Index exception processing method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of data processing, and discloses an index exception processing method and device, computer equipment and a storage medium. The index exception processing method comprises the steps of determining an index type of an exception index according to index alarm information; determining a to-be-analyzed event object corresponding to the abnormal index according to the index type; recalling at least one candidate event corresponding to the to-be-analyzed event object from a preset event library according to a preset recall rule; sorting all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; and when an event selection signal is received within a preset selection time, determining a target root cause event from the candidate event sorting list, and performing event rollback processing on the target root cause event to convert an abnormal index into a normal index. According to the method, intelligent investigation is realized, the timeliness and accuracy of investigation of root cause events can be ensured, meanwhile, system problems can be quickly repaired by utilizing one-key rollback, and the processing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an indicator exception processing method, device, computer equipment and storage medium. Background Art

[0002] In the process of managing and operating the system, it is necessary to analyze and monitor the indicators, and determine the causes of the abnormal indicators when abnormal indicators occur, so as to optimize the system and business processes. The existing method is that when an alarm of abnormal indicators is received, data analysts manually analyze and troubleshoot the data until the cause of the abnormal indicators is located, and then modify and release the version after the abnormalities are located. The number of indicators in a large business system may reach thousands, and the troubleshooting methods for different types of indicators are also different. It is time-consuming and laborious to manually troubleshoot a large number of indicators, and errors may occur when new businesses are launched or functions change, and the system cannot be repaired in time, reducing processing efficiency.

[0003] Therefore, how to effectively determine the cause of the abnormality and deal with the indicator abnormality in a timely manner is an issue that needs to be solved urgently. Summary of the invention

[0004] Based on this, it is necessary to provide an indicator abnormality processing method, device, computer equipment and storage medium to address the above technical problems, so as to solve the problem that manual investigation when indicators are abnormal is prone to errors and omissions and has low processing efficiency.

[0005] A method for processing an indicator exception, comprising: Obtain indicator alarm information, and determine the indicator type of the abnormal indicator according to the indicator alarm information; Determine, according to the indicator type, an event object to be analyzed corresponding to the abnormal indicator; Recalling at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule; Sorting all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; When an event selection signal is received within a preset selection time, a target root cause event is determined from the candidate event sorting list according to the event selection signal, and an event rollback process is performed on the target root cause event to convert the abnormal indicator into a normal indicator.

[0006] An indicator abnormality processing device, comprising: An indicator type determination module is used to obtain indicator alarm information and determine the indicator type of the abnormal indicator according to the indicator alarm information; An event object determination module, used to determine the event object to be analyzed corresponding to the abnormal indicator according to the indicator type; An event recall module, used to recall at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule; An event sorting module is used to sort all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; The event rollback processing module is used to determine the target root cause event from the candidate event sorting list according to the event selection signal when an event selection signal is received within a preset selection time, and perform event rollback processing on the target root cause event to convert the abnormal indicator into a normal indicator.

[0007] A computer device comprises a memory, a processor and computer-readable instructions stored in the memory and executable on the processor, wherein the processor implements the above-mentioned indicator exception processing method when executing the computer-readable instructions.

[0008] A computer-readable storage medium stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the above-mentioned indicator exception processing method.

[0009] In the above-mentioned index abnormality processing method, device, computer equipment and storage medium, the index abnormality processing method obtains index alarm information, determines the index type of the abnormal index according to the index alarm information; determines the event object to be analyzed corresponding to the abnormal index according to the index type; recalls at least one candidate event corresponding to the event object to be analyzed from the preset event library according to the preset recall rule; sorts all candidate events according to the preset sorting rule to obtain a candidate event sorting list; when an event selection signal is received within the preset selection time, the target root cause event is determined from the candidate event sorting list according to the event selection signal, and the target root cause event is subjected to event rollback processing to convert the abnormal index into a normal index. The present invention determines the corresponding event object to be analyzed for abnormal indicators of different index types, realizes intelligent investigation, and the preset recall rules and preset sorting rules help to quickly realize event recall and event sorting, which can ensure the timeliness and accuracy of investigating the root cause event. At the same time, one-key rollback can quickly repair system problems, improve processing efficiency, and reduce system business losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0011] Figure 1 It is a flow chart of a method for handling abnormal indicators in one embodiment of the present invention; Figure 2 is a flow chart of step S20 in the method for handling abnormal indicators in one embodiment of the present invention; Figure 3 It is another flowchart of step S20 in the indicator abnormality processing method in one embodiment of the present invention; Figure 4 is another flow chart of step S20 in the method for handling abnormal indicators in one embodiment of the present invention; Figure 5 It is another flowchart of step S20 in the method for handling abnormal indicators in one embodiment of the present invention; Figure 6 is a flow chart of step S40 in the method for handling abnormal indicators in one embodiment of the present invention; Figure 7 is a flow chart of step S30 in the method for handling abnormal indicators in one embodiment of the present invention; Figure 8 is a structural schematic diagram of an indicator abnormality processing device in one embodiment of the present invention; Fig. 9 is a schematic diagram of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0013] The indicator abnormality processing method provided in this embodiment can be applied to the application scenario in which the server analyzes and processes the abnormal indicators of the client, and the client establishes a communication connection with the server. Among them, the client includes but is not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented with an independent server or a server cluster composed of multiple servers. The preset event library of the server contains all the change operation events in the system that may affect the indicators. An event refers to an operation that causes the state of an event object to change, such as a series of operations performed by a user at a certain time that causes the state of an event object to change from one state to another. The process of the server processing the indicator abnormality includes event recall, event sorting, event rollback and result feedback. Based on event recall and event sorting, the target root cause event that causes the indicator abnormality can be determined. When the target root cause event is rolled back, the abnormal indicator can be converted into a normal indicator.

[0014] In one embodiment, if Figure 1 As shown, a method for processing abnormal indicators is provided, comprising the following steps S10-S50: S10. Obtain indicator alarm information, and determine the indicator type of the abnormal indicator according to the indicator alarm information.

[0015] Understandably, indicator alarm information is a notification message sent by the client to the server to indicate that an indicator is abnormal. In order to monitor various indicators, the system sets a corresponding normal threshold for each indicator in advance. When the actual value of an indicator exceeds the corresponding normal threshold, the alarm mechanism will be triggered, and the client will generate an alarm message and send it to the server. An abnormal indicator refers to an indicator whose actual value exceeds the normal threshold.

[0016] After the server obtains the indicator alarm information, it needs to parse the fields of the indicator alarm information to extract key information. This key information may include indicator name, indicator type, alarm event object, alarm time, actual value of abnormal indicator, and alarm description information. That is, the server determines the indicator type of the abnormal indicator based on the indicator alarm information. Indicator type refers to the type of system indicators divided according to their functions, including business indicator type and technical indicator type. Each system indicator corresponds to an indicator type. Business indicators refer to indicators directly related to the business operation of the system, such as sales, user activity, conversion rate, etc. Business indicators reflect the status of business operations. Technical indicators are indicators related to system operation performance and resource utilization, such as memory usage, response time, and number of logs. Technical indicators reflect the stability of system operation.

[0017] S20. Determine, according to the indicator type, an event object to be analyzed corresponding to the abnormal indicator.

[0018] Understandably, the event object refers to the object of the operation process node in the event operation, that is, the object whose state changes due to the specific event operation. For example, when the event operation is to call an interface, the called interface is the event object. An abnormal indicator corresponds to an indicator type. When the indicator type of the abnormal indicator is different, the event object to be analyzed is determined in different ways. When the indicator type is a technical indicator type, since the technical indicator directly reflects the state of the system according to the event object, the server can directly determine the event object that causes the alarm by parsing the indicator alarm information. When the indicator type is a business indicator type, since the business indicator can only indirectly reflect the state of the system according to the event object (such as the conversion rate is an indicator that reflects the proportional relationship between the order volume and the transaction volume), the server cannot directly determine the event object that causes the alarm by parsing the indicator alarm information. It is also necessary to determine the event object that causes the alarm through a specific attribution method (such as dimensional attribution or link attribution method) according to the actual situation. The event object to be analyzed refers to all possible event objects corresponding to the abnormal indicator that issues the indicator alarm information, that is, the event object that can potentially trigger the alarm of the abnormal indicator.

[0019] S30. Recall at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule.

[0020] Understandably, the preset event library of the server contains all the change operation events in the system that may affect the indicators. An event refers to an operation that causes the state of an event object to change, and there is a mapping relationship between the event object and the event. The preset event library records the mapping relationship between different event objects and different events. According to the event object, the event involving the same event object in the operation process can be found from the preset event library and used as a candidate event, that is, the recall of the event. An event object can correspond to one or more events (indicating that an event object can be the object of one or more event operations), and an event can also correspond to one or more event objects (indicating that an event can act on one or more event objects at the same time). The preset recall rule is a pre-set rule algorithm for finding candidate events corresponding to the event object to be analyzed. The operation process node of an event may involve only one event object, or may involve multiple event objects at the same time. Candidate events correspond to the event object to be analyzed. Candidate events refer to events whose object of action of the operation process node is consistent with the event object to be analyzed, that is, events that may cause abnormal indicators of the event object to be analyzed and issue indicator alarm information.

[0021] S40: Sorting all the candidate events according to a preset sorting rule to obtain a candidate event sorting list.

[0022] Understandably, the preset sorting rules are pre-set rule algorithms for sorting the candidate events found. The preset recall rules and preset sorting rules can be rule algorithms built based on machine learning algorithms, rule engines or other data analysis technologies, and the construction of the algorithm model depends on knowledge in a specific field, historical data and system business logic. The preset recall rules are used to identify and recall related events from complex data, and the preset sorting rules are used to sort the recalled related events. The preset recall rules and preset sorting rules can be rule algorithms constructed separately, or they can be combined into a preset event analysis model, and the output of the preset recall rules in the preset event analysis model is the input of the preset sorting rules. The candidate event sorting list is an event list formed by sorting all candidate events corresponding to the event object to be analyzed according to specific rules, for example, sorting from high to low according to the probability of causing abnormal indicators.

[0023] In a specific embodiment, the preset recall rule is set to search for candidate events corresponding to the event object to be analyzed within a preset recall time. The preset recall time is a pre-set time range for limiting the recall, and the preset recall time can be adjusted according to the actual situation, for example, it is set to the last hour before the indicator alarm information is received. At the same time, the preset sorting rules include but are not limited to the same alarm object priority (compared to the alarm dependent object) rule, the closer the alarm time, the higher the priority rule, and the prior probability sorting rule output by the Bayesian model. When the indicator type is a technical indicator type, the server recalls events with the same event object as the event object to be analyzed (the first alarm object and the first alarm dependent object) within 1 hour from the preset event library as candidate events, and comprehensively sorts the event objects, time and model output probability of each candidate event to obtain a candidate event sorting list.

[0024] S50: When an event selection signal is received within a preset selection time, a target root cause event is determined from the candidate event sorting list according to the event selection signal, and an event rollback process is performed on the target root cause event to convert the abnormal indicator into a normal indicator.

[0025] Understandably, the system allows users (such as operation and maintenance personnel with operation authority) or automatic decision-making mechanisms to select the event that is most likely to be the root cause from the candidate event ranking list according to actual conditions within a certain time window. The selection process can be completed through human-computer interaction, automatic decision-making algorithms or other methods. After the preset event analysis model outputs the candidate event ranking list, the system enters a waiting state so that the user or the automatic decision-making mechanism can send an event selection signal within the preset selection time. The preset selection time is a pre-set waiting time for determining whether the event selection signal is received. The preset selection time can be adjusted according to actual conditions to ensure that the user or the automatic decision-making mechanism has enough time to review the candidate event ranking list. The event selection signal is an instruction signal for selecting a candidate event from the candidate event ranking list, and the event selection signal indicates the selected candidate event. The triggering method of the event selection signal can be a manual triggering method in which the user clicks a button through the client, or an automatic triggering method in which the automatic decision-making mechanism sends a specific instruction.

[0026] When the server receives an event selection signal within a preset selection time, the server finds the candidate event corresponding to the event selection signal from the candidate event sorting list according to the event selection signal, and determines the selected candidate event as the target root cause event. The target root cause event refers to the event of the root cause of the alarm issued by the abnormal indicator. The target root cause event is one or more of the candidate events. For example, the target root cause event can be the candidate event with the highest probability of causing the abnormal indicator. After determining the target root cause event, the system performs event rollback processing on the target root cause event to convert the abnormal indicator into a normal indicator. Event rollback processing refers to rolling back the version of the function module code corresponding to the target root cause event, and the function module of the target root cause event returns to a state that is one version lower than the current version. At this time, the system indicator that issues the alarm changes from an abnormal state to a normal state, that is, from an abnormal indicator to a normal indicator. Further, the function module code corresponding to the target root cause event before the rollback is modified so that the system can be updated to the latest version according to the modified function module code corresponding to the target root cause event.

[0027] This embodiment obtains indicator alarm information, determines the indicator type of the abnormal indicator according to the indicator alarm information; determines the event object to be analyzed corresponding to the abnormal indicator according to the indicator type; analyzes and processes the event object to be analyzed according to the preset event analysis model, and obtains a candidate event sorting list corresponding to the event object to be analyzed; when an event selection signal is received within a preset selection time, the target root cause event is determined from the candidate event sorting list according to the event selection signal, and the target root cause event is subjected to event rollback processing to convert the abnormal indicator into a normal indicator. This embodiment determines the corresponding event object to be analyzed for abnormal indicators of different indicator types, realizes intelligent investigation, and uses preset recall rules and preset sorting rules to help quickly realize event recall and event sorting, which can ensure the timeliness and accuracy of investigating root cause events, realize the orderly display of candidate events, and improve the convenience of subsequent selection of target root cause events. At the same time, one-key rollback can quickly repair system problems, improve processing efficiency, and reduce system business losses.

[0028] In one embodiment, if Figure 2 As shown, in step S20, that is, determining the event object to be analyzed corresponding to the abnormal indicator according to the indicator type, includes: S201. When the indicator type is a technical indicator type, determining the abnormal indicator as a technical abnormal indicator, and determining an event object to be analyzed corresponding to the technical abnormal indicator according to a preset dependency relationship; S202: When the indicator type is a business indicator type, obtain indicator configuration information of the abnormal indicator, and determine whether there is an indicator link relationship in the indicator configuration information; S203: If there is an indicator link relationship in the indicator configuration information, determine the abnormal indicator as a first business abnormal indicator, and determine the event object to be analyzed corresponding to the first business abnormal indicator by link attribution processing of the first business abnormal indicator; S204: If there is no indicator link relationship in the indicator configuration information, the abnormal indicator is determined as a second business abnormal indicator, and the event object to be analyzed corresponding to the second business abnormal indicator is determined by dimensional attribution processing of the second business abnormal indicator.

[0029] Understandably, when the indicator type of the abnormal indicator is different, the event object to be analyzed is determined in different ways. When the indicator type is a technical indicator type, the abnormal indicator is determined as a technical abnormal indicator, and the technical abnormal indicator is used to characterize the type of the abnormal indicator as a technical indicator type. The server needs to determine the event object to be analyzed corresponding to the technical abnormal indicator based on the preset dependency relationship. The same technical indicator may involve multiple event objects, and there are dependencies between these event objects, such as the dependency relationship between the upper and lower levels of calls between different interfaces. The preset dependency relationship refers to a pre-set relationship diagram used to characterize the call dependency relationship between all event objects corresponding to the technical indicator in the system, that is, the call dependency relationship is pre-defined based on the system architecture, business processes, and service dependencies.

[0030] When the indicator type is a business indicator type, the business indicator type is divided into a first business indicator type and a second business indicator type. The first business indicator type refers to an indicator type in which a link relationship exists between business indicators to jointly reflect the system status, and the second business indicator type refers to an indicator type that reflects the system status from a dimensional level. When the indicator type is a business indicator type, the indicator configuration information of the abnormal indicator is obtained, and it is determined whether there is an indicator link relationship in the indicator configuration information. Each indicator has corresponding indicator configuration information. The indicator configuration information is information used to characterize the differences and relationships between different indicators, such as the definition of the indicator, calculation method, data source, and association with other indicators. There may be an indicator link relationship in the indicator configuration information. The indicator link relationship refers to the relationship that the change of one indicator may affect the change of other indicators, that is, there is a direct or indirect influence relationship between two or more indicators.

[0031] If there is an indicator link relationship in the indicator configuration information, the abnormal indicator is the first business abnormal indicator, and the type of the first business abnormal indicator used to characterize the abnormal indicator is the first business indicator type. The first business abnormal indicator needs to be processed by link attribution to determine the event object to be analyzed corresponding to the first business abnormal indicator. Link attribution identifies the main driving factors that lead to specific results by tracking and analyzing the impact of each link in the business process on the indicator. If there is no indicator link relationship in the indicator configuration information, the abnormal indicator is the second business abnormal indicator, and the type of the second business abnormal indicator used to characterize the abnormal indicator is the second business indicator type. The second business abnormal indicator needs to be processed by dimension attribution to determine the event object to be analyzed corresponding to the second business abnormal indicator. Dimension attribution directly compares the indicator values ​​under different dimensions to find the dimension combination or dimension attribute that has the greatest impact on the indicator. The dimension attribution methods in actual applications include dimension search, impact identification between related dimensions, contribution attribution, etc. Link attribution mainly focuses on the transmission path of indicator changes in the business process, and dimension attribution focuses on analyzing the degree of influence of different dimensions on indicators. Link attribution is more complex than dimension attribution.

[0032] In one embodiment, if Figure 3 As shown, in step S201, that is, determining the event object to be analyzed corresponding to the technical abnormality indicator according to the preset dependency relationship includes: S2011, determining a first alarm object according to the indicator alarm information; S2012. Determine a first alarm dependency object corresponding to the first alarm object according to the preset dependency relationship; S2013: Determine the first alarm object and the first alarm dependent object as event objects to be analyzed corresponding to the technical abnormality indicator.

[0033] Understandably, the server can determine the first alarm object by parsing the indicator alarm information. The first alarm object refers to the event object that directly causes the abnormality of the technical indicator, such as applications, interfaces, and instances. The same technical indicator may involve multiple event objects, and there is a dependency relationship between these event objects, such as the dependency relationship between the upper and lower levels of calls between different interfaces. Therefore, the server also needs to determine the first alarm dependency object corresponding to the first alarm object according to the preset dependency relationship, so as to determine the first alarm object and the first alarm dependency object together as the event object to be analyzed corresponding to the technical abnormality indicator. When the interface call is abnormal, it may be that the next-level interface is abnormal, or it may be that the upper-level interface is abnormal. At this time, the next-level interface is the first alarm object, and the upper-level interface is the first alarm dependency object. The first alarm dependency object refers to an event object that has a call dependency relationship with the first alarm object, that is, more event objects are obtained in combination with the call dependency relationship of the first alarm object, and the call dependency relationship includes a first-level dependency (direct dependency) and a second-level dependency (indirect dependency).

[0034] In this embodiment, when the indicator type is a technical indicator type, the first alarm object and the first alarm dependent object corresponding to the first alarm object are first determined, and the two are jointly determined as the event object to be analyzed corresponding to the technical abnormality indicator, thereby ensuring the comprehensiveness of the event object to be analyzed and helping to improve the accuracy of subsequent root cause event investigation.

[0035] In one embodiment, if Figure 4 As shown, in step S203, that is, determining the event object to be analyzed corresponding to the first business abnormality indicator by link attribution processing of the first business abnormality indicator, includes: S2031. Perform link attribution processing on the first service abnormality indicator to obtain a target indicator factor; S2032, acquiring all technical indicators, performing correlation analysis on the target indicator factor and each of the technical indicators, and determining the correlated technical indicators correlated with the target indicator factor from all the technical indicators according to the correlation analysis result; S2033, obtaining associated alarm information of the associated technical indicator, determining a second alarm object according to the associated alarm information, and determining a second alarm dependency object corresponding to the second alarm object according to the preset dependency relationship; S2034: Determine the second alarm object and the second alarm dependent object as event objects to be analyzed corresponding to the first business abnormality indicator.

[0036] Understandably, when the abnormal indicator is the first business abnormal indicator, it indicates that there is a link relationship between the abnormal indicator and other business indicators, which jointly reflect the system status. For example, the product purchase conversion rate = the number of product purchases / the number of product clicks, where the number of product purchases and the number of product clicks are respectively an indicator factor. At this time, link attribution can be used to analyze which indicator factor introduced the increase or decrease in the product purchase conversion rate. During link attribution analysis, the first business abnormal indicator is derived from other indicator factors through function operations, nested layer by layer, and the indicator factor that introduces the abnormality can be located through changes in contribution. The server performs link attribution processing on the first business abnormal indicator to obtain the target indicator factor. The target indicator factor refers to the indicator factor that may cause the first business abnormal indicator based on link attribution analysis.

[0037] The indicator factor of the first business abnormality indicator may be associated with the technical indicator. For example, when the first business abnormality indicator is the commodity purchase conversion rate, the number of commodity purchases is the indicator factor, but the number of commodity purchases can only be obtained by calling the interface to obtain transaction data. After the server determines the target indicator factor, it performs association analysis between the target indicator factor and all technical indicators to obtain the associated technical indicators associated with the target indicator factor. The associated technical indicator refers to the technical indicator that may indirectly cause the abnormality of the target indicator factor. During the association analysis, the shopping basket analysis method is used to analyze the historical data, and the technical indicator improvement degree corresponding to the target indicator factor is obtained based on the historical abnormal data of the indicator factor and the historical abnormal data of all technical indicators. The technical indicator improvement degree refers to the probability that each technical indicator also has an abnormality when the target indicator factor is abnormal. The server combines the technical indicator improvement degree of each technical indicator with the intersection of the technical indicators that have abnormalities in the recent period (such as 24 hours) to obtain a set of abnormal technical indicators related to the abnormality of the indicator factor, that is, the associated technical indicator.

[0038] After determining the associated technical indicator, the server uses the above-mentioned method when the abnormal indicator is a technical abnormal indicator to determine the event object to be analyzed corresponding to the first business abnormal indicator. The server obtains the associated alarm information of the associated technical indicator, determines the second alarm object according to the associated alarm information, determines the second alarm dependency object corresponding to the second alarm object according to the preset dependency relationship, and determines the second alarm object and the second alarm dependency object as the event object to be analyzed corresponding to the first business abnormal indicator. Among them, the associated alarm information refers to the indicator alarm information when the associated technical indicator is abnormal, the second alarm object refers to the event object that directly causes the abnormality of the associated technical indicator, and the second alarm dependency object refers to the event object that has a call dependency relationship with the second alarm object.

[0039] In this embodiment, when the abnormal indicator is the first business abnormal indicator, the link attribution analysis is first performed to obtain the target indicator factor, and then the target indicator factor is subjected to correlation analysis to find the related technical indicator, thereby achieving in-depth mining from the business abnormal indicator to the related technical indicator, improving the rationality and accuracy of the investigation scope, and avoiding omissions. At the same time, the alarm object and the alarm dependent object of the related technical indicator are jointly determined as the event object to be analyzed corresponding to the first business abnormal indicator, ensuring the comprehensiveness of the event object to be analyzed.

[0040] In one embodiment, if Figure 5 As shown, in step S204, that is, determining the event object to be analyzed corresponding to the second business abnormality indicator by dimensional attribution processing of the second business abnormality indicator, includes: S2041. Perform dimensional attribution processing on the second business abnormality indicator to obtain a business abnormality dimensional factor; S2042: Acquire an associated activity object corresponding to the business abnormality dimension factor, and determine the associated activity object as an event object to be analyzed corresponding to the second business abnormality indicator.

[0041] Understandably, the second business abnormality indicator is used to characterize the type of abnormal indicator as the second business indicator type. The second business indicator type refers to the indicator type that reflects the system status from the dimension level. The dimension is an attribute that describes the data characteristics, such as population, assets, etc. Specifically, when the second business abnormality indicator is the gross merchandise volume (GMV), the GMV indicator = GMV of population a + GMV of population b, and population a and population b are each a business dimension. At this time, through dimension attribution, it can be analyzed which dimension introduced the increase or decrease of the GMV indicator. During the dimension attribution analysis, the business indicator is drilled down in multiple layers according to different dimensions, and then the contribution of different dimensions to the change of the business indicator is analyzed, so as to determine which dimension is the main cause. Specifically, by analyzing the contribution of GMV of population a and GMV of population b to the change rate, that is, the change rate of GMV compared with yesterday, the same day last week, or the same day last month, the server can determine which population caused the greater change, that is, which population is the business abnormality dimension factor. The business abnormality dimension factor refers to the indicator factor that may cause the second business abnormality indicator based on the dimension attribution analysis. An associated activity object corresponding to the business abnormality dimension factor is obtained, and the associated activity object is determined as an event object to be analyzed corresponding to the second business abnormality indicator.

[0042] In a specific embodiment, the event object to be analyzed refers to an operational activity corresponding to a business anomaly dimension factor, such as issuing promotional discount coupons to a specific group of people. When the server determines the event object to be analyzed corresponding to the second business anomaly indicator based on the business anomaly dimension factor, it is necessary to first obtain the associated activity object corresponding to the business anomaly dimension factor, and determine the associated activity object as the event object to be analyzed corresponding to the second business anomaly indicator. In actual business, the development of operational activities requires delivery objects of specific dimensions, such as issuing consumption coupons to different users. Associated activity objects refer to operational strategies or activities that use business anomaly dimension factors as delivery objects. That is, corresponding strategies and activities (associated activity objects) are obtained based on business anomaly dimension factors such as people and assets, and then the various activities in which people participate are used as event objects to be analyzed, so as to facilitate the subsequent recall of specific activity events.

[0043] In this embodiment, when the indicator type is the second business abnormality indicator, a dimensional attribution analysis is performed on the second business abnormality indicator to obtain a business abnormality dimension, and an event object to be analyzed corresponding to the second business abnormality indicator is determined based on the business abnormality dimension, thereby ensuring accurate positioning of the business dimension and helping to improve the rationality and accuracy of subsequent root cause event investigation.

[0044] In one embodiment, if Figure 6As shown, in step S40, that is, after determining the target root cause event from the candidate event sorting list according to the event selection signal, it also includes: S401, performing structured processing on the abnormal indicators, the event objects to be analyzed and the target root cause events, generating an indicator attribution data group, and storing the indicator attribution data group in a preset sample database; S402. Periodically obtain at least one indicator attribution data group from the preset sample database as an indicator attribution sample, and update the preset recall rule according to the indicator attribution sample to obtain an updated preset recall rule, and update the preset sorting rule according to the indicator attribution sample to obtain an updated preset sorting rule.

[0045] Understandably, after determining the target root cause event from the candidate event ranking list, in addition to performing event rollback processing on the target root cause event to achieve system repair, it is also necessary to optimize the model according to the target root cause event. The server performs structured processing on the abnormal indicators, the event objects to be analyzed, and the target root cause events, generates an indicator attribution data group, and stores the generated indicator attribution data group to the preset sample database to update the model sample data. The indicator attribution data group is structured data used to characterize the association relationship between the abnormal indicators, the event objects to be analyzed, and the target root cause events. The indicator attribution data group reflects the causal relationship between indicators, event objects, and events in the actual processing scenario. The preset sample database is a pre-set database for storing model sample data. The model sample data is sample data used to train the rule algorithm model of the preset recall rules and preset sorting rules.

[0046] Timing is a method of triggering according to a fixed time period. The fixed time period can be adjusted according to actual needs, for example, set to 1 week. The server periodically obtains at least one newly stored indicator attribution data group within the current fixed time period from the preset sample database as an indicator attribution sample. If there is no newly stored indicator attribution data group within the current fixed time period, no subsequent update operation is performed. The current fixed time period refers to the time between the last acquisition of the indicator attribution data group and the acquisition of the indicator attribution data group this time. The server updates the preset recall rules and preset sorting rules according to the indicator attribution sample to obtain the updated preset recall rules and preset sorting rules. For example, if the target root cause event in the indicator attribution data group is not the candidate event ranked first in the candidate event sorting list obtained based on the existing preset sorting rules, it indicates that the existing preset sorting rules cannot meet the actual situation, so the preset sorting rules need to be adjusted. After receiving the newly added indicator alarm information, the server analyzes and processes the event object to be analyzed according to the updated preset sorting rules to obtain the candidate event sorting list corresponding to the event object to be analyzed.

[0047] This embodiment performs structured processing on abnormal indicators, event objects to be analyzed, and target root cause events, and uses the generated indicator attribution data group as sample data of the rule algorithm model to continuously optimize the model, continuously improve the applicability and effectiveness of the preset event analysis model, and improve the accuracy of troubleshooting and the stability of the system.

[0048] In one embodiment, if Figure 7 As shown, in step S30, that is, after analyzing and processing the event object to be analyzed according to the preset event analysis model to obtain a candidate event ranking list corresponding to the event object to be analyzed, it also includes: S301: When no event selection signal is received within a preset selection time, the candidate event ranked first in the candidate event ranking list is determined as a target root cause event.

[0049] Understandably, when the server does not receive an event selection signal within the preset selection time, it indicates that the user or the automatic decision-making mechanism has not selected any candidate event from the candidate event ranking list. At this time, the candidate event ranked first in the candidate event ranking list is directly determined as the target root cause event to facilitate subsequent processing and avoid the system being abnormal for a long time. The candidate event ranked first in the candidate event ranking list may be the candidate event with the highest probability of causing indicator abnormality, or it may be the candidate event with the highest priority.

[0050] When the event selection signal cannot be received in time, this embodiment automatically selects the candidate event with the highest ranking in the candidate event ranking list as the target root cause event, thereby avoiding long and invalid waiting, and attempting to repair the system as soon as possible.

[0051] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0052] In one embodiment, a device for handling abnormal indicators is provided, and the device for handling abnormal indicators corresponds to the method for handling abnormal indicators in the above embodiment. Figure 8 As shown, the indicator abnormality processing device includes an indicator type determination module 10, an event object determination module 20, an event recall module 30, an event sorting module 40 and an event rollback processing module 50. The functional modules are described in detail as follows: The indicator type determination module 10 is used to obtain indicator alarm information and determine the indicator type of the abnormal indicator according to the indicator alarm information; An event object determination module 20, configured to determine, according to the indicator type, an event object to be analyzed corresponding to the abnormal indicator; An event recall module 30, configured to recall at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule; An event sorting module 40 is used to sort all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; The event rollback processing module 50 is used to determine the target root cause event from the candidate event sorting list according to the event selection signal when an event selection signal is received within a preset selection time, and perform event rollback processing on the target root cause event to convert the abnormal indicator into a normal indicator.

[0053] In one embodiment, the event object determination module 20 includes: A technical abnormality indicator analysis unit, configured to determine the abnormal indicator as a technical abnormality indicator when the indicator type is a technical indicator type, and determine an event object to be analyzed corresponding to the technical abnormality indicator according to a preset dependency relationship; An indicator configuration information judging unit, configured to obtain the indicator configuration information of the abnormal indicator when the indicator type is a business indicator type, and to judge whether there is an indicator link relationship in the indicator configuration information; A first business abnormality indicator analysis unit, configured to determine the abnormal indicator as a first business abnormality indicator if an indicator link relationship exists in the indicator configuration information, and determine an event object to be analyzed corresponding to the first business abnormality indicator by performing link attribution processing on the first business abnormality indicator; The second business abnormality indicator analysis unit is used to determine the abnormal indicator as a second business abnormality indicator if there is no indicator link relationship in the indicator configuration information, and determine the event object to be analyzed corresponding to the second business abnormality indicator by dimensional attribution processing of the second business abnormality indicator.

[0054] In one embodiment, the event object determination module 20 further includes: A first alarm object determining unit, configured to determine a first alarm object according to the indicator alarm information; A first dependent alarm object determining unit, configured to determine a first alarm dependent object corresponding to the first alarm object according to the preset dependency relationship; The first event object to be analyzed determining unit is used to determine the first alarm object and the first alarm dependent object as the event objects to be analyzed corresponding to the technical abnormality indicator.

[0055] In one embodiment, the event object determination module 20 further includes: a link attribution processing unit, configured to, when the indicator type is a first business indicator type, determine the abnormal indicator as a first business abnormal indicator, and perform link attribution processing on the first business abnormal indicator to obtain a target indicator factor; The associated technical indicator determination unit is used to obtain all technical indicators, perform an association analysis process on the target indicator factor and each of the technical indicators, and determine the associated technical indicator associated with the target indicator factor from all the technical indicators according to the association analysis result; A second alarm object determination unit, configured to obtain associated alarm information of the associated technical indicator, determine a second alarm object according to the associated alarm information, and determine a second alarm dependency object corresponding to the second alarm object according to a preset dependency relationship; The second event object to be analyzed determining unit is used to determine the second alarm object and the second alarm dependent object as the event objects to be analyzed corresponding to the first business abnormality indicator.

[0056] In one embodiment, the event object determination module 20 further includes: A business anomaly dimension determination unit, configured to perform dimensional attribution processing on the second business anomaly indicator to obtain a business anomaly dimension factor; The third event object to be analyzed determining unit is used to obtain the associated activity object corresponding to the business abnormality dimension factor, and determine the associated activity object as the event object to be analyzed corresponding to the second business abnormality indicator.

[0057] In one embodiment, the event rollback processing module 40 includes: An indicator attribution data group generating unit, used for performing structured processing on the abnormal indicator, the event object to be analyzed and the target root cause event, generating an indicator attribution data group, and storing the indicator attribution data group in a preset sample database; A rule updating unit is used to periodically obtain at least one indicator attribution data group from the preset sample database as an indicator attribution sample, and update the preset recall rule according to the indicator attribution sample to obtain an updated preset recall rule, and update the preset sorting rule according to the indicator attribution sample to obtain an updated preset sorting rule.

[0058] In one embodiment, the event analysis module 30 includes: The target root cause event determination unit is used to determine the candidate event ranked first in the candidate event ranking list as the target root cause event when no event selection signal is received within a preset selection time.

[0059] For the specific definition of the indicator exception handling device, please refer to the definition of the indicator exception handling method above, which will not be repeated here. Each module in the above-mentioned indicator exception handling device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0060] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a readable storage medium and an internal memory. The readable storage medium stores an operating system, computer-readable instructions and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the readable storage medium. The database of the computer device is used to store data involved in the indicator exception processing method. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer-readable instructions are executed by the processor, an indicator exception processing method is implemented. The readable storage medium provided in this embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0061] In one embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor executes the computer-readable instructions to implement the following steps: Obtain indicator alarm information, and determine the indicator type of the abnormal indicator according to the indicator alarm information; Determine, according to the indicator type, an event object to be analyzed corresponding to the abnormal indicator; Recalling at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule; Sorting all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; When an event selection signal is received within a preset selection time, a target root cause event is determined from the candidate event sorting list according to the event selection signal, and an event rollback process is performed on the target root cause event to convert the abnormal indicator into a normal indicator.

[0062] In one embodiment, one or more computer-readable storage media storing computer-readable instructions are provided. The readable storage media provided in this embodiment include non-volatile readable storage media and volatile readable storage media. The readable storage media store computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the following steps are implemented: Obtain indicator alarm information, and determine the indicator type of the abnormal indicator according to the indicator alarm information; Determine, according to the indicator type, an event object to be analyzed corresponding to the abnormal indicator; Recalling at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule; Sorting all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; When an event selection signal is received within a preset selection time, a target root cause event is determined from the candidate event sorting list according to the event selection signal, and an event rollback process is performed on the target root cause event to convert the abnormal indicator into a normal indicator.

[0063] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions. The computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When the computer-readable instructions are executed, they can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0064] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0065] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for processing abnormal indicators, characterized in that: include: Obtain indicator alarm information, and determine the indicator type of the abnormal indicator according to the indicator alarm information; Determine, according to the indicator type, an event object to be analyzed corresponding to the abnormal indicator; Recalling at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule; Sorting all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; When an event selection signal is received within a preset selection time, a target root cause event is determined from the candidate event sorting list according to the event selection signal, and an event rollback process is performed on the target root cause event to convert the abnormal indicator into a normal indicator.

2. The method for handling abnormal indicators according to claim 1, characterized in that: The determining, according to the indicator type, the event object to be analyzed corresponding to the abnormal indicator includes: When the indicator type is a technical indicator type, the abnormal indicator is determined as a technical abnormal indicator, and the event object to be analyzed corresponding to the technical abnormal indicator is determined according to a preset dependency relationship; When the indicator type is a business indicator type, obtaining indicator configuration information of the abnormal indicator, and determining whether there is an indicator link relationship in the indicator configuration information; If there is an indicator link relationship in the indicator configuration information, the abnormal indicator is determined as a first business abnormal indicator, and an event object to be analyzed corresponding to the first business abnormal indicator is determined by link attribution processing of the first business abnormal indicator; If there is no indicator link relationship in the indicator configuration information, the abnormal indicator is determined as a second business abnormal indicator, and the event object to be analyzed corresponding to the second business abnormal indicator is determined by dimensional attribution processing of the second business abnormal indicator.

3. The method for handling abnormal indicators according to claim 2, characterized in that: The determining, according to the preset dependency relationship, the event object to be analyzed corresponding to the technical abnormality indicator comprises: Determine a first alarm object according to the indicator alarm information; Determine, according to the preset dependency relationship, a first alarm dependency object corresponding to the first alarm object; The first alarm object and the first alarm dependent object are determined as event objects to be analyzed corresponding to the technical abnormality indicator.

4. The method for handling abnormal indicators according to claim 2, characterized in that: The determining the event object to be analyzed corresponding to the first service abnormality indicator by link attribution processing of the first service abnormality indicator includes: Performing link attribution processing on the first service abnormality indicator to obtain a target indicator factor; Acquire all technical indicators, perform correlation analysis between the target indicator factor and each of the technical indicators, and determine the associated technical indicators associated with the target indicator factor from all the technical indicators according to the correlation analysis result; Acquire the associated alarm information of the associated technical indicator, determine the second alarm object according to the associated alarm information, and determine the second alarm dependency object corresponding to the second alarm object according to a preset dependency relationship; The second alarm object and the second alarm dependent object are determined as event objects to be analyzed corresponding to the first business abnormality indicator.

5. The method for handling abnormal indicators according to claim 2, characterized in that: The determining the event object to be analyzed corresponding to the second business abnormality indicator by dimensional attribution processing of the second business abnormality indicator includes: Performing dimensional attribution processing on the second business abnormality indicator to obtain a business abnormality dimensional factor; An associated activity object corresponding to the business abnormality dimension factor is obtained, and the associated activity object is determined as an event object to be analyzed corresponding to the second business abnormality indicator.

6. The method for handling abnormal indicators according to claim 1, characterized in that: After determining the target root cause event from the candidate event sorting list according to the event selection signal, the method further includes: Performing structured processing on the abnormal indicators, the event objects to be analyzed, and the target root cause events to generate an indicator attribution data group, and storing the indicator attribution data group in a preset sample database; At least one indicator attribution data group is periodically obtained from the preset sample database as an indicator attribution sample, and the preset recall rule is updated according to the indicator attribution sample to obtain an updated preset recall rule, and the preset sorting rule is updated according to the indicator attribution sample to obtain an updated preset sorting rule.

7. The method for handling abnormal indicators according to claim 1, characterized in that: After all the candidate events are sorted according to the preset sorting rules to obtain a sorted list of candidate events, the method further includes: When no event selection signal is received within the preset selection time, the candidate event ranked first in the candidate event ranking list is determined as the target root cause event.

8. An indicator abnormality processing device, characterized in that: include: An indicator type determination module is used to obtain indicator alarm information and determine the indicator type of the abnormal indicator according to the indicator alarm information; An event object determination module, used to determine the event object to be analyzed corresponding to the abnormal indicator according to the indicator type; An event recall module, used to recall at least one candidate event corresponding to the event object to be analyzed from a preset event library according to a preset recall rule; An event sorting module is used to sort all the candidate events according to a preset sorting rule to obtain a candidate event sorting list; The event rollback processing module is used to determine the target root cause event from the candidate event sorting list according to the event selection signal when an event selection signal is received within a preset selection time, and perform event rollback processing on the target root cause event to convert the abnormal indicator into a normal indicator.

9. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, characterized in that: When the processor executes the computer-readable instructions, the indicator exception processing method as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by one or more processors, the one or more processors execute the indicator exception processing method as described in any one of claims 1 to 7.

Images