Business exception monitoring method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a service exception monitoring method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring controlled information corresponding to a controlled item of a to-be-monitored service; determining alarm information corresponding to the controlled item based on a preset abnormal rule corresponding to the controlled item and the controlled information; the preset exception rule is flexibly configured based on the controlled item; based on a preset alarm rule and alarm information corresponding to the controlled item, alarm push information and an alarm push post corresponding to the controlled item are determined, and the alarm push information is pushed to the alarm push post; the preset alarm rule is flexibly configured based on the controlled item; and adjusting the abnormal state of the controlled item based on the processing result of the alarm pushing post. Through the technical scheme of the embodiment of the invention, the business exception can be accurately and conveniently determined, and the business exception can be accurately pushed by using the flexibly configured rule, so that the exception can be quickly handled.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to a method, device, electronic device and storage medium for monitoring business anomalies. Background Art

[0002] With the rapid development of the market and the diversification of customer needs, business complexity is increasing. Problems in any link of the information flow in the system may cause the overall business to lag, giving customers a bad feeling, and may even cause customer loss, causing huge losses to the company. In order to quickly discover business problems and handle them in a timely manner, it is necessary to monitor the abnormal conditions of the business during the system operation in real time and handle them in a timely manner.

[0003] At present, the existing business exception handling systems usually focus on the monitoring and alarming of system software and hardware resources, but lack the collection, abnormality identification, analysis and alarming of business data. Moreover, when an abnormal situation is found, it only identifies and displays the abnormal scene, but lacks the intelligent push capability, resulting in a large amount of repeated alarm information, which is not conducive to the rapid handling of abnormalities. Summary of the invention

[0004] The embodiments of the present invention provide a business anomaly monitoring method, device, electronic device and storage medium to accurately and conveniently determine business anomalies, and use flexibly configurable rules to accurately push them, thereby achieving rapid handling of anomalies.

[0005] In a first aspect, an embodiment of the present invention provides a method for monitoring service anomalies, comprising:

[0006] Obtaining controlled information corresponding to the controlled items of the business to be monitored;

[0007] Based on the preset abnormal rule corresponding to the controlled item and the controlled information, determining the alarm information corresponding to the controlled item; the preset abnormal rule is flexibly configured based on the controlled item;

[0008] Based on the preset alarm rules corresponding to the controlled item and the alarm information, determine the alarm push information and alarm push post corresponding to the controlled item, and push the alarm push information to the alarm push post; the preset alarm rules are flexibly configured based on the controlled item;

[0009] The abnormal state of the controlled item is adjusted based on the handling result of the alarm push post.

[0010] Optionally, the method also includes: obtaining a controlled item type corresponding to the controlled item of the business to be monitored, and determining an information acquisition method corresponding to the controlled item type; the information acquisition method is flexibly configured based on the controlled item type; and based on the information acquisition method, obtaining controlled information corresponding to the controlled item of the business to be monitored from the controlled unit of the client to be monitored.

[0011] Optionally, the method also includes: if the alarm push post fails to resolve the exception within a preset time period, the abnormal state of the controlled item is upgraded, and the alarm push information is pushed to the superior post of the alarm push post, and the abnormal state of the controlled item is adjusted based on the handling result of the superior post; if the alarm push post resolves the exception within a preset time period, the abnormal state of the controlled item is downgraded or converted to a normal state.

[0012] Optionally, the method also includes: obtaining historical control information of the controlled item; the historical control information includes: the abnormal state of the controlled item, the disposal result and the processing information corresponding to the disposal result; by analyzing the historical control information, determining the root cause of the abnormality and the root cause of the invalid disposal result.

[0013] Optionally, the method also includes: determining the warning push information and warning push position corresponding to the controlled item based on the historical control information, real-time processing information and preset warning rules corresponding to the controlled item; the preset warning rules are flexibly configured based on the controlled item; and pushing the warning push information to the warning push position.

[0014] Optionally, the method also includes: determining the warning information corresponding to the controlled item based on the historical control information and real-time processing information corresponding to the controlled item; determining the warning push information and warning push position corresponding to the controlled item based on the preset warning rules corresponding to the controlled item and the warning information; wherein the preset warning rules are flexibly configured based on the controlled item.

[0015] In a second aspect, an embodiment of the present invention further provides a service anomaly monitoring device, the device comprising:

[0016] A controlled information acquisition module, used to acquire controlled information corresponding to the controlled items of the business to be monitored;

[0017] An alarm information determination module, used to determine the alarm information corresponding to the controlled item based on the preset abnormal rule corresponding to the controlled item and the controlled information; the preset abnormal rule is flexibly configured based on the controlled item;

[0018] An alarm information push module, used to determine the alarm push information and alarm push post corresponding to the controlled item based on the preset alarm rule corresponding to the controlled item and the alarm information, and push the alarm push information to the alarm push post; the preset alarm rule is flexibly configured based on the controlled item;

[0019] The abnormal state adjustment module is used to adjust the abnormal state of the controlled item based on the handling result of the alarm push post.

[0020] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0021] one or more processors;

[0022] A memory for storing one or more programs;

[0023] When the one or more programs are executed by the one or more processors, the one or more processors implement the service exception monitoring method provided by any embodiment of the present invention.

[0024] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for monitoring business anomalies as provided in any embodiment of the present invention.

[0025] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements a business anomaly monitoring method as provided in any embodiment of the present invention.

[0026] The technical solution of the embodiment of the present invention is to obtain the controlled information corresponding to the controlled item of the business to be monitored; determine the alarm information corresponding to the controlled item based on the preset abnormal rule corresponding to the controlled item and the controlled information; the preset abnormal rule is flexibly configured based on the controlled item; determine the alarm push information and alarm push post corresponding to the controlled item based on the preset alarm rule corresponding to the controlled item and the alarm information, and push the alarm push information to the alarm push post; the preset alarm rule is flexibly configured based on the controlled item; adjust the abnormal state of the controlled item based on the disposal result of the alarm push post. Therefore, business anomalies can be accurately and conveniently determined, and accurately pushed using flexibly configurable rules to achieve rapid disposal of anomalies.

[0027] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 This is a flow chart of a method for monitoring business anomalies provided by Embodiment 1 of the present invention;

[0030] Figure 2 is a flow chart of a method for monitoring business anomalies provided by Embodiment 2 of the present invention;

[0031] Figure 3 It is a structural diagram of a business abnormality monitoring system provided by a preferred embodiment of the present invention;

[0032] Figure 4 It is a structural diagram of a service anomaly monitoring device provided in Embodiment 3 of the present invention;

[0033] Figure 5 It is a structural schematic diagram of an electronic device for implementing the service anomaly monitoring method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] Embodiment 1

[0037] Figure 1 A flowchart of a method for monitoring business anomalies is provided for the first embodiment of the present invention. This embodiment can be applied to the situation where accurate push based on controlled information and flexibly configurable rules is performed to achieve rapid handling of anomalies. The method can be executed by a business anomaly monitoring device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0038] S110: Obtain controlled information corresponding to a controlled item of the service to be monitored.

[0039] Among them, the business to be monitored may refer to the business running in the client. The controlled item may refer to the item that is monitored in the business. The controlled information may refer to the real-time information of the controlled item when the business is running. The controlled information has the characteristics of flexible and changeable forms, different data sources, and data ranges that change with business development. For example, the controlled information may include but is not limited to the controlled item identifier, the value of the controlled item, and the corresponding occurrence time of the controlled item value. If the value of the controlled item is detected to be abnormal, the corresponding occurrence time of the controlled item value is the time when the problem occurred.

[0040] Specifically, the server receives the controlled information corresponding to the controlled items of the to-be-monitored service sent by the client.

[0041] S120. Determine the alarm information corresponding to the controlled item based on the preset abnormal rule and the controlled information corresponding to the controlled item.

[0042] Among them, the preset exception rule is flexibly configured based on the controlled item. The preset exception rule may refer to a pre-set rule for determining whether there is an exception in the monitored business. In the embodiment of the present invention, the business exception has complex logic and correlation, so the pre-configured complex expression is used as the preset exception rule to define the exception. The alarm information may refer to the controlled information that determines that there is an abnormality and needs to be alarmed.

[0043] Specifically, the discovery engine in the server is responsible for receiving the controlled information corresponding to the controlled item sent by the client, and performing anomaly calculation in combination with the preset anomaly rules corresponding to the controlled item to determine the alarm information corresponding to the controlled item.

[0044] S130. Based on the preset alarm rules and alarm information corresponding to the controlled item, determine the alarm push information and alarm push position corresponding to the controlled item, and push the alarm push information to the alarm push position.

[0045] Among them, the preset alarm rules are flexibly configured based on the controlled items. The preset alarm rules may refer to pre-set rules for guiding how to determine the alarm push information and the alarm push position. The alarm push information may be a push information that indicates to the user that an abnormality has occurred in the business. The alarm push position may refer to the push location of the alarm push information. For example, the alarm push position may be the position of the user who receives the alarm push information.

[0046] Specifically, the alarm engine in the server determines the alarm push information and alarm push position corresponding to the controlled item based on the preset alarm rules and alarm information corresponding to the controlled item, and pushes the alarm push information to the alarm push position, thereby realizing the push of alarm push information to specific personnel and large screens.

[0047] S140. Adjust the abnormal state of the controlled item based on the handling result of the alarm push post.

[0048] The handling result may refer to whether the abnormality is eliminated after the personnel at the alarm push post perform the handling operation. The handling information may refer to the specific operation information of the handling operation. The abnormal status may refer to the status of the controlled item and the business mark to which the controlled item belongs when the service detects an abnormality in the business based on the controlled information.

[0049] Specifically, when the server detects that a business is abnormal based on the controlled information, the controlled item and the business to which the controlled item belongs are marked as abnormal. The tracking engine in the server can track the progress and handling results of the abnormality in real time, and continue to track when the handling result is that the abnormality is not resolved, and adjust the abnormal state of the controlled item to a normal state when the handling result is that the abnormality has been resolved.

[0050] The technical solution of the embodiment of the present invention obtains the controlled information corresponding to the controlled item of the business to be monitored; determines the alarm information corresponding to the controlled item based on the preset abnormal rules and the controlled information corresponding to the controlled item; the preset abnormal rules are flexibly configured based on the controlled item; based on the preset alarm rules and alarm information corresponding to the controlled item, determines the alarm push information and alarm push post corresponding to the controlled item, and pushes the alarm push information to the alarm push post; the preset alarm rules are flexibly configured based on the controlled item; and adjusts the abnormal state of the controlled item based on the disposal result of the alarm push post. Therefore, business anomalies can be accurately and conveniently determined, and accurately pushed using flexibly configurable rules to achieve rapid disposal of anomalies.

[0051] Embodiment 2

[0052] Figure 2This is a flowchart of a method for monitoring business anomalies provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment describes in detail the process of obtaining controlled information and adjusting abnormal states. The explanations of the terms that are the same or corresponding to the above embodiments are not repeated here. Figure 2 As shown, the method includes:

[0053] S210: Obtain a controlled item type corresponding to a controlled item of a service to be monitored, and determine an information acquisition method corresponding to the controlled item type.

[0054] Among them, the information acquisition method is flexibly configured based on the type of controlled items. The type of controlled items can refer to the item type of the controlled items. For example, the item to be monitored is delivery information; the controlled items can include vehicle information and cargo information; when obtaining vehicle information, the camera can be used to wait for license plate information; when obtaining cargo information, the cargo loading information reported by the driver can be retrieved.

[0055] S220: Acquire controlled information corresponding to the controlled item of the service to be monitored from the controlled unit of the client to be monitored based on the information acquisition method.

[0056] The client to be monitored may refer to the client to which the service to be monitored belongs. The controlled unit may be bound to the server to achieve long-term monitoring.

[0057] S230: Determine the alarm information corresponding to the controlled item based on the preset abnormal rule and the controlled information corresponding to the controlled item.

[0058] Among them, the preset exception rules are flexibly configured based on the controlled items.

[0059] S240. Based on the preset alarm rules and alarm information corresponding to the controlled item, determine the alarm push information and alarm push position corresponding to the controlled item, and push the alarm push information to the alarm push position.

[0060] Among them, the preset alarm rules are flexibly configured based on the controlled items.

[0061] S250. If the alarm push post fails to resolve the anomaly within the preset time, the abnormal state of the controlled item will be upgraded, and the alarm push information will be pushed to the superior post of the alarm push post, and the abnormal state of the controlled item will be adjusted based on the handling result of the superior post.

[0062] The superior position may refer to the superior of the alarm push position.

[0063] Specifically, the upgrade engine in the server can adjust the abnormal state of the controlled item according to the disposal result. If the upgrade engine in the server detects that the alarm push post has not resolved the abnormality within the preset time, it will upgrade the abnormality level based on the preset upgrade rules, and push the alarm push information of the upgraded abnormality level to the superior post of the alarm push post, and continue to track the abnormal progress and disposal results. If the superior post still fails to resolve the abnormality within the preset time, it will continue to upgrade, push and track based on the preset upgrade rules.

[0064] S260. If the alarm push post resolves the anomaly within the preset time, the abnormal state of the controlled item is downgraded or converted to a normal state.

[0065] The normal state may refer to a state after the abnormality is eliminated. The abnormal state degradation may refer to an operation performed when the abnormality impact is mitigated.

[0066] Specifically, if the server detects that the alarm push post solves some anomalies within the preset time and reduces the impact of the anomalies on the business, the abnormal state of the controlled item will be downgraded. If it is detected that the alarm push post solves all anomalies within the preset time and eliminates the anomalies, the abnormal state of the controlled item will be converted to normal.

[0067] It should be noted that the embodiments of the present invention can achieve full life cycle management of abnormal states. Full life cycle management can include creation, continuation, upgrade, downgrade and completion. For example, when the server detects that the controlled information is abnormal, it creates an abnormal state about the task to be monitored, continues to perform abnormal calculations, issues an alarm if the preset alarm conditions are met, and continues to pay attention to the disposal results and abnormal states, thereby achieving the upgrade or downgrade of the abnormal state; when all detected abnormalities are eliminated, the abnormal state is completed.

[0068] The technical solution of the embodiment of the present invention is to obtain the controlled item type corresponding to the controlled item of the business to be monitored, and determine the information acquisition method corresponding to the controlled item type; the information acquisition method is flexibly configured based on the controlled item type; based on the information acquisition method, the controlled information corresponding to the controlled item of the business to be monitored is obtained from the controlled unit of the client to be monitored. Controlled information is different from system software and hardware data. It has the characteristics of flexible and changeable forms, different data sources, and data range changes with business development. The traditional method of obtaining system software and hardware data cannot accurately and comprehensively obtain controlled information. Therefore, the embodiment of the present invention adopts the above-mentioned acquisition method to support the acquisition of multiple controlled information, so as to realize the rapid and accurate acquisition of controlled information corresponding to the controlled item through a flexible configuration method. In addition, the traditional business abnormality alarm only issues an alarm and manually closes the alarm, while the embodiment of the present invention can report to a higher-level business management department based on factors such as the duration of the abnormality and the severity of the abnormality, and can automatically downgrade or cancel the alarm when the abnormality is alleviated or eliminated. Specifically, if the alarm push post fails to resolve the exception within the preset time, the abnormal state of the controlled item will be upgraded, and the alarm push information will be pushed to the superior post of the alarm push post, and the abnormal state of the controlled item will be adjusted based on the handling results of the superior post; if the alarm push post resolves the exception within the preset time, the abnormal state of the controlled item will be downgraded or converted to normal.

[0069] Based on the above technical solution, the method also includes: obtaining historical control information of the controlled item; the historical control information includes: the abnormal state of the controlled item, the disposal result and the processing information corresponding to the disposal result; by analyzing the historical control information, determining the root cause of the abnormality and the root cause of the invalid disposal result.

[0070] The historical control information may refer to control information that can be used as a reference for analysis within a period of time before the current service exception processing.

[0071] Specifically, the statistics module in the server can obtain the historical control information of the controlled items regularly and perform classified statistics. The analysis module in the server can perform root cause analysis based on the abnormalities and ineffective handling of the statistical results, and form a final analysis report and rectification measures based on the management personnel's supplementary improvement of the analysis results.

[0072] Based on the above technical solution, the method also includes: determining the warning push information and warning push position corresponding to the controlled item based on the historical control information, real-time processing information and preset warning rules corresponding to the controlled item; the preset warning rules are flexibly configured based on the controlled item; and the warning push information is pushed to the warning push position.

[0073] The real-time processing information may refer to the processing information when there is no abnormality in the current business. The preset warning rules may refer to the pre-set rules for guiding how to avoid abnormalities. The warning push information may refer to the push information showing the user the abnormalities that may occur in the business.

[0074] Specifically, during the time period when no abnormalities are detected and the abnormalities are eliminated, it is possible to predict whether an abnormality will occur based on the historical control information corresponding to the controlled item, the real-time processing information and the preset warning rules; determine the warning push information and warning push positions corresponding to the controlled items for possible abnormalities, and push the warning push information to the warning push positions to avoid the occurrence of abnormalities in advance.

[0075] On the basis of the above technical solution, "determining the warning push information and warning push position corresponding to the controlled item based on the historical control information, real-time processing information and preset warning rules corresponding to the controlled item" may include: determining the warning information corresponding to the controlled item based on the historical control information and real-time processing information corresponding to the controlled item; determining the warning push information and warning push position corresponding to the controlled item based on the preset warning rules and warning information corresponding to the controlled item; wherein the preset warning rules are flexibly configured based on the controlled item.

[0076] Among them, the warning information may refer to controlled information that predicts that there is a high probability of abnormality and requires a warning.

[0077] Specifically, the prediction engine in the server predicts possible risks based on the historical control information and real-time processing information corresponding to the controlled item, and obtains the warning information corresponding to the controlled item. The warning engine in the server determines the warning push information and warning push position corresponding to the controlled item based on the preset warning rules and warning information corresponding to the controlled item.

[0078] Illustratively, based on the technical solutions of the above-mentioned embodiments, this embodiment also provides a preferred embodiment of a method for monitoring business anomalies. Figure 3 A schematic diagram of the structure of a business abnormality monitoring system provided by a preferred embodiment. Figure 3 , the business anomaly monitoring method applied to the business anomaly monitoring system includes:

[0079] 1) The discovery engine on the server side is responsible for receiving the controlled information sent by the client, and determining the abnormal data (equivalent to the alarm information) in the controlled information based on the preset abnormal rules, and storing the abnormal data in the abnormal table.

[0080] The controlled information may include data in a message queue (MQ), data transmitted by a hypertext transfer protocol (HTTP), data in a database (DB), and data in a script.

[0081] Since controlled information is different from system software and hardware data, it has the characteristics of flexible and changeable forms, different data sources, and data scope changing with business development, which puts higher requirements on the design and implementation of data collection functions. Step 1) Support multiple controlled information collection methods, realize the ability to obtain business exception information through pre-configuration, and achieve the purpose of quickly realizing business exception information collection.

[0082] The preferred embodiment supports dynamic configuration of preset exception rules, so as to achieve the purpose of flexibly and dynamically configuring exceptions according to needs.

[0083] 2) The alarm engine on the server side determines the alarm push information and alarm push position corresponding to the controlled item according to the preset alarm rules and alarm information, and stores the alarm push information and alarm push position in the alarm table.

[0084] Among them, the preferred embodiment supports dynamic configuration of preset alarm rules, so as to achieve the purpose of flexibly and dynamically configuring exceptions according to needs.

[0085] 3) The prediction engine on the server side predicts possible risks based on the accumulated historical knowledge (equivalent to historical control information) combined with the forecast information and real-time processing information, and stores the prediction results (equivalent to early warning information) in the risk table.

[0086] 4) The warning engine on the server side determines the warning push information and warning push positions based on the prediction results and the preset warning rules, and stores the warning push information and warning push positions in the alarm table.

[0087] Among them, the preferred embodiment supports dynamic configuration of preset warning rules, so as to achieve the purpose of flexibly and dynamically configuring anomalies according to needs.

[0088] 5) The tracking engine on the server side can use the tracking script to track the progress and handling of abnormal business, and can automatically close the resolved exceptions to complete the exception.

[0089] Among them, the preferred embodiment supports the full life cycle management of abnormal status, including: creation, continuation, upgrade, downgrade and completion. After the server determines the alarm information, it will continue to calculate the abnormality and issue an alarm if the preset alarm conditions are met until the abnormality is completed.

[0090] 6) The handling module on the server side can provide an operating platform for the responsible person to intervene in the production process according to the alarm push information and early warning push information to eliminate abnormalities or reduce the impact of abnormalities.

[0091] Among them, the preferred embodiment supports manual closing exceptions, upgrade exceptions and downgrade exceptions. It also supports system automatic closing exceptions, upgrade exceptions and downgrade exceptions.

[0092] 7) The upgrade engine on the server side, when the exception is not resolved within the specified time, the system automatically upgrades the exception level according to the preset upgrade rules, and stores the alarm push information and parent position after the exception level is upgraded into the alarm table.

[0093] Among them, the preferred embodiment supports dynamic configuration of preset upgrade rules to achieve the purpose of flexible and dynamic configuration of exceptions according to needs.

[0094] 8) The push engine on the server side, when a business warning occurs, based on the warning push information and warning push positions in the alarm table, sends warning push information to specific personnel and the large screen; when a business alarm occurs, based on the alarm push information and alarm push positions in the alarm table, sends alarm push information to specific personnel and the large screen; when an abnormality escalation occurs, based on the alarm push information and the superior position after the abnormality level is upgraded in the alarm table, sends the alarm push information with the upgraded abnormality level to specific personnel and the large screen.

[0095] Among them, the preferred implementation supports multi-channel push of abnormal information, automatically upgrades and pushes according to the position and disposal situation, and supports automatic cancellation of abnormalities and notification after abnormality recovery, so as to achieve the purpose of accurate push, timely intervention, and automatic perception. The push table can be used to store the content of the most recent push of alarm warning and the push time and other information.

[0096] 9) The statistics module on the server side can regularly classify and count abnormalities and handling situations.

[0097] 10) The analysis module on the server side can conduct root cause analysis based on the statistical results of anomalies and poor handling. The management personnel will supplement and improve the analysis results to form a final analysis report and corrective measures.

[0098] Among them, the preferred embodiment supports the query and classification statistics of abnormal historical information (equivalent to historical control information), thereby discovering business shortcomings and promoting the optimization and upgrading of business processing procedures and management.

[0099] It should be noted that the preferred embodiment supports a variety of flexible rule configurations. The system provides a flexible configuration function for preset exception rules, preset alarm rules, preset warning rules, preset disposal rules, preset upgrade rules, preset closing rules, preset judgment rules, and preset assessment rules. The exception monitoring database is a supporting database for the exception monitoring system, and the database stores the basic data of the exception monitoring system. The basic data may include, but is not limited to, flexible configuration of various preset rules and abnormal historical information.

[0100] Exemplarily, the preferred embodiment also supports abnormality visualization, that is, the abnormality, warning, alarm and disposal information are displayed, and the subsequent processing trajectory can be traced.

[0101] The technical solution of the preferred embodiment of the present invention provides a flexible, efficient and convenient business anomaly monitoring system, which can detect anomalies in time and track the status of anomaly processing. While greatly reducing the workload of manual monitoring, it realizes flexible definition and real-time monitoring and alarming of complex business anomaly scenarios, enables accurate discovery and evaluation of abnormal business, enriches the alarm information content and pushes it accurately, avoids information bombardment, improves the user experience of monitoring managers, strengthens the standardized management capabilities of business system command and dispatch, improves management efficiency and overall effectiveness, and improves the overall operation level.

[0102] The following is an embodiment of a business anomaly monitoring device provided in an embodiment of the present invention. The device and the business anomaly monitoring methods of the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the business anomaly monitoring device, please refer to the embodiment of the above-mentioned business anomaly monitoring method.

[0103] Embodiment 3

[0104] Figure 4 This is a schematic diagram of the structure of a service anomaly monitoring device provided by Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a controlled information acquisition module 410, an alarm information determination module 420, an alarm information push module 430 and an abnormal state adjustment module 440.

[0105] Among them, the controlled information acquisition module 410 is used to obtain the controlled information corresponding to the controlled item of the monitored business; the alarm information determination module 420 is used to determine the alarm information corresponding to the controlled item based on the preset abnormal rules and controlled information corresponding to the controlled item; the preset abnormal rules are flexibly configured based on the controlled items; the alarm information push module 430 is used to determine the alarm push information and alarm push post corresponding to the controlled item based on the preset alarm rules and alarm information corresponding to the controlled item, and push the alarm push information to the alarm push post; the preset alarm rules are flexibly configured based on the controlled items; the abnormal state adjustment module 440 is used to adjust the abnormal state of the controlled item based on the handling result of the alarm push post.

[0106] The technical solution of the embodiment of the present invention obtains the controlled information corresponding to the controlled item of the business to be monitored; determines the alarm information corresponding to the controlled item based on the preset abnormal rules and the controlled information corresponding to the controlled item; the preset abnormal rules are flexibly configured based on the controlled item; based on the preset alarm rules and alarm information corresponding to the controlled item, determines the alarm push information and alarm push post corresponding to the controlled item, and pushes the alarm push information to the alarm push post; the preset alarm rules are flexibly configured based on the controlled item; and adjusts the abnormal state of the controlled item based on the disposal result of the alarm push post. Therefore, business anomalies can be accurately and conveniently determined, and accurately pushed using flexibly configurable rules to achieve rapid disposal of anomalies.

[0107] Based on the above technical solution, the controlled information acquisition module 410 is specifically used to: obtain the controlled item type corresponding to the controlled item of the business to be monitored, and determine the information acquisition method corresponding to the controlled item type; the information acquisition method is flexibly configured based on the controlled item type; based on the information acquisition method, obtain the controlled information corresponding to the controlled item of the business to be monitored from the controlled unit of the client to be monitored.

[0108] Based on the above technical solution, the abnormal status adjustment module 440 is specifically used for: if the alarm push post fails to resolve the abnormality within the preset time, the abnormal status of the controlled item will be upgraded, and the alarm push information will be pushed to the superior post of the alarm push post, and the abnormal status of the controlled item will be adjusted based on the handling results of the superior post; if the alarm push post resolves the abnormality within the preset time, the abnormal status of the controlled item will be downgraded or converted to normal status.

[0109] On the basis of the above technical solution, the device also includes:

[0110] A historical control information acquisition module is used to acquire historical control information of the controlled item; the historical control information includes: abnormal status of the controlled item, disposal results, and processing information corresponding to the disposal results;

[0111] The root cause determination module is used to determine the root cause of the abnormality and the root cause of the invalid treatment result by analyzing the historical control information.

[0112] On the basis of the above technical solution, the device also includes:

[0113] The warning information determination module is used to determine the warning push information and warning push position corresponding to the controlled item based on the historical control information, real-time processing information and preset warning rules corresponding to the controlled item; the preset warning rules are flexibly configured based on the controlled item;

[0114] The early warning information push module is used to push the early warning information to the early warning push post.

[0115] On the basis of the above technical scheme, "determining the warning push information and warning push position corresponding to the controlled item based on the historical control information, real-time processing information and preset warning rules corresponding to the controlled item" is specifically used for: determining the warning information corresponding to the controlled item based on the historical control information and real-time processing information corresponding to the controlled item; determining the warning push information and warning push position corresponding to the controlled item based on the preset warning rules and warning information corresponding to the controlled item; wherein, the preset warning rules are flexibly configured based on the controlled items.

[0116] The service anomaly monitoring device provided in the embodiment of the present invention can execute the service anomaly monitoring method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the service anomaly monitoring method.

[0117] It is worth noting that in the above-mentioned embodiment of business anomaly monitoring, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0118] Embodiment 4

[0119] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0120] like Figure 5As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0121] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0122] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a business anomaly monitoring method.

[0123] In some embodiments, the business anomaly monitoring method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the business anomaly monitoring method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the business anomaly monitoring method in any other appropriate manner (e.g., by means of firmware).

[0124] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0125] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0126] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0127] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0128] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0129] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0130] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the service anomaly monitoring method provided in any embodiment of the present application.

[0131] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, and the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet). The program product belongs to the same inventive concept as the business abnormality monitoring method disclosed in each embodiment of the present application, so it is not repeated here.

[0132] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0133] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for monitoring business anomalies, characterized in that: include: Obtaining controlled information corresponding to the controlled items of the business to be monitored; Determine the alarm information corresponding to the controlled item based on the preset abnormal rule corresponding to the controlled item and the controlled information; The preset exception rules are flexibly configured based on the controlled items; Based on the preset alarm rules corresponding to the controlled item and the alarm information, determine the alarm push information and alarm push post corresponding to the controlled item, and push the alarm push information to the alarm push post; the preset alarm rules are flexibly configured based on the controlled item; The abnormal state of the controlled item is adjusted based on the handling result of the alarm push post.

2. The method according to claim 1, characterized in that The step of obtaining the controlled information corresponding to the controlled item of the service to be monitored includes: Obtaining a controlled item type corresponding to a controlled item of a service to be monitored, and determining an information acquisition method corresponding to the controlled item type; the information acquisition method is flexibly configured based on the controlled item type; Based on the information acquisition method, the controlled information corresponding to the controlled item of the service to be monitored is acquired from the controlled unit of the client to be monitored.

3. The method according to claim 1, characterized in that The adjusting the abnormal state of the controlled item based on the handling result of the alarm push post includes: If the alarm push post fails to resolve the anomaly within the preset time, the abnormal state of the controlled item will be upgraded, and the alarm push information will be pushed to the superior post of the alarm push post, and the abnormal state of the controlled item will be adjusted based on the handling result of the superior post; If the alarm push post resolves the anomaly within a preset time period, the abnormal state of the controlled item will be downgraded or converted to a normal state.

4. The method according to claim 1, characterized in that: The method further comprises: Acquire historical control information of the controlled item; the historical control information includes: abnormal state of the controlled item, treatment result and processing information corresponding to the treatment result; By analyzing the historical control information, the root cause of the abnormality and the root cause of the invalid treatment result are determined.

5. The method according to claim 4, characterized in that The method further comprises: Based on the historical control information, real-time processing information and preset warning rules corresponding to the controlled item, the warning push information and warning push position corresponding to the controlled item are determined; the preset warning rules are flexibly configured based on the controlled item; The warning push information is pushed to the warning push post.

6. The method according to claim 5, characterized in that The determining of the warning push information and warning push position corresponding to the controlled item based on the historical control information, real-time processing information and preset warning rules corresponding to the controlled item includes: Determine the warning information corresponding to the controlled item based on the historical control information and real-time processing information corresponding to the controlled item; Based on the preset warning rules corresponding to the controlled items and the warning information, determine the warning push information and warning push positions corresponding to the controlled items; Among them, the preset warning rules are flexibly configured based on the controlled items.

7. A service abnormality monitoring device, characterized in that: The device comprises: A controlled information acquisition module, used to acquire controlled information corresponding to the controlled items of the business to be monitored; An alarm information determination module, used to determine the alarm information corresponding to the controlled item based on the preset abnormal rule corresponding to the controlled item and the controlled information; the preset abnormal rule is flexibly configured based on the controlled item; An alarm information push module, used to determine the alarm push information and alarm push post corresponding to the controlled item based on the preset alarm rule corresponding to the controlled item and the alarm information, and push the alarm push information to the alarm push post; the preset alarm rule is flexibly configured based on the controlled item; The abnormal state adjustment module is used to adjust the abnormal state of the controlled item based on the handling result of the alarm push post.

8. An electronic device, characterized in that: The electronic device comprises: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the service exception monitoring method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the service exception monitoring method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the service anomaly monitoring method as described in any one of claims 1 to 6.

Images