result sending unit is used to send the analysis result to a detection system, and the detection system is used to detect abnormal conditions of cache delay of the cache service, so that after receiving the analysis result, the detection system generates an alarm notification based on the alarm information and the analysis result, and sends the alarm notification to the target operation and maintenance terminal.

[0353] In some embodiments, the device 1700 also includes: a data generation module, used to generate alarm data based on the analysis results of at least one cache delay alarm occurring in the cache service within the first time period, and the alarm data is used to record the cache delay anomalies occurring in the cache service within the first time period.

[0354] It should be noted that the device provided in the above embodiment, when realizing its function, only uses the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the content structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device provided in the above embodiment belongs to the same concept as the method embodiment. The specific implementation process is detailed in the method embodiment, which will not be repeated here. Please refer to the description of the method side embodiment for the beneficial effects of the device provided in the above embodiment, which will not be repeated here.

[0355] Fig.18 The structure block diagram of a computer device provided by an exemplary embodiment of the present application is shown. The alarm analysis device 1800 can be any device in the analysis system introduced above.

[0356] Typically, the computer device 1800 includes a processor 1801 and a memory 1802 .

[0357] The processor 1801 may include one or more processing cores, such as a 4-core processor, an 18-core processor, and the like. The processor 1801 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1801 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1801 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1801 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0358] The memory 1802 may include one or more computer-readable storage media, which may be tangible and non-transitory. The memory 1802 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices, flash memory storage devices.

[0359] In some embodiments, the non-transitory computer-readable storage medium in the memory 1802 stores at least one program, which is loaded and executed by the processor 1801 to implement the alarm analysis method provided by the above-mentioned method embodiments.

[0360] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the alarm analysis method provided by the above-mentioned method embodiments.

[0361] The computer-readable medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other solid-state storage technology, CD-ROM, DVD (Digital Video Disc) or other optical storage, cassettes, magnetic tapes, disk storage or other magnetic storage devices. Of course, those skilled in the art will know that the computer storage medium is not limited to the above-mentioned ones.

[0362] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor reads and executes the computer program from the computer-readable storage medium to implement the alarm analysis method provided in the above-mentioned method embodiments.

[0363] It should be understood that the "plurality" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0364] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent switching, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An alarm analysis method, characterized in that: The method comprises: Acquire alarm information for prompting a cache service of cache delay anomaly, where the cache delay is used to characterize the speed at which the cache service responds to a service object; Determine, according to the alarm information, an alarm analysis rule for the cache service, wherein the alarm analysis rule is used to indicate at least one analysis atom corresponding to the cache service, wherein the analysis atom is used to analyze the cache delay anomaly from an atomic perspective, and the atom is an independent factor capable of causing the cache delay anomaly; generating, according to the at least one analysis atom, an analysis result of the cache delay anomaly, wherein the analysis result is used to characterize a cause of the cache delay anomaly obtained through analysis; The analysis result is sent to an operation and maintenance terminal for processing the cache delay exception.

2. The method according to claim 1, characterized in that The step of determining an alarm analysis rule for the cache service according to the alarm information includes: Determining identification information of the cache service according to the alarm information; According to the identification information, determine, from at least one candidate alarm analysis rule, an alarm analysis rule preconfigured for the cache service as an alarm analysis rule for the cache service; or, Determining identification information of the cache service according to the alarm information; Determining, according to the identification information, a plurality of alarm analysis rules matching the cache service; From the multiple alarm analysis rules, determine an alarm analysis rule whose usage frequency is greater than a threshold as the alarm analysis rule for the cache service; The identification information includes at least one of the following: identity identification and category identification.

3. The method according to claim 1, characterized in that The generating, according to the at least one analysis atom, an analysis result of the cache delay anomaly includes: For a first analysis atom in the at least one analysis atom, sending a data call request to the cache service through the first analysis atom, wherein the data call request is used to call performance data of a first atomic angle during the operation of the cache service, and the first atomic angle is an atomic angle used for analysis by the first analysis atom; After receiving the performance data of the first atomic angle sent by the cache service, determining an atomic result of the first atomic angle according to the performance data of the first atomic angle through the first analysis atom, wherein the atomic result is used to characterize the correlation between the first atomic angle and the cache delay anomaly; The analysis result of the cache delay anomaly is generated according to the atomic results respectively determined by the at least one analysis atom.

4. The method according to claim 3, characterized in that The method further comprises: Recording the working time of the first analysis atom; Determine a limited time length of the first analysis atom, where the limited time length of the first analysis atom refers to an upper limit of a time length consumed by the first analysis atom to determine an analysis result; When the working time of the first analysis atom is greater than or equal to the limited time of the first analysis atom, the first analysis atom is controlled to stop determining the atomic result of the first atomic angle; in the process of generating the analysis result of the cache delay exception, the atomic result determined by the first analysis atom is not used.

5. The method according to claim 4, characterized in that The determining of the limited duration of the first analysis atom includes: Counting the obtained analysis results respectively determined by at least one second analysis atom before reaching a first limited time, the second analysis atom is different from the first analysis atom, and the first limited time refers to the limited time of a target analysis atom in the at least one second analysis atom; If the obtained analysis result satisfies the waiting condition, the first limited time is updated to obtain an updated first limited time, and the waiting condition is related to at least one of the following: the priority of the second analysis atom and the number of the obtained atomic results; The updated limited duration is determined as the limited duration of the first analysis atom.

6. The method according to claim 3, characterized in that The step of generating the analysis result of the cache delay anomaly according to the atomic results respectively determined by the at least one analysis atom includes: Determining the root cause of the cache delay anomaly from the atomic results respectively determined by the at least one analysis atom, the root cause being the atomic angle resulting from the analysis that causes the cache delay anomaly; An analysis result of the cache delay exception is generated according to the root cause and the atomic results respectively determined by the at least one analysis atom.

7. The method according to claim 6, characterized in that The atomic results include: existence of correlation and no correlation, wherein the existence of correlation is used to characterize that the atomic angle used by the analysis atom for analysis is correlated with the cache delay anomaly, and the no correlation is used to characterize that the atomic angle used by the analysis atom for analysis is irrelevant to the cache delay anomaly; Determining the root cause of the cache delay exception from the atomic results respectively determined by the at least one analysis atom includes: Determine the determined atomic result as belonging to the associated analysis atom as an abnormal analysis atom; If there is one abnormal analysis atom, determining the atomic angle used for analysis by the abnormal analysis atom as the root cause; If there are multiple abnormal analysis atoms, one abnormal analysis atom is selected from the multiple abnormal analysis atoms according to the priorities of the analysis atoms, and the atomic angle used for analysis by the selected abnormal analysis atom is determined as the root cause.

8. The method according to claim 6, characterized in that The analysis result includes a first part of results and a second part of results; the first part of results is used to characterize the root cause, and the second part of results is used to characterize the correlation between the atomic angle corresponding to each of the at least one analysis atom and the cache delay anomaly; The step of generating the analysis result delay of the cache delay exception according to the root cause and the atomic results respectively determined by the at least one analysis atom includes: Perform rendering processing based on the root cause to generate the first part of results; Perform rendering processing based on the atomic results respectively determined by the at least one analysis atom to generate the second part of results; The method further comprises: Determine attribute information of the cache delay anomaly according to the alarm information, where the attribute information is used to describe the cache delay anomaly; Rendering processing is performed based on the attribute information to generate a third part of the results included in the analysis result, and the third part of the results is used to locate the cache delay exception.

9. The method according to claim 1, characterized in that: The method further comprises: Acquire traffic information of the cache service from the cache service, where the traffic information is used to characterize the pressure of data transmission between the cache service and the service object; Acquire capacity information of the cache service from the cache service, where the capacity information is used to characterize the ability of the cache service to carry the service object; generating an application decision of the cache service according to the flow information and the capacity information, wherein the application decision is used to indicate a usage status of the cache service after the cache delay exception occurs; Indicating the usage status of the cache service through the application decision; Rendering is performed based on the application decision to obtain a fourth part of the results included in the analysis result, and the fourth part of the results is used to characterize the usage status of the cache service after the cache delay exception occurs.

10. The method according to claim 1, characterized in that The analysis result of the cache delay anomaly includes a first result part, and the first result part is used to characterize the root cause of the cache delay anomaly; The sending the analysis result to the operation and maintenance terminal for processing the cache delay exception includes: According to the root cause, determining a target operation and maintenance terminal from at least one type of operation and maintenance terminal, wherein the target operation and maintenance terminal has the ability to handle the root cause; The analysis result is sent to the target operation and maintenance terminal.

11. The method according to claim 10, characterized in that The sending the analysis result to the target operation and maintenance terminal includes: The analysis result is sent to a detection system, where the detection system is used to detect abnormal conditions of cache delay of the cache service, so that after receiving the analysis result, the detection system generates an alarm notification based on the alarm information and the analysis result, and sends the alarm notification to the target operation and maintenance terminal.

12. The method according to claim 1, characterized in that The method further comprises: According to an analysis result of at least one cache delay alarm occurring in the cache service within a first time period, alarm data is generated, where the alarm data is used to record cache delay anomalies occurring in the cache service within the first time period.

13. An alarm analysis device, characterized in that: The device comprises: An information acquisition module, used to acquire alarm information for prompting a cache service of cache delay anomaly, wherein the cache delay is used to characterize the speed at which the cache service responds to a service object; an atom determination module, configured to determine an alarm analysis rule of the cache service according to the alarm information, wherein the alarm analysis rule is used to indicate at least one analysis atom corresponding to the cache service, wherein the analysis atom is used to analyze the cache delay anomaly from an atomic perspective, and the atom is an independent factor capable of causing the cache delay anomaly; A result generating module, used for generating an analysis result of the cache delay anomaly according to the at least one analysis atom, wherein the analysis result is used for characterizing a cause of the cache delay anomaly obtained through analysis; The result sending module is used to send the analysis result to the operation and maintenance terminal used to process the cache delay exception.

14. A computer device, characterized in that: The computer device includes a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the alarm analysis method according to any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which is loaded and executed by a processor to implement the alarm analysis method according to any one of claims 1 to 12.

Images