Alarm scene processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an alarm scene processing method and device, electronic equipment and a storage medium, and relates to the technical field of alarm data processing, and the method comprises the steps: obtaining an alarm strategy through a strategy configuration platform, and transmitting the alarm strategy to an alarm execution engine; the method comprises the following steps: receiving an alarm strategy sent by an alarm execution engine through a multiplexing layer, carrying out semantic analysis on the alarm strategy to obtain a basic condition corresponding to the alarm strategy, carrying out abstraction processing on the basic condition to obtain a target basic condition, then classifying the basic condition based on the occurrence frequency corresponding to each target basic condition, and carrying out classification on the classified basic condition; obtaining a hot spot condition and a non-hot spot condition, then querying the hot spot condition and the non-hot spot condition from a database, and obtaining a first observation value of the hot spot condition and a second observation value of the non-hot spot condition; the alarm processing process for the alarm strategy is executed through the alarm execution engine according to the first observation value and the second observation value, so that the stability of system operation and the service availability are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of alarm data processing, and in particular to a method for processing an alarm scene, a device for processing an alarm scene, an electronic device, and a computer-readable storage medium. Background Art

[0002] In the CDN service system, operators need to monitor the performance indicators and monitoring status of the nodes corresponding to each region in real time, and promptly troubleshoot and repair faulty nodes; or optimize traffic distribution and scheduling strategies to ensure service quality. Among them, due to the characteristics of CDN services being located on the edge side, the system usually includes a large number of node servers located on the edge side, and CDN generally also carries a large amount of traffic data, so the objects that need to be monitored are more complex. In the actual monitoring and alarm process, corresponding alarm strategies need to be set, and the number of alarm strategies is huge and continues to grow. The judgment of each alarm strategy requires a corresponding query to be executed, which will undoubtedly bring a huge performance burden and further transfer the pressure to the underlying database, thereby affecting the stability of system operation and service availability. Summary of the invention

[0003] The embodiments of the present invention provide a method, device, electronic device and computer-readable storage medium for processing an alarm scenario to solve or partially solve the problem that the alarm strategy brings a great performance burden to the CDN business system, affecting the stability of system operation and service availability.

[0004] An embodiment of the present invention discloses a method for processing an alarm scenario, which relates to a content distribution network, wherein the content distribution network includes a plurality of nodes, and the content distribution network caches business content corresponding to a source station on each of the nodes; wherein the node, the source station, and a first dimension corresponding to the node and a second dimension corresponding to the source station are all provided with independent alarm strategies, wherein the first dimension is an analysis dimension for analyzing the node performance of the node, and the second dimension is an analysis dimension for analyzing the source station performance of the source station; wherein the method is applied to a monitoring and analysis system, wherein the monitoring and analysis system at least includes a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a multiplexing layer communicatively connected to the alarm execution engine, and a database communicatively connected to the multiplexing layer, and the method includes:

[0005] Acquiring the alarm strategy through the strategy configuration platform, and sending the alarm strategy to the alarm execution engine;

[0006] Receiving the alarm strategy sent by the alarm execution engine through the multiplexing layer, performing semantic level analysis on the alarm strategy to obtain basic conditions corresponding to the alarm strategy, and abstracting the basic conditions to obtain target basic conditions;

[0007] Classifying the basic conditions based on the occurrence frequencies corresponding to the target basic conditions through the multiplexing layer to obtain hotspot conditions and non-hotspot conditions;

[0008] Query the hotspot condition and the non-hotspot condition from the database through the multiplexing layer to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition, wherein the first observation value and the second observation value are the basis for triggering an alarm strategy;

[0009] The alarm execution engine executes an alarm processing process for the alarm strategy according to the first observation value and the second observation value.

[0010] In some feasible implementations, the performing semantic level analysis on the alarm strategy to obtain basic conditions corresponding to the alarm strategy includes:

[0011] Obtaining a logical operator for the alarm strategy;

[0012] The alarm strategy is segmented according to the logical operator to obtain corresponding basic conditions.

[0013] In some feasible implementations, abstracting the basic conditions to obtain target basic conditions includes:

[0014] Obtain a source station description corresponding to the source station and a node description corresponding to the node;

[0015] The source station description and / or the node description in each of the basic conditions are removed to obtain the target basic conditions.

[0016] In some feasible implementations, the basic conditions are classified based on the occurrence frequencies corresponding to the target basic conditions to obtain hotspot conditions and non-hotspot conditions, including:

[0017] Obtaining the occurrence frequency corresponding to each of the target basic conditions;

[0018] The first basic condition to which the target basic condition belongs whose occurrence frequency is greater than or equal to the preset threshold is taken as the hotspot condition, and the second basic condition to which the target basic condition belongs whose occurrence frequency is less than the preset threshold is taken as the non-hotspot condition.

[0019] In some feasible implementations, querying the database for the hotspot condition and the non-hotspot condition to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition includes:

[0020] Determine input parameters corresponding to the database, the input parameters including at least a first input parameter for specifying a query statement to be executed, and a second input parameter for specifying a timestamp of the query;

[0021] Call the interface corresponding to the database, pass in the first input parameter and the second input parameter, execute a query operation for the hotspot condition, obtain the source station observation value of the hotspot condition on each of the source stations, and the node observation value of the hotspot condition on each of the nodes.

[0022] In some feasible implementations, querying the database for the hotspot condition and the non-hotspot condition to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition further includes:

[0023] The non-hotspot condition is directly transmitted to the database through the multiplexing layer for query, so as to obtain a second observation value corresponding to the non-hotspot condition.

[0024] In some feasible implementations, the performing an alarm processing process for the alarm strategy according to the first observation value and the second observation value includes:

[0025] If the first observation value satisfies a first preset condition, and / or the second observation value satisfies a second preset condition, an alarm prompt information corresponding to the alarm strategy is generated.

[0026] The embodiment of the present invention further discloses a processing device for an alarm scenario, which relates to a content distribution network, wherein the content distribution network includes a plurality of nodes, and the content distribution network caches the business content corresponding to the source station on each of the nodes; wherein the node, the source station, and the first dimension corresponding to the node and the second dimension corresponding to the source station are all provided with independent alarm strategies, wherein the first dimension is an analysis dimension for analyzing the node performance of the node, and the second dimension is an analysis dimension for analyzing the source station performance of the source station; wherein the device is applied to a monitoring and analysis system, wherein the monitoring and analysis system at least includes a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a multiplexing layer communicatively connected to the alarm execution engine, and a database communicatively connected to the multiplexing layer, and the device includes:

[0027] A policy acquisition module located in the policy configuration platform, used to acquire the alarm policy and send the alarm policy to the alarm execution engine;

[0028] The condition decomposition module located at the multiplexing layer is used to receive the alarm strategy sent by the alarm execution engine, perform semantic analysis on the alarm strategy, obtain basic conditions corresponding to the alarm strategy, and abstract the basic conditions to obtain target basic conditions;

[0029] A classification module located at the multiplexing layer, used to classify the basic conditions based on the occurrence frequencies corresponding to the target basic conditions, and obtain hotspot conditions and non-hotspot conditions;

[0030] A query module located at the multiplexing layer, used to query the database for the hotspot condition and the non-hotspot condition, obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition, wherein the first observation value and the second observation value are the basis for triggering an alarm strategy;

[0031] The alarm processing module located in the alarm execution engine is used to execute the alarm processing process for the alarm strategy according to the first observation value and the second observation value.

[0032] In some feasible implementations, the conditional decomposition module is specifically used to:

[0033] Obtaining a logical operator for the alarm strategy;

[0034] The alarm strategy is segmented according to the logical operator to obtain corresponding basic conditions.

[0035] In some feasible implementations, the conditional decomposition module is specifically used to:

[0036] Obtain a source station description corresponding to the source station and a node description corresponding to the node;

[0037] The source station description and / or the node description in each of the basic conditions are removed to obtain the target basic conditions.

[0038] In some feasible implementations, the classification module is specifically used to:

[0039] Obtaining the occurrence frequency corresponding to each of the target basic conditions;

[0040] The first basic condition to which the target basic condition belongs whose occurrence frequency is greater than or equal to the preset threshold is taken as the hotspot condition, and the second basic condition to which the target basic condition belongs whose occurrence frequency is less than the preset threshold is taken as the non-hotspot condition.

[0041] In some feasible implementations, the query module is specifically used to:

[0042] Determine input parameters corresponding to the database, the input parameters including at least a first input parameter for specifying a query statement to be executed, and a second input parameter for specifying a timestamp of the query;

[0043] Call the interface corresponding to the database, pass in the first input parameter and the second input parameter, execute a query operation for the hotspot condition, obtain the source station observation value of the hotspot condition on each of the source stations, and the node observation value of the hotspot condition on each of the nodes.

[0044] In some feasible implementations, the query module is further configured to:

[0045] The non-hotspot condition is directly transmitted to the database through the multiplexing layer for query, so as to obtain a second observation value corresponding to the non-hotspot condition.

[0046] In some feasible implementations, the alarm processing module is specifically used to:

[0047] If the first observation value satisfies a first preset condition, and / or the second observation value satisfies a second preset condition, an alarm prompt information corresponding to the alarm strategy is generated.

[0048] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0049] The memory is used to store computer programs;

[0050] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0051] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0052] The embodiments of the present invention include the following advantages:

[0053] In an embodiment of the present invention, when processing the monitoring and alarm scenario of the content distribution network, the monitoring and analysis system can be optimized. The optimized monitoring and analysis system may include a policy configuration platform, an alarm execution engine connected to the policy configuration platform in communication, a multiplexing layer connected to the alarm execution engine in communication, and a database connected to the multiplexing layer in communication. The system can obtain the alarm policy through the policy configuration platform, send the alarm policy to the alarm execution engine, receive the alarm policy sent by the alarm execution engine through the multiplexing layer, perform semantic analysis on the alarm policy, obtain basic conditions corresponding to the alarm policy, then abstract the basic conditions to obtain target basic conditions, and then perform an analysis based on the frequency of occurrence corresponding to each target basic condition. The basic conditions are classified to obtain hotspot conditions and non-hotspot conditions, and then the hotspot conditions and non-hotspot conditions are queried from the database to obtain the first observation value corresponding to the hotspot condition and the second observation value corresponding to the non-hotspot condition. Finally, the alarm execution engine executes the alarm processing process for the alarm strategy according to the first observation value and the second observation value. The first observation value and the second observation value are the basis for triggering the alarm strategy, so as to segment the alarm strategy at the semantic level to obtain the corresponding basic conditions, and combine with the method of identifying hotspot conditions, effectively reducing the redundancy in the alarm strategy, improving the processing efficiency of the system, simplifying the structure of the lexical analyzer under the content distribution network and providing system performance, ensuring the stability of system operation and service availability. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 is a flowchart of a method for processing an alarm scenario provided in an embodiment of the present invention;

[0055] Figure 2 is a schematic diagram of a CDN monitoring architecture provided in an embodiment of the present invention;

[0056] Figure 3 is a software flow chart of the multiplexing layer provided in an embodiment of the present invention;

[0057] Figure 4 It is a structural block diagram of a processing device for an alarm scenario provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0059] As an example, in the actual monitoring and alarm process, corresponding alarm strategies need to be set. The number of alarm strategies is huge and continues to grow. The judgment of each alarm strategy requires the execution of a corresponding query, which will undoubtedly bring a huge performance burden and further transmit the pressure to the underlying database, thereby affecting the stability of system operation and service availability.

[0060] In this regard, in the present invention, the monitoring and analysis system is optimized. The optimized monitoring and analysis system may include a policy configuration platform, an alarm execution engine connected to the policy configuration platform in communication, a multiplexing layer connected to the alarm execution engine in communication, and a database connected to the multiplexing layer in communication. The system can obtain the alarm strategy through the policy configuration platform, send the alarm strategy to the alarm execution engine, receive the alarm strategy sent by the alarm execution engine through the multiplexing layer, perform semantic analysis on the alarm strategy, obtain basic conditions corresponding to the alarm strategy, then abstract the basic conditions to obtain target basic conditions, and then classify the basic conditions based on the frequency of occurrence corresponding to each target basic condition to obtain Hotspot conditions and non-hotspot conditions, and then query the database for hotspot conditions and non-hotspot conditions to obtain the first observation value corresponding to the hotspot condition and the second observation value corresponding to the non-hotspot condition. Finally, the alarm execution engine executes the alarm processing process for the alarm strategy according to the first observation value and the second observation value. The first observation value and the second observation value are the basis for triggering the alarm strategy, thereby cutting the alarm strategy at the semantic level to obtain the corresponding basic conditions, and combining with the method of identifying hotspot conditions, effectively reducing the redundancy in the alarm strategy, improving the processing efficiency of the system, and simplifying the structure of the lexical analyzer under the content distribution network and providing system performance, ensuring the stability of system operation and service availability.

[0061] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, some technical features involved in the embodiments of the present invention are explained and illustrated below:

[0062] CDN (Content Distribution Network): A content distribution network stores content copies on servers distributed in different regions and distributes them to nearby requesting clients, making content transmission faster and more stable.

[0063] Engine: refers to a combination of a series of closely related software operations to achieve a specific goal, providing users with an easy-to-use calling method while hiding the internal details.

[0064] Lexical Analyzer (Lexer for short): A program tool in computer processing technology that extracts valid words from a character sequence, usually used in the field of compiler front-end processing.

[0065] Reference Figure 1 , shows a step flow chart of a method for processing an alarm scenario provided in an embodiment of the present invention, involving a content distribution network, the content distribution network includes a plurality of nodes, the content distribution network caches the business content corresponding to the source station to each of the nodes; wherein the node, the source station, and the first dimension corresponding to the node and the second dimension corresponding to the source station are all provided with independent alarm strategies, the first dimension is an analysis dimension for analyzing the node performance of the node, and the second dimension is an analysis dimension for analyzing the source station performance of the source station; wherein, applied to a monitoring and analysis system, the monitoring and analysis system at least includes a policy configuration platform, an alarm execution engine connected to the policy configuration platform in communication, a multiplexing layer connected to the alarm execution engine in communication, and a database connected to the multiplexing layer in communication, and may specifically include the following steps:

[0066] Step 101, obtaining the alarm strategy through the policy configuration platform, and sending the alarm strategy to the alarm execution engine;

[0067] Optionally, for a content delivery network CDN, it can be a group of server networks distributed in different geographical locations, aiming to improve the loading speed and performance of the website by providing content nearby. For example, CDN can cache the content of the source site and distribute it to nodes around the world, allowing users to obtain content from the nearest node, thereby reducing latency and bandwidth consumption.

[0068] Among them, the CDN network can include several nodes. The node can be a server in the CDN network, which is usually located in a data center or network access point close to the user. It is responsible for caching the content of the source station and directly providing these contents when the user requests them, thereby reducing the direct access to the source station. As for the source station, it can be a server that stores the original content, usually the back-end server of a website or application, etc., which is responsible for generating or storing the original content of the website, such as HTML, CSS, JavaScript, pictures, videos, etc.

[0069] For CDN networks, dimensions can be different perspectives or classification standards for analyzing and monitoring CDN network performance. For example, dimensions can include request response status codes, abnormal bandwidth changes, download speeds, and other dimensions. These dimensions can include settings for nodes, source stations, and individual indicators. In actual production activities, by setting independent alarm strategies for each node, each source station, and each unique, the product of the number of nodes, source stations, and dimensions is the final number of alarm strategies. By setting corresponding alarm strategies, it is possible to effectively detect whether nodes, source stations, dimensions, etc. meet performance requirements, etc. Among them, the alarm strategy is sent to the alarm execution engine at a specified time interval. The execution engine queries and calculates performance indicators in massive monitoring data according to the description of the alarm strategy, and determines whether to send an alarm message to relevant personnel.

[0070] In an embodiment of the present invention, the monitoring and analysis system may at least include a policy configuration platform, an alarm execution engine connected to the policy configuration platform, a multiplexing layer connected to the alarm execution engine, and a database connected to the multiplexing layer. The policy configuration platform may be used to configure the alarm policy, etc.; the alarm execution engine may be used to receive the alarm policy periodically sent by the policy configuration platform, and execute the corresponding alarm policy, such as querying the database for corresponding data, etc.; the multiplexing layer may be used to process the alarm policy received by the alarm execution engine, optimize the content involved in the alarm policy, reduce the redundancy in the alarm policy, so as to improve the efficiency and performance of the system operation; the database may be used to store the corresponding monitoring data, such as the data obtained by monitoring the source station, the node, and the corresponding dimension, etc.

[0071] In the specific implementation, users can configure alarm strategies for source stations, nodes, and corresponding dimensions on the alarm strategy configuration platform, and send the alarm strategies to the alarm execution engine so that the alarm execution engine can query and calculate performance indicators in massive monitoring data according to the relevant description of the alarm strategy, and determine whether to send alarm information to relevant personnel based on the processing results.

[0072] Step 102: receiving the alarm policy sent by the alarm execution engine through the multiplexing layer, performing semantic analysis on the alarm policy to obtain basic conditions corresponding to the alarm policy, and abstracting the basic conditions to obtain target basic conditions;

[0073] For the alarm execution engine, if it immediately executes the operations corresponding to the alarm strategy after receiving it, queries and calculates the performance indicators in the massive monitoring data according to the description of the alarm strategy, and determines whether to send an alarm message to relevant personnel, it is easy to cause the judgment requirement of each alarm strategy to execute a query in the database due to the large and continuously growing number of alarm strategies, which will cause the alarm execution engine to bear greater performance pressure, and the pressure will be further transmitted to the underlying database, thereby affecting the stability of system operation and service availability.

[0074] In this regard, in an embodiment of the present invention, with respect to the alarm execution engine, in order to reduce the query calculation pressure of the alarm execution engine, a multiplexing layer is introduced between the alarm execution engine and the database. The alarm strategy received by the alarm execution engine is processed through the multiplexing layer, the content involved in the alarm strategy is optimized, and the redundancy in the alarm strategy is reduced, so as to improve the efficiency and performance of the system operation.

[0075] In a specific implementation, the alarm execution engine can send the received alarm strategy to the multiplexing layer. After the multiplexing layer receives the alarm strategy sent by the alarm execution engine, it can first perform a semantic analysis on the alarm strategy to obtain the basic conditions corresponding to the alarm strategy, and then abstract the basic conditions to obtain the target basic conditions, thereby cutting the alarm strategy at the semantic level and obtaining the corresponding basic conditions, effectively reducing the redundancy in the alarm strategy and improving the processing efficiency of the system.

[0076] In some feasible implementations, the multiplexing layer can obtain the logical operator for the alarm strategy, and then cut the alarm strategy according to the logical operator to obtain the corresponding basic conditions; then obtain the source station description corresponding to the source station and the node description corresponding to the node, and remove the source station description and / or node description in each basic condition to obtain the target basic condition. Optionally, the alarm strategy can be composed of at least two basic conditions, and different basic conditions are combined based on logical operators. Then, the alarm strategy can be decomposed into corresponding basic conditions based on logical operators, such as and, or, &&, || and other logical operators. For example, the alarm strategy for a sudden drop in the number of requests can be split into two basic conditions such as "the rate of decrease in the number of requests is greater than 80%" and "the number of requests before the decrease is greater than 20,000", etc. The present invention does not limit this.

[0077] In the specific implementation, the multiplexing layer can first perform a semantic analysis on the received alarm strategy, decompose it into a combination of basic conditions, and then abstract all the basic conditions, remove the filtering descriptions related to the specific source station and node, so as to merge them and obtain the corresponding target basic conditions, so as to perform further processing based on the target basic conditions, thereby cutting the alarm strategy at the semantic level and obtaining the corresponding basic conditions, effectively reducing the redundancy in the alarm strategy and improving the processing efficiency of the system.

[0078] In one example, after receiving the alarm policy sent by the alarm execution engine, the multiplexing layer can obtain logical operators, such as and, or, &&, ||, etc., and then cut the alarm policy according to the logical operators to obtain the corresponding basic conditions, such as cpu_usage{instance="node1"}>80, memory_usage{instance="node1"}<20, network_latency{instance="node2"}>100, etc. Then, the multiplexing layer can further obtain the source station description and node description, etc., so as to remove specific business information based on the source station description and node description, such as instance = "node1", instance = "node2", and obtain the corresponding target basic conditions, such as cpu_usage>80, memory_usage<20, network_latency>100, etc., in order to perform further processing based on the target basic conditions, thereby cutting the alarm strategy at the semantic level and obtaining the corresponding basic conditions, effectively reducing the redundancy in the alarm strategy and improving the processing efficiency of the system.

[0079] Step 104, classifying the basic conditions based on the occurrence frequencies corresponding to the target basic conditions through the multiplexing layer to obtain hotspot conditions and non-hotspot conditions;

[0080] After obtaining the target basic conditions through semantic-level segmentation and removal of corresponding business information, the occurrence frequencies of each target basic condition can be further counted, and the basic conditions can be classified based on the occurrence frequencies. The first basic condition to which the target basic condition with an occurrence frequency greater than or equal to a preset threshold belongs is taken as a hotspot condition, and the second basic condition to which the target basic condition with an occurrence frequency less than the preset threshold belongs is taken as a non-hotspot condition. Thus, the alarm strategy is segmented at the semantic level to obtain the corresponding basic conditions, and combined with the method of identifying hotspot conditions, the redundancy in the alarm strategy is effectively reduced, thereby improving the processing efficiency of the system.

[0081] In the specific implementation, the multiplexing layer can cut the expression of the alarm strategy into basic conditions according to the characters "and, or, &&, ||" to form condition set 1; then, according to the syntax of the PromQL statement, remove specific business information such as accid from the metric label set to form condition set 2; then, condition set 2 is merged and counted, and the basic conditions that account for more than 10% of the total are marked as hot conditions; according to the mapping relationship between condition set 2 and condition set 1, the remaining conditions that are not marked as hot conditions are selected from condition set 1 to form non-hot conditions. For example, after removing the business information, the same target basic conditions can be merged and counted, and the basic conditions to which the target basic conditions that account for more than 10% of the total are marked as hot conditions, and the basic conditions to which the target basic conditions that do not exceed 10% are marked as non-hot conditions, thereby cutting the alarm strategy at the semantic level, obtaining the corresponding basic conditions, and combining the method of identifying hot conditions, effectively reducing the redundancy in the alarm strategy and improving the processing efficiency of the system.

[0082] Step 105, querying the database for the hotspot condition and the non-hotspot condition through the multiplexing layer to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition;

[0083] After the classification of the basic conditions is completed, the multiplexing layer can query the database for the hotspot conditions and non-hotspot conditions obtained after the classification, so as to extract the corresponding target data from the massive monitoring data stored in the database according to the description corresponding to the corresponding basic conditions, and calculate the corresponding performance indicators according to the target data to obtain the first observation value corresponding to the hotspot condition and the second observation value corresponding to the non-hotspot condition. Among them, the first observation value and the second observation value are the basis for triggering the alarm strategy, so as to determine whether the alarm strategy is triggered, so as to determine whether to notify the corresponding personnel.

[0084] In some feasible implementations, for hotspot conditions, the multiplexing layer can determine the input parameters corresponding to the database, the input parameters at least include a first input parameter for specifying the query statement to be executed, and a second input parameter for specifying the timestamp of the query, and then call the corresponding interface of the database, pass in the first input parameter and the second input parameter, perform the query operation for the hotspot condition, obtain the source station observation value of the hotspot condition on each source station, and the node observation value of the hotspot condition on each node. For non-hotspot conditions, the multiplexing layer can directly pass the non-hotspot condition to the database for query, and obtain the second observation value corresponding to the non-hotspot condition.

[0085] In a specific implementation, the database can be a Prometheus database, and the multiplexing layer can call the / api / v1 / query interface of Prometheus through an HTTP POST request, and pass in the query parameter (i.e., the first input parameter) and the time parameter (i.e., the second input parameter) through the interface to query the Prometheus database for hotspot conditions, obtain the observation values ​​of the hotspot conditions at all source stations and nodes, and store the obtained observation values ​​in hotspot files. During the storage process, a high-speed hard disk can be used to improve the access speed; for non-hotspot conditions, the decomposed basic conditions are directly transmitted to the back-end Prometheus database for query, and the obtained observation values ​​are directly stored in the memory, so that by extracting the unchanged basic conditions in the alarm strategy, and then using the hotspot condition merging algorithm of the basic condition set module, the total number of basic conditions can be greatly reduced, thereby reducing the number of queries to the back-end database.

[0086] Step 106: Execute an alarm processing process for the alarm strategy according to the first observation value and the second observation value through the alarm execution engine.

[0087] In an embodiment of the present invention, after optimizing the alarm strategy through the multiplexing layer and reducing the redundancy in the alarm strategy, after querying the corresponding observation values ​​from the database based on the decomposed basic conditions, the multiplexing layer can return the first observation value corresponding to the hot event and the second observation value corresponding to the non-hot event to the alarm execution engine, and the alarm execution engine executes the alarm processing process for the alarm strategy according to the first observation value and the second observation value, thereby cutting the alarm strategy at the semantic level, obtaining the corresponding basic conditions, and combining with the method of identifying hot spot conditions, effectively reducing the redundancy in the alarm strategy, improving the processing efficiency of the system, simplifying the structure of the lexical analyzer under the content distribution network and providing system performance, thereby ensuring the stability of system operation and service availability.

[0088] In a specific implementation, the alarm execution engine can compare the corresponding observation value with the preset alarm condition and determine whether the alarm is triggered. If the first observation value meets the first preset condition, and / or the second observation value meets the second preset condition, an alarm prompt information corresponding to the alarm strategy is generated.

[0089] In one example, suppose the observations are as follows:

[0090] cpu_usage: 75

[0091] memory_usage: 15

[0092] network_latency: 90

[0093] Comparison results:

[0094] cpu_usage>80:75<=80, which does not meet the first preset condition.

[0095] memory_usage<20:15<20, satisfying the second preset condition.

[0096] network_latency>100: 90<=100, which does not meet the third preset condition.

[0097] Trigger conditions:

[0098] if(cpu_usage>80andmemory_usage<20)or(network_latency>100)thenalert

[0099] Since cpu_usage>80 is not met and network_latency>100 is not met, no alarm is triggered.

[0100] Warning information:

[0101] Alert strategy:

[0102] if(cpu_usage>80andmemory_usage<20)or(network_latency>100)thenalert

[0103] Observed values: cpu_usage = 75, memory_usage = 15, network_latency = 90

[0104] Alarm prompt: No alarm was triggered.

[0105] In another example, suppose the observations are as follows:

[0106] cpu_usage: 85

[0107] memory_usage: 25

[0108] network_latency: 120

[0109] Comparison results:

[0110] cpu_usage>80:85>80, meeting the first preset condition.

[0111] memory_usage<20:25>=20, which does not meet the second preset condition.

[0112] network_latency>100:120>100, satisfying the third preset condition.

[0113] Trigger conditions:

[0114] if(cpu_usage>80and memory_usage<20)or(network_latency>100)then alert

[0115] Since network_latency>100 is satisfied, the alarm is triggered.

[0116] Warning information:

[0117] Alert strategy: if(cpu_usage>80and memory_usage<20)or(network_latency>100)then alert

[0118] Observed values: cpu_usage = 85, memory_usage = 25, network_latency = 120

[0119] Alarm prompt: The network delay exceeds 100ms, triggering an alarm.

[0120] It should be noted that the embodiments of the present invention include but are not limited to the above examples. It is understandable that those skilled in the art can also make settings according to actual needs under the guidance of the ideas of the embodiments of the present invention, and the present invention is not limited to this.

[0121] In an embodiment of the present invention, when processing the monitoring and alarm scenario of the content distribution network, the monitoring and analysis system can be optimized. The optimized monitoring and analysis system may include a policy configuration platform, an alarm execution engine connected to the policy configuration platform in communication, a multiplexing layer connected to the alarm execution engine in communication, and a database connected to the multiplexing layer in communication. The system can obtain the alarm policy through the policy configuration platform, send the alarm policy to the alarm execution engine, receive the alarm policy sent by the alarm execution engine through the multiplexing layer, perform semantic analysis on the alarm policy, obtain basic conditions corresponding to the alarm policy, then abstract the basic conditions to obtain target basic conditions, and then perform an analysis based on the frequency of occurrence corresponding to each target basic condition. The basic conditions are classified to obtain hotspot conditions and non-hotspot conditions, and then the hotspot conditions and non-hotspot conditions are queried from the database to obtain the first observation value corresponding to the hotspot condition and the second observation value corresponding to the non-hotspot condition. Finally, the alarm execution engine executes the alarm processing process for the alarm strategy according to the first observation value and the second observation value. The first observation value and the second observation value are the basis for triggering the alarm strategy, so as to segment the alarm strategy at the semantic level to obtain the corresponding basic conditions, and combine with the method of identifying hotspot conditions, effectively reducing the redundancy in the alarm strategy, improving the processing efficiency of the system, simplifying the structure of the lexical analyzer under the content distribution network and providing system performance, ensuring the stability of system operation and service availability.

[0122] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the following examples are used for exemplary description:

[0123] Reference Figure 2 , shows a schematic diagram of the CDN monitoring architecture provided in an embodiment of the present invention. The CDN monitoring architecture may include an alarm policy configuration platform, an alarm execution engine, a reuse layer, and a Prometheus database. Among them, the administrator can configure the corresponding alarm policy on the alarm policy configuration platform, and periodically send the alarm policy to the alarm execution engine. After receiving the alarm policy, the alarm execution engine can send the alarm policy to the reuse layer. In each alarm cycle:

[0124] 1. Perform semantic analysis on the received alert strategy and decompose it into a combination of basic conditions;

[0125] 2. Secondly, all basic conditions are abstracted and the filtering descriptions related to specific source stations and nodes are removed for merging;

[0126] 3. Then identify the basic conditions with higher frequency of occurrence, which become hot conditions;

[0127] 4. Call the / api / v1 / query interface of Prometheus through HTTP POST request, pass in query and time parameters, query the hotspot conditions from the Prometheus database, obtain the observation values ​​of the conditions on all source stations and nodes, store them in the hotspot file, and use high-speed hard disk to improve access speed;

[0128] 5. For non-hotspot conditions, directly pass the basic conditions decomposed in step 1 to the backend Prometheus database for query, and the observed values ​​are stored in memory;

[0129] 6. Traverse each alarm strategy, combine the observation values ​​of non-hotspot conditions and hotspot conditions based on the decomposition relationship in step 1, and return them to the alarm execution engine.

[0130] In the specific implementation, refer to Figure 3 , shows a software flow chart of the multiplexing layer provided in an embodiment of the present invention. Specifically, in each alarm determination cycle, the multiplexing layer has the following operations:

[0131] The semantic segmentation module divides the expression of the alarm strategy into basic conditions according to the characters "and, or, &&, ||" to form a condition set 1;

[0132] The semantic segmentation module removes specific business information such as accid from the metric label set according to the syntax of the PromQL statement to form condition set 2;

[0133] The basic condition set module performs a combined count on condition set 2, and basic conditions that account for more than 10% of the total are marked as hotspot conditions; according to the mapping relationship between condition set 2 and condition set 1, the remaining conditions that are not marked as hotspot conditions are selected from condition set 1 to form non-hotspot conditions;

[0134] The query module calls the / api / v1 / query interface of Prometheus through HTTP POST, passing in the query and time parameters, and queries the hotspot conditions and non-hotspot conditions respectively to form a result set. The query result of the hotspot condition is a compact dictionary type data structure, which contains the mapping relationship between the original business information and the query result;

[0135] Reorganize the output module, traverse all alarm strategies, and select the correct results from the non-hotspot condition query result set and the hotspot condition query result set according to the mapping relationship in the above steps, merge and return them to the alarm execution engine.

[0136] Through the above process, the basic conditions can be segmented according to semantics and the technology of identifying hot spot conditions can be merged. Compared with the existing technology, the redundancy in the alarm strategy can be discovered and reduced, and the system efficiency can be improved; and through the alarm strategy semantic segmentation method, the general rules of alarm strategy expression in the CDN monitoring scenario are combined to simplify the structure of the lexical analyzer in this scenario and improve the performance.

[0137] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0138] Reference Figure 4 , shows a structural block diagram of a processing device for an alarm scenario provided in an embodiment of the present invention, involving a content distribution network, the content distribution network includes a plurality of nodes, the content distribution network caches the business content corresponding to the source station to each of the nodes; wherein the node, the source station, and the first dimension corresponding to the node and the second dimension corresponding to the source station are all provided with independent alarm strategies, the first dimension is an analysis dimension for analyzing the node performance of the node, and the second dimension is an analysis dimension for analyzing the source station performance of the source station; wherein, applied to a monitoring and analysis system, the monitoring and analysis system at least includes a policy configuration platform, an alarm execution engine connected to the policy configuration platform in communication, a multiplexing layer connected to the alarm execution engine in communication, and a database connected to the multiplexing layer in communication, and may specifically include the following modules:

[0139] A policy acquisition module 401 located in the policy configuration platform is used to acquire the alarm policy and send the alarm policy to the alarm execution engine;

[0140] The condition decomposition module 402 located at the multiplexing layer is used to receive the alarm strategy sent by the alarm execution engine, perform semantic analysis on the alarm strategy, obtain basic conditions corresponding to the alarm strategy, and perform abstract processing on the basic conditions to obtain target basic conditions;

[0141] The classification module 403 located at the multiplexing layer is used to classify the basic conditions based on the occurrence frequency corresponding to each of the target basic conditions to obtain hotspot conditions and non-hotspot conditions;

[0142] The query module 404 located at the multiplexing layer is used to query the hotspot condition and the non-hotspot condition from the database to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition, wherein the first observation value and the second observation value are the basis for triggering the alarm strategy;

[0143] The alarm processing module 405 located in the alarm execution engine is used to execute the alarm processing process for the alarm strategy according to the first observation value and the second observation value.

[0144] In some feasible implementations, the condition decomposition module 402 is specifically used to:

[0145] Obtaining a logical operator for the alarm strategy;

[0146] The alarm strategy is segmented according to the logical operator to obtain corresponding basic conditions.

[0147] In some feasible implementations, the condition decomposition module 402 is specifically used to:

[0148] Obtain a source station description corresponding to the source station and a node description corresponding to the node;

[0149] The source station description and / or the node description in each of the basic conditions are removed to obtain the target basic conditions.

[0150] In some feasible implementations, the classification module 403 is specifically used to:

[0151] Obtaining the occurrence frequency corresponding to each of the target basic conditions;

[0152] The first basic condition to which the target basic condition belongs whose occurrence frequency is greater than or equal to the preset threshold is taken as the hotspot condition, and the second basic condition to which the target basic condition belongs whose occurrence frequency is less than the preset threshold is taken as the non-hotspot condition.

[0153] In some feasible implementations, the query module 404 is specifically used to:

[0154] Determine input parameters corresponding to the database, the input parameters including at least a first input parameter for specifying a query statement to be executed, and a second input parameter for specifying a timestamp of the query;

[0155] Call the interface corresponding to the database, pass in the first input parameter and the second input parameter, execute a query operation for the hotspot condition, obtain the source station observation value of the hotspot condition on each of the source stations, and the node observation value of the hotspot condition on each of the nodes.

[0156] In some feasible implementations, the query module 404 is further configured to:

[0157] The non-hotspot condition is directly transmitted to the database through the multiplexing layer for query, so as to obtain a second observation value corresponding to the non-hotspot condition.

[0158] In some feasible implementations, the alarm processing module 405 is specifically used to:

[0159] If the first observation value satisfies a first preset condition, and / or the second observation value satisfies a second preset condition, an alarm prompt information corresponding to the alarm strategy is generated.

[0160] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0161] In addition, an embodiment of the present invention further provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the embodiment of the processing method for the above-mentioned alarm scenario are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0162] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned alarm scene processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0163] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0164] It should be understood by those skilled in the art that the embodiments of the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, EEPROM, Flash, and eMMC, etc.) containing computer-usable program codes.

[0165] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0168] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0169] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0170] The above is a detailed introduction to a method for processing an alarm scenario and a device for processing an alarm scenario provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for processing an alarm scenario, characterized in that: The invention relates to a content distribution network, wherein the content distribution network includes a plurality of nodes, and the content distribution network caches the business content corresponding to the source station on each of the nodes; wherein the node, the source station, and the first dimension corresponding to the node and the second dimension corresponding to the source station are all provided with independent alarm strategies, wherein the first dimension is an analysis dimension for analyzing the node performance of the node, and the second dimension is an analysis dimension for analyzing the source station performance of the source station; wherein the method is applied to a monitoring and analysis system, wherein the monitoring and analysis system at least includes a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a multiplexing layer communicatively connected to the alarm execution engine, and a database communicatively connected to the multiplexing layer, and the method includes: Acquiring the alarm strategy through the strategy configuration platform, and sending the alarm strategy to the alarm execution engine; Receiving the alarm strategy sent by the alarm execution engine through the multiplexing layer, performing semantic level analysis on the alarm strategy to obtain basic conditions corresponding to the alarm strategy, and abstracting the basic conditions to obtain target basic conditions; Classifying the basic conditions based on the occurrence frequencies corresponding to the target basic conditions through the multiplexing layer to obtain hotspot conditions and non-hotspot conditions; Query the hotspot condition and the non-hotspot condition from the database through the multiplexing layer to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition, wherein the first observation value and the second observation value are the basis for triggering an alarm strategy; The alarm execution engine executes an alarm processing process for the alarm strategy according to the first observation value and the second observation value.

2. The method according to claim 1, characterized in that The performing semantic level analysis on the alarm strategy to obtain basic conditions corresponding to the alarm strategy includes: Obtaining a logical operator for the alarm strategy; The alarm strategy is segmented according to the logical operator to obtain corresponding basic conditions.

3. The method according to claim 2, characterized in that The abstracting of the basic conditions to obtain target basic conditions includes: Obtain a source station description corresponding to the source station and a node description corresponding to the node; The source station description and / or the node description in each of the basic conditions are removed to obtain the target basic conditions.

4. The method according to claim 1, characterized in that: The basic conditions are classified based on the occurrence frequencies corresponding to the target basic conditions to obtain hotspot conditions and non-hotspot conditions, including: Obtaining the occurrence frequency corresponding to each of the target basic conditions; The first basic condition to which the target basic condition belongs whose occurrence frequency is greater than or equal to the preset threshold is taken as the hotspot condition, and the second basic condition to which the target basic condition belongs whose occurrence frequency is less than the preset threshold is taken as the non-hotspot condition.

5. The method according to claim 1, characterized in that The querying the database about the hotspot condition and the non-hotspot condition to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition includes: Determine input parameters corresponding to the database, the input parameters including at least a first input parameter for specifying a query statement to be executed, and a second input parameter for specifying a timestamp of the query; Call the interface corresponding to the database, pass in the first input parameter and the second input parameter, execute a query operation for the hotspot condition, obtain the source station observation value of the hotspot condition on each of the source stations, and the node observation value of the hotspot condition on each of the nodes.

6. The method according to claim 5, characterized in that The querying the database for the hotspot condition and the non-hotspot condition to obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition further includes: The non-hotspot condition is directly transmitted to the database through the multiplexing layer for query, so as to obtain a second observation value corresponding to the non-hotspot condition.

7. The method according to claim 1, characterized in that The performing of the alarm processing process for the alarm strategy according to the first observation value and the second observation value includes: If the first observation value satisfies a first preset condition, and / or the second observation value satisfies a second preset condition, an alarm prompt information corresponding to the alarm strategy is generated.

8. A device for processing an alarm scene, characterized in that: The invention relates to a content distribution network, wherein the content distribution network includes a plurality of nodes, and the content distribution network caches the business content corresponding to the source station on each of the nodes; wherein the node, the source station, and the first dimension corresponding to the node and the second dimension corresponding to the source station are all provided with independent alarm strategies, wherein the first dimension is an analysis dimension for analyzing the node performance of the node, and the second dimension is an analysis dimension for analyzing the source station performance of the source station; wherein the device is applied to a monitoring and analysis system, wherein the monitoring and analysis system at least includes a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a multiplexing layer communicatively connected to the alarm execution engine, and a database communicatively connected to the multiplexing layer, and the device includes: A policy acquisition module located in the policy configuration platform, used to acquire the alarm policy and send the alarm policy to the alarm execution engine; The condition decomposition module located at the multiplexing layer is used to receive the alarm strategy sent by the alarm execution engine, perform semantic analysis on the alarm strategy, obtain basic conditions corresponding to the alarm strategy, and abstract the basic conditions to obtain target basic conditions; A classification module located at the multiplexing layer, used to classify the basic conditions based on the occurrence frequencies corresponding to the target basic conditions, and obtain hotspot conditions and non-hotspot conditions; A query module located at the multiplexing layer, used to query the database for the hotspot condition and the non-hotspot condition, obtain a first observation value corresponding to the hotspot condition and a second observation value corresponding to the non-hotspot condition, wherein the first observation value and the second observation value are the basis for triggering an alarm strategy; The alarm processing module located in the alarm execution engine is used to execute the alarm processing process for the alarm strategy according to the first observation value and the second observation value.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images