Multi-region service monitoring method, system and device and storage medium

Abstract

The embodiment of the invention discloses a multi-area service monitoring method, system and device and a storage medium. According to the technical scheme provided by the embodiment of the invention, under the condition of detecting that the target service index corresponding to the multi-region service triggers the alarm event, the first dimension parameter of each first specified dimension associated with the target service index is collected, and the abnormal dimension analysis data is determined according to the first dimension parameter; determining an associated business index of the target business index, and collecting associated index analysis data of the associated business index; collecting each regional network parameter corresponding to the multi-regional service, and determining regional network quality analysis data based on the regional network parameters; and determining an abnormal reason of the alarm event based on the abnormal dimension analysis data, the association index analysis data and the regional network quality analysis data. By adopting the technical means, multi-dimensional anomaly analysis is carried out by integrating the anomaly dimension, the association index and the regional network quality, so that the anomaly reason is accurately positioned.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a multi-region business monitoring method, system, device and storage medium. Background Art

[0002] At present, with the global development of Internet services such as live broadcast, short video, and communication, in order to ensure the normal operation of the business, it is often necessary to monitor the business indicators in real time or regularly. When monitoring the business, the operation and maintenance personnel manually configure the business monitoring items one by one, and configure fixed year-on-year and month-on-month thresholds for each monitoring indicator of each business monitoring item. When the year-on-year or month-on-month change of the monitoring indicator exceeds the corresponding static threshold at the same time, the business alarm event is triggered. After the alarm event is triggered, the abnormality is gradually located and investigated through manual experience to find the abnormal cause of the business alarm event, and then the alarm event is handled according to the abnormal cause.

[0003] However, for a globally deployed business monitoring system, there are many business monitoring items that need to be monitored. Relying on manual troubleshooting experience to gradually locate and troubleshoot the cause of the abnormality is cumbersome and time-consuming, and requires high labor costs. The entire process is complex and inefficient, and the business monitoring effect is poor. Summary of the invention

[0004] The embodiments of the present application provide a multi-region business monitoring method, system, device and storage medium, which can accurately locate the cause of the anomaly through multi-dimensional anomaly analysis, and solve the technical problem of cumbersome and time-consuming anomaly cause troubleshooting process.

[0005] In a first aspect, an embodiment of the present application provides a multi-area service monitoring method, including:

[0006] When it is detected that the target business indicator corresponding to the multi-region business triggers an alarm event, first dimension parameters of each first specified dimension associated with the target business indicator are collected, and abnormal dimension analysis data is determined according to the first dimension parameters;

[0007] Determine the associated business indicators of the target business indicators, and collect the associated indicator analysis data of the associated business indicators;

[0008] Collect regional network parameters corresponding to multi-region services, and determine regional network quality analysis data based on the regional network parameters;

[0009] Determine the abnormal cause of the alarm event based on abnormal dimension analysis data, related indicator analysis data and regional network quality analysis data.

[0010] In a second aspect, an embodiment of the present application provides a multi-area service monitoring system, including:

[0011] A dimension analysis module is configured to collect first dimension parameters of each first specified dimension associated with the target business indicator when detecting that the target business indicator corresponding to the multi-region business triggers an alarm event, and determine abnormal dimension analysis data according to the first dimension parameters;

[0012] A correlation analysis module, configured to determine the correlated business indicators of the target business indicators and collect correlated indicator analysis data of the correlated business indicators;

[0013] A network analysis module configured to collect regional network parameters corresponding to the multi-regional services and determine regional network quality analysis data based on the regional network parameters;

[0014] The abnormality determination module is configured to determine the abnormal cause of the alarm event based on the abnormal dimension analysis data, the associated indicator analysis data and the regional network quality analysis data.

[0015] In a third aspect, an embodiment of the present application provides a multi-area service monitoring device, including:

[0016] memory and one or more processors;

[0017] The memory is configured to store one or more programs;

[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement the multi-area business monitoring method as described in the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a non-volatile computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are configured to execute the multi-region business monitoring method as described in the first aspect when executed by a computer processor.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a computer or a processor, the computer or the processor executes the multi-area business monitoring method as described in the first aspect.

[0021] The embodiment of the present application, when detecting that the target business indicator corresponding to the multi-regional business triggers an alarm event, collects the first dimension parameters of each first specified dimension associated with the target business indicator, and determines the abnormal dimension analysis data according to the first dimension parameters; determines the associated business indicator of the target business indicator, and collects the associated indicator analysis data of the associated business indicator; collects each regional network parameter corresponding to the multi-regional business, and determines the regional network quality analysis data based on the regional network parameters; determines the abnormal cause of the alarm event based on the abnormal dimension analysis data, the associated indicator analysis data and the regional network quality analysis data. The above-mentioned technical means are adopted to conduct multi-dimensional abnormal analysis by integrating abnormal dimensions, associated indicators and regional network quality, so as to accurately locate the abnormal cause, without the need to manually locate and troubleshoot the abnormal cause step by step, and improve the efficiency of abnormal location, thereby improving the stability and reliability of business monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a flow chart of a multi-region business monitoring method provided by an embodiment of the present application;

[0023] Figure 2 is a flow chart for determining abnormal dimension analysis data in an embodiment of the present application;

[0024] Figure 3 is a flow chart for determining the abnormal cause of an alarm event in an embodiment of the present application;

[0025] Figure 4 is an update flow chart of a business indicator prediction template in an embodiment of the present application;

[0026] Figure 5 It is a structural diagram of a multi-region business monitoring system provided by an embodiment of the present application;

[0027] Figure 6 It is a structural diagram of a multi-area business monitoring device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical scheme and advantages of the present application clearer, the specific embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. It is understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for the convenience of description, only the part related to the present application but not all the contents are shown in the accompanying drawings. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow chart describes each operation (or step) as a sequential process, many of the operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of each operation can be rearranged. The process can be terminated when its operation is completed, but it can also have additional steps not included in the accompanying drawings. The process can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0029] The multi-region business monitoring method provided in this application aims to perform multi-dimensional anomaly analysis by integrating anomaly dimensions, related indicators and regional network quality, so as to accurately locate the cause of the anomaly and improve the efficiency of anomaly location.

[0030] With the rapid development of globalization, the operation scope of mobile applications continues to expand all over the world, and at the same time faces complex operating environments from different regions and markets. Monitoring global business not only requires the management of regional business activities, but also requires coping with the rapid changes in policies and regulations, market demands and competition in multiple regions. These factors make global business management increasingly complex. In the face of the complexity and diversity of global business, it is necessary to monitor and manage the different operations of mobile applications in multiple regions in real time to maintain competitiveness and respond quickly to market changes.

[0031] For globalized Internet services such as live broadcast, short video, and communication, in order to ensure their normal operation, real-time or scheduled monitoring of business indicators is often required. That is, the operation and maintenance personnel manually configure business monitoring items one by one, and configure fixed year-on-year or month-on-month thresholds for each monitoring indicator of each business monitoring item. When the year-on-year or month-on-month change exceeds the corresponding static threshold at the same time, it is considered an abnormal point.

[0032] However, this manual year-on-year and year-on-year alarm configuration method has several obvious problems:

[0033] Problem 1: Due to the wide variety of business indicators for global businesses, and the fact that each business monitoring item can have multiple monitoring periods with different characteristics, a business monitoring item usually needs to be configured with multiple thresholds, making the alarm configuration process very cumbersome and the monitoring cost high.

[0034] Question 2: When business services are online or offline and the indicator trend changes, this manually configured monitoring rule will not be applicable, and the adaptation cycle of the entire alarm rule will be longer.

[0035] Problem 3: The year-on-year and month-on-month configuration method requires that the indicators have a certain periodic regularity. However, the indicators under global business will be affected by regional holidays and operational activities, resulting in the traffic characteristics of the corresponding period being very different from usual, which will lead to false alarms or missed reports. In other words, the current business indicator monitoring methods have problems such as low accuracy and high monitoring costs.

[0036] In addition, due to the characteristics of globalized business, regional holidays and operational activities will bring about changes in the form of business indicators, which will have no impact on actual business. For indicators such as anchor fluency, false alarms may occur. Not only that, globalized business is easily affected by regional network quality and regional policy restrictions, which may cause changes in the form of indicators. On the basis of real-time discovery of business indicator anomalies, in order to quickly locate the cause of the anomaly and make stop-loss operations in a timely manner when the business is damaged, it is necessary to have the ability to perform multi-dimensional root cause analysis and organize relevant technical teams to handle faults in a timely manner to ensure rapid recovery of the business. However, most of the current monitoring systems are not designed for the above-mentioned global business characteristics, which leads to most monitoring systems relying on specific manual troubleshooting experience for step-by-step positioning and troubleshooting. The entire fault handling process is opaque and time-consuming.

[0037] Based on this, a multi-region business monitoring method of an embodiment of the present application is provided to solve the technical problem of cumbersome and time-consuming abnormal cause troubleshooting process in global multi-region business monitoring, and to provide a more intelligent and integrated business monitoring solution.

[0038] Example:

[0039] Figure 1 A flowchart of a multi-region business monitoring method provided in an embodiment of the present application is given. The multi-region business monitoring method provided in this embodiment can be executed by a multi-region business monitoring device, which can be implemented by software and / or hardware. The multi-region business monitoring device can be composed of two or more physical entities, or can be composed of one physical entity. Generally speaking, the multi-region business monitoring device can be a computing device such as a business monitoring server.

[0040] The following description is made by taking the multi-region service monitoring device as an example to implement the multi-region service monitoring method. Figure 1 , the multi-region business monitoring method specifically includes:

[0041] S110: When it is detected that a target business indicator corresponding to a multi-region business triggers an alarm event, first dimension parameters of each first specified dimension associated with the target business indicator are collected, and abnormal dimension analysis data is determined according to the first dimension parameters.

[0042] When conducting global multi-regional business monitoring, this application uses multiple algorithm models to simultaneously detect anomalies in business indicators, and supports adaptation to different business indicator monitoring scenarios, thereby improving the accuracy of business alerts and reducing missed alerts. Multiple algorithm models perform anomaly analysis on the corresponding anomaly dimensions, related indicators, and regional network quality, respectively, thereby comprehensively analyzing the anomaly dimensions, related indicators, and regional network quality to accurately locate the cause of the anomaly.

[0043] Among them, when monitoring the business indicators of corresponding multi-regional businesses, first collect the indicator data from the indicator data source of the business indicators through a scheduled task, store the data in the cache, ensure the integrity of the indicator data through retrospective collection, and store a copy of the latest data in the redis database to quickly obtain related historical data during anomaly detection. After each point is detected, the data point is cached in the redis key of the corresponding indicator. The data is used for the display of the business monitoring system to ensure that the operation data and the detection results are consistent.

[0044] By real-time monitoring of various business indicators of multi-regional business. Business indicators may include user activity, transaction volume, response time, error rate and other business indicators in the multi-regional business operation process. When the change range of a business indicator (i.e., the target business indicator) exceeds the preset static threshold, the indicator will trigger an alarm event.

[0045] When the target business indicator triggers an alarm event, it is necessary to collect the parameters of the dimensions related to the business indicator, define these dimensions as the first specified dimensions, and their dimension parameters are the first dimension parameters. Use the drill-down algorithm to perform multi-dimensional drill-down analysis on the business indicator, locate the abnormal root cause dimension from multiple first specified dimensions, and thus determine the abnormal dimension analysis data.

[0046] It can be understood that the first specified dimension is the various dimension types that affect the status of business indicators. Taking the business indicator "response time" as an example, the first specified dimension that affects its status includes system load, network factors, storage conditions, data request volume, etc. Under different first specified dimensions, several dimensional parameters are included to comprehensively characterize the state of the dimension. Taking system load as an example, dimensional parameters such as the number of concurrent requests and system busyness are included. By analyzing the changes in these dimensional parameters, it is possible to determine which dimensions cause the business indicators to trigger alarm events, thereby obtaining abnormal dimensional analysis data.

[0047] Specifically, determining abnormal dimension analysis data according to the first dimension parameter includes:

[0048] Based on the parameter change amount of the first dimension parameter, the abnormal dimension and the abnormal parameter corresponding to the abnormal dimension are determined, and the abnormal dimension analysis data is constructed using the abnormal dimension and the corresponding abnormal parameter.

[0049] Based on each first specified dimension pre-associated with the business indicator, clarify each first dimension parameter to be analyzed in the first specified dimension. By calculating the change in the first dimension parameter over a period of time. This change can be an absolute change (i.e., the difference between the current value and the value at the previous moment) or a relative change (i.e., the proportional change between the current value and the value at the previous moment). The calculation of the change helps to identify abnormal fluctuations in the parameters. By setting a reasonable abnormal threshold, when the parameter change exceeds the abnormal threshold, this part of the dimension parameters is considered abnormal. Similarly, by comparing whether the change in the dimension parameters under each dimension exceeds the abnormal threshold, it can be determined which dimensions are abnormal. Then, the identified abnormal dimensions and their corresponding abnormal parameters can be organized into abnormal dimension analysis data.

[0050] Optionally, refer to Figure 2 , determining the abnormal dimension and the abnormal parameter corresponding to the abnormal dimension based on the parameter change of the first dimension parameter, including:

[0051] S1101, determining, from the first dimension parameters of each first dimension, a first candidate parameter whose parameter change relative to the previous acquisition period reaches a change threshold;

[0052] S1102, selecting second candidate parameters from the first candidate parameters according to the influence of the first candidate parameters on the set first specified dimension to which they belong, to obtain a candidate parameter set;

[0053] S1103. Calculate the average parameter change of each candidate parameter set according to the parameter change of the second candidate parameter, select a set number of candidate parameter sets with the largest average parameter change as abnormal parameter sets, determine the first specified dimension corresponding to the abnormal parameter set as the abnormal dimension, and the first dimension parameter in the abnormal parameter set as the abnormal parameter.

[0054] After the target business indicator triggers an alarm, the present application uses a drill-down algorithm to perform a multi-dimensional drill-down analysis on the target business indicator, so as to locate the abnormal root cause dimension. Among them, for each first specified dimension associated with the target business indicator, find the element whose parameter change reaches the change threshold relative to the previous acquisition cycle from the first dimension parameters corresponding to the first specified dimension, and define this part of the first dimension parameters as the first candidate parameters. For the above-mentioned first candidate parameter set obtained under each first specified dimension, find the element with the most obvious influence on the set dimension of the first specified dimension (such as the top three in the set influence ranking), and define this part of the first candidate parameters as the second candidate parameters. The set of second candidate parameters is the candidate parameter set. For the above-mentioned candidate parameter set obtained under each first specified dimension, calculate the average parameter change of each candidate parameter set, find several candidate parameter sets with the largest average parameter change, and determine them as abnormal parameter sets. Then the first specified dimension corresponding to the abnormal parameter set is the abnormal dimension, and the first dimension parameters in the abnormal parameter set are abnormal parameters.

[0055] S120: Determine the associated business indicator of the target business indicator, and collect associated indicator analysis data of the associated business indicator.

[0056] Based on the target business indicators that trigger the alarm, in addition to analyzing the abnormal dimensions and abnormal parameters under the target business indicators, the abnormal analysis of the associated business indicators is also performed in combination with the associated business indicators of the target business indicators. It can be understood that the associated indicators directly or indirectly affect the changes of the target business indicators. By collecting the relevant data of these associated indicators and analyzing and processing them, the associated indicator analysis data is generated. The association analysis can reveal the internal connection between different business indicators and help understand the root cause of the business alarm event. By analyzing the change trend of the associated indicators, the accuracy of the abnormal dimension analysis results can be further verified.

[0057] Optionally, determining a business indicator associated with the target business indicator and collecting associated indicator analysis data of the associated business indicator include:

[0058] Detect business indicators that have the same label as the target business indicator, and determine that the business indicator that has triggered an alarm event within a set period is an associated business indicator of the target business indicator;

[0059] The second dimension parameters of each second specified dimension of the associated business indicator are collected, and the associated indicator analysis data is determined according to the second dimension parameters.

[0060] When the target business indicator triggers an alarm event, this application automatically detects the business indicator under the same application tag as the target business indicator. If an alarm event is found within 10 minutes for a business indicator, it is determined to be an abnormal associated business indicator. For each associated business indicator, refer to the dimension drill-down method of the target business indicator above to continue drilling down to analyze the abnormal dimensions and abnormal parameters.

[0061] Among them, find the elements whose parameter change reaches the change threshold relative to the previous collection period from the second dimension parameters corresponding to each second specified dimension of the associated business indicator, and find the elements with the most obvious influence on the set dimension of the second specified dimension based on the above element set (such as the top three in the set influence ranking). Then find the element set with the largest average parameter change from each narrowed element set, the second specified dimension corresponding to the element set is the abnormal dimension of the associated business indicator, and the second dimension parameters in the element set are the abnormal parameters of the associated business indicator.

[0062] S130: Collect regional network parameters corresponding to the multi-regional service, and determine regional network quality analysis data based on the regional network parameters.

[0063] Considering that globalized business is easily affected by regional network quality, blocking factors, etc., which may lead to business damage, after the alarm is triggered, in addition to analyzing the business indicators of the multi-regional business disk, this application will further automatically link the regional quality analysis disk for in-depth analysis and positioning to determine whether there is a network failure or blocking in the region.

[0064] Based on the pre-set regional network parameters for network quality analysis, such as evaluating key indicators such as network delay, packet loss rate, bandwidth, etc. in each region. These regional network parameters will guide subsequent data collection and analysis. Collect various types of regional network parameters through pre-set corresponding collection tools or methods. Based on the collected regional network parameters, use the set analysis rules to conduct in-depth analysis of the regional network parameters. For example, calculate the average delay, maximum delay, packet loss rate, bandwidth and other key indicators of each region. Analyze the changes in network quality under different time periods and different network conditions. Then, according to different calculation results, determine the corresponding network quality analysis results according to the set analysis rules.

[0065] Specifically, regional network parameters include regional PING success rate, service flow, third-party communication status, and signaling success rate;

[0066] Determine regional network quality analysis data based on regional network parameters, including:

[0067] When the regional PING success rate and service traffic anomalies are determined, regional network quality analysis data is determined based on the anomaly analysis of the corresponding regional computer room and operator;

[0068] When it is determined that the regional PING success rate, business traffic, and third-party communication status are abnormal, it is determined that a regional network failure occurs in the corresponding area, and regional network quality analysis data is generated based on the regional network failure;

[0069] When it is determined that there is no abnormality in the regional PING success rate, business traffic or third-party communication status, signaling anomaly analysis is performed based on the signaling success rate, and regional network quality analysis data is determined based on the signaling anomaly analysis results. When it is determined that a signaling anomaly has occurred, the regional network quality analysis data is determined based on the blocked channel information associated with the corresponding area.

[0070] Among them, the set threshold information is used to determine whether there are any abnormalities in the regional PING success rate and business traffic. If an abnormality occurs, further drilling down is performed to obtain the root cause dimension of the abnormality to confirm whether the abnormality is caused by the computer room dimension or the operator dimension, thereby obtaining regional network quality analysis data.

[0071] By setting threshold information, the corresponding third-party regional traffic or BGP routing statistics are detected in real time to see if there are any abnormalities. If the regional ping success rate, business traffic indicators, third-party regional traffic & BGP routing statistics are all abnormal, it is determined that a regional network failure has occurred in the corresponding area. At this time, regional network quality analysis data is generated based on the regional network failure.

[0072] Based on the above-mentioned anomaly detection, if no obvious abnormality is found in the regional network quality, it is further determined whether the signaling success rate of the corresponding area has dropped significantly. The signaling success rate changes are compared by setting threshold information. If abnormalities are found in signaling-related indicators, further correlation analysis is performed to find that there are obvious blocked channels, thereby determining the regional network quality analysis data based on the blocked channel information associated with the corresponding area.

[0073] By collecting the regional network parameters corresponding to the multi-regional services and determining the regional network quality analysis data based on these parameters, these data can be used for subsequent abnormal cause analysis to improve the accuracy of abnormal cause location of alarm events.

[0074] S140. Determine the abnormal cause of the alarm event based on the abnormal dimension analysis data, the associated indicator analysis data, and the regional network quality analysis data.

[0075] Finally, the abnormal dimension analysis data and the associated indicator analysis data are combined to comprehensively analyze the mutual influence and correlation between the indicators. Through comprehensive analysis, the abnormal cause of the alarm event can be determined more accurately. In addition, the regional network quality analysis data is taken into consideration to further verify and refine the abnormal cause. For example, if it is found that the network quality in a certain area is generally poor and is associated with a specific alarm event, it can be inferred that the network problem in the area may be one of the causes of the alarm event. According to the determined abnormal cause, the corresponding solution can be formulated. For example, for network congestion problems, the network structure can be optimized, the bandwidth can be increased, or the network equipment can be upgraded; for equipment failure problems, the equipment can be replaced or repaired; for configuration errors, the configuration parameters can be adjusted or the configuration file can be updated.

[0076] Prior to this, the corresponding abnormal causes can be pre-configured according to the different states of abnormal dimension analysis data, related indicator analysis data and regional network quality analysis data, and the abnormal causes can be set according to actual analysis experience. Finally, the states of abnormal dimension analysis data, related indicator analysis data and regional network quality analysis data can be integrated, and the abnormal causes of alarm events can be accurately determined by querying the preset abnormal causes.

[0077] Based on the above multi-region business monitoring method, it is possible to monitor global business in real time, ensuring that enterprises can quickly discover and respond to any abnormal situations or risks, thereby reducing potential losses and ensuring business continuity and stability. In addition, this application integrates multi-source data from different business units and geographical locations, and through data analysis and processing technology, it can achieve unified management and in-depth analysis of data. It allows managers to grasp the business operation status from a global perspective and effectively support strategic decision-making. In addition, the system supports the fusion of multiple algorithm models to detect anomalies of indicators at the same time, thereby improving the accuracy of alarms and reducing the false alarm rate. On the other hand, this application transforms the process of manual troubleshooting that relies on manual experience into a system automatic analysis process by building a multi-dimensional root cause analysis link, significantly reducing the need for manual intervention and improving the efficiency and accuracy of fault location. The automated characteristics can also reduce human errors and improve the overall operational quality.

[0078] For example, refer to Figure 3Based on the configuration of indicator data collection and business attributes, query statements are configured to collect indicator data that need to be tested at regular intervals. The system supports multiple time series data storage and collection such as mysql, victoriaMetrics, clickHouse, opentsdb, etc. After the indicator data is successfully collected and stored, the business attribute information corresponding to the indicator is configured, such as business line, application name, etc. Through the indicator business attributes, the indicator is configured on the system as a core indicator of the market or a regional core indicator, and business line market monitoring and regional market monitoring are built respectively. The real-time monitoring of the business line market mainly guarantees the overall stability of the core business, and the regional market monitoring is to perceive whether there are problems with the regional network quality.

[0079] After the system obtains the corresponding indicator data, the monitoring background will configure different algorithm models according to different types of indicator forms to perform anomaly detection. After detecting the anomaly, it will determine whether the anomaly meets the corresponding alarm conditions. If it does, an alarm event will be triggered.

[0080] After an alarm event is triggered, the corresponding root cause analysis link is triggered. The system automatically analyzes the abnormal dimensions and related indicators of the corresponding business indicators, and combines the regional network quality analysis dashboard to check whether there are network failures or policy restrictions in the region.

[0081] Then, by combining the above-mentioned abnormal dimension analysis, correlation indicator analysis and regional network quality analysis results, we can obtain the location conclusion of the alarm event, and then formulate the alarm event processing strategy based on the location conclusion to achieve efficient and reliable business exception processing.

[0082] Optionally, the multi-region service monitoring method further includes:

[0083] In a specified period, a business indicator prediction template configured for a specified period is obtained, and an alarm event triggering rule of a target business indicator in the specified period is updated according to the business indicator prediction template.

[0084] On the basis of the above-mentioned multi-regional business monitoring method, the present application also predicts, adjusts and adapts business indicators for important regional events by sensing changes in regional business traffic caused by regional holidays and operational events. When designated time periods such as holidays and operational activities come, the alarm event triggering rules of the target business indicators in the designated time period are updated based on the business indicator prediction template configured for the corresponding designated time period. It is understandable that globalized business is susceptible to important regional events (such as holidays, operational activities, etc.), especially during holidays, the form of business indicators will change, and the original business monitoring algorithm cannot be applied to changes in the form of business indicators. Since business indicators may change dramatically during these designated time periods, but they are not actually caused by abnormalities, a large number of business indicator false alarms may occur, so it is necessary to adapt the alarm event triggering rules of business indicators during holidays to ensure that abnormal alarms can be accurately performed.

[0085] Optionally, the business indicator prediction template is constructed based on historical difference information of the target business indicator in the specified time period and other time periods.

[0086] For example, by counting the status information of the target business indicator in the target period and other periods last year, the information with large differences between the target period and other periods, i.e., historical difference information, can be determined. Based on this historical difference information, the business indicator prediction template can be adjusted, such as adjusting the corresponding threshold information, so that in the specified period, the configured alarm event triggering rules can meet the actual business monitoring situation of the specified period.

[0087] Optionally, considering the large number of Internet business indicators, especially the tens of thousands of indicators to be operated during holidays, it is necessary to quickly and accurately find the corresponding affected business indicators and apply appropriate holiday forecast template rules for them. Figure 4 , this application first queries the indicator state change trend of the corresponding business indicator on the holidays of last year based on the above-mentioned pre-set business indicator prediction template, automatically calculates the curve change interval and value change interval of the indicator, and then obtains the real-time state change trend of the corresponding indicator when the current holiday arrives, and uses dbscan clustering, Euclidean distance, dtw and other algorithms to automatically calculate the degree of fit between the current indicator and the state change trend of the indicator on the holidays of last year. If the degree of fit reaches the set fit threshold (such as 80%), the business indicator prediction template pre-configured for the indicator is configured to the indicator to update the alarm event triggering rules of the indicator on the current holiday. In order to improve configuration efficiency, for each business indicator, find the indicator set whose current state change trend reaches the fit threshold with the state change trend of the holidays of last year, extract the pre-configured business indicator prediction template in the indicator set, and realize the one-click configuration of the alarm event triggering rules of each business indicator, thereby reducing the manual configuration cost and improving operational efficiency.

[0088] By building a management platform for important regional holidays and operational events, we can perceive sudden changes in indicator trends in advance. In the event of peak business traffic, we can notify the business to make relevant plans. The system will automatically adapt to the corresponding algorithm model, thereby reducing alarm storms and providing stability guarantees for the business in real time.

[0089] In the above, when the target business indicator corresponding to the multi-regional business triggers an alarm event, the first dimension parameters of each first specified dimension associated with the target business indicator are collected, and the abnormal dimension analysis data is determined according to the first dimension parameters; the associated business indicator of the target business indicator is determined, and the associated indicator analysis data of the associated business indicator is collected; the regional network parameters of the corresponding multi-regional business are collected, and the regional network quality analysis data is determined based on the regional network parameters; the abnormal cause of the alarm event is determined based on the abnormal dimension analysis data, the associated indicator analysis data and the regional network quality analysis data. The above technical means are adopted to conduct multi-dimensional abnormal analysis by integrating abnormal dimensions, associated indicators and regional network quality, so as to accurately locate the abnormal cause, without the need to manually locate and troubleshoot the abnormal cause step by step, and improve the efficiency of abnormal location, thereby improving the stability and reliability of business monitoring.

[0090] Based on the above embodiments, Figure 5 A schematic diagram of the structure of a multi-region business monitoring system provided by this application. Figure 5 The multi-region service monitoring system provided in this embodiment specifically includes:

[0091] Wherein, the dimension analysis module 21 is configured to collect first dimension parameters of each first specified dimension associated with the target business indicator when detecting that the target business indicator corresponding to the multi-region business triggers an alarm event, and determine abnormal dimension analysis data according to the first dimension parameters;

[0092] The correlation analysis module 22 is configured to determine the correlated business indicators of the target business indicators and collect correlated indicator analysis data of the correlated business indicators;

[0093] The network analysis module 23 is configured to collect regional network parameters corresponding to the multi-regional service and determine regional network quality analysis data based on the regional network parameters;

[0094] The abnormality determination module 24 is configured to determine the abnormal cause of the alarm event based on the abnormal dimension analysis data, the associated indicator analysis data and the regional network quality analysis data.

[0095] Specifically, determining abnormal dimension analysis data according to the first dimension parameter includes:

[0096] Based on the parameter change amount of the first dimension parameter, the abnormal dimension and the abnormal parameter corresponding to the abnormal dimension are determined, and the abnormal dimension analysis data is constructed using the abnormal dimension and the corresponding abnormal parameter.

[0097] The abnormal dimension and the abnormal parameter corresponding to the abnormal dimension are determined based on the parameter change amount of the first dimension parameter, including:

[0098] Determine, from the first dimension parameters of each first dimension, a first candidate parameter whose parameter change relative to the last acquisition period reaches a change threshold;

[0099] Filtering second candidate parameters from the first candidate parameters according to the influence of the first candidate parameters on the setting of the first specified dimension to which they belong, to obtain a candidate parameter set;

[0100] The average parameter change of each candidate parameter set is calculated according to the parameter change of the second candidate parameter, and a set number of candidate parameter sets with the largest average parameter change are selected as abnormal parameter sets, and the first specified dimension corresponding to the abnormal parameter set is determined as the abnormal dimension, and the first dimension parameter in the abnormal parameter set is the abnormal parameter.

[0101] Specifically, determining the associated business indicators of the target business indicators and collecting the associated indicator analysis data of the associated business indicators include:

[0102] Detect business indicators that have the same label as the target business indicator, and determine that the business indicator that has triggered an alarm event within a set period is an associated business indicator of the target business indicator;

[0103] The second dimension parameters of each second specified dimension of the associated business indicator are collected, and the associated indicator analysis data is determined according to the second dimension parameters.

[0104] Specifically, regional network parameters include regional PING success rate, service flow, third-party communication status, and signaling success rate;

[0105] Determine regional network quality analysis data based on regional network parameters, including:

[0106] When the regional PING success rate and service traffic anomalies are determined, regional network quality analysis data is determined based on the anomaly analysis of the corresponding regional computer room and operator;

[0107] When it is determined that the regional PING success rate, business traffic, and third-party communication status are abnormal, it is determined that a regional network failure occurs in the corresponding area, and regional network quality analysis data is generated based on the regional network failure;

[0108] When it is determined that there is no abnormality in the regional PING success rate, business traffic or third-party communication status, signaling anomaly analysis is performed based on the signaling success rate, and regional network quality analysis data is determined based on the signaling anomaly analysis results. When it is determined that a signaling anomaly has occurred, the regional network quality analysis data is determined based on the blocked channel information associated with the corresponding area.

[0109] Specifically, the multi-region service monitoring method further includes:

[0110] In a specified period, a business indicator prediction template configured for a specified period is obtained, and an alarm event triggering rule of a target business indicator in the specified period is updated according to the business indicator prediction template.

[0111] The business indicator forecast template is constructed based on the historical difference information of the target business indicator in the specified period and other periods.

[0112] In the above, when the target business indicator corresponding to the multi-regional business triggers an alarm event, the first dimension parameters of each first specified dimension associated with the target business indicator are collected, and the abnormal dimension analysis data is determined according to the first dimension parameters; the associated business indicator of the target business indicator is determined, and the associated indicator analysis data of the associated business indicator is collected; the regional network parameters of the corresponding multi-regional business are collected, and the regional network quality analysis data is determined based on the regional network parameters; the abnormal cause of the alarm event is determined based on the abnormal dimension analysis data, the associated indicator analysis data and the regional network quality analysis data. The above technical means are adopted to conduct multi-dimensional abnormal analysis by integrating abnormal dimensions, associated indicators and regional network quality, so as to accurately locate the abnormal cause, without the need to manually locate and troubleshoot the abnormal cause step by step, and improve the efficiency of abnormal location, thereby improving the stability and reliability of business monitoring.

[0113] The multi-area business monitoring system provided in the embodiment of the present application can be configured to execute the multi-area business monitoring method provided in the above embodiment, and has corresponding functions and beneficial effects.

[0114] Based on the above practical example, the present application embodiment also provides a multi-area business monitoring device, referring to Figure 6, the multi-region business monitoring device includes: a processor, a memory, a communication module, an input device and an output device. The memory, as a computer-readable storage medium, can be configured to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the multi-region business monitoring method described in any embodiment of the present application (for example, various modules in the multi-region business monitoring system). The communication module is configured to transmit data. The processor executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory, that is, implements the above-mentioned multi-region business monitoring method. The input device can be configured to receive input digital or character information, and generate key signal input related to user settings and function control of the device. The output device may include a display device such as a display screen. The multi-region business monitoring device provided above can be configured to execute the multi-region business monitoring method provided in the above-mentioned embodiment, and has corresponding functions and beneficial effects.

[0115] On the basis of the above embodiments, the embodiments of the present application further provide a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions, wherein the computer-executable instructions are configured to execute a multi-region business monitoring method when executed by a computer processor, and the storage medium may be any of various types of memory devices or storage devices. Of course, the non-volatile computer-readable storage medium provided in the embodiments of the present application, whose computer-executable instructions are not limited to the multi-region business monitoring method described above, may also execute related operations in the multi-region business monitoring method provided in any embodiment of the present application.

[0116] On the basis of the above embodiments, the embodiments of the present application also provide a computer program product. The technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer program product is stored in a storage medium, including a number of instructions for enabling a computer device, a mobile terminal or a processor therein to execute all or part of the steps of the multi-area business monitoring method described in each embodiment of the present application.

Claims

1. A multi-region business monitoring method, characterized in that: include: When it is detected that a target business indicator corresponding to a multi-region business triggers an alarm event, first dimension parameters of each first specified dimension associated with the target business indicator are collected, and abnormal dimension analysis data is determined according to the first dimension parameters; Determine the associated business indicator of the target business indicator, and collect associated indicator analysis data of the associated business indicator; Collecting regional network parameters corresponding to the multi-regional service, and determining regional network quality analysis data based on the regional network parameters; The abnormal cause of the alarm event is determined based on the abnormal dimension analysis data, the associated indicator analysis data and the regional network quality analysis data.

2. The multi-region business monitoring method according to claim 1, characterized in that: The determining of abnormal dimension analysis data according to the first dimension parameter includes: Based on the parameter change amount of the first dimensional parameter, an abnormal dimension and an abnormal parameter corresponding to the abnormal dimension are determined, and abnormal dimension analysis data is constructed using the abnormal dimension and the corresponding abnormal parameter.

3. The multi-region business monitoring method according to claim 2, characterized in that: The determining the abnormal dimension and the abnormal parameter corresponding to the abnormal dimension based on the parameter change amount of the first dimensional parameter includes: Determine, from each of the first dimension parameters of the first dimension, a first candidate parameter whose parameter change relative to the last acquisition period reaches a change threshold; Filtering second candidate parameters from the first candidate parameters according to the influence of the first candidate parameters on the settings of the first specified dimension to which they belong, to obtain a candidate parameter set; According to the parameter change of the second candidate parameter, the average parameter change of each candidate parameter set is calculated, and a set number of candidate parameter sets with the largest average parameter change are screened as abnormal parameter sets, and the first specified dimension corresponding to the abnormal parameter set is determined to be the abnormal dimension, and the first dimensional parameter in the abnormal parameter set is the abnormal parameter.

4. The multi-region business monitoring method according to claim 1, characterized in that: The determining of the associated business indicator of the target business indicator and collecting associated indicator analysis data of the associated business indicator include: Detecting a business indicator with the same tag as the target business indicator, and determining that the business indicator that has triggered an alarm event within a set period is an associated business indicator of the target business indicator; The second dimension parameters of each second specified dimension of the associated business indicator are collected, and the associated indicator analysis data is determined according to the second dimension parameters.

5. The multi-region business monitoring method according to claim 1, characterized in that: The regional network parameters include regional PING success rate, service flow, third-party communication status and signaling success rate; The determining of regional network quality analysis data based on the regional network parameters includes: In the case where the regional PING success rate and the service traffic are determined to be abnormal, regional network quality analysis data is determined based on abnormal analysis of the computer room and the operator in the corresponding region; When determining that the regional PING success rate, the service flow, and the third-party communication status are abnormal, determining that a regional network failure occurs in the corresponding area, and generating regional network quality analysis data based on the regional network failure; When it is determined that there is no abnormality in the regional PING success rate, the business traffic or the third-party communication status, a signaling anomaly analysis is performed based on the signaling success rate, and regional network quality analysis data is determined based on the signaling anomaly analysis results. When it is determined that a signaling anomaly occurs, the regional network quality analysis data is determined based on the blocked channel information associated with the corresponding area.

6. The multi-region service monitoring method according to any one of claims 1 to 5, characterized in that: The multi-area business monitoring method further includes: A business indicator prediction template configured for the specified time period is obtained in a specified time period, and an alarm event triggering rule of the target business indicator in the specified time period is updated according to the business indicator prediction template.

7. The multi-region business monitoring method according to claim 6, characterized in that: The business indicator prediction template is constructed based on historical difference information of the target business indicator between the specified time period and other time periods.

8. A multi-region business monitoring system, characterized in that: include: The dimension analysis module is configured to collect first dimension parameters of each first specified dimension associated with the target business indicator when detecting that the target business indicator corresponding to the multi-region business triggers an alarm event, and determine abnormal dimension analysis data according to the first dimension parameters; A correlation analysis module, configured to determine the associated business indicator of the target business indicator and collect the associated indicator analysis data of the associated business indicator; A network analysis module configured to collect regional network parameters corresponding to the multi-regional service and determine regional network quality analysis data based on the regional network parameters; The abnormality determination module is configured to determine the abnormal cause of the alarm event based on the abnormal dimension analysis data, the associated indicator analysis data and the regional network quality analysis data.

9. A multi-area business monitoring device, characterized in that: include: memory and one or more processors; The memory is configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the multi-region business monitoring method as described in any one of claims 1-7.

10. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a computer processor, they are configured to execute the multi-region service monitoring method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product includes instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes the multi-region service monitoring method according to any one of claims 1 to 7.

Images