Information system operation data snapshot storage and analysis method and device

Abstract

The present application discloses a method and device for storing and analyzing snapshots of information system operation data. The method includes: receiving first event information reported by a first subsystem in a distributed information system; determining a first data collection rule corresponding thereto from an event rule library, and collecting data generated by event-related nodes within a preset time window from multiple subsystems of the system according to this rule; the event rule library contains a mapping relationship between different events and data collection rules; in response to a data management instruction input by a target object in an interactive interface, the first event data is processed to obtain second event data, and displayed in a specified manner, the instruction including: viewing, filtering, analyzing or replaying data in chronological order. The present application solves the technical problems of excessive data volume, difficulty in efficiently obtaining necessary event information, and low observability in distributed information system management scenarios.

Description

Technical Field

[0001] The present application relates to the technical field of distributed system management, and in particular to a method and device for storing and analyzing snapshots of operation data of an information system. Background Art

[0002] Distributed architecture systems play an important role in many key scenarios, especially in services that need to process large amounts of data, provide high availability and elastic expansion. In the financial field, online payment processing, risk management and compliance, big data analysis and risk control, intelligent customer service and decision support, cross-border payment and settlement, equipment monitoring and data processing, investment trading platforms, risk management, etc. of financial services all widely use distributed architecture systems. With the widespread application of distributed architecture in information system construction, the complexity of operation and maintenance brought by it has gradually become the focus of attention in the industry. Observability, as a key link in the construction of distributed system capabilities, aims to monitor, debug and analyze system behavior, use automated means to capture operating details in complex environments, identify and solve potential problems in a timely manner. Despite this, there are still many challenges to improving observability. On the one hand, the growth of the number of nodes in distributed systems leads to a geometric increase in operating information. It is time-consuming and laborious to accurately extract data related to potential risks of the system from massive data. On the other hand, since data is scattered in logs, monitoring, link tracking and internal applications, data formats from different sources are different, which brings additional difficulties to data collection, integration and effective analysis.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method and device for storing and analyzing snapshots of information system operation data, so as to at least solve the technical problems of excessive data volume, difficulty in efficiently obtaining necessary event information, and low observability in distributed information system management scenarios.

[0005] According to one aspect of an embodiment of the present application, a method for storing and analyzing snapshots of operation data of an information system is provided, comprising: receiving first event information reported by a first subsystem in a distributed information system; determining a first data collection rule corresponding to the first event information from an event rule library, and collecting the first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection range, and the data collection range includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window; in response to a data management instruction input by a target object in an interactive interface, processing the first event data according to the data management instruction to obtain second event data, and displaying the second event data in a preset display manner in the interactive interface, wherein the data management instruction includes at least one of the following: a data viewing instruction, a data filtering instruction, a data analysis instruction, and a data playback instruction for playing event data in a time sequence in video form.

[0006] Optionally, the first event information is alarm event information. After receiving the first event information reported by the first subsystem in the distributed information system, the method also includes: determining the first node in the first subsystem that reports the first event information, and determining a preset second node associated with the first node, wherein the second node is a node that will trigger its own alarm due to the alarm of the first node; and not processing the alarm event information received from the first node or the second node within a preset time period after receiving the first event information.

[0007] Optionally, the event rule library stores data collection rules corresponding to multiple events, wherein each data collection rule includes: the event type of the corresponding event, the nodes associated with the corresponding event in multiple subsystems of the distributed information system, the collection items corresponding to each associated node, the collection method and the collection time window, the type of collection item includes at least one of the following: log, monitoring indicator, link monitoring information, and the collection time window is a time period including a preset time length before and after the event occurs.

[0008] Optionally, the configuration process of the event rule library includes: determining multiple events that may occur in the distributed information system; for each event, determining the event type of the event; obtaining a system topology diagram of the distributed information system, and determining the nodes associated with the event based on the system topology diagram, or obtaining the nodes associated with the event set by the target object in the interactive interface; obtaining the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface; generating data collection rules corresponding to the event based on the event type, the nodes associated with the event, and the collection items, collection methods and collection time windows corresponding to each associated node.

[0009] Optionally, the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface are obtained, including: for each associated node, in response to the template selection instruction of the target object in the interactive interface, obtaining a template that matches the template selection instruction from a preset template library, wherein the template includes: preconfigured collection items, collection methods, and collection time windows; in response to the modification instruction of the target object in the interactive interface, modifying the obtained template according to the modification instruction, and determining the collection items, collection methods and collection time windows corresponding to the associated nodes according to the modified template; or, obtaining the collection items, collection methods and collection time windows customized by the target object for the associated nodes in the interactive interface.

[0010] Optionally, each data collection rule also includes: weights corresponding to each associated node of the corresponding event, wherein when data collection is performed according to the data collection rule, only node data of associated nodes whose weights are not less than a preset threshold will be collected.

[0011] Optionally, first event data is collected from the distributed information system according to the first data collection rule, including: for each first collection item corresponding to each first associated node in the first data collection rule, using the first collection method corresponding to the first collection item to collect data corresponding to the first collection item generated by the first associated node within the corresponding first collection time window; wherein, when the first collection item is a log, the first collection method is to use the ElasticSearch tool to collect the corresponding log; when the first collection item is a monitoring indicator, the first collection method is to use the Prometheus tool to collect the corresponding monitoring indicator; when the first collection item is link monitoring information, the first collection method is to use the SkyWalking tool to collect the corresponding link monitoring information; multiple groups of data corresponding to multiple first collection items are stored in the target database according to a preset data format, wherein the preset data format at least includes: collection timestamp, event type, trigger event node, collection node, data type, data content, and time synchronization of all nodes in multiple subsystems of the distributed information system.

[0012] Optionally, in response to a data management instruction input by the target object in the interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner, including: in response to a data filtering instruction input by the target object in the interactive interface, third event data matching the data filtering instruction is selected from the first event data of the target database; for each associated node in the third event data, the filtered data corresponding to the associated node is determined, and unfiltered data corresponding to the associated node is obtained from the target database; the filtered data and unfiltered data corresponding to each associated node in the third event data are uniformly displayed as second event data in the interactive interface.

[0013] Optionally, in response to a data management instruction input by the target object in the interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner, including: in response to a data viewing instruction input by the target object in the interactive interface, the first event data is obtained from the target database; for the monitoring indicator data corresponding to each associated node in the first event data, a curve of the monitoring indicator data changing over time is determined; for the log data and / or link monitoring information data corresponding to each associated node in the first event data, an index sequence corresponding to the log data and / or link monitoring information data is generated, wherein the index sequence is a sequence composed of indexes of multiple groups of log data and / or link monitoring information data of the same associated node in time series; and each curve and index sequence is displayed as the preset area corresponding to each of the second event data in the interactive interface.

[0014] Optionally, the method also includes: in response to the target object's selection operation on the monitoring indicator data or log data index or link monitoring information data index of any associated node at any time in a preset area, the monitoring indicator data, log data and link monitoring information data of the associated node at the corresponding time are uniformly highlighted and displayed.

[0015] Optionally, data corresponding to different associated nodes are displayed in different colors.

[0016] Optionally, in response to a data management instruction input by the target object in the interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner, including: in response to a data playback instruction input by the target object in the interactive interface, determining the second event data within a time window that matches the data playback instruction from the first event data; displaying the second event data in the interactive interface in a time sequence in the form of a video; in response to an operation instruction of the target object on the displayed video, performing a corresponding operation on the displayed video, wherein the operation instruction includes at least one of the following: pause, jump, and playback speed adjustment.

[0017] Optionally, in response to a data management instruction input by the target object in the interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner, including: in response to a data analysis instruction input by the target object in the interactive interface, calling a pre-trained large language model to analyze the first event data to obtain second event data, wherein the second event data at least includes: an event description text, the large language model is trained using historical event information and a knowledge base corresponding to the distributed information system; and displaying the second event data in the interactive interface.

[0018] Optionally, the method also includes: displaying in the interactive interface first note information added by other objects to the second event data, to which the target object has access rights; and in response to second note information and note access rights setting information added by the target object to the second event data in the interactive interface, storing the second note information and note access rights setting information in the target database.

[0019] Optionally, the method also includes: obtaining the target object's evaluation information on each associated node in the first event data, analyzing the evaluation information using a pre-trained evaluation analysis model to obtain new weights corresponding to each associated node, and using the new weights to update the weights corresponding to each associated node in the first data collection rule; or, in response to the target object's weight update instruction for each associated node in the first data collection rule in the interactive interface, updating the weights corresponding to each associated node according to the weight update instruction.

[0020] According to another aspect of an embodiment of the present application, there is also provided an information system operation data snapshot storage and analysis device, comprising: a receiving module, for receiving first event information reported by a first subsystem in a distributed information system; a collection module, for determining a first data collection rule corresponding to the first event information from an event rule library, and collecting the first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection range, and the data collection range includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window; a management module, for responding to a data management instruction input by a target object in an interactive interface, processing the first event data according to the data management instruction to obtain second event data, and displaying the second event data in a preset display manner in the interactive interface, wherein the data management instruction includes at least one of the following: a data viewing instruction, a data filtering instruction, a data analysis instruction, and a data playback instruction for playing event data in a time sequence in video form.

[0021] According to another aspect of an embodiment of the present application, a computer program product is also provided, the computer program product comprising: a computer program, wherein when the computer program is executed by a processor, the above-mentioned information system operation data snapshot storage and analysis method is implemented.

[0022] According to another aspect of an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned information system operation data snapshot storage and analysis method through the computer program.

[0023] In an embodiment of the present application, event information reported from a first subsystem in a distributed information system is received; a data collection rule matching the received event information is searched from an event rule library, the event rule library storing a mapping relationship between different event types and rules for required data collection; based on the determined data collection rules, event-related data can be collected from multiple associated subsystems in the distributed information system, including monitoring indicators, logs, and link tracking data within a preset time window; the system responds to user operations on the interactive interface, including instructions such as data viewing, data filtering, data analysis, and data playback, through which the user can finely control the display and analysis of event data as needed, thereby improving the flexibility of troubleshooting and system optimization; the data (second event data) processed by the user instructions is displayed to the user in a preset manner, such as displaying indicator changes through a curve chart, displaying log information through a list, or displaying time series changes of events through video playback, this intuitive display method helps users quickly understand the overall picture and details of the event, thereby solving the technical problems of excessive data volume, difficulty in efficiently obtaining necessary event information, and low observability in distributed information system management scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0025] Figure 1 It is a flowchart of an optional information system operation data snapshot storage and analysis method according to an embodiment of the present application;

[0026] Figure 2 It is a structural diagram of a system for implementing an optional method for storing and analyzing snapshots of information system operation data according to an embodiment of the present application;

[0027] Figure 3 It is a schematic structural diagram of an optional information system operation data snapshot storage and analysis device according to an embodiment of the present application;

[0028] Figure 4 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Example 1

[0032] According to an embodiment of the present application, a method for storing and analyzing snapshots of operation data of an information system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 1 is a flow chart of a method for storing and analyzing snapshots of information system operation data provided in accordance with an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0034] Step S102, receiving first event information reported by a first subsystem in a distributed information system;

[0035] Step S104, determining a first data collection rule corresponding to the first event information from an event rule library, and collecting the first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection scope, and the data collection scope includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window;

[0036] Step S106, in response to the data management instruction input by the target object in the interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner, wherein the data management instruction includes at least one of the following: data viewing instructions, data filtering instructions, data analysis instructions, and data playback instructions for playing event data in a time sequence in video form.

[0037] The following describes the various steps of the information system operation data snapshot storage and analysis method in conjunction with a specific implementation process.

[0038] First, first event information reported by a first subsystem in a distributed information system is received.

[0039] As an optional implementation, the first event information is alarm event information. After receiving the first event information reported by the first subsystem in the distributed information system, the method also includes: determining the first node in the first subsystem that reports the first event information, and determining a preset second node associated with the first node, wherein the second node is a node that will trigger its own alarm due to the alarm of the first node; and not processing the alarm event information received from the first node or the second node within a preset time period after receiving the first event information.

[0040] For example, when a component in the first subsystem (such as a service instance or node) encounters a problem and triggers an alarm, the alarm information will be reported to the unified alarm platform data aggregation unit A. The alarm information may include key data such as the basic description of the event, timestamp, and scope of impact. After determining the second node associated with the first node, the alarm events from the first node or the second node within a preset time period after receiving the first event information can be processed by the alarm convergence algorithm to avoid interference from repeated or irrelevant alarms. Specifically, if the first node or the second node reports the alarm information again within the preset time period, it will be determined whether these alarms are associated with the first event. If it is determined to be an associated alarm, it will not be processed repeatedly to avoid unnecessary resource consumption and potential information confusion.

[0041] After obtaining the first event information, a first data collection rule corresponding to the first event information is determined from an event rule library, and the first event data is collected from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection scope, and the data collection scope includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window.

[0042] As an optional implementation, the event rule library stores data collection rules corresponding to multiple events, wherein each data collection rule includes: the event type of the corresponding event, the nodes associated with the corresponding event in multiple subsystems of the distributed information system, the collection items corresponding to each associated node, the collection method and the collection time window, the type of the collection item includes at least one of the following: log, monitoring indicator, link monitoring information, and the collection time window is a time period including a preset time before and after the event occurs. Each data collection rule can also include the associated nodes of the reporting subsystem and the associated nodes of other subsystems associated with the reporting subsystem. Table 1 gives a list of data collection rules.

[0043] Table 1 List of data collection rules

[0044]

[0045] The event rule base is a dynamically updated database that contains data collection rules for different event types. These rules describe in detail how the system should obtain event-related data from multiple subsystems in the distributed information system when a specific event occurs. Each data collection rule in the rule base contains the following key information: Event type: specifies the specific event that triggers data collection, such as service anomalies, system restarts, performance bottlenecks, etc.; Associated nodes: lists the system nodes related to specific events, which may be directly or indirectly affected and need to be checked in detail; Collection items: defines the type of data that needs to be obtained from the associated nodes, including logs, monitoring indicators, link monitoring information, etc.; Collection methods: specifies the method of obtaining specific types of data, such as through interface calls, database queries, system log capture, etc.; Collection time window: sets the time range for data collection, usually including a preset time before and after the event occurs, in order to capture the cause and effect of the event.

[0046] As an optional implementation method, the configuration process of the event rule library can be carried out according to the following steps: determine the various events that may occur in the distributed information system; for each event, determine the event type of the event; obtain the system topology diagram of the distributed information system, and determine the nodes associated with the event based on the system topology diagram, or obtain the nodes associated with the event set by the target object in the interactive interface; obtain the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface; generate data collection rules corresponding to the event based on the event type, the node associated with the event, the collection items, collection methods and collection time windows corresponding to each associated node. The specific collection instructions are the implementation codes of these contents, and the list of collection instructions is shown in Table 2:

[0047] Table 2 List of acquisition instructions

[0048]

[0049] As an optional implementation, the following steps can be taken to obtain the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface: for each associated node, in response to the template selection instruction of the target object in the interactive interface, obtain a template that matches the template selection instruction from a preset template library, wherein the template includes: preconfigured collection items, collection methods, and collection time windows; in response to the modification instruction of the target object in the interactive interface, modify the obtained template according to the modification instruction, and determine the collection items, collection methods and collection time windows corresponding to the associated nodes according to the modified template; or, obtain the collection items, collection methods and collection time windows customized by the target object for the associated nodes in the interactive interface.

[0050] For example, the target object (usually an operation and maintenance personnel or a system administrator) selects a preset template that matches the event type through an interactive interface. The system responds to the template selection instruction and obtains the selected template from the template library. The template library stores information such as pre-configured collection items, collection methods, and collection time windows for different event types. The design of the template library takes into account the characteristics of different event types. For example, for a service restart event, the pre-configured collection items may include service logs, CPU and memory utilization at the restart time, and system operation status. The collection method is selected based on the data source of the collection item. The collection time window should be set reasonably. It should not be too short to cause omission of key information, nor too long to cause data redundancy and storage pressure. The processing of modification instructions needs to ensure the integrity and consistency of data collection rules. Some verification checks may be required, such as ensuring that all Each collection item has a corresponding collection method, and the setting of the collection time window will not cause data collection conflicts. In addition, the system can support version management of templates, record the time, modification content and modifier of each template modification, so as to track historical changes and roll back to the previous version. The target object directly sets specific collection items, collection methods and collection time windows for associated nodes on the interactive interface instead of using preset templates. Custom collection item settings provide maximum flexibility. The system can provide sufficient guidance and help information on the interactive interface, such as descriptions of collection items, available options for collection methods, recommended collection time windows, etc., to reduce the difficulty of user configuration. In addition, to prevent configuration errors, the system can have certain intelligent verification capabilities, such as checking whether the collection time window covers the time when the event occurs, or verifying whether the collection method matches the data source of the collection item.

[0051] As an optional implementation, each data collection rule also includes: the weights corresponding to each associated node of the corresponding event, wherein, when data collection is performed according to the data collection rule, only the node data of the associated nodes whose weights are not less than a preset threshold will be collected. Table 3 gives a list of node weights for a collection rule.

[0052] Table 3 Node weight list of collection rules

[0053]

[0054] As an optional implementation, first event data is collected from a distributed information system according to a first data collection rule, including: for each first collection item corresponding to each first associated node in the first data collection rule, the data corresponding to the first collection item generated by the first associated node within the corresponding first collection time window is collected using the first collection method corresponding to the first collection item; wherein, when the first collection item is a log, the first collection method is to use the ElasticSearch tool to collect the corresponding log; when the first collection item is a monitoring indicator, the first collection method is to use the Prometheus tool to collect the corresponding monitoring indicator; when the first collection item is link monitoring information, the first collection method is to use the SkyWalking tool to collect the corresponding link monitoring information; multiple groups of data corresponding to multiple first collection items are stored in a target database according to a preset data format, wherein the preset data format at least includes: collection timestamp, event type, trigger event node, collection node, data type, data content, and time synchronization of all nodes in multiple subsystems of the distributed information system.

[0055] In response to a data management instruction input by a target object in an interactive interface, first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner, wherein the data management instruction includes at least one of the following: a data viewing instruction, a data filtering instruction, a data analysis instruction, and a data playback instruction for playing event data in a time sequence in video form.

[0056] Among them, as an optional implementation, users can also be allowed to filter event data according to specific needs while retaining the integrity of the data. Specifically: in response to a data filtering instruction input by the target object in the interactive interface, third event data that matches the data filtering instruction is selected from the first event data of the target database; for each associated node in the third event data, the filtered data corresponding to the associated node is determined, and the unfiltered data corresponding to the associated node is obtained from the target database; the filtered data and unfiltered data corresponding to each associated node in the third event data are uniformly displayed as second event data in the interactive interface.

[0057] Data filtering instructions are commands or operations initiated by users on the interactive interface to accurately filter the first event data stored in the target database. These instructions can be customized based on multiple dimensions and conditions, including but not limited to time windows, data types (logs, monitoring indicators, link tracking information), keywords, value ranges, specific nodes or systems, etc. The flexibility of the instructions lies in the fact that users can select a single filtering condition according to specific analysis needs, or combine multiple conditions to achieve more accurate data retrieval. For example, without filtering conditions, all data information related to the event is directly displayed, which is suitable for a preliminary understanding of the overall picture of the event. Alternatively, the user sets filtering conditions (such as time, keywords, indicator range, etc.), the system filters the data according to the conditions, and then displays the filtered results in the interface, which is suitable for in-depth analysis of specific data. Alternatively, it is similar to "filter first, then display", but after filtering, the system not only displays the data, but also supports users to dynamically replay the filtered data in chronological order to observe the evolution of the event.

[0058] In addition, as an optional implementation, when the user issues a viewing instruction on the interactive interface, the response to the instruction is specifically: in response to the data viewing instruction input by the target object in the interactive interface, the first event data is obtained from the target database; for the monitoring indicator data corresponding to each associated node in the first event data, a curve of the monitoring indicator data changing over time is determined, so that the target object can intuitively understand the dynamic changes of the indicator; for the log data and / or link monitoring information data corresponding to each associated node in the first event data, an index sequence corresponding to the log data and / or link monitoring information data is generated, wherein the index sequence is a sequence composed of indexes of multiple groups of log data and / or link monitoring information data of the same associated node in time sequence, and these sequences are arranged in chronological order to help the target object quickly locate the log and link information at a specific time point; each curve and index sequence is displayed as the second event data in the corresponding preset area in the interactive interface, so that the target object can clearly distinguish different types of data.

[0059] As an optional implementation, further, in response to the target object's selection operation in a preset area on the monitoring indicator data or log data index or link monitoring information data index of any associated node at any time, the monitoring indicator data, log data and link monitoring information data of the associated node at the corresponding time are uniformly highlighted and displayed, so as to facilitate the target object to compare and comprehensively analyze the data.

[0060] As an optional implementation, in order to improve the readability and distinguishability of data, data corresponding to different associated nodes are displayed in different colors.

[0061] This method greatly simplifies the user's analysis process of event data. By converting data into intuitive curves and ordered index sequences, and providing unified highlight functions and color coding, users can more efficiently understand and locate key information of events. At the same time, the display method of preset areas ensures clear classification of different types of data, avoids data confusion, and further improves the efficiency and accuracy of data management.

[0062] As an optional implementation, for data playback, the following steps can be taken: in response to a data playback instruction input by a target object in an interactive interface, second event data within a time window that matches the data playback instruction is determined from the first event data; the second event data is displayed in a time sequence in the form of a video in the interactive interface; in response to an operation instruction of the target object on the displayed video, corresponding operations are performed on the displayed video, wherein the operation instruction includes at least one of the following: pause, jump, and playback speed adjustment.

[0063] As an optional implementation, for data analysis, the following steps can be taken: in response to a data analysis instruction input by a target object in an interactive interface, a pre-trained large language model is called to analyze the first event data to obtain second event data, wherein the second event data at least includes: an event description text, and the large language model is trained using historical event information and a knowledge base corresponding to a distributed information system; and the second event data is displayed in the interactive interface.

[0064] As an optional implementation, in addition to the above method, for note sharing, the following steps can be taken: displaying in the interactive interface the first note information added by other objects to the second event data, to which the target object has access rights; in response to the second note information and note access rights setting information added by the target object to the second event data in the interactive interface, storing the second note information and note access rights setting information in the target database.

[0065] As an optional implementation, the following steps may also be included: obtaining the target object's evaluation information on each associated node in the first event data, analyzing the evaluation information using a pre-trained evaluation analysis model to obtain new weights corresponding to each associated node, and using the new weights to update the weights corresponding to each associated node in the first data collection rule; or, in response to the target object's weight update instruction for each associated node in the first data collection rule in the interactive interface, updating the weights corresponding to each associated node according to the weight update instruction.

[0066] Figure 2 A schematic diagram of a system structure that can realize the above process is given, as shown in Figure 2As shown in the figure, observability tool E includes log tools (such as ES), indicator tools (such as Prometheus) and link tracking tools (such as SkyWalking). These tools are deployed in distributed systems and are responsible for continuous monitoring and collection of operation data, providing raw data for module A. The unified alarm platform data aggregation unit A is responsible for collecting and integrating alarm information. It aggregates data from different sources (such as logs and indicator monitoring) and prepares data for subsequent analysis. The operation data analysis and playback unit B provides a user interface, allowing users to view and analyze event data. It also supports event playback under time synchronization and is the main tool for users to troubleshoot. The event knowledge base C stores and optimizes data collection rules when events occur, optimizes which data is most valuable for analysis through user feedback, and reduces the collection of invalid data. Intelligent analysis tool D can use AI technology (such as large models) to analyze event data and generate natural language descriptions to help users quickly understand events and make intelligent decisions. The ABCDE modules work together to form a platform that can intelligently collect and analyze distributed system operation information. Users operate on the data in unit B, such as filtering, viewing and analyzing, and then the intelligent analysis tool D generates a description. All these operations and feedback will be recorded by the knowledge base C for the optimization of subsequent event processing.

[0067] The application scenario of this solution can be concretized into the following steps, aiming to improve the operation and maintenance efficiency and troubleshooting capabilities of distributed systems: Assume that in the core transaction system (first subsystem) of the bank, an abnormal transaction processing is detected, triggering an event alarm. The abnormality may be caused by a software bug, hardware failure or external network delay within the system. It is necessary to quickly locate the source of the problem to avoid affecting customer transactions and bank operations. The bank's unified alarm platform receives abnormal transaction event information reported by the core transaction system, such as "transaction processing timeout" or "transaction failure". Based on the event type, the platform searches for the corresponding collection rule from the event rule library. The rule may include collecting the core transaction system and its upstream and downstream related links. The system collects logs, performance indicators and link tracking data of the system, covering a specific time window before and after the event. With the help of mapping relationships, the system automatically and specifically collects related data, effectively reducing the blindness of data collection and improving the efficiency of fault analysis. On the interactive interface, the operation and maintenance personnel send data playback instructions based on the preliminary information of the event, requesting to view all node data related to the abnormal transaction. The platform responds to the instructions, processes and filters the event data, and generates second event data, that is, the related data that focuses more on the abnormal transaction, and displays the second event data on the interactive interface in a dynamic playback (similar to video playback). The operation and maintenance personnel can control the playback speed, pause and jump to observe the system status changes when the event occurs in more detail.

[0068] In an embodiment of the present application, event information reported from a first subsystem in a distributed information system is received; a data collection rule matching the received event information is searched from an event rule library, the event rule library stores a mapping relationship between different event types and rules for required data collection, and the setting of such rules can reduce the collection of invalid data and optimize the storage and analysis process; according to the determined data collection rules, event-related data can be collected from multiple associated subsystems in the distributed information system, including monitoring indicators, logs, and link tracking data within a preset time window; the system responds to user operations on the interactive interface, including instructions such as data viewing, data filtering, data analysis, and data playback, through which the user can finely control the display and analysis of event data as needed, thereby improving the flexibility of troubleshooting and system optimization; the data (second event data) processed by the user instructions is displayed to the user in a preset manner, such as displaying indicator changes through a curve chart, displaying log information through a list, or displaying the time series changes of events through video playback, and this intuitive display method helps users quickly understand the overall picture and details of the event, thereby solving the technical problems of excessive data volume, difficulty in efficiently obtaining necessary event information, and low observability in the distributed information system management scenario.

[0069] Example 2

[0070] According to an embodiment of the present application, there is also provided an information system operation data snapshot storage and analysis device for implementing the information system operation data snapshot storage and analysis method in Example 1, such as Figure 3 As shown, the information system operation data snapshot storage and analysis device at least includes: a receiving module 31, a collection module 32 and a management module 33, wherein:

[0071] A receiving module 31, configured to receive first event information reported by a first subsystem in a distributed information system;

[0072] The collection module 32 is used to determine a first data collection rule corresponding to the first event information from the event rule library, and collect the first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate the data collection scope, and the data collection scope includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window;

[0073] The management module 33 is used to respond to the data management instructions input by the target object in the interactive interface, process the first event data according to the data management instructions to obtain the second event data, and display the second event data in the interactive interface in a preset display mode, wherein the data management instructions include at least one of the following: data viewing instructions, data filtering instructions, data analysis instructions, and data playback instructions for playing the event data in a time sequence in the form of a video.

[0074] The functions of each module of the information system operation data snapshot storage and analysis device are explained below in conjunction with a specific implementation process.

[0075] The receiving module receives first event information reported by a first subsystem in the distributed information system.

[0076] As an optional implementation, the first event information is alarm event information. After receiving the first event information reported by the first subsystem in the distributed information system, the method also includes: determining the first node in the first subsystem that reports the first event information, and determining a preset second node associated with the first node, wherein the second node is a node that will trigger its own alarm due to the alarm of the first node; and not processing the alarm event information received from the first node or the second node within a preset time period after receiving the first event information.

[0077] After obtaining the first event information, the collection module determines a first data collection rule corresponding to the first event information from an event rule library, and collects the first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection scope, and the data collection scope includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window;

[0078] As an optional implementation, the event rule library stores data collection rules corresponding to multiple events, wherein each data collection rule includes: the event type of the corresponding event, the nodes associated with the corresponding event in multiple subsystems of the distributed information system, the collection items corresponding to each associated node, the collection method and the collection time window, the type of collection item includes at least one of the following: log, monitoring indicator, link monitoring information, and the collection time window is a time period including a preset time length before and after the event occurs.

[0079] As an optional implementation, the configuration process of the event rule library can be carried out according to the following steps: determine the various events that may occur in the distributed information system; for each event, determine the event type of the event; obtain the system topology diagram of the distributed information system, and determine the nodes associated with the event based on the system topology diagram, or obtain the nodes associated with the event set by the target object in the interactive interface; obtain the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface; generate data collection rules corresponding to the event based on the event type, the nodes associated with the event, and the collection items, collection methods and collection time windows corresponding to each associated node.

[0080] As an optional implementation, the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface are obtained, including: for each associated node, in response to the template selection instruction of the target object in the interactive interface, obtaining a template matching the template selection instruction from a preset template library, wherein the template includes: preconfigured collection items, collection methods, and collection time windows; in response to the modification instruction of the target object in the interactive interface, modifying the obtained template according to the modification instruction, and determining the collection items, collection methods and collection time windows corresponding to the associated nodes according to the modified template; or, obtaining the collection items, collection methods and collection time windows customized by the target object for the associated nodes in the interactive interface.

[0081] As an optional implementation, each data collection rule also includes: weights corresponding to each associated node of the corresponding event, wherein when data collection is performed according to the data collection rule, only node data of associated nodes with weights not less than a preset threshold will be collected.

[0082] As an optional implementation, first event data is collected from a distributed information system according to a first data collection rule, including: for each first collection item corresponding to each first associated node in the first data collection rule, the data corresponding to the first collection item generated by the first associated node within the corresponding first collection time window is collected using the first collection method corresponding to the first collection item; wherein, when the first collection item is a log, the first collection method is to use the ElasticSearch tool to collect the corresponding log; when the first collection item is a monitoring indicator, the first collection method is to use the Prometheus tool to collect the corresponding monitoring indicator; when the first collection item is link monitoring information, the first collection method is to use the SkyWalking tool to collect the corresponding link monitoring information; multiple groups of data corresponding to multiple first collection items are stored in a target database according to a preset data format, wherein the preset data format at least includes: collection timestamp, event type, trigger event node, collection node, data type, data content, and time synchronization of all nodes in multiple subsystems of the distributed information system.

[0083] Among them, as an optional implementation, in response to a data management instruction input by the target object in the interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner. The process can be carried out in the following steps: in response to a data filtering instruction input by the target object in the interactive interface, third event data matching the data filtering instruction is selected from the first event data of the target database; for each associated node in the third event data, the filtered data corresponding to the associated node is determined, and the unfiltered data corresponding to the associated node is obtained from the target database; the filtered data and unfiltered data corresponding to each associated node in the third event data are uniformly displayed as second event data in the interactive interface.

[0084] In addition, as an optional implementation, in response to a data management instruction input by the target object in the interactive interface, the first event data is processed according to the data management instruction to obtain the second event data, and the second event data is displayed in the interactive interface in a preset display manner. The process can be carried out in the following steps: in response to a data viewing instruction input by the target object in the interactive interface, the first event data is obtained from the target database; for the monitoring indicator data corresponding to each associated node in the first event data, a curve of the monitoring indicator data changing over time is determined; for the log data and / or link monitoring information data corresponding to each associated node in the first event data, an index sequence corresponding to the log data and / or link monitoring information data is generated, wherein the index sequence is a sequence of indexes of multiple groups of log data and / or link monitoring information data of the same associated node in time sequence; each curve and index sequence is displayed as the preset area corresponding to each of the second event data in the interactive interface.

[0085] As an optional implementation, in response to the target object's selection operation on the monitoring indicator data or log data index or link monitoring information data index of any associated node at any time in a preset area, the monitoring indicator data, log data and link monitoring information data of the associated node at the corresponding time are uniformly highlighted and displayed.

[0086] As an optional implementation, data corresponding to different associated nodes are displayed in different colors.

[0087] The management module responds to the data management instructions input by the target object in the interactive interface, processes the first event data according to the data management instructions to obtain second event data, and displays the second event data in the interactive interface in a preset display manner, wherein the data management instructions include at least one of the following: data viewing instructions, data filtering instructions, data analysis instructions, and data playback instructions for playing event data in video form in chronological order.

[0088] As an optional implementation, for data playback, the following steps can be taken: in response to a data playback instruction input by a target object in an interactive interface, second event data within a time window that matches the data playback instruction is determined from the first event data; the second event data is displayed in a time sequence in the form of a video in the interactive interface; in response to an operation instruction of the target object on the displayed video, corresponding operations are performed on the displayed video, wherein the operation instruction includes at least one of the following: pause, jump, and playback speed adjustment.

[0089] As an optional implementation, for data analysis, the following steps can be taken: in response to a data analysis instruction input by a target object in an interactive interface, a pre-trained large language model is called to analyze the first event data to obtain second event data, wherein the second event data at least includes: an event description text, and the large language model is trained using historical event information and a knowledge base corresponding to a distributed information system; and the second event data is displayed in the interactive interface.

[0090] As an optional implementation, in addition to the above method, for note sharing, the following steps can be taken: displaying in the interactive interface the first note information added by other objects to the second event data, to which the target object has access rights; in response to the second note information and note access rights setting information added by the target object to the second event data in the interactive interface, storing the second note information and note access rights setting information in the target database.

[0091] As an optional implementation, the following steps may also be included: obtaining the target object's evaluation information on each associated node in the first event data, analyzing the evaluation information using a pre-trained evaluation analysis model to obtain new weights corresponding to each associated node, and using the new weights to update the weights corresponding to each associated node in the first data collection rule; or, in response to the target object's weight update instruction for each associated node in the first data collection rule in the interactive interface, updating the weights corresponding to each associated node according to the weight update instruction.

[0092] It should be noted that the modules in the information system operation data snapshot storage and analysis device in the embodiment of the present application correspond one-to-one to the implementation steps of the information system operation data snapshot storage and analysis method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be repeated here.

[0093] Example 3

[0094] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, the information system operation data snapshot storage and analysis method in Example 1 is implemented.

[0095] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the information system operation data snapshot storage and analysis method in Example 1 by running the computer program.

[0096] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the information system operation data snapshot storage and analysis method in Example 1 is executed when the computer program is running.

[0097] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the information system operation data snapshot storage and analysis method in Example 1 through the computer program.

[0098] Specifically, when the computer program is running, the following steps are executed: receiving first event information reported by a first subsystem in a distributed information system; determining a first data collection rule corresponding to the first event information from an event rule library, and collecting first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection range, and the data collection range includes: node data generated by nodes associated with events in multiple subsystems of the distributed information system within a preset time window; in response to a data management instruction input by a target object in an interactive interface, processing the first event data according to the data management instruction to obtain second event data, and displaying the second event data in a preset display manner in the interactive interface, wherein the data management instruction includes at least one of the following: a data viewing instruction, a data screening instruction, a data analysis instruction, and a data playback instruction for playing event data in a time sequence in video form.

[0099] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 4 The hardware structure block diagram of an electronic device for implementing a method for storing and analyzing snapshots of information system operation data is shown. Figure 4 As shown, the electronic device 40 may include one or more (402a, 402b, ..., 402n are used to illustrate) processors 402 (the processor 402 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 404 for storing data, and a transmission device 406 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components as shown, or with Figure 4 Different configurations shown.

[0100] It should be noted that the one or more processors 402 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 40. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0101] The memory 404 can be used to store software programs and modules of application software, such as the program instruction / data storage device corresponding to the information system operation data snapshot storage and analysis method in the embodiment of the present application. The processor 402 executes various functional applications and data processing by running the software programs and modules stored in the memory 404, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 404 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 404 may further include a memory remotely arranged relative to the processor 402, and these remote memories may be connected to the electronic device 40 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0102] The transmission device 406 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 40. In one example, the transmission device 406 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 406 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0103] The display may be, for example, a touch screen liquid crystal display (LCD) that may enable a user to interact with a user interface of the electronic device 40 .

[0104] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.

[0105] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0107] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0108] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0109] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0110] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for storing and analyzing snapshots of information system operation data, characterized in that: include: Receiving first event information reported by a first subsystem in a distributed information system; Determine a first data collection rule corresponding to the first event information from an event rule library, and collect the first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection range, and the data collection range includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window; In response to a data management instruction input by a target object in an interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display manner, wherein the data management instruction includes at least one of the following: a data viewing instruction, a data filtering instruction, a data analysis instruction, and a data playback instruction for playing event data in a time sequence in video form.

2. The method according to claim 1, characterized in that: The first event information is alarm event information. After receiving the first event information reported by the first subsystem in the distributed information system, the method further includes: Determine a first node in the first subsystem that reports the first event information, and determine a preset second node associated with the first node, wherein the second node is a node that triggers its own alarm due to the alarm of the first node; The alarm event information received from the first node or the second node within a preset time period after the first event information is received is not processed.

3. The method according to claim 1, characterized in that The event rule library stores data collection rules corresponding to multiple events, wherein each of the data collection rules includes: the event type of the corresponding event, the nodes associated with the corresponding event in the multiple subsystems of the distributed information system, the collection items corresponding to each associated node, the collection method and the collection time window, the type of the collection item includes at least one of the following: log, monitoring indicator, link monitoring information, and the collection time window is a time period including a preset time length before and after the event occurs.

4. The method according to claim 3, characterized in that The configuration process of the event rule base includes: determining a plurality of events that may occur in the distributed information system; For each event, determining an event type of the event; Acquire a system topology diagram of the distributed information system, determine a node associated with the event based on the system topology diagram, or acquire a node associated with the event set by the target object in an interactive interface; Obtaining the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface; The data collection rules corresponding to the event are generated according to the event type, the nodes associated with the event, the collection items corresponding to each associated node, the collection method and the collection time window.

5. The method according to claim 4, characterized in that Acquiring the collection items, collection methods and collection time windows corresponding to each associated node set by the target object in the interactive interface, including: For each associated node, in response to a template selection instruction of the target object in the interactive interface, a template matching the template selection instruction is obtained from a preset template library, wherein the template includes: preconfigured collection items, collection methods, and collection time windows; in response to a modification instruction of the target object in the interactive interface, the obtained template is modified according to the modification instruction, and the collection items, collection methods, and collection time windows corresponding to the associated node are determined according to the modified template; or, The collection items, collection methods and collection time windows customized by the target object for the associated node in the interactive interface are obtained.

6. The method according to claim 3, characterized in that Each of the data collection rules also includes: weights corresponding to the associated nodes of the corresponding event, wherein when data collection is performed according to the data collection rules, only the node data of the associated nodes whose weights are not less than a preset threshold value will be collected.

7. The method according to claim 3, characterized in that Collecting first event data from the distributed information system according to the first data collection rule includes: For each first collection item corresponding to each first associated node in the first data collection rule, the data corresponding to the first collection item generated by the first associated node within the corresponding first collection time window is collected using the first collection method corresponding to the first collection item; wherein, when the first collection item is a log, the first collection method is to use the ElasticSearch tool to collect the corresponding log; when the first collection item is a monitoring indicator, the first collection method is to use the Prometheus tool to collect the corresponding monitoring indicator; when the first collection item is link monitoring information, the first collection method is to use the SkyWalking tool to collect the corresponding link monitoring information; Store multiple groups of data corresponding to multiple first collection items in a target database according to a preset data format, wherein the preset data format includes at least: collection timestamp, event type, trigger event node, collection node, data type, data content, and time synchronization of all nodes in multiple subsystems of the distributed information system.

8. The method according to claim 7, characterized in that In response to a data management instruction input by a target object in an interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display mode, including: In response to a data screening instruction input by the target object in the interactive interface, selecting third event data matching the data screening instruction from the first event data in the target database; For each associated node in the third event data, determining the filtered data corresponding to the associated node, and acquiring the unfiltered data corresponding to the associated node from the target database; The filtered data and unfiltered data corresponding to each associated node in the third event data are uniformly displayed in the interactive interface as the second event data.

9. The method according to claim 7, characterized in that: In response to a data management instruction input by a target object in an interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display mode, including: In response to a data viewing instruction input by the target object in the interactive interface, acquiring the first event data from the target database; For each associated node in the first event data, determining a curve of the monitoring indicator data changing over time; For the log data and / or link monitoring information data corresponding to each associated node in the first event data, generate an index sequence corresponding to the log data and / or link monitoring information data, wherein the index sequence is a sequence composed of indexes of multiple groups of the log data and / or link monitoring information data of the same associated node in time sequence; Each of the curves and the index sequence is displayed as the second event data in a preset area corresponding to each other in the interactive interface.

10. The method according to claim 9, characterized in that The method further comprises: In response to the target object's selection operation on the monitoring indicator data or log data index or link monitoring information data index of any associated node at any time in the preset area, the monitoring indicator data, log data and link monitoring information data of the associated node at the corresponding time are uniformly highlighted and displayed.

11. The method according to any one of claims 8 to 10, characterized in that The data corresponding to different associated nodes are displayed in different colors.

12. The method according to claim 1, characterized in that In response to a data management instruction input by a target object in an interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display mode, including: In response to a data playback instruction input by the target object in the interactive interface, determining second event data within a time window matching the data playback instruction from the first event data; Displaying the second event data in a time sequence in the form of a video in an interactive interface; In response to the operation instruction of the target object on the displayed video, a corresponding operation is performed on the displayed video, wherein the operation instruction includes at least one of the following: pause, jump, and play speed adjustment.

13. The method according to claim 1, characterized in that In response to a data management instruction input by a target object in an interactive interface, the first event data is processed according to the data management instruction to obtain second event data, and the second event data is displayed in the interactive interface in a preset display mode, including: In response to a data analysis instruction input by the target object in the interactive interface, a pre-trained large language model is called to analyze the first event data to obtain the second event data, wherein the second event data at least includes: an event description text, and the large language model is trained using historical event information and a knowledge base corresponding to the distributed information system; The second event data is displayed in the interactive interface.

14. The method according to claim 1, characterized in that The method further comprises: Displaying, in the interactive interface, first remark information added by other objects to the second event data and to which the target object has access rights; In response to the second remark information and remark access permission setting information added by the target object to the second event data in the interactive interface, the second remark information and remark access permission setting information are stored in the target database.

15. The method according to claim 6, characterized in that The method further comprises: Obtaining evaluation information of the target object on each associated node in the first event data, analyzing the evaluation information using a pre-trained evaluation analysis model to obtain new weights corresponding to each associated node, and using the new weights to update the weights corresponding to each associated node in the first data collection rule; or, In response to the target object's weight update instruction for each associated node in the first data collection rule in the interactive interface, the weight corresponding to each associated node is updated according to the weight update instruction.

16. An information system operation data snapshot storage and analysis device, characterized in that: include: A receiving module, used to receive first event information reported by a first subsystem in a distributed information system; A collection module, used to determine a first data collection rule corresponding to the first event information from an event rule library, and collect the first event data from the distributed information system according to the first data collection rule, wherein the event rule library stores a mapping relationship between different events and different data collection rules, and the data collection rule is used to indicate a data collection range, and the data collection range includes: node data generated by nodes associated with the event in multiple subsystems of the distributed information system within a preset time window; A management module, for responding to a data management instruction input by a target object in an interactive interface, processing the first event data according to the data management instruction to obtain second event data, and displaying the second event data in a preset display manner in the interactive interface, wherein the data management instruction includes at least one of the following: a data viewing instruction, a data filtering instruction, a data analysis instruction, and a data playback instruction for playing event data in a time sequence in the form of a video.

17. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the information system operation data snapshot storage and analysis method described in any one of claims 1 to 15 is implemented.

18. An electronic device, characterized in that: include: A memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the information system operation data snapshot storage and analysis method according to any one of claims 1 to 15 through the computer program.

Images