Cloud cluster monitoring response method and device, equipment, storage medium and product

Abstract

The invention relates to a cloud cluster monitoring response method and device, equipment, a storage medium and a product. The method comprises the following steps: acquiring monitoring index data of a target cloud cluster; generating an alarm event according to a size relationship between the monitoring index data and a preset alarm threshold value; wherein the alarm event comprises alarm data. And processing an alarm event according to the alarm data and the monitoring index data. By adopting the method, the abnormal condition of the target cloud cluster can be quickly and accurately solved, a targeted solution is provided for the abnormal condition, and the comprehensiveness and the accuracy of monitoring the target cloud cluster are improved.

Description

Technical Field

[0001] The present application relates to the technical field of cloud cluster monitoring and response, and in particular to a cloud cluster monitoring and response method, device, equipment, storage medium and product. Background Art

[0002] As cloud clusters continue to expand in size and their architectures become increasingly complex, real-time monitoring of numerous device resources is required during the operation of cloud clusters in order to promptly detect anomalies and faults and resolve them.

[0003] In traditional cloud cluster monitoring technology, multiple monitoring tools are usually used to monitor different modules of the cloud cluster, and different monitoring tools are isolated from each other and lack the necessary linkage and coordination mechanism. During the operation of the system, when an abnormal situation occurs in a certain link, different monitoring tools cannot automatically share information, which leads to problems such as untimely and inaccurate data analysis. Summary of the invention

[0004] Based on this, it is necessary to provide a cloud cluster monitoring response method, device, equipment, storage medium and product that can timely analyze abnormal data of a cloud cluster and respond to the abnormal data in response to the above technical problems.

[0005] In a first aspect, the present application provides a cloud cluster monitoring response method, comprising:

[0006] Obtain monitoring indicator data of the target cloud cluster;

[0007] Generate an alarm event according to the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes alarm data;

[0008] Process the alarm event according to the alarm data and the monitoring indicator data.

[0009] In one of the embodiments, the processing of the alarm event according to the alarm data and the monitoring indicator data includes: processing the alarm event according to the alarm data and the monitoring indicator data based on at least one preset solidified processing logic.

[0010] In one of the embodiments, the alarm event is processed based on the alarm data and the monitoring indicator data based on at least one preset solidified processing logic, including: determining the alarm type based on the alarm data and the monitoring indicator data; selecting the target solidified processing logic of the alarm event from the at least one preset solidified processing logic based on the alarm type; and processing the alarm event based on the target solidified processing logic.

[0011] In one of the embodiments, the method further includes: in the event that the alarm event processing fails, analyzing the alarm event based on the alarm data and the monitoring indicator data to obtain the alarm cause and the event impact scope; and outputting an intervention plan for the alarm event based on the alarm cause and the event impact scope.

[0012] In one of the embodiments, before processing the alarm event based on the alarm data and the monitoring indicator data, the method further includes: extracting key information from the alarm data; generating alarm data in a preset format based on the key information; filtering abnormal alarm data in the alarm data in the preset format to update the alarm data; wherein the abnormal alarm data includes at least one of first alarm data generated due to a maintenance period change, second alarm data generated due to a task cycle change, and third alarm data repeated within a preset time period.

[0013] In one of the embodiments, generating an alarm event based on the size relationship between the monitoring indicator data and a preset alarm threshold includes: extracting disk description data from the monitoring indicator data; wherein the disk description data includes total disk data and disk usage data; determining disk usage based on the disk description data; generating an alarm event based on the size relationship between the disk usage and a preset alarm threshold.

[0014] In a second aspect, the present application also provides a cloud cluster monitoring response device, including:

[0015] The acquisition module is used to obtain the monitoring indicator data of the target cloud cluster;

[0016] A generating module, used to generate an alarm event according to the size relationship between the monitoring indicator data and a preset alarm threshold; wherein the alarm event includes alarm data;

[0017] A processing module is used to process the alarm event according to the alarm data and the monitoring indicator data.

[0018] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0019] Obtain monitoring indicator data of the target cloud cluster;

[0020] Generate an alarm event according to the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes alarm data;

[0021] Process the alarm event according to the alarm data and the monitoring indicator data.

[0022] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0023] Obtain monitoring indicator data of the target cloud cluster;

[0024] Generate an alarm event according to the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes alarm data;

[0025] Process the alarm event according to the alarm data and the monitoring indicator data.

[0026] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0027] Obtain monitoring indicator data of the target cloud cluster;

[0028] Generate an alarm event according to the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes alarm data;

[0029] Process the alarm event according to the alarm data and the monitoring indicator data.

[0030] The above-mentioned cloud cluster monitoring and response method, device, equipment, storage medium and product can obtain the data that needs to be monitored by the target cloud cluster in a timely and accurate manner by acquiring the monitoring indicator data of the target cloud cluster, and can centrally acquire the scattered data of the target cloud cluster, thereby providing data support for monitoring whether there are abnormal conditions in the target cloud cluster. Furthermore, according to the size relationship between the monitoring indicator data and the preset alarm threshold, an alarm event including alarm data is generated, and the alarm event is processed according to the alarm data and the monitoring indicator data, so that the abnormal conditions in the target cloud cluster can be quickly responded to. In addition, since the generated alarm data and monitoring indicator data can effectively characterize the key problems of the abnormality of the target cloud cluster, therefore, based on the alarm data and the monitoring indicator data, the abnormal conditions of the target cloud cluster can be quickly and accurately resolved, and targeted solutions can be provided for the abnormal conditions, thereby improving the comprehensiveness and accuracy of the cloud cluster monitoring response. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 An application environment diagram of a cloud cluster monitoring response method in one embodiment;

[0033] Figure 2 A schematic diagram of a process flow of a cloud cluster monitoring response method in one embodiment;

[0034] Figure 3 is a schematic diagram of the process of S210 in one embodiment;

[0035] Figure 4 Schematic diagram of the process of S310 to S330 in one embodiment;

[0036] Figure 5 is a schematic diagram of the process of S410 to S430 in one embodiment;

[0037] Figure 6 It is a flowchart of a cloud cluster monitoring response method in another embodiment;

[0038] Figure 7 It is a structural block diagram of a cloud cluster monitoring response device in one embodiment;

[0039] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] The cloud cluster monitoring response method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0042] In an exemplary embodiment, Figure 2 As shown, a cloud cluster monitoring response method is provided, and the method is applied to Figure 1 The server in the example is used for explanation. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0043] S110, obtaining monitoring indicator data of the target cloud cluster.

[0044] The monitoring indicator data can be understood as data collected by monitoring the operation of the target cloud cluster under at least one monitoring indicator during the operation of the target cloud cluster. Optionally, the monitoring indicator data can be used to measure the performance, health status and operating efficiency of the target cloud cluster. For example, the monitoring indicator data can include at least one of the CPU (Central Processing Unit) usage, memory usage and disk usage.

[0045] Exemplarily, the monitoring indicator data of the target cloud cluster can be obtained in real time or periodically from a data collection terminal for collecting monitoring indicator data, so as to be able to respond to changes in the cluster in a timely manner and quickly diagnose and solve problems when they occur.

[0046] It should be noted that before obtaining the target cloud cluster monitoring indicator data, the monitoring indicators and monitoring data to be obtained can be set according to user needs. Of course, the user's operation permissions can also be set to provide different monitoring indicator data for users with different operation permissions. Optionally, the operation permissions can include at least one of the permissions to view monitoring information, the permissions to adjust alarm thresholds, and the permissions to assign tasks.

[0047] It is understandable that, before obtaining the monitoring indicator data of the target cloud cluster, the monitoring indicator, monitoring data collection parameters, alarm thresholds, storage data cleaning cycle and alarm receiving list can be set according to user needs. After obtaining the monitoring indicator data of the target cloud cluster, the obtained data can be periodically cleaned according to actual needs.

[0048] S120, generating an alarm event according to the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes alarm data.

[0049] The preset alarm threshold can be understood as the monitoring standard of the target cloud cluster pre-set for each monitoring indicator. Accordingly, when the monitoring indicator data reaches or exceeds this threshold, an alarm can be triggered to notify the operation and maintenance personnel or the automated script to respond.

[0050] Exemplarily, the preset alarm threshold may be set to one or more preset specific values ​​or ranges. The preset alarm threshold may be determined based on experience, statistics, theoretical analysis, etc., in order to discover potential problems or risks so that corresponding countermeasures can be taken to ensure the normal operation of the target cloud cluster.

[0051] Among them, an alarm event can be understood as an event generated when the monitoring indicator reaches or exceeds the preset alarm threshold. It is used to indicate that there are potential problems or abnormalities in the target cloud cluster, which requires intervention and troubleshooting by operation and maintenance personnel or automated systems.

[0052] Among them, alarm data can be understood as data generated based on abnormal monitoring indicator data when the monitoring indicator reaches or exceeds the preset alarm threshold. Alarm data can include problem indications about the performance, security, availability, etc. of the target cloud cluster, which can be used as a basis for resolving alarm events.

[0053] In a specific embodiment, the alarm data may include at least one of the information such as timestamp, alarm level, alarm source, alarm indicator, current value of the indicator, alarm state and associated information. Among them, the timestamp can record the exact time when the alarm occurs, so as to track and analyze the alarm event. The alarm level can indicate the severity of the alarm, such as information, warning, important, urgent, etc. The alarm source can be the system component or resource that generates the alarm, such as a database, a Web (World Wide Web Server) server, a network device, etc. The alarm indicator may include CPU usage, response time, error count, etc. The current value of the indicator may provide detailed information about the alarm, such as the current value, threshold, duration, etc. of the indicator. The alarm state may provide the current processing status of the alarm event, such as unprocessed, processing, resolved, etc. The associated information may include related logs, stack traces, historical alarm data, etc.

[0054] Exemplarily, the required monitoring indicators can be defined according to the actual situation and user needs, such as CPU usage, memory usage, disk space, network traffic, response time, etc. Correspondingly, according to the above monitoring indicators, the alarm threshold is set in a targeted manner. Specifically, the alarm threshold can be divided into several levels, such as warning, serious and urgent. By comparing the size relationship between the monitoring indicator data and the preset alarm threshold, an alarm event is automatically generated. Specifically, when the monitoring indicator data reaches or exceeds the preset alarm threshold, an alarm event is automatically generated. Of course, the monitoring indicator data can be collected in real time according to the actual situation, and compared with the alarm threshold, and an alarm event is generated immediately. Alternatively, the monitoring indicator data can be collected within a predetermined time interval according to the actual situation and compared with the alarm threshold.

[0055] S130: Process the alarm event according to the alarm data and the monitoring indicator data.

[0056] For example, when monitoring indicator data triggers an alarm event, a prompt can be given through a preset channel, such as email, SMS, instant message, or sound and light prompt. Moreover, after the alarm prompt is output, an in-depth investigation and analysis is conducted based on the alarm information, and the cause of the alarm is further confirmed by checking the current indicator data and historical indicator data corresponding to the monitoring indicator that triggered the alarm, and finally corresponding processing measures are taken according to the cause of the alarm.

[0057] It should be noted that after processing the alarm event, the data of the processed alarm event can be stored and cleared according to the actual situation. It is understandable that the alarm data can be stored as historical alarm data to provide data support for subsequent monitoring of the target cloud cluster.

[0058] In a specific implementation, in order to facilitate user processing, a mobile terminal can be provided to facilitate users to perform platform work without geographical restrictions or time restrictions. The platform work may include account registration, permission application, permission approval, receiving alarm information, obtaining monitoring view presentation, etc.

[0059] The above-mentioned cloud cluster monitoring and response method, device, equipment, storage medium and product can obtain the data that needs to be monitored by the target cloud cluster in a timely and accurate manner by acquiring the monitoring indicator data of the target cloud cluster, and can centrally acquire the scattered data of the target cloud cluster, thereby providing data support for monitoring whether there are abnormal conditions in the target cloud cluster. Furthermore, according to the size relationship between the monitoring indicator data and the preset alarm threshold, an alarm event including alarm data is generated, and the alarm event is processed according to the alarm data and the monitoring indicator data, so that the abnormal conditions in the target cloud cluster can be quickly responded to. In addition, since the generated alarm data and monitoring indicator data can effectively characterize the key problems of the abnormality of the target cloud cluster, therefore, based on the alarm data and the monitoring indicator data, the abnormal conditions of the target cloud cluster can be quickly and accurately resolved, and targeted solutions can be provided for the abnormal conditions, thereby improving the comprehensiveness and accuracy of the cloud cluster monitoring response.

[0060] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment. In this optional embodiment, the alarm event processing steps in S130 are refined.

[0061] See also Figure 3 The steps for handling the alarm event shown include:

[0062] S210, based on at least one preset solidified processing logic, processing the alarm event according to the alarm data and the monitoring indicator data.

[0063] The preset solidified processing logic can be understood as pre-defining at least one set of fixed processing procedures and rules before processing an alarm event.

[0064] Specifically, in this embodiment, the preset solidification processing logic may include an already developed automation script, which is deployed to a corresponding platform environment. When a specific alarm type is received, the automation script can be executed to resolve the alarm event. The automation script may include at least one of a Python script and a Shell script.

[0065] Since different alarm events correspond to different processing logics, it is also possible to pre-set preset solidified processing logics that match the alarm events for different alarm events. Accordingly, when an alarm event is generated, corresponding operations can be performed for each alarm event according to the corresponding preset solidified processing logic until the alarm event processing is completed.

[0066] Since the processing logic corresponding to the same type of alarm events is usually the same, it is also possible to set preset fixed processing logics that match the event type for different types of alarm events, so as to establish a set of standardized processes and methods for alarm events of the same event type, so that they can be repeatedly applied when facing the same type of alarm events, thereby improving the efficiency and consistency of processing alarm events. Accordingly, in an optional embodiment, based on at least one preset fixed processing logic, processing an alarm event according to alarm data and monitoring indicator data can be: determining the alarm type according to the alarm data and monitoring indicator data; selecting the target fixed processing logic of the alarm event from at least one preset fixed processing logic according to the alarm type; and processing the alarm event based on the target fixed processing logic.

[0067] Among them, the alarm type can be understood as the result of event classification of different alarm events, which can be used to indicate the type of abnormality or problem that occurs in the target cloud cluster during operation. Specifically, the alarm type may include at least one of performance alarm, availability alarm, error alarm, security alarm, capacity alarm and configuration alarm. Among them, the performance alarm can be too high CPU usage, too much memory usage, insufficient hard disk space, too long response time, etc. Availability alarm can be triggered when the target cloud cluster is unavailable, for example, service unresponsiveness, website inaccessibility, service interruption, etc. Error alarm can be triggered when an error occurs in the target cloud cluster, for example, application error, database query failure, network connection error, etc. Security alarm can be triggered when security threats or abnormalities are detected, for example, unauthorized access attempts, vulnerabilities, virus or malware activities, etc. Capacity alarm can be triggered when the target cloud cluster is close to its capacity limit, for example, the database table size is close to the maximum value, the message queue length is too long, etc. Configuration alarm can be triggered when the target cloud cluster changes or does not meet expectations during operation, for example, configuration file changes, parameters are modified, etc.

[0068] The target solidification processing logic may be understood as a preset solidification processing logic specifically used for performing the alarm type to which the aforementioned generated alarm event belongs.

[0069] In another optional embodiment, when the alarm event processing fails, the alarm event can be analyzed based on the alarm data and monitoring indicator data to obtain the alarm cause and the event impact range; according to the alarm cause and the event impact range, an intervention plan for the alarm event is output. The advantage of this is that the intervention plan for the alarm event can be directly output without manual investigation by operation and maintenance personnel, which improves the subsequent intervention efficiency of the alarm event. At the same time, it reduces the technical threshold for operation and maintenance personnel.

[0070] Among them, the alarm cause can be understood as the root cause of the alarm trigger, which can indicate the anomalies or problems that occur in the target cloud cluster during operation; the event impact scope can be understood as the degree and coverage of the impact that the alarm event may have on the system, business processes, users, services and the organization as a whole; the intervention plan can be understood as a solution formulated according to the type, severity, scope of impact and cause of the alarm event to reduce or eliminate the adverse effects of the alarm event.

[0071] Specifically, for alarm events that cannot be handled by a fixed processing flow, a machine learning algorithm can be used to analyze the cause of the failure or abnormality and the scope of subsequent impact, generate solutions, and provide decision support. It is worth noting that the machine learning algorithm used in this application can reuse existing algorithm logic, and this application does not make any restrictions on this.

[0072] In another optional embodiment, event detail data generated by processing an alarm event may be stored, wherein the event detail data includes at least one of event processing steps, user information corresponding to monitoring indicator data, script description information of target solidified processing logic, and alarm processing status.

[0073] It should be noted that after processing the alarm event, a work order can be automatically generated. For example, the operation data in the process of processing the alarm event can be converted into work order information; wherein the work order information can include at least one of the information such as processing steps, user information, automation script information and alarm processing status. wherein the alarm processing status includes at least one of the states of pending, processing and resolved.

[0074] The cloud cluster monitoring response method in this embodiment processes alarm events according to alarm data and monitoring indicator data through at least one preset solidified processing logic. When an alarm event in the target cloud cluster and an alarm event that has occurred in the past are of the same alarm type, the solution used for historical processing of alarm events can be reused, thereby accurately providing the solution logic for the alarm event, and quickly responding to the alarm event to improve the response speed. The interruption time of the target cloud cluster service is reduced, thereby improving the continuity and availability of the service. Alarm events can be processed without manual intervention, reducing the workload of operation and maintenance personnel, and reducing the possibility of human errors and the error rate.

[0075] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment. In this optional embodiment, an alarm data update step is further added before S130.

[0076] See also Figure 4 The steps for updating the alarm data shown include:

[0077] S310, extracting key information from the alarm data.

[0078] Among them, key information can be understood as important information generated during the operation of the monitoring target cloud cluster to indicate potential problems or abnormal situations. Optionally, the key information can include at least one of the abnormal source name, alarm time, alarm content, etc.

[0079] S320, generating alarm data in a preset format according to the key information.

[0080] The alarm data in a preset format may be understood as a predefined data format used to issue a warning or notification in a specific format when an alarm event occurs. The alarm data in a preset format may include detailed information about the alarm, such as at least one of a timestamp, event type, severity, etc.

[0081] Exemplarily, key information such as the abnormal source name, alarm time, and alarm content may be combined according to preset format requirements to generate alarm data.

[0082] S330, filtering abnormal alarm data in the alarm data of a preset format to update the alarm data.

[0083] The abnormal alarm data may include at least one of the first alarm data generated due to a maintenance period change, the second alarm data generated due to a task cycle change, and the third alarm data repeated within a preset time period.

[0084] Exemplarily, Python, Java and other programming languages ​​can be used in combination with relevant data processing libraries to filter abnormal alarm data in the preset format. It should be noted that before filtering the abnormal alarm data in the preset format, data cleaning and preprocessing can also be performed. For example, the preprocessing method can include processing missing values, abnormal values, and converting data formats.

[0085] Exemplarily, abnormal alarm data may be directly removed from the alarm data in a preset format to obtain updated alarm data.

[0086] The cloud cluster monitoring and response method in this embodiment can extract the key alarm data for solving the alarm event by extracting the key information in the alarm data, thereby narrowing the scope of analyzing the alarm data. According to the key information, the alarm data in the preset format is generated, and the generation format of the alarm data can be standardized. Then, different processing measures can be adopted for the alarm data in different formats, and the alarm data in the preset format can be processed in a targeted manner to improve the processing efficiency and response speed of the alarm event. In addition, filtering the abnormal alarm data in the alarm data in the preset format can avoid repeated warnings caused by changes in the maintenance period, changes in the task cycle, and repetitions within the preset time period, reduce the probability of invalid alarm events, and improve the accuracy of monitoring the target cloud cluster.

[0087] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment. In this optional embodiment, the alarm event generation step in S120 is refined.

[0088] See also Figure 5 The steps for generating an alarm event include:

[0089] S410, extracting disk description data from the monitoring indicator data; wherein the disk description data includes disk total amount data and disk usage data.

[0090] The total disk data can be understood as the total capacity of the disk storage device, and the disk usage data can be understood as the data on the disk storage usage.

[0091] S420: Determine disk usage according to the disk description data.

[0092] Among them, the disk usage rate is used to reflect the current usage status of the disk, which can be understood as the proportion of the disk occupied by data read and write operations generated when the disk is working.

[0093] Exemplarily, the disk usage rate can be calculated and determined based on the disk total amount data and the disk usage data. For example, the ratio of the disk usage data to the disk total amount data can be used as the disk usage rate.

[0094] S430: Generate an alarm event according to the magnitude relationship between the disk usage and a preset alarm threshold.

[0095] For example, the disk usage rate can be compared with a preset alarm threshold, and an alarm event is generated when the disk usage rate is greater than the preset alarm threshold. Further, when the disk usage rate is not greater than (that is, less than or equal to) the preset alarm threshold, no response is made, or the generation of an alarm event is prohibited.

[0096] The cloud cluster monitoring response method in this embodiment can provide data support for alarm events by extracting disk description data from monitoring indicator data. According to the disk description data, the disk usage rate is determined, the disk space usage of each node can be monitored, and the generation of alarm events can be predicted to prevent alarm events. According to the size relationship between the disk usage rate and the preset alarm threshold, an alarm event is generated, which can accurately reflect the disk usage when the disk usage is abnormal, and thus accurately monitor the abnormal situation of the target cloud cluster.

[0097] Based on the technical solutions provided in the above embodiments, the present application also provides an optional embodiment. In this optional embodiment, a more detailed cloud cluster monitoring response method is provided. Figure 6 An abnormal data identification method shown includes:

[0098] S510: Acquire monitoring indicator data of the target cloud cluster and historical data stored in the target cloud cluster, wherein the historical data includes historical alarm data, operation data generated by resolving the alarm data, and operation data generated by normal operation.

[0099] S520: Clean and analyze the acquired monitoring indicator data, set an alarm threshold, and generate alarm data according to the size relationship between the alarm threshold and the monitoring indicator data.

[0100] S530: normalize and filter the alarm data, send the alarm data to the target user, and store the alarm data.

[0101] S540. Automatically process the alarm event through a solidified processing flow.

[0102] S550. For alarm events that cannot be automatically processed using a fixed processing flow, intelligent analysis is used to provide users with decision support for resolving the alarm events. After the alarm events are resolved, the operating data generated during the resolution process is stored.

[0103] S560. Generate a monitoring view based on the data generated by monitoring the target cloud cluster according to user needs and permissions, and push the view to the user according to user needs and permissions. The user can also retrieve and view the target view by himself.

[0104] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0105] Based on the same inventive concept, the embodiment of the present application also provides a cloud cluster monitoring response device for implementing the cloud cluster monitoring response method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more cloud cluster monitoring response device embodiments provided below can refer to the limitations of the cloud cluster monitoring response method above, and will not be repeated here.

[0106] In an exemplary embodiment, Figure 7 As shown, a cloud cluster monitoring response device is provided, including: an acquisition module, a generation module and a processing module, wherein:

[0107] The acquisition module 610 is used to acquire monitoring indicator data of the target cloud cluster.

[0108] The generation module 620 is used to generate an alarm event according to the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes alarm data.

[0109] The processing module 630 is used to process the alarm event according to the alarm data and the monitoring indicator data.

[0110] Each module in the above-mentioned cloud cluster monitoring response device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0111] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store cloud cluster monitoring response data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a cloud cluster monitoring response method is implemented.

[0112] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0113] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0114] Get the monitoring indicator data of the target cloud cluster.

[0115] An alarm event is generated based on the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes the alarm data.

[0116] Process alarm events based on alarm data and monitoring indicator data.

[0117] In one embodiment, when the processor executes the computer program, the following steps are also implemented: based on at least one preset solidified processing logic, the alarm event is processed according to the alarm data and the monitoring indicator data.

[0118] In one embodiment, when the processor executes the computer program, the following steps are also implemented: determining the alarm type based on the alarm data and the monitoring indicator data; selecting the target solidification processing logic of the alarm event from the at least one preset solidification processing logic based on the alarm type; and processing the alarm event based on the target solidification processing logic.

[0119] In one embodiment, when the processor executes the computer program, the following steps are also implemented: in the event that the alarm event processing fails, the alarm event is analyzed based on the alarm data and the monitoring indicator data to obtain the alarm cause and the event impact scope; based on the alarm cause and the event impact scope, an intervention plan for the alarm event is output.

[0120] In one embodiment, when the processor executes the computer program, the following steps are also implemented: extracting key information from the alarm data; generating alarm data in a preset format based on the key information; filtering abnormal alarm data in the alarm data in the preset format to update the alarm data; wherein the abnormal alarm data includes at least one of the first alarm data generated due to a maintenance period change, the second alarm data generated due to a task cycle change, and the third alarm data repeated within a preset time period.

[0121] In one embodiment, when the processor executes the computer program, the following steps are also implemented: extracting disk description data from the monitoring indicator data; wherein the disk description data includes total disk data and disk usage data; determining disk usage based on the disk description data; and generating an alarm event based on the size relationship between the disk usage and a preset alarm threshold.

[0122] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0123] Get the monitoring indicator data of the target cloud cluster.

[0124] An alarm event is generated based on the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes the alarm data.

[0125] Process alarm events based on alarm data and monitoring indicator data.

[0126] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on at least one preset solidified processing logic, the alarm event is processed according to the alarm data and the monitoring indicator data.

[0127] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the alarm type based on the alarm data and the monitoring indicator data; selecting the target solidification processing logic of the alarm event from the at least one preset solidification processing logic based on the alarm type; and processing the alarm event based on the target solidification processing logic.

[0128] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: in the event that the alarm event processing fails, the alarm event is analyzed based on the alarm data and the monitoring indicator data to obtain the alarm cause and the event impact scope; based on the alarm cause and the event impact scope, an intervention plan for the alarm event is output.

[0129] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting key information from the alarm data; generating alarm data in a preset format based on the key information; filtering abnormal alarm data in the alarm data in the preset format to update the alarm data; wherein the abnormal alarm data includes at least one of the first alarm data generated due to a maintenance period change, the second alarm data generated due to a task cycle change, and the third alarm data repeated within a preset time period.

[0130] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting disk description data from the monitoring indicator data; wherein the disk description data includes total disk data and disk usage data; determining disk usage based on the disk description data; and generating an alarm event based on the size relationship between the disk usage and a preset alarm threshold.

[0131] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0132] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0133] Get the monitoring indicator data of the target cloud cluster.

[0134] An alarm event is generated based on the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes the alarm data.

[0135] Process alarm events based on alarm data and monitoring indicator data.

[0136] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on at least one preset solidified processing logic, the alarm event is processed according to the alarm data and the monitoring indicator data.

[0137] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the alarm type based on the alarm data and the monitoring indicator data; selecting the target solidification processing logic of the alarm event from the at least one preset solidification processing logic based on the alarm type; and processing the alarm event based on the target solidification processing logic.

[0138] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: in the event that the alarm event processing fails, the alarm event is analyzed based on the alarm data and the monitoring indicator data to obtain the alarm cause and the event impact scope; based on the alarm cause and the event impact scope, an intervention plan for the alarm event is output.

[0139] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting key information from the alarm data; generating alarm data in a preset format based on the key information; filtering abnormal alarm data in the alarm data in the preset format to update the alarm data; wherein the abnormal alarm data includes at least one of the first alarm data generated due to a maintenance period change, the second alarm data generated due to a task cycle change, and the third alarm data repeated within a preset time period.

[0140] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting disk description data from the monitoring indicator data; wherein the disk description data includes total disk data and disk usage data; determining disk usage based on the disk description data; and generating an alarm event based on the size relationship between the disk usage and a preset alarm threshold.

[0141] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0142] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0143] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0144] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A cloud cluster monitoring response method, characterized in that: include: Obtain monitoring indicator data of the target cloud cluster; Generate an alarm event according to the size relationship between the monitoring indicator data and the preset alarm threshold; wherein the alarm event includes alarm data; Process the alarm event according to the alarm data and the monitoring indicator data.

2. The cloud cluster monitoring response method according to claim 1, characterized in that: The processing of the alarm event according to the alarm data and the monitoring indicator data includes: Based on at least one preset solidified processing logic, the alarm event is processed according to the alarm data and the monitoring indicator data.

3. The cloud cluster monitoring response method according to claim 2, characterized in that: The processing of the alarm event based on at least one preset solidified processing logic and according to the alarm data and the monitoring indicator data includes: Determine the alarm type according to the alarm data and the monitoring indicator data; According to the alarm type, selecting a target solidification processing logic for the alarm event from the at least one preset solidification processing logic; Based on the target solidification processing logic, the alarm event is processed.

4. The cloud cluster monitoring response method according to any one of claims 2-3, characterized in that: The method further comprises: In the case where the alarm event processing fails, the alarm event is analyzed according to the alarm data and the monitoring indicator data to obtain the alarm cause and the event impact scope; Output an intervention plan for the alarm event according to the alarm cause and the event impact scope.

5. The cloud cluster monitoring response method according to claim 1, characterized in that: Before processing the alarm event according to the alarm data and the monitoring indicator data, the method further includes: Extracting key information from the alarm data; Generate warning data in a preset format according to the key information; Filtering abnormal alarm data in the alarm data in the preset format to update the alarm data; The abnormal alarm data includes at least one of first alarm data generated due to a maintenance period change, second alarm data generated due to a task cycle change, and third alarm data repeated within a preset time period.

6. The cloud cluster monitoring and response method according to claim 1, characterized in that: The generating of an alarm event according to the magnitude relationship between the monitoring indicator data and a preset alarm threshold value includes: Extracting disk description data from the monitoring indicator data; wherein the disk description data includes disk total amount data and disk usage data; Determine the disk usage rate according to the disk description data; An alarm event is generated according to the magnitude relationship between the disk usage and a preset alarm threshold.

7. A cloud cluster monitoring response device, characterized in that: include: The acquisition module is used to obtain the monitoring indicator data of the target cloud cluster; A generating module, used to generate an alarm event according to the size relationship between the monitoring indicator data and a preset alarm threshold; wherein the alarm event includes alarm data; A processing module is used to process the alarm event according to the alarm data and the monitoring indicator data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images