System event early warning analysis method based on graph database

Abstract

The invention relates to the technical field of oil and gas production, in particular to a system event early warning analysis method based on a graph database, which comprises the following steps of: acquiring data to form a system operation and maintenance relation model based on the graph database; setting a specific weight value for a node label according to the importance degree of the node label in the system operation and maintenance relation model in an operation and maintenance system, and constructing a node weight library; early warning levels are divided according to the severity of the system events, and a system event early warning rule base is constructed; carrying out system event influence surface analysis, and carrying out accumulation calculation according to node weights to obtain a system event influence degree value; judging system event levels according to the system event influence degree values, and sending message notifications to related cadres according to different system event levels. According to the method, the system event can be analyzed quickly, flexibly and comprehensively, the influence surface of the system event is quantified, the analysis efficiency of the system event is improved, and the method has the value of comprehensive popularization in the field of system operation and maintenance.

Description

Technical Field

[0001] The invention relates to the technical field of oil and gas production, and is a system event early warning analysis method based on a graph database. Background Art

[0002] With the development of Xinjiang Oilfield Company's information construction process, more and more oilfield information management systems are being built. These information systems play an important role in production operation, oil and gas exploration, reservoir evaluation, oil and gas production, engineering technology, business management and other business sectors. Many businesses are operated and processed on these information systems. In order to ensure the continuity of users' operations of various oilfield information management systems, it is necessary to ensure the continuous, stable and orderly operation of various oilfield information management systems. However, in the operation and maintenance of oilfield industry information systems, there are interlaced calls to the underlying data of the application system. There has been a lack of accurate assessment of the affected business and affected users after a system event occurs, and the ability to promptly and effectively notify relevant stakeholders, accurately trace the source and solve problems in a timely manner.

[0003] In the past, in the operation and maintenance of application systems, system personnel generally used monitoring software to monitor the running status of application systems in real time. After discovering system problems, they determined the causes of the system problems and the scope of impact of the system problems based on their own experience, further notified relevant stakeholders, and then analyzed and determined the causes and solved the system problems. There are certain omissions in the real-time monitoring of the system by operation and maintenance personnel using monitoring software. Occasionally, users discover the problems first after system events occur, and there is a certain lag in discovering system problems. Operation and maintenance personnel rely on experience to judge the scope of impact of system events, and cannot accurately and comprehensively judge the impact of system events, which has certain limitations. After a system event occurs, operation and maintenance personnel need to make a judgment first and then notify relevant stakeholders, which may result in omissions.

[0004] In the prior art, a Chinese invention patent with publication number CN104144071A discloses a system log processing method and a system log processing platform, which collects system logs from a device that generates system logs by accessing the device; matches the format of the collected system logs with a specified device template to confirm the device type corresponding to each system log; filters the system logs according to the device type of each system log using a specified keyword template; and sends the filtering results to a server side, which performs alarm processing on the system log.

[0005] In the prior art, a Chinese invention patent with publication number CN114238010A discloses a system event alarm method and device, which proposes a system event alarm method including: determining that a system event to be checked needs to be alarmed based on a preset alarm event rule list; determining a component to be alarmed and an alarm type based on an event type of the system event to be checked; identifying whether the system event to be checked is repeated with a previous system event of the component to be alarmed based on a repeated event identification rule corresponding to the alarm type; when the system event to be checked is not repeated with a previous system event, generating an event code indicating the event type based on the system event to be checked; storing the event code and assigning an associated event code identifier; wherein the event code identifier is unique within the current baseboard management controller operation cycle; and sending the event code identifier and the event code to an out-of-band management device for checking the event code based on the event code identifier to obtain the event type of the system event to be checked.

[0006] In the prior art, a Chinese invention patent with publication number CN112579402A discloses a method and device for locating application system faults. The method for locating application system faults includes: determining operation and maintenance objects related to the operation and maintenance of the application system; determining an indicator system required to be monitored for the operation of the application system; identifying one or more possible fault propagation chains based on the indicator system and the operation and maintenance objects; locating the fault of the application system through a fault tree analysis method based on the one or more fault propagation chains; this method overcomes the drawbacks of traditional fault locating technology based on CMDB rule reasoning, and realizes seamless connection from indicator management to fault tree analysis method.

[0007] However, the above-mentioned existing technologies mainly focus on the analysis and alarm of single system logs, which is limited to a small scope; the analysis and alarm of system events are limited to analyzing the causes of system events, and only alarm the system operation and maintenance personnel; the application system failure is accurately located, but there is a lack of analysis of the impact of system events and no related stakeholders. Summary of the invention

[0008] The present invention provides a system event early warning analysis method based on a graph database, which overcomes the deficiencies of the above-mentioned prior art and can effectively solve the problems of low efficiency, low precision and difficulty in quantification of traditional system event analysis methods.

[0009] One of the technical solutions of the present invention is achieved by the following measures: A system event early warning analysis method based on a graph database comprises the following steps: Collect data and divide it into different node labels. Establish different types of relationships based on the connections between node labels, verify all node and relationship data, remove node islands, and form a system operation and maintenance relationship model based on the graph database. According to the importance of node labels in the system operation and maintenance relationship model in the operation and maintenance system, specific weight values ​​are set for them, and a node weight library is constructed to provide a basis for quantifying the results of system event impact analysis; Divide warning levels according to the severity of system events and build a system event warning rule base; Conduct system event impact analysis, starting from the node where the fault occurs, display all nodes associated with the faulty node through graph analysis, locate the fault point in time, and perform cumulative calculation based on the node weight to obtain the system event impact value; The system event level is determined according to the system event impact value, and message notifications are sent to relevant stakeholders according to different system event levels.

[0010] The following is a further optimization and / or improvement of one of the above-mentioned technical solutions: The above data may include static data and dynamic data. The static data is directly entered into the graph database, while the dynamic data is entered into the data creation rules.

[0011] The above node weight setting rule may be: the wider the application scope of the node, the greater the weight value; the more relationships associated with the node, the greater the weight value.

[0012] The system event warning levels are graded from low to high. The above warning levels may include: information, warning, general severity, severe and disaster. Different categories of stakeholders are associated according to the level.

[0013] The construction principle of the above-mentioned warning rule library can be: the higher the system event warning level, the higher the level of the personnel notified; the higher the system event warning level, the wider the range of personnel notified.

[0014] The second technical solution of the present invention is achieved by the following measures: A system event early warning analysis system based on a graph database, comprising: System operation and maintenance relationship model building component, used to model the relationship between operation and maintenance system events and establish an operation and maintenance relationship model; Impact surface analysis and quantification components are used to perform graph analysis on the impact surface of system events, quantify the analysis results, and determine the warning level of system events; A node weight library building component is used to apply node weight setting rules to form a node weight library; The warning rule base building component is used to classify the warning levels of system events and build a warning rule base; The system event warning component is used to determine the warning level based on the analysis results after the system event is triggered, and push warning information to stakeholders.

[0015] The following is a further optimization and / or improvement of the second technical solution of the above invention: The above-mentioned impact surface analysis and quantification component may include an impact surface analysis subcomponent and an analysis result quantification subcomponent; Among them, the impact surface analysis subcomponent is used to determine the impact surface of system events; Among them, the analysis result quantification subcomponent is used to obtain the impact value of system events and determine the warning level.

[0016] The third technical solution of the present invention is achieved through the following measures: a computer device, including a memory and a processor, the memory stores a program that can be run on the processor, and the processor implements the above-mentioned system event warning analysis method based on the graph database when executing the program.

[0017] The fourth technical solution of the present invention is achieved through the following measures: a storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned system event warning analysis method based on graph database.

[0018] The present invention is based on a graph database system event analysis method, uses a relational graph database to associate information such as servers, application services, application systems, and authentication, and improves operation and maintenance efficiency by building a model through a graph database and combining monitoring data. The present invention uses a graph database for data modeling, takes the system event association relationship as the main line, and uses a force-directed graph to intuitively and vividly display the event association relationship. It performs multi-layer association relationship analysis on system events from aspects such as system event tracing, severity classification, and impact analysis, solving the problems of low efficiency, low precision, and difficulty in quantification of traditional system event analysis methods. The present invention is based on a statistical analysis method, is business-oriented, opens up the interface between the SMS gateway and the instant messaging software, and sends messages to stakeholders in real time according to the event level. Based on a graph database, the present invention performs statistics on the software and hardware information involved in the application system, classifies system events, and classifies event impacts. Through graph analysis, it fully displays the business aspects and users affected by system events, and automatically distributes warning messages to stakeholders, thereby improving the efficiency of system event resolution, and has the value of comprehensive promotion in the field of system operation and maintenance. The comprehensive graph analysis of the impact of system events on business provides a reliable basis for the integrated command of oil and gas exploration, and helps the normalization of oil and gas production in oil fields; it improves the speed of locating the cause of system events. Compared with conventional fault location, the recommended efficiency is increased by 90%, reducing labor costs; the system event impacts the automatic message sent to stakeholders, reducing the communication costs of stakeholders' telephone inquiries. The present invention adopts a traditional relational database, the underlying data is intricate, the efficiency of multi-layer correlation analysis is low, the system event classification is inflexible, and the impact analysis coverage is not comprehensive. The system event analysis method based on the graph database can quickly, flexibly and comprehensively analyze system events, quantify the impact of system events, automatically send messages to stakeholders affected by the event and quickly locate the system event failure point, improve the efficiency of system event analysis, and has the value of comprehensive promotion in the field of system operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Attached Figure 1 Schematic diagram of a flow chart of an embodiment of the present invention.

[0020] Attached Figure 2 The figure is a schematic diagram of the system event warning process according to an embodiment of the present invention.

[0021] Attached Figure 3 Schematic diagram of the system operation and maintenance metamodel of an embodiment of the present invention.

[0022] Attached Figure 4 This is a block diagram of system event quantization according to an embodiment of the present invention.

[0023] Attached Figure 5 Schematic diagram of warning message push rules according to an embodiment of the present invention.

[0024] Attached Figure 6Schematic diagram of the system operation and maintenance relationship model construction process according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The present invention is not limited by the following embodiments, and specific implementation methods can be determined based on the technical solution of the present invention and actual conditions.

[0026] The present invention will be further described below in conjunction with embodiments: Embodiment 1: As attached Figure 1 To Attachment Figure 6 As shown, the system event early warning analysis method based on the graph database includes the following steps: Based on the graph database and system operation and maintenance data, data (network, server, virtual machine, middleware, cluster, application service, system, database, administrator, user, etc.) is collected and divided into different node labels. Different types of relationships are established according to the connection between each node label, such as: user operation relationship from user to application system, service call relationship from application system to service cluster, load balancing relationship from service cluster to application service, etc. All node and relationship data are verified, node islands are removed, and a system operation and maintenance relationship model based on the graph database is formed. Among them, data includes static data and dynamic data; in the operation and maintenance environment, some data will remain fixed after being stored in the database for a certain period of time, which is static data, such as: application system, application service, virtual machine, etc., while other data will change in a short period of time, which is dynamic data, such as: user permissions, database authorization relationship, etc. Therefore, there are different construction methods for static data and dynamic data in the graph database model construction tool. Static data is directly entered into the graph database, and dynamic data is entered into the data creation rules. After the dynamic data and static data relationships are constructed, all nodes and relationship data are verified, and redundant data, i.e., node islands, are removed to form a system operation and maintenance relationship model.

[0027] According to the importance of the node labels in the system operation and maintenance relationship model in the operation and maintenance system, specific weight values ​​are set for them, and a node weight library is constructed to provide a basis for quantifying the results of the system event impact analysis. Among them, the node weight setting rules are: the wider the application range of the node, the greater the weight value; the more relationships associated with the node, the greater the weight value. Within a certain time and within a certain range, the above node weight setting rules are applied to form a node weight library.

[0028] According to the severity of system events, the warning level is divided and the system event warning rule base is constructed. The system event warning levels are classified from low to high. The warning levels include: information, warning, general severity, severity and disaster. Different categories of stakeholders are associated according to the level. The principle of constructing the warning rule base is: the higher the system event warning level, the higher the level of personnel notified; the higher the system event warning level, the wider the range of personnel notified.

[0029] Finally, the impact surface of system events is analyzed. Starting from the node where the fault occurs, all nodes associated with the faulty node are displayed through graph analysis, the fault point is located in time, and the cumulative calculation is performed according to the node weight to obtain the impact degree value of the system event. Specifically, based on the system operation and maintenance meta-model and relational data model, the impact surface of system events is analyzed by graph analysis, and the fault point of the system event is located by tracing the node source; by tracking the node association relationship, the points affected by the system event are analyzed, such as the failure of the virtual machine, which affects the middleware, service, system, user, etc., and the impact surface of the system event is determined from the point to the surface. Based on the nodes in the system event impact surface analysis results, the weight values ​​corresponding to the nodes are extracted from the node weight library, and the cumulative calculation is performed to obtain the impact degree value of the system event and determine the warning level. From the quantified analysis results, the specific impact of the system event on the operation and maintenance node is obtained.

[0030] The system event level is determined according to the system event impact value, and message notifications are sent to relevant stakeholders according to different system event levels. After the system event is triggered, the system event impact surface is analyzed based on the operation and maintenance relationship model, and the warning level is determined according to the analysis results. The corresponding stakeholders are extracted from the warning rule library, and the warning information is pushed to the stakeholders. After the warning event is lifted, the warning event release message is pushed to the stakeholders.

[0031] The purpose of the embodiment of the present invention is to make a quantitative analysis of the impact of system events based on the graph database model after the system event is generated, and automatically send messages to stakeholders according to the impact of the system event, so as to ensure the sustainable operation of the application system and the normal development of the business supported by the application system. The embodiment of the present invention focuses on the key technology of the automatic identification algorithm of the steam channeling relationship. Attempting to realize the automatic identification of steam channeling through the learning of historical data, improve the consistency and efficiency of steam channeling identification, is a useful supplement to the on-site records. The embodiment of the present invention is based on the graph database system event analysis method, uses a relational graph database to associate information such as servers, application services, application systems, and authentication, and improves the operation and maintenance efficiency by building a model through the graph database and combining monitoring data. The embodiment of the present invention uses a graph database for data modeling, takes the system event association relationship as the main line, and uses a force-directed graph to intuitively and vividly display the event association relationship. It performs multi-layer association relationship analysis on system events from aspects such as system event tracing, severity classification, and impact analysis, solving the problems of low efficiency, low precision, and difficulty in quantification of traditional system event analysis methods. The embodiment of the present invention is based on a statistical analysis method, is business production-oriented, opens up the interface between the SMS gateway and the instant messaging software, and sends messages to stakeholders in real time according to the event level.

[0032] The embodiment of the present invention is based on a graph database, which counts the software and hardware information related to the application system, classifies system events, and grades the impact of events. Through graph analysis, it comprehensively displays the business aspects and users affected by system events, and automatically distributes warning messages to stakeholders, thereby improving the efficiency of system event resolution and having the value of comprehensive promotion in the field of system operation and maintenance. The comprehensive graph analysis of the impact of system events on business provides a reliable basis for the integrated command of oil and gas exploration, and helps the normalization of oil and gas production in oil fields; it improves the speed of locating the cause of system events, and compared with conventional fault location, the recommended efficiency is increased by 90%, reducing labor costs; system event impact messages are automatically sent to stakeholders, reducing the communication costs of stakeholders' telephone inquiries. The embodiment of the present invention adopts a traditional relational database, which has complex underlying data, low efficiency in multi-layer association analysis, inflexible system event classification, and incomplete coverage of impact analysis. The system event analysis method based on a graph database can quickly, flexibly and comprehensively analyze system events, quantify the impact of system events, automatically send messages to stakeholders affected by the events, and quickly locate system event failure points, thereby improving the efficiency of system event analysis and having the value of comprehensive promotion in the field of system operation and maintenance.

[0033] Embodiment 2: Embodiments of the present invention provide a system event early warning analysis system based on a graph database, including: The system operation and maintenance relationship model building component is used to model the relationship between operation and maintenance system events and establish an operation and maintenance relationship model. The operation and maintenance system event relationship is modeled based on the graph database and operation and maintenance data. The node data is sorted out from the operation and maintenance data, such as users, networks, virtual machines, services, systems, etc. At the same time, the relationship types between the node data are sorted out, such as service deployment, service call, user operation, etc. The sorted operation and maintenance nodes and relationship data are used to establish the operation and maintenance relationship model using the graph database model building tool, including static data relationship model and dynamic data relationship model. In the operation and maintenance environment, some data will remain unchanged after being stored in the database for a certain period of time, which is static data, such as application systems, application services, virtual machines, etc., while other data will change in a short period of time, which is dynamic data, such as user permissions, database authorization relationships, etc. Therefore, there are different construction methods for static data and dynamic data in the graph database model building tool. Static data is directly entered into the graph database, while dynamic data is entered into the data creation rules. After the dynamic data and static data relationships are constructed, all nodes and relationship data are verified, and redundant data, i.e., node islands, are removed to form a system operation and maintenance relationship model.

[0034] The impact surface analysis and quantification component is used to perform a graph analysis on the impact surface of system events, quantify the analysis results, and determine the warning level of system events. The impact surface analysis and quantification component includes an impact surface analysis subcomponent and an analysis result quantification subcomponent. Among them, the impact surface analysis subcomponent is used to determine the impact surface of system events. Based on the system operation and maintenance metamodel and the relational data model, a graph analysis is performed on the impact surface of system events, and the failure point of system events is located by tracing the source of nodes; by tracking the node association relationship, the points affected by system events are analyzed, such as virtual machine failures, affecting middleware, services, systems, users, etc., and the impact surface of system events is determined from the point to the surface. Among them, the analysis result quantification subcomponent is used to obtain the impact degree value of system events and determine the warning level. Based on the nodes in the system event impact surface analysis results, the weight values ​​corresponding to the nodes are extracted from the node weight library, and the cumulative calculation is performed to obtain the impact degree value of system events and determine the warning level. From the quantified analysis results, the specific impact of system events on operation and maintenance nodes is obtained.

[0035] The node weight library construction component is used to apply the node weight setting rules to form a node weight library. The construction of the node weight library is mainly based on the following assumption, that is, the importance of the nodes in the operation and maintenance relationship model is consistent within a certain time and a certain range. This assumption is valid during the normal system operation and maintenance process. Based on this assumption, two node weight setting rules can be derived: the wider the application scope of the node, the greater the weight value; the more relationships associated with the node, the greater the weight value. Within a certain time and a certain range, the above node weight setting rules are applied to form a node weight library.

[0036] The warning rule base construction component is used to classify the warning levels of system events and build a warning rule base. The warning levels of system events are classified from low to high, including: information, warning, general severity, severity and disaster, and different categories of stakeholders are associated according to the level. Among them, the principle of building the warning rule base is: the higher the warning level of the system event, the higher the level of the personnel notified; the higher the warning level of the system event, the wider the range of personnel notified.

[0037] The system event warning component is used to determine the warning level based on the analysis results after the system event is triggered, and push warning information to stakeholders. After the system event is triggered, the impact surface of the system event is analyzed based on the operation and maintenance relationship model, the warning level is determined based on the analysis results, the corresponding stakeholders are extracted from the warning rule library, and the warning information is pushed to the stakeholders. After the warning event is lifted, the warning event release message is pushed to the stakeholders.

[0038] The embodiment of the present invention adopts a graph database for data modeling, takes the system event correlation relationship as the main line, and uses a force-directed graph to intuitively and vividly display the event correlation relationship. It performs multi-layer correlation analysis on system events from aspects such as system event tracing, severity classification, and impact analysis, solving the problems of low efficiency, low precision, and difficulty in quantification of traditional system event analysis methods. The embodiment of the present invention is based on a statistical analysis method, is business production-oriented, opens up the interface between the SMS gateway and the instant messaging software, and sends messages to stakeholders in real time according to the event level. Based on a graph database, the embodiment of the present invention counts the software and hardware information involved in the application system, classifies system events, and classifies the impact of events. Through graph analysis, it comprehensively displays the business aspects and users affected by system events, and automatically distributes warning messages to stakeholders, thereby improving the efficiency of system event resolution. It has the value of comprehensive promotion in the field of system operation and maintenance. Comprehensive map analysis of the impact of system events on business provides a reliable basis for integrated command of oil and gas exploration, and helps normalize oil and gas production in oil fields. It improves the speed of locating the cause of system events. Compared with conventional fault location, the recommended efficiency is increased by 90%, reducing labor costs. Automatic messages about the impact of system events are sent to stakeholders, reducing the communication costs of stakeholders' telephone inquiries.

[0039] Embodiment 3: In the embodiment of the present invention, by collecting basic data (network, server, virtual machine, middleware, cluster, application service, system, database, administrator, user, etc.), it is divided into different node labels, and different types of relationships are established according to the connection between each node label, for example: user operation relationship from user to application system, service call relationship from application system to service cluster, load balancing relationship from service cluster to application service, etc., verify all nodes and relationship data, remove node islands, and form a system operation and maintenance relationship model based on graph database through continuous improvement; based on the system operation and maintenance metamodel and relational data model, a graph analysis is performed on the impact surface of system events, and the system event failure point is located by tracing the node source; by tracking the node association relationship, the points affected by the system event are analyzed, for example, a virtual machine failure affects the middleware, service, system, user, etc., and the system event impact surface is judged from the point to the surface; thereby solving the problem of quickly locating the system event node and accurately analyzing the impact surface of the system event.

[0040] The embodiment of the present invention sets the weight of the node according to the influence scope and management relationship of the model node, and associates it with the system event. The system event warning level is graded from low to high, including: information, warning, general severity, severity and disaster. Different categories of stakeholders are associated according to the level. The principle of constructing the warning rule base is: the higher the system event warning level, the higher the level of the personnel notified; the higher the system event warning level, the wider the scope of the personnel notified.

[0041] The embodiments of the present invention were gradually put into use in the operation and maintenance of the Xinjiang Oilfield application system in 2021. After applying this innovative achievement, the three platforms of Xinjiang Oilfield (intelligent oilfield integration platform 1.0, intelligent oilfield integration 2.0, web application platform, a total of 103 systems) were reduced from the initial 9 people to the current 3 people. The failure time of the application system was reduced from 40 hours / year in 2021 to less than 8 hours / year at present. User satisfaction increased from 94% in 2021 to the current 99.2%, as shown in Table 1.

[0042] Embodiment 4: An embodiment of the present invention provides a computer device, which includes a memory, a processor, a communication interface and a communication bus. The memory stores a program that can be run on the processor. When the processor executes the program, it implements the system event warning analysis method based on the graph database described in the above embodiment.

[0043] The processor may be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, field programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0044] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and units, such as the corresponding program units in the above method embodiments of the present invention. The processor executes various functional applications of the processor and works data processing by running the non-transitory software programs, instructions and modules stored in the memory, that is, realizing the system event early warning analysis method based on the graph database described in the above embodiment.

[0045] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. The memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. The one or more programs are stored in the memory, and when executed by the processor, the system event warning analysis method based on the graph database described in the above embodiment is executed.

[0046] Embodiment 5: The embodiment of the present invention provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement a system event warning analysis method based on a graph database as described in any one of the above method embodiments.

[0047] The storage medium may be an internal storage unit of a computer device, such as a hard disk or memory of the computer device. The storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, smart memory card, secure digital card, flash memory card, etc. equipped on the computer device.

[0048] The above technical features constitute the embodiments of the present invention, which have strong adaptability and implementation effect. Non-essential technical features can be added or reduced according to actual needs to meet the requirements of different situations.

Claims

1. A system event early warning analysis method based on graph database, characterized in that The following steps are involved: Collect data and divide it into different node labels. Establish different types of relationships based on the connections between node labels, verify all node and relationship data, remove node islands, and form a system operation and maintenance relationship model based on the graph database. According to the importance of node labels in the system operation and maintenance relationship model in the operation and maintenance system, specific weight values ​​are set for them, and a node weight library is constructed to provide a basis for quantifying the results of system event impact analysis; Divide warning levels according to the severity of system events and build a system event warning rule base; Conduct system event impact analysis, starting from the node where the fault occurs, display all nodes associated with the faulty node through graph analysis, locate the fault point in time, and perform cumulative calculation based on the node weight to obtain the system event impact value; The system event level is determined according to the system event impact value, and message notifications are sent to relevant stakeholders according to different system event levels.

2. The system event early warning analysis method based on graph database according to claim 1 is characterized in that The data includes static data and dynamic data. Static data is directly entered into the graph database, while dynamic data is entered into data creation rules.

3. The system event early warning analysis method based on graph database according to claim 1 or 2 is characterized in that The rule for setting node weight is: the wider the application scope of the node, the greater the weight value; the more relationships associated with the node, the greater the weight value.

4. The system event early warning analysis method based on graph database according to claim 1 or 2 is characterized in that The system event warning levels are graded from low to high. The warning levels include: information, warning, general severity, severity and disaster. Different categories of stakeholders are associated according to the level.

5. The system event early warning analysis method based on graph database according to claim 3 is characterized in that The system event warning levels are graded from low to high. The warning levels include: information, warning, general severity, severity and disaster. Different categories of stakeholders are associated according to the level.

6. The system event early warning analysis method based on graph database according to claim 1, 2 or 5, characterized in that The principles for constructing the warning rule library are: the higher the system event warning level, the higher the level of personnel notified; the higher the system event warning level, the wider the range of personnel notified.

7. A system event early warning analysis system based on a graph database, characterized in that include: System operation and maintenance relationship model building component, used to model the relationship between operation and maintenance system events and establish an operation and maintenance relationship model; Impact surface analysis and quantification components are used to perform graph analysis on the impact surface of system events, quantify the analysis results, and determine the warning level of system events; A node weight library building component is used to apply node weight setting rules to form a node weight library; The warning rule base building component is used to classify the warning levels of system events and build a warning rule base; The system event warning component is used to determine the warning level based on the analysis results after the system event is triggered, and push warning information to stakeholders.

8. The system event early warning analysis system based on graph database according to claim 7 is characterized in that The impact surface analysis and quantification component includes an impact surface analysis subcomponent and an analysis result quantification subcomponent; Among them, the impact surface analysis subcomponent is used to determine the impact surface of system events; Among them, the analysis result quantification subcomponent is used to obtain the impact value of system events and determine the warning level.

9. A computer device comprising a memory and a processor, wherein the memory stores a program that can be run on the processor, characterized in that: When the processor executes the program, the system event early warning analysis method based on the graph database as described in any one of claims 1 to 6 is implemented.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the system event early warning analysis method based on the graph database as described in any one of claims 1 to 6.

Images