Alarm scene processing method and device, electronic equipment and storage medium

Abstract

This invention provides a method, apparatus, electronic device, and storage medium for processing alarm scenarios, relating to the field of alarm data processing technology. The method includes: obtaining an alarm policy through a policy configuration platform and sending the alarm policy to an alarm execution engine; receiving the alarm policy sent by the alarm execution engine through a multiplexing layer, performing semantic analysis on the alarm policy to obtain the basic conditions corresponding to the alarm policy, abstracting the basic conditions to obtain target basic conditions, classifying the basic conditions based on the frequency of occurrence of each target basic condition to obtain hot conditions and non-hot conditions, querying the database for hot conditions and non-hot conditions to obtain a first observation value for hot conditions and a second observation value for non-hot conditions; and executing an alarm processing procedure for the alarm policy through the alarm execution engine based on the first observation value and the second observation value, thereby ensuring the stability of system operation and service availability.

Description

Technical Field

[0001] This invention relates to the field of alarm data processing technology, and in particular to a method for processing alarm scenarios, an apparatus for processing alarm scenarios, an electronic device, and a computer-readable storage medium. Background Technology

[0002] In CDN service systems, operators need to monitor the performance metrics and monitoring status of nodes in various regions in real time, and promptly troubleshoot and repair faulty nodes; or optimize traffic distribution and scheduling strategies to ensure service quality. Due to the edge-side nature of CDN services, the system typically includes a large number of edge-side node servers, and CDNs generally carry a large amount of traffic data, making the objects to be monitored more complex. In actual monitoring and alarm processes, corresponding alarm policies need to be set. However, the number of alarm policies is large and constantly growing. Each alarm policy judgment requires a corresponding query, which undoubtedly brings a huge performance burden and further transmits the pressure to the underlying database, thus affecting the stability and service availability of the system. Summary of the Invention

[0003] The present invention provides a method, apparatus, electronic device, and computer-readable storage medium for processing alarm scenarios, in order to solve or partially solve the problem that alarm policies bring a great performance burden to CDN business systems, affecting the stability of system operation and service availability.

[0004] This invention discloses a method for handling alarm scenarios, involving a content distribution network (CDN). The CDN includes several nodes, and caches business content corresponding to an origin server on each node. Each node, the origin server, and each node's corresponding first dimension and the origin server's corresponding second dimension are configured with independent alarm policies. The first dimension is an analysis dimension for analyzing the node's performance, and the second dimension is an analysis dimension for analyzing the origin server's performance. The method is applied to a monitoring and analysis system, which at least includes a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a reuse layer communicatively connected to the alarm execution engine, and a database communicatively connected to the reuse layer. The method includes:

[0005] The alarm policy is obtained through the policy configuration platform and sent to the alarm execution engine;

[0006] The multiplexing layer receives the alarm policy sent by the alarm execution engine, performs semantic analysis on the alarm policy to obtain the basic conditions corresponding to the alarm policy, and abstracts the basic conditions to obtain the target basic conditions.

[0007] The reuse layer classifies the basic conditions based on the frequency of occurrence of each of the target basic conditions to obtain hot conditions and non-hot conditions.

[0008] The reuse layer queries the database for the hot spot conditions and the non-hot spot conditions to obtain the first observation value corresponding to the hot spot conditions and the second observation value corresponding to the non-hot spot conditions. The first observation value and the second observation value are the basis for triggering the alarm policy.

[0009] The alarm execution engine performs the alarm processing procedure for the alarm policy based on the first observation and the second observation.

[0010] In some feasible implementations, the semantic analysis of the alarm strategy to obtain the basic conditions corresponding to the alarm strategy includes:

[0011] Obtain the logical operators for the alarm policy;

[0012] The alarm policy is segmented according to the logical operators to obtain the corresponding basic conditions.

[0013] In some feasible implementations, the abstraction of the basic conditions to obtain the target basic conditions includes:

[0014] Obtain the source site description corresponding to the source site, and the node description corresponding to the node;

[0015] Remove the source station description and / or the node description from each of the basic conditions to obtain the target basic conditions.

[0016] In some feasible implementations, classifying the basic conditions based on their frequency of occurrence to obtain hot and non-hot conditions includes:

[0017] Obtain the frequency of occurrence of each of the aforementioned basic conditions for the target;

[0018] The first basic condition to which the target basic condition with a frequency greater than or equal to a preset threshold belongs is designated as a hot spot condition, and the second basic condition to which the target basic condition with a frequency less than a preset threshold belongs is designated as a non-hot spot condition.

[0019] In some feasible implementations, querying the database for the hot spot conditions and the non-hot spot conditions to obtain the first observation value corresponding to the hot spot conditions and the second observation value corresponding to the non-hot spot conditions includes:

[0020] Determine the input parameters corresponding to the database, the input parameters including at least a first input parameter for specifying the query statement to be executed, and a second input parameter for specifying the timestamp of the query;

[0021] The interface corresponding to the database is called, and the first input parameter and the second input parameter are passed in to perform a query operation for the hotspot condition, so as to obtain the source station observation value of the hotspot condition on each of the source stations and the node observation value of the hotspot condition on each of the nodes.

[0022] In some feasible implementations, the step of querying the database for the hot spot conditions and the non-hot spot conditions to obtain the first observation value corresponding to the hot spot conditions and the second observation value corresponding to the non-hot spot conditions further includes:

[0023] The non-hotspot conditions are directly transmitted to the database through the multiplexing layer for querying, thereby obtaining the second observation value corresponding to the non-hotspot conditions.

[0024] In some feasible implementations, the alarm processing procedure for the alarm policy based on the first observation and the second observation includes:

[0025] If the first observation value meets the first preset condition, and / or the second observation value meets the second preset condition, then an alarm prompt message corresponding to the alarm strategy is generated.

[0026] This invention also discloses a processing device for alarm scenarios, involving a content distribution network. The content distribution network includes several nodes, and caches the business content corresponding to the origin server on each of the nodes. Each node, the origin server, and the first dimension and the second dimension corresponding to the origin server are configured with independent alarm policies. The first dimension is an analysis dimension for analyzing the node performance, and the second dimension is an analysis dimension for analyzing the origin server performance. The device is applied to a monitoring and analysis system, which at least includes a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a reuse layer communicatively connected to the alarm execution engine, and a database communicatively connected to the reuse layer. The device includes:

[0027] The policy acquisition module located in the policy configuration platform is used to acquire the alarm policy and send the alarm policy to the alarm execution engine;

[0028] The condition decomposition module located in the multiplexing layer is used to receive the alarm policy sent by the alarm execution engine, perform semantic analysis on the alarm policy, obtain the basic conditions corresponding to the alarm policy, and abstract the basic conditions to obtain the target basic conditions.

[0029] The classification module located in the reuse layer is used to classify the basic conditions based on the frequency of occurrence of each of the target basic conditions, and obtain hot conditions and non-hot conditions;

[0030] The query module located in the reuse layer is used to query the database for the hot spot conditions and the non-hot spot conditions, and obtain the first observation value corresponding to the hot spot conditions and the second observation value corresponding to the non-hot spot conditions. The first observation value and the second observation value are the basis for triggering the alarm policy.

[0031] The alarm processing module located in the alarm execution engine is used to perform an alarm processing procedure for the alarm policy based on the first observation value and the second observation value.

[0032] In some feasible implementations, the condition decomposition module is specifically used for:

[0033] Obtain the logical operators for the alarm policy;

[0034] The alarm policy is segmented according to the logical operators to obtain the corresponding basic conditions.

[0035] In some feasible implementations, the condition decomposition module is specifically used for:

[0036] Obtain the source site description corresponding to the source site, and the node description corresponding to the node;

[0037] Remove the source station description and / or the node description from each of the basic conditions to obtain the target basic conditions.

[0038] In some feasible implementations, the classification module is specifically used for:

[0039] Obtain the frequency of occurrence of each of the aforementioned basic conditions for the target;

[0040] The first basic condition to which the target basic condition with a frequency greater than or equal to a preset threshold belongs is designated as a hot spot condition, and the second basic condition to which the target basic condition with a frequency less than a preset threshold belongs is designated as a non-hot spot condition.

[0041] In some feasible implementations, the query module is specifically used for:

[0042] Determine the input parameters corresponding to the database, the input parameters including at least a first input parameter for specifying the query statement to be executed, and a second input parameter for specifying the timestamp of the query;

[0043] The interface corresponding to the database is called, and the first input parameter and the second input parameter are passed in to perform a query operation for the hotspot condition, so as to obtain the source station observation value of the hotspot condition on each of the source stations and the node observation value of the hotspot condition on each of the nodes.

[0044] In some feasible implementations, the query module is further used for:

[0045] The non-hotspot conditions are directly transmitted to the database through the multiplexing layer for querying, thereby obtaining the second observation value corresponding to the non-hotspot conditions.

[0046] In some feasible implementations, the alarm processing module is specifically used for:

[0047] If the first observation value meets the first preset condition, and / or the second observation value meets the second preset condition, then an alarm prompt message corresponding to the alarm strategy is generated.

[0048] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0049] The memory is used to store computer programs;

[0050] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0051] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0052] The embodiments of the present invention have the following advantages:

[0053] In this embodiment of the invention, when processing monitoring and alarm scenarios of a content delivery network, the monitoring and analysis system can be optimized. The optimized monitoring and analysis system may include a policy configuration platform, an alarm execution engine communicating with the policy configuration platform, a multiplexing layer communicating with the alarm execution engine, and a database communicating with the multiplexing layer. The system can then obtain alarm policies through the policy configuration platform and send them to the alarm execution engine. The multiplexing layer receives the alarm policies sent by the alarm execution engine, performs semantic analysis on the alarm policies to obtain the basic conditions corresponding to the alarm policies, then abstracts these basic conditions to obtain target basic conditions, and finally analyzes the alarm policies based on the frequency of occurrence of each target basic condition. The basic conditions are categorized to obtain hot and non-hot conditions. Then, the database is queried to obtain the first observation value corresponding to the hot conditions and the second observation value corresponding to the non-hot conditions. Finally, the alarm execution engine executes the alarm processing procedure according to the alarm policy based on the first and second observation values. The first and second observation values ​​are the basis for triggering the alarm policy, thereby segmenting the alarm policy at the semantic level to obtain the corresponding basic conditions. Combined with the method of identifying hot conditions, the redundancy in the alarm policy is effectively reduced, the system processing efficiency is improved, and the structure of the lexical analyzer under the content delivery network is simplified and the system performance is improved, ensuring the stability of system operation and service availability. Attached Figure Description

[0054] Figure 1 This is a flowchart of the steps of a method for processing an alarm scenario provided in an embodiment of the present invention;

[0055] Figure 2 This is a schematic diagram of the CDN monitoring architecture provided in this embodiment of the invention;

[0056] Figure 3 This is a software flowchart of the reuse layer provided in this embodiment of the invention;

[0057] Figure 4 This is a structural block diagram of an alarm scenario processing device provided in an embodiment of the present invention. Detailed Implementation

[0058] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0059] As an example, in actual monitoring and alarm processes, it is necessary to set corresponding alarm policies. However, the number of alarm policies is huge and continues to grow. The judgment of each alarm policy requires the execution of a corresponding query, which will undoubtedly bring a huge performance burden and further transmit the pressure to the underlying database, thereby affecting the stability of system operation and service availability.

[0060] To address this, the monitoring and analysis system is optimized in this invention. The optimized system includes a policy configuration platform, an alarm execution engine communicating with the policy configuration platform, a multiplexing layer communicating with the alarm execution engine, and a database communicating with the multiplexing layer. The system can obtain alarm policies through the policy configuration platform and send them to the alarm execution engine. The multiplexing layer receives the alarm policies from the alarm execution engine, performs semantic analysis on the alarm policies to obtain the basic conditions corresponding to the alarm policies, then abstracts these basic conditions to obtain target basic conditions, and finally classifies the basic conditions based on the frequency of occurrence of each target basic condition to obtain... The system identifies hot and non-hot conditions, then queries the database to obtain the first observation value corresponding to the hot condition and the second observation value corresponding to the non-hot condition. Finally, the alarm execution engine executes the alarm processing procedure based on the first and second observation values, which serve as the basis for triggering the alarm policy. This semantically segments the alarm policy to obtain the corresponding basic conditions. Combined with the method of identifying hot conditions, this effectively reduces redundancy in the alarm policy, improves the system's processing efficiency, simplifies the structure of the lexical analyzer under the content delivery network, and enhances system performance, ensuring system stability and service availability.

[0061] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, some technical features involved in the embodiments of the present invention are explained and described below:

[0062] CDN (Content Distribution Network): A content delivery network that stores copies of content on servers located in different regions and distributes them to nearby requesting clients, making content delivery faster and more stable.

[0063] Engine: refers to a combination of closely related software operations to accomplish a specific goal, providing users with an easy-to-use calling method while hiding the internal details.

[0064] Lexical Analyzer (Lexer): A program tool in computer processing technology that extracts valid words from a sequence of characters, typically used in the front-end processing of compilers.

[0065] Reference Figure 1 This document illustrates a flowchart of a method for handling an alarm scenario according to an embodiment of the present invention. The method involves a content distribution network (CDN), which includes several nodes. The CDN caches business content corresponding to an origin server on each of the nodes. Each node, the origin server, and each of the node's first dimension and the origin server's second dimension are configured with independent alarm policies. The first dimension is an analysis dimension for analyzing the node's performance, and the second dimension is an analysis dimension for analyzing the origin server's performance. The method is applied to a monitoring and analysis system, which includes at least a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a reuse layer communicatively connected to the alarm execution engine, and a database communicatively connected to the reuse layer. Specifically, the method may include the following steps:

[0066] Step 101: Obtain the alarm policy through the policy configuration platform and send the alarm policy to the alarm execution engine;

[0067] Alternatively, a Content Delivery Network (CDN) can be a network of servers distributed across different geographical locations, designed to improve website loading speed and performance by providing content from the nearest location. For example, a CDN can cache content from the origin server and distribute it to nodes around the world, enabling users to access content from the nearest node, thereby reducing latency and bandwidth consumption.

[0068] A CDN network can consist of several nodes. These nodes can be servers within the CDN network, typically located in data centers or network access points close to the user. They are responsible for caching content from the origin server and providing this content directly to the user upon request, thereby reducing direct access to the origin server. The origin server, on the other hand, can be a server storing the original content, typically a backend server for a website or application, responsible for generating or storing the website's original content, such as HTML, CSS, JavaScript, images, and videos.

[0069] For CDN networks, dimensions can be different perspectives or classification standards for analyzing and monitoring CDN network performance. For example, dimensions can include multiple dimensions such as request response status codes, abnormal bandwidth fluctuations, and download speeds. These dimensions can be set for nodes, origin servers, and individual metrics. In actual production activities, by setting independent alarm policies for each node, origin server, and dimension, the product of the number of nodes, origin servers, and dimensions is the final number of alarm policies. By setting appropriate alarm policies, it is possible to effectively detect whether nodes, origin servers, and dimensions meet performance requirements. The alarm policies are sent to the alarm execution engine at specified time intervals. The execution engine queries and calculates performance metrics from massive amounts of monitoring data based on the description of the alarm policies, and determines whether to send alarm messages to relevant personnel.

[0070] In this embodiment of the invention, the monitoring and analysis system may at least include a policy configuration platform, an alarm execution engine communicatively connected to the policy configuration platform, a multiplexing layer communicatively connected to the alarm execution engine, and a database communicatively connected to the multiplexing layer. The policy configuration platform can be used to configure alarm policies, etc.; the alarm execution engine can be used to receive alarm policies periodically sent by the policy configuration platform and execute the corresponding alarm policies, such as querying relevant data from the database; the multiplexing layer can be used to process the alarm policies received by the alarm execution engine, optimize the content involved in the alarm policies, reduce redundancy in the alarm policies, and improve the efficiency and performance of system operation; the database can be used to store relevant monitoring data, such as data obtained from monitoring source stations, nodes, and corresponding dimensions.

[0071] In practice, users can configure alarm policies for source servers, nodes, and corresponding dimensions on the alarm policy configuration platform, and send the alarm policies to the alarm execution engine. The alarm execution engine can then query and calculate performance indicators from massive amounts of monitoring data based on the relevant description of the alarm policy, and determine whether to send alarm information to relevant personnel based on the processing results.

[0072] Step 102: Receive the alarm policy sent by the alarm execution engine through the multiplexing layer, perform semantic analysis on the alarm policy to obtain the basic conditions corresponding to the alarm policy, and abstract the basic conditions to obtain the target basic conditions.

[0073] For alarm execution engines, if upon receiving an alarm policy, they immediately execute the corresponding operation, query and calculate performance metrics from massive amounts of monitoring data based on the description of the alarm policy, and determine whether to send an alarm message to relevant personnel, the sheer number and continuous growth of alarm policies can easily lead to a database query being performed for each alarm policy's determination. This results in the alarm execution engine bearing significant performance pressure, which will further propagate to the underlying database, thereby affecting the stability and service availability of the system.

[0074] In this embodiment of the invention, to reduce the query and computation pressure on the alarm execution engine, a reuse layer is introduced between the alarm execution engine and the database. The reuse layer processes the alarm policies received by the alarm execution engine, optimizes the content involved in the alarm policies, reduces redundancy in the alarm policies, and improves the efficiency and performance of system operation.

[0075] In practical implementation, the alarm execution engine can send the received alarm policy to the multiplexing layer. After receiving the alarm policy sent by the alarm execution engine, the multiplexing layer can first perform semantic analysis on the alarm policy to obtain the basic conditions corresponding to the alarm policy. Then, it can abstract the basic conditions to obtain the target basic conditions, thereby segmenting the alarm policy at the semantic level to obtain the corresponding basic conditions. This effectively reduces the redundancy in the alarm policy and improves the processing efficiency of the system.

[0076] In some feasible implementations, the reuse layer can obtain the logical operators for the alarm policy, then segment the alarm policy according to the logical operators to obtain the corresponding basic conditions; then, it can obtain the source site description corresponding to the source site and the node description corresponding to the node, and remove the source site description and / or node description from each basic condition to obtain the target basic condition. Optionally, the alarm policy can consist of at least two basic conditions, and different basic conditions can be combined based on logical operators. Based on logical operators, the alarm policy can be decomposed into corresponding basic conditions, such as logical operators such as and, or, &&, and ||. For example, for an alarm policy for a sudden drop in the number of requests, it can be split into two basic conditions such as "the rate of decrease in the number of requests is greater than 80%" and "the number of requests before the drop is greater than 20,000". This invention does not limit this.

[0077] In its implementation, the reuse layer first performs semantic analysis on the received alarm policies, decomposing them into combinations of basic conditions. Then, it abstracts all the basic conditions, removing the filtering descriptions related to specific source stations and nodes, so that they can be merged to obtain the corresponding target basic conditions. Based on the target basic conditions, further processing can be performed, thereby segmenting the alarm policies at the semantic level to obtain the corresponding basic conditions. This effectively reduces redundancy in alarm policies and improves the system's processing efficiency.

[0078] In one example, after receiving the alarm policy sent by the alarm execution engine, the multiplexing layer can obtain logical operators such as and, or, &&, ||, etc., and then cut the alarm policy according to the logical operators to obtain the corresponding basic conditions, such as cpu_usage{instance="node1"}>80, memory_usage{instance="node1"}<20, network_latency{instance="node2"}>100, etc. Then, the reuse layer can further obtain source station descriptions and node descriptions, so as to remove specific business information such as instance="node1" and instance="node2" based on the source station descriptions and node descriptions. After removing the source station descriptions and node descriptions, the corresponding target basic conditions are obtained, such as cpu_usage>80, memory_usage<20, network_latency>100, etc., so as to perform further processing based on the target basic conditions. This allows the alarm policy to be segmented at the semantic level to obtain the corresponding basic conditions, effectively reducing the redundancy in the alarm policy and improving the system's processing efficiency.

[0079] Step 104: The reuse layer classifies the basic conditions based on the frequency of occurrence of each of the target basic conditions to obtain hot conditions and non-hot conditions.

[0080] After obtaining the target basic conditions through semantic segmentation and removal of relevant business information, the frequency of occurrence of each target basic condition can be further counted. Based on the frequency of occurrence, the basic conditions are classified. The first basic condition to which the target basic condition with an occurrence frequency greater than or equal to a preset threshold belongs is designated as a hot spot condition, and the second basic condition to which the target basic condition with an occurrence frequency less than the preset threshold belongs is designated as a non-hot spot condition. In this way, the alarm strategy is segmented at the semantic level to obtain the corresponding basic conditions. Combined with the method of identifying hot spot conditions, the redundancy in the alarm strategy is effectively reduced and the system processing efficiency is improved.

[0081] In its implementation, the reuse layer can segment the alarm policy expression into basic conditions using characters like "and," "or," "&&," and "||," forming condition set 1. Then, according to the PromQL syntax, it removes specific business information such as accid from the metric label set, forming condition set 2. Condition set 2 is then merged and counted, with basic conditions exceeding 10% of the total marked as hot conditions. Following the mapping relationship between condition set 2 and condition set 1, the remaining conditions not marked as hot conditions are selected from condition set 1 to form non-hot conditions. For example, after removing business information, identical target basic conditions can be merged and counted, with those exceeding 10% marked as hot conditions and those below 10% marked as non-hot conditions. This semantically segments the alarm policy to obtain the corresponding basic conditions. Combined with the hot condition identification method, this effectively reduces redundancy in the alarm policy and improves system processing efficiency.

[0082] Step 105: Query the database through the multiplexing layer for the hot spot conditions and the non-hot spot conditions to obtain the first observation value corresponding to the hot spot conditions and the second observation value corresponding to the non-hot spot conditions;

[0083] After classifying the basic conditions, the reuse layer can query the database for hot and non-hot conditions. Based on the descriptions corresponding to the basic conditions, it can extract the relevant target data from the massive monitoring data stored in the database, calculate the corresponding performance indicators based on the target data, and obtain the first observation value corresponding to the hot condition and the second observation value corresponding to the non-hot condition. The first and second observation values ​​serve as the basis for triggering alarm policies, thereby determining whether an alarm policy has been triggered and whether to notify the relevant personnel.

[0084] In some feasible implementations, for hotspot conditions, the reuse layer can determine the input parameters corresponding to the database. These input parameters include at least a first input parameter specifying the query statement to be executed and a second input parameter specifying the query timestamp. Then, it calls the corresponding database interface, passing in the first and second input parameters, to execute the query operation for the hotspot conditions, obtaining the source site observations and node observations for the hotspot conditions on each source site and each node. For non-hotspot conditions, the reuse layer can directly pass the non-hotspot conditions to the database for querying, obtaining the second observation corresponding to the non-hotspot conditions.

[0085] In the specific implementation, the database can be a Prometheus database. The reuse layer can call the Prometheus interface such as / api / v1 / query via HTTP POST requests, passing the query parameter (i.e., the first input parameter) and the time parameter (i.e., the second input parameter) to query the Prometheus database for hotspot conditions. This retrieves the observation values ​​of the hotspot conditions across all source servers and nodes, and stores the obtained observation values ​​in a hotspot file. High-speed hard drives can be used to improve access speed during storage. For non-hotspot conditions, the decomposed basic conditions are directly passed through to the backend Prometheus database for querying, and the obtained observation values ​​are directly stored in memory. By extracting the unchanging basic conditions in the alarm strategy and then using the hotspot condition merging algorithm of the basic condition set module, the total number of basic conditions can be greatly reduced, thereby reducing the number of queries to the backend database.

[0086] Step 106: The alarm execution engine performs an alarm processing procedure for the alarm policy based on the first observation and the second observation.

[0087] In this embodiment of the invention, the alarm strategy is optimized through a reuse layer to reduce redundancy. After retrieving the corresponding observations from the database based on the decomposed basic conditions, the reuse layer can return the first observation corresponding to hot events and the second observation corresponding to non-hot events to the alarm execution engine. The alarm execution engine then executes the alarm processing procedure for the alarm strategy based on the first and second observations. This allows the alarm strategy to be segmented at the semantic level to obtain the corresponding basic conditions. Combined with the method of identifying hot conditions, this effectively reduces redundancy in the alarm strategy, improves the system's processing efficiency, simplifies the structure of the lexical analyzer under the content delivery network, and improves system performance, ensuring the stability of system operation and service availability.

[0088] In the specific implementation, the alarm execution engine can compare the corresponding observation value with the preset alarm conditions and determine whether an alarm has been triggered. If the first observation value meets the first preset condition and / or the second observation value meets the second preset condition, then an alarm prompt message corresponding to the alarm strategy is generated.

[0089] In one example, suppose the observations are as follows:

[0090] cpu_usage: 75

[0091] memory_usage: 15

[0092] network latency: 90

[0093] Comparison results:

[0094] cpu_usage>80: 75<=80, the first preset condition is not met.

[0095] memory_usage<20:15<20, which satisfies the second preset condition.

[0096] network_latency>100: 90<=100, the third preset condition is not met.

[0097] Triggering conditions:

[0098] if(cpu_usage>80andmemory_usage<20)or(network_latency>100)thenalert

[0099] Since the conditions of cpu_usage>80 and network_latency>100 are not met, no alarm was triggered.

[0100] Alarm message:

[0101] Alarm strategy:

[0102] if(cpu_usage>80andmemory_usage<20)or(network_latency>100)thenalert

[0103] Observations: cpu_usage = 75, memory_usage = 15, network_latency = 90

[0104] Alarm message: No alarm triggered.

[0105] In another example, suppose the observations are as follows:

[0106] cpu_usage: 85

[0107] memory_usage: 25

[0108] network_latency: 120

[0109] Comparison results:

[0110] cpu_usage>80:85>80, satisfying the first preset condition.

[0111] memory_usage<20:25>=20, which does not meet the second preset condition.

[0112] network_latency>100: 120>100, satisfying the third preset condition.

[0113] Triggering conditions:

[0114] if(cpu_usage>80and memory_usage<20)or(network_latency>100)then alert

[0115] An alarm was triggered because network_latency > 100 was met.

[0116] Alarm message:

[0117] Alert policy: if (cpu_usage > 80 and memory_usage < 20) or (network_latency > 100) then alert

[0118] Observations: cpu_usage = 85, memory_usage = 25, network_latency = 120

[0119] Alarm message: Network latency exceeded 100ms, triggering an alarm.

[0120] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0121] In this embodiment of the invention, when processing monitoring and alarm scenarios of a content delivery network, the monitoring and analysis system can be optimized. The optimized monitoring and analysis system may include a policy configuration platform, an alarm execution engine communicating with the policy configuration platform, a multiplexing layer communicating with the alarm execution engine, and a database communicating with the multiplexing layer. The system can then obtain alarm policies through the policy configuration platform and send them to the alarm execution engine. The multiplexing layer receives the alarm policies sent by the alarm execution engine, performs semantic analysis on the alarm policies to obtain the basic conditions corresponding to the alarm policies, then abstracts these basic conditions to obtain target basic conditions, and finally analyzes the alarm policies based on the frequency of occurrence of each target basic condition. The basic conditions are categorized to obtain hot and non-hot conditions. Then, the database is queried to obtain the first observation value corresponding to the hot conditions and the second observation value corresponding to the non-hot conditions. Finally, the alarm execution engine executes the alarm processing procedure according to the alarm policy based on the first and second observation values. The first and second observation values ​​are the basis for triggering the alarm policy, thereby segmenting the alarm policy at the semantic level to obtain the corresponding basic conditions. Combined with the method of identifying hot conditions, the redundancy in the alarm policy is effectively reduced, the system processing efficiency is improved, and the structure of the lexical analyzer under the content delivery network is simplified and the system performance is improved, ensuring the stability of system operation and service availability.

[0122] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the following examples are provided for illustrative purposes:

[0123] Reference Figure 2 This diagram illustrates a CDN monitoring architecture provided in an embodiment of the present invention. The CDN monitoring architecture may include an alarm policy configuration platform, an alarm execution engine, a reuse layer, and a Prometheus database. Administrators can configure corresponding alarm policies on the alarm policy configuration platform and periodically send these policies to the alarm execution engine. Upon receiving the alarm policy, the alarm execution engine can send it to the reuse layer. The reuse layer, in each alarm cycle:

[0124] 1. Perform semantic analysis on the received alarm policies and decompose them into combinations of basic conditions;

[0125] 2. Secondly, all basic conditions are abstracted, and their filtering descriptions related to specific source sites and nodes are removed in order to facilitate merging;

[0126] 3. Next, identify the basic conditions that appear most frequently, which become hot conditions;

[0127] 4. By using an HTTP POST request, the Prometheus / api / v1 / query interface is called, passing the query and time parameters, to query the Prometheus database for hotspot conditions. The observations of this condition across all origin servers and nodes are then stored in a hotspot file, using a high-speed hard drive to improve access speed.

[0128] 5. For non-hotspot conditions, the basic conditions decomposed in step 1 are directly passed through to the backend Prometheus database for querying, and the observations are stored in memory;

[0129] 6. Iterate through each alarm policy, and based on the decomposition relationship in step 1, combine the observations of non-hotspot conditions and hotspot conditions, and return them to the alarm execution engine.

[0130] In the specific implementation, refer to Figure 3 The diagram illustrates the software flowchart of the reuse layer provided in this embodiment of the invention. Specifically, in each alarm determination cycle, the reuse layer performs the following operations:

[0131] The semantic segmentation module segments the alarm policy expression into basic conditions using the characters "and", "or", "&&", and "||", forming condition set 1.

[0132] The semantic segmentation module removes specific business information such as accid from the metric label set according to the syntax of the PromQL statement, forming condition set 2;

[0133] The basic condition set module merges and counts condition set 2, and basic conditions that account for more than 10% of the total are marked as hot conditions; according to the mapping relationship between condition set 2 and condition set 1, the remaining conditions that are not marked as hot conditions are selected from condition set 1 to form non-hot conditions.

[0134] The query module calls Prometheus's / api / v1 / query interface via HTTP POST, passing in the query and time parameters to query hot and non-hot conditions respectively, forming a result set. The query results for hot conditions are a compact dictionary-type data structure, containing the mapping relationship between the original business information and the query results.

[0135] The output module is reorganized, all alarm policies are traversed, and the correct results are selected from the non-hotspot condition query result set and the hotspot condition query result set according to the mapping relationship in the above steps and then merged and returned to the alarm execution engine.

[0136] Through the above process, techniques for merging and identifying hotspot conditions based on semantic segmentation can be used. Compared with existing technologies, this can identify and reduce redundancy in alarm strategies and improve system efficiency. Furthermore, by combining the general rules of alarm strategy expression in CDN monitoring scenarios with the semantic segmentation method of alarm strategies, the structure of the lexical analyzer in this scenario is simplified and its performance is improved.

[0137] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0138] Reference Figure 4 This diagram illustrates a structural block diagram of an alarm scenario processing device provided in an embodiment of the present invention. It relates to a content distribution network, which includes several nodes. The content distribution network caches business content corresponding to an origin server on each of the nodes. Each node, the origin server, and the first dimension and second dimension corresponding to the node and the origin server are each configured with an independent alarm strategy. The first dimension is an analysis dimension for analyzing the node's performance, and the second dimension is an analysis dimension for analyzing the origin server's performance. The device is applied to a monitoring and analysis system, which at least includes a strategy configuration platform, an alarm execution engine communicatively connected to the strategy configuration platform, a reuse layer communicatively connected to the alarm execution engine, and a database communicatively connected to the reuse layer. Specifically, it may include the following modules:

[0139] The policy acquisition module 401 located in the policy configuration platform is used to acquire the alarm policy and send the alarm policy to the alarm execution engine;

[0140] The condition decomposition module 402 located in the multiplexing layer is used to receive the alarm policy sent by the alarm execution engine, perform semantic analysis on the alarm policy, obtain the basic conditions corresponding to the alarm policy, and abstract the basic conditions to obtain the target basic conditions.

[0141] The classification module 403 located in the reuse layer is used to classify the basic conditions based on the frequency of occurrence of each of the target basic conditions, and obtain hot conditions and non-hot conditions.

[0142] The query module 404 located in the reuse layer is used to query the database for the hot spot conditions and the non-hot spot conditions, and obtain the first observation value corresponding to the hot spot conditions and the second observation value corresponding to the non-hot spot conditions. The first observation value and the second observation value are the basis for triggering the alarm policy.

[0143] The alarm processing module 405 located in the alarm execution engine is used to perform an alarm processing procedure for the alarm policy based on the first observation value and the second observation value.

[0144] In some feasible implementations, the condition decomposition module 402 is specifically used for:

[0145] Obtain the logical operators for the alarm policy;

[0146] The alarm policy is segmented according to the logical operators to obtain the corresponding basic conditions.

[0147] In some feasible implementations, the condition decomposition module 402 is specifically used for:

[0148] Obtain the source site description corresponding to the source site, and the node description corresponding to the node;

[0149] Remove the source station description and / or the node description from each of the basic conditions to obtain the target basic conditions.

[0150] In some feasible implementations, the classification module 403 is specifically used for:

[0151] Obtain the frequency of occurrence of each of the aforementioned basic conditions for the target;

[0152] The first basic condition to which the target basic condition with a frequency greater than or equal to a preset threshold belongs is designated as a hot spot condition, and the second basic condition to which the target basic condition with a frequency less than a preset threshold belongs is designated as a non-hot spot condition.

[0153] In some feasible implementations, the query module 404 is specifically used for:

[0154] Determine the input parameters corresponding to the database, the input parameters including at least a first input parameter for specifying the query statement to be executed, and a second input parameter for specifying the timestamp of the query;

[0155] The interface corresponding to the database is called, and the first input parameter and the second input parameter are passed in to perform a query operation for the hotspot condition, so as to obtain the source station observation value of the hotspot condition on each of the source stations and the node observation value of the hotspot condition on each of the nodes.

[0156] In some feasible implementations, the query module 404 is further used for:

[0157] The non-hotspot conditions are directly transmitted to the database through the multiplexing layer for querying, thereby obtaining the second observation value corresponding to the non-hotspot conditions.

[0158] In some feasible implementations, the alarm processing module 405 is specifically used for:

[0159] If the first observation value meets the first preset condition, and / or the second observation value meets the second preset condition, then an alarm prompt message corresponding to the alarm strategy is generated.

[0160] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0161] In addition, this invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described alarm scenario processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0162] This invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described alarm scenario processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0163] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0164] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, EEPROM, Flash, and eMMC, etc.) containing computer-usable program code.

[0165] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0166] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0168] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0169] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0170] The above provides a detailed description of a method and apparatus for processing alarm scenarios provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method of processing an alarm scenario, characterized by, The application relates to a content distribution network, the content distribution network comprising a plurality of nodes, the content distribution network caching service content corresponding to a source station to each node; wherein the nodes, the source station and a first dimension corresponding to the nodes and a second dimension corresponding to the source station are provided with independent alarm strategies, the first dimension is an analysis dimension for analyzing node performance of the nodes, and the second dimension is an analysis dimension for analyzing source station performance of the source station; wherein the method is applied to a monitoring and analysis system, the monitoring and analysis system at least comprising a strategy configuration platform, an alarm execution engine in communication connection with the strategy configuration platform, a multiplexing layer in communication connection with the alarm execution engine, and a database in communication connection with the multiplexing layer, and the method comprises the following steps: acquiring the alarm strategies through the strategy configuration platform and sending the alarm strategies to the alarm execution engine; receiving the alarm strategies sent by the alarm execution engine through the multiplexing layer, performing semantic layer analysis on the alarm strategies, obtaining basic conditions corresponding to the alarm strategies, and performing abstract processing on the basic conditions to obtain target basic conditions; classifying the basic conditions based on occurrence frequencies of the target basic conditions through the multiplexing layer to obtain hot conditions and non-hot conditions; inquiring the hot conditions and the non-hot conditions from the database through the multiplexing layer to obtain first observation values corresponding to the hot conditions and second observation values corresponding to the non-hot conditions, the first observation values and the second observation values being bases for triggering alarm strategies; performing alarm processing processes for the alarm strategies according to the first observation values and the second observation values through the alarm execution engine.

2. The method of claim 1, wherein, The semantic layer analysis on the alarm strategies to obtain the basic conditions corresponding to the alarm strategies comprises the following steps: acquiring logical operation symbols for the alarm strategies; cutting the alarm strategies according to the logical operation symbols to obtain corresponding basic conditions.

3. The method of claim 2, wherein, The abstract processing on the basic conditions to obtain the target basic conditions comprises the following steps: acquiring source station descriptions corresponding to the source stations and node descriptions corresponding to the nodes; removing the source station descriptions and / or the node descriptions in each basic condition to obtain target basic conditions.

4. The method of claim 1, wherein, The classification of the basic conditions based on the occurrence frequencies of the target basic conditions to obtain the hot conditions and the non-hot conditions comprises the following steps: acquiring occurrence frequencies of each target basic condition; taking first basic conditions to which target basic conditions with occurrence frequencies greater than or equal to a preset threshold belong as hot conditions, and taking second basic conditions to which target basic conditions with occurrence frequencies less than the preset threshold belong as non-hot conditions.

5. The method of claim 1, wherein, The inquiring of the hot conditions and the non-hot conditions from the database to obtain the first observation values corresponding to the hot conditions and the second observation values corresponding to the non-hot conditions comprises the following steps: determining input parameters corresponding to the database, the input parameters at least including a first input parameter for specifying a query statement to be executed, and a second input parameter for specifying a timestamp of the query; calling an interface corresponding to the database, and inputting the first input parameter and the second input parameter, to execute a query operation for the hot spot condition, to obtain source station observation values of the hot spot condition on each of the source stations, and node observation values of the hot spot condition on each of the nodes.

6. The method of claim 5, wherein, The querying of the database for the hot spot condition and the non-hot spot condition to obtain a first observation value corresponding to the hot spot condition and a second observation value corresponding to the non-hot spot condition further includes: directly transmitting the non-hot spot condition to the database through the multiplexing layer for querying to obtain a second observation value corresponding to the non-hot spot condition.

7. The method of claim 1, wherein, The alarm processing procedure for the alarm strategy according to the first observation value and the second observation value includes: generating alarm prompt information corresponding to the alarm strategy if the first observation value satisfies a first preset condition, and / or the second observation value satisfies a second preset condition.

8. An apparatus for processing an alarm scenario, characterized by The content distribution network includes a plurality of nodes, and the content distribution network caches service content corresponding to a source station on each of the nodes; wherein the nodes, the source station, and a first dimension corresponding to the nodes and a second dimension corresponding to the source station are each provided with an independent alarm strategy, the first dimension is an analysis dimension for analyzing node performance of the nodes, and the second dimension is an analysis dimension for analyzing source station performance of the source station; wherein the monitoring and analysis system at least includes a strategy configuration platform, an alarm execution engine in communication connection with the strategy configuration platform, a multiplexing layer in communication connection with the alarm execution engine, and a database in communication connection with the multiplexing layer, and the device includes: a strategy acquisition module located at the strategy configuration platform, configured to acquire the alarm strategy and send the alarm strategy to the alarm execution engine; a condition decomposition module located at the multiplexing layer, configured to receive the alarm strategy sent by the alarm execution engine, analyze the alarm strategy at a semantic level, obtain basic conditions corresponding to the alarm strategy, and perform abstraction processing on the basic conditions to obtain target basic conditions; a classification module located at the multiplexing layer, configured to classify the basic conditions based on occurrence frequencies of each of the target basic conditions to obtain hot spot conditions and non-hot spot conditions; a querying module located at the multiplexing layer, configured to query the database for the hot spot conditions and the non-hot spot conditions to obtain a first observation value corresponding to the hot spot conditions and a second observation value corresponding to the non-hot spot conditions, the first observation value and the second observation value being a basis for triggering an alarm strategy; an alarm processing module located at the alarm execution engine, configured to execute an alarm processing procedure for the alarm strategy according to the first observation value and the second observation value.

9. An electronic device, comprising: comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory accomplish mutual communication through the communication bus; the memory, configured to store a computer program; the processor, configured to execute the program stored on the memory, so as to realize the method in any one of claims 1-7.

10. A computer readable storage medium having stored thereon instructions which, when executed by one or more processors, cause the processors to perform the method in any one of claims 1-7.

Images