Data center emergency guarantee method, equipment, medium and product

Abstract

The invention relates to the technical field of data processing, in particular to a data center emergency guarantee method and device, a medium and a product, and the method comprises the steps: carrying out the abnormality diagnosis analysis based on multi-dimensional monitoring data, and determining a plurality of abnormal events. In order to more accurately lock a root cause of a fault and improve the accuracy of subsequent fault positioning and emergency processing, association analysis is performed based on a plurality of abnormal events, and a target abnormal event set is determined. Furthermore, fault positioning and emergency processing analysis are performed on the target abnormal event set by using a scenarized rule base, fault root information and an emergency processing flow are determined, and an emergency processing case similar to the target abnormal event set can be quickly found by using the scenarized rule base. And the accuracy of fault source positioning and emergency processing flow is improved. And finally, work order circulation is carried out based on the fault root information, the emergency processing flow and the standard work order circulation flow until the abnormal events in the target abnormal event set are solved.

Description

Technical Field

[0001] The present application relates to the technical field of data processing, and in particular to a data center emergency support method, equipment, medium and product. Background Art

[0002] With the rapid development of cloud computing and big data technology, data centers, as the cornerstone of the information society, are becoming increasingly important. Data centers not only carry the storage and processing tasks of massive data, but also support the stable operation of various online services and applications. However, as the scale and complexity of data centers continue to increase, their operation and maintenance management faces unprecedented challenges, especially the need for emergency management and rapid fault location.

[0003] Related data center operation and maintenance systems usually rely on manual experience and simple alarm mechanisms for fault detection and location. However, in the context of the cloud computing and big data era, the amount of data generated by data centers is growing exponentially. In complex data center environments, the operation and maintenance systems in related technologies lack the ability to deeply analyze and locate the root causes of faults, making it difficult for technicians to quickly and accurately find the root causes of faults.

[0004] Therefore, how to solve the above technical defects is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0005] The purpose of this application is to provide a data center emergency protection method, equipment, medium and product to solve at least one of the above technical problems.

[0006] The above invention objectives of the present application are achieved through the following technical solutions: In the first aspect, the present application provides a data center emergency protection method, which adopts the following technical solution: A data center emergency protection method, comprising: Acquire multi-dimensional monitoring data collected by the monitoring agent, and perform abnormal diagnosis and analysis based on the multi-dimensional monitoring data to determine multiple abnormal events, wherein the multi-dimensional monitoring data includes: power system monitoring data, computer room environment monitoring data, security access control monitoring data, power equipment monitoring data and network monitoring data; Performing correlation analysis based on the multiple abnormal events to determine a target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from the multiple abnormal events; Use the scenario-based rule base to perform fault location and emergency processing analysis on the target abnormal event set to determine the fault root cause information and emergency processing process; A standard work order flow process is automatically created based on the emergency handling process, and work order flow is performed based on the fault root cause information, the emergency handling process and the standard work order flow process until the abnormal event in the target abnormal event set is resolved, wherein the standard work order flow process is used to ensure accurate information transmission and complete information chain in the emergency handling process.

[0007] By adopting the above technical solution, the multi-dimensional monitoring data collected by the monitoring agent is obtained, and the abnormal diagnosis analysis is performed based on the multi-dimensional monitoring data to determine multiple abnormal events. In order to more accurately lock the root cause of the fault, avoid wasting time and energy on minor abnormal events, and improve the accuracy of subsequent fault location and emergency treatment, therefore, a correlation analysis is performed based on multiple abnormal events to determine the target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from multiple abnormal events, so that the target abnormal event set screened out is directly related to the main abnormal event. Then, the scenario rule library is used to perform fault location and emergency treatment analysis on the target abnormal event set, and the fault root source information and emergency treatment process are determined. The scenario rule library is used to quickly find emergency treatment cases similar to the target abnormal event set, which shortens the time cycle of fault location and emergency treatment analysis to a certain extent, and also improves the accuracy of fault root source location and emergency treatment process. Finally, a standard work order flow process is automatically created based on the emergency treatment process, and the work order flow is performed based on the fault root source information, the emergency treatment process and the standard work order flow process until the abnormal events in the target abnormal event set are resolved.

[0008] In a preferred example, the present application can be further configured as follows: the construction method of the scenario-based rule library includes: Acquire multiple standard abnormal event processing procedures, extract key features based on each of the standard abnormal event processing procedures, and determine standard abnormal event features, wherein the standard abnormal event features include: abnormal event description, processing action, processing steps, and processing results; A knowledge graph is constructed based on each of the standard abnormal event features to obtain an abnormal event knowledge graph, and the abnormal event knowledge graph is stored in a scenario-based rule base, wherein the graph nodes in the abnormal event knowledge graph represent abnormal event descriptions, processing actions, and processing results, and the graph edges represent the associations between the graph nodes based on the processing steps; When it is detected that there is an abnormal event processing process to be supplemented, a supplementary graph is constructed based on the abnormal event processing process to be supplemented to obtain a supplementary knowledge graph, and the supplementary knowledge graph is added to the scenario-based rule base, wherein the supplementary graph construction is used to expand the scale of the abnormal event knowledge graph to cover multiple fault scenarios and solutions.

[0009] In a preferred example, the present application can be further configured as follows: using a scenario-based rule library to perform fault location and emergency processing analysis on the target abnormal event set, and determining fault root information and emergency processing procedures, including: Based on each main abnormal event in the target abnormal event set, matching is performed with the abnormal event description in the abnormal event knowledge graph in the scenario rule base to determine the target graph node corresponding to each main abnormal event; Based on the positional relationship of each target graph node in the abnormal event knowledge graph, the root cause information of the fault is determined, and the root source graph node corresponding to the root source information of the fault and the scenario-based rule base are selected to extract the processing flow and determine the emergency processing flow.

[0010] In a preferred example, the present application can be further configured to: automatically create a standard work order flow process based on the emergency handling process, including: Based on the processing actions and the processing steps in the emergency processing process, determine the work order transfer department and the transfer department order; A process is created based on the work order transfer department and the order of the transfer departments to obtain a standard work order transfer process.

[0011] In a preferred example, the present application may be further configured as follows: performing correlation analysis based on a plurality of abnormal events to determine a target abnormal event set, including: Performing event correlation analysis on the plurality of abnormal events using a correlation analysis algorithm to determine a correlation analysis result, and performing clustering processing based on the correlation analysis result to determine an event clustering result; Minor abnormal events are eliminated based on the event clustering result to determine a target abnormal event set.

[0012] In a preferred example, the present application may be further configured as follows: based on the fault root information, the emergency handling process and the standard work order flow process, work order flow is performed until the abnormal event in the target abnormal event set is resolved, including: When a work order creation instruction is detected, a work order template is obtained, and the work order is filled based on the work order template, the fault root cause information, and the emergency processing flow to obtain a fault emergency processing work order; Pushing the fault emergency processing work order according to the flow path in the standard work order flow process, and sending a fault emergency processing reminder to the processing terminal corresponding to the target processing node when the fault emergency processing work order arrives at the target processing node; Acquire the fault emergency feedback information sent by the processing terminal, store the fault emergency feedback information in the standard work order flow process, and continue to push the fault emergency processing work order according to the flow path until the abnormal event in the target abnormal event set is resolved.

[0013] In a second aspect, the present application provides an electronic device, which adopts the following technical solution: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the above-mentioned data center emergency protection method.

[0014] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium stores a computer program, which, when executed in a computer, causes the computer to execute the data center emergency protection method described above.

[0015] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution: A computer program product includes a computer program, and when the computer program is executed by a processor, the data center emergency protection method is implemented.

[0016] In summary, the present application includes at least one of the following beneficial technical effects: The multi-dimensional monitoring data collected by the monitoring agent is obtained, and an abnormal diagnosis analysis is performed based on the multi-dimensional monitoring data to determine multiple abnormal events. In order to more accurately lock the root cause of the fault, avoid wasting time and energy on minor abnormal events, and improve the accuracy of subsequent fault location and emergency treatment, therefore, a correlation analysis is performed based on multiple abnormal events to determine the target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from multiple abnormal events, so that the target abnormal event set screened out is directly related to the main abnormal event. Then, the target abnormal event set is analyzed for fault location and emergency treatment using a scenario-based rule library to determine the fault root cause information and emergency treatment process. The scenario-based rule library is used to quickly find emergency treatment cases similar to the target abnormal event set, which shortens the time cycle of fault location and emergency treatment analysis to a certain extent, and also improves the accuracy of fault root location and emergency treatment process. Finally, a standard work order flow process is automatically created based on the emergency treatment process, and the work order flow is performed based on the fault root cause information, emergency treatment process and standard work order flow process until the abnormal events in the target abnormal event set are resolved.

[0017] In order to further improve the efficiency of emergency handling, avoid distortion of emergency handling information and delay of emergency handling tasks, a standardized and templated work order circulation system is pre-designed, which can ensure the accuracy of emergency handling information transmission and the consistency of the processing flow. Therefore, based on the processing actions and processing steps in the emergency handling process, the work order circulation department and circulation department sequence are determined, and then the process is created based on the work order circulation department and circulation department sequence to obtain the standard work order circulation process. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of a data center emergency protection method according to one embodiment of the present application; Figure 2 This is a structural diagram of a data center emergency protection system according to one embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device according to one embodiment of the present application. DETAILED DESCRIPTION

[0019] The following combination Figures 1 to 3 This application is described in further detail.

[0020] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, a person skilled in the art may make non-creative modifications to the present embodiment as needed, but such modifications are protected by the patent law as long as they are within the scope of the present application.

[0021] In order to make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is a part of the embodiment of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application. It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the data related to the object is involved in the embodiment of the present application, it needs to be obtained through the authorization and consent of the object, the authorization and consent of the relevant departments, and in accordance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiment, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained, and the embodiment also needs to be implemented with the authorization and consent of the object.

[0022] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0023] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0024] The embodiment of the present application provides a data center emergency support method, which is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and the embodiment of the present application does not limit this. Figure 1 As shown, the method includes step S101, step S102, step S103 and step S104, wherein: Step S101: Acquire multi-dimensional monitoring data collected by the monitoring agent, and perform abnormal diagnosis and analysis based on the multi-dimensional monitoring data to determine multiple abnormal events, wherein the multi-dimensional monitoring data includes: power system monitoring data, computer room environment monitoring data, security access control monitoring data, power equipment monitoring data and network monitoring data.

[0025] For the embodiment of the present application, the data center will store multi-dimensional data such as power equipment, room environment, network monitoring, security access control, etc. in the computer room. The multi-dimensional monitoring data can fully and accurately display the overall working status of the computer room, that is, in order to obtain accurate multi-dimensional monitoring data, various sensors and data acquisition devices are deployed in advance at key positions in the computer room, so that the monitoring agent can collect high-precision multi-dimensional monitoring data and send it to the electronic device by wireless transmission. For multi-dimensional monitoring data, the power system monitoring data includes but is not limited to: city power input data, UPS power supply data, generator working data, high and low voltage distribution cabinet working data, etc., the computer room environment monitoring data includes but is not limited to: temperature, humidity, smoke, water immersion, air quality, etc., the security access control monitoring data includes but is not limited to: the switch status of the access control, personnel entry and exit records, monitoring video images, the power equipment monitoring data includes but is not limited to: server working data, switch working data, other power equipment working data, network monitoring data includes but is not limited to: network connection status, network traffic data, etc.

[0026] Furthermore, an abnormality detection is performed on the multidimensional monitoring data using an abnormality diagnosis algorithm, that is, a reasonable monitoring threshold is pre-set in the abnormality diagnosis algorithm, so that when the multidimensional monitoring data exceeds the normal range preset in the abnormality diagnosis algorithm, the monitoring data is recorded as abnormal monitoring data, and multiple abnormal events are determined based on the characteristics of the abnormal monitoring data and the relationship between the data characteristics and the abnormal events. The embodiment of the present application does not limit the type and specific event content of the abnormal event, and the user can set it according to the actual situation.

[0027] Step S102: performing correlation analysis based on multiple abnormal events to determine a target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from the multiple abnormal events.

[0028] For the embodiments of the present application, in order to more accurately identify the root cause of the fault, avoid wasting time and energy on minor abnormal events, and improve the accuracy of subsequent fault location and emergency handling, a correlation analysis is performed based on multiple abnormal events to determine a target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from multiple abnormal events, so that the target abnormal event set screened out are all events directly related to the main abnormal event. There are many ways to implement correlation analysis, and the embodiments of the present application are no longer limited. In one achievable method, a correlation analysis algorithm is used to perform event correlation analysis on multiple abnormal events to determine the correlation analysis results, and clustering is performed based on the correlation analysis results to determine the event clustering results; minor abnormal events are eliminated based on the event clustering results to determine the target abnormal event set.

[0029] Step S103: Use the scenario-based rule library to perform fault location and emergency processing analysis on the target abnormal event set to determine the fault root cause information and emergency processing process.

[0030] For the embodiment of the present application, the scenario-based rule base is a rule base that stores relevant emergency solutions for a variety of different fault scenarios, which is convenient for quickly identifying the root causes of abnormal situations existing in the data center and providing corresponding solutions, so that technical personnel can quickly identify the root causes of the faults and take emergency treatment measures in time, which can greatly shorten the time from the occurrence of the fault to the restoration of normal, reduce the business interruption time caused by the fault, and reduce the losses caused by business interruption. Therefore, the scenario-based rule base is used to perform fault location and emergency treatment analysis on the target abnormal event set, determine the root cause information and emergency treatment process, wherein the relationship between the fault and the solution in the scenario-based rule base is displayed in the form of an intuitive graphical knowledge graph, which is convenient for quickly finding emergency treatment cases similar to the target abnormal event set, and shortens the time period of fault location and emergency treatment analysis to a certain extent.

[0031] The construction method of the scenario-based rule base is as follows: obtain multiple standard abnormal event processing processes, extract key features based on each standard abnormal event processing process, and determine the standard abnormal event features, wherein the standard abnormal event features include: abnormal event description, processing action, processing steps, and processing results; construct a knowledge graph based on each standard abnormal event feature to obtain an abnormal event knowledge graph, and store the abnormal event knowledge graph in the scenario-based rule base, wherein the graph nodes in the abnormal event knowledge graph represent abnormal event descriptions, processing actions, and processing results, and the graph edges represent the associations between graph nodes based on the processing steps; when it is detected that there is an abnormal event processing process to be supplemented, a supplementary graph is constructed based on the abnormal event processing process to be supplemented to obtain a supplementary knowledge graph, and the supplementary knowledge graph is added to the scenario-based rule base, wherein the supplementary graph construction is used to expand the scale of the abnormal event knowledge graph to cover multiple fault scenarios and solutions. The scenario-based rule base is used to perform fault location and emergency processing analysis operations, which improves the utilization rate of historical emergency processing experience in the fault processing process and shortens the time cycle of fault location and emergency processing analysis.

[0032] Step S104: Automatically create a standard work order flow process based on the emergency handling process, and perform work order flow based on the fault root cause information, emergency handling process and standard work order flow process until the abnormal event in the target abnormal event set is resolved. Among them, the standard work order flow process is used to ensure accurate information transmission and complete information chain in the emergency handling process.

[0033] For the embodiment of the present application, in order to further improve the work efficiency of emergency handling, avoid distortion of emergency handling information and delay of emergency handling tasks, in the embodiment of the present application, a set of standardized and templated work order circulation system is pre-designed, which can ensure the accuracy of emergency handling information transmission and the consistency of the processing flow. Therefore, a standard work order circulation process is automatically created based on the emergency handling process. Since the emergency handling processes are not the same, the corresponding work order circulation departments and circulation department sequences in the standard work order circulation process are also different. Therefore, a standard work order circulation process that is highly matched with this emergency handling is created based on the emergency handling process, which helps to ensure that the information transmission in the emergency handling process is accurate and the information chain is complete. The specific implementation process for automatically creating a standard work order circulation process is as follows: based on the processing actions and processing steps in the emergency handling process, determine the work order circulation department and circulation department sequence; create a process based on the work order circulation department and circulation department sequence to obtain a standard work order circulation process.

[0034] Furthermore, the work order is transferred based on the fault root information, the emergency processing process and the standard work order flow process until the abnormal event in the target abnormal event set is resolved, that is, an automated notification mechanism is set in the work order flow process, so that when it is transferred to the corresponding target processing node, the relevant personnel can receive the message notification in time and perform the corresponding emergency processing, reducing the waiting time caused by human negligence. There are many specific implementation methods for the work order flow, and the embodiment of the present application is no longer limited. In one achievable method, when a work order creation instruction is detected, a work order template is obtained, and the work order is filled based on the work order template, the fault root information, and the emergency processing process to obtain a fault emergency processing work order; the fault emergency processing work order is pushed according to the flow path in the standard work order flow process, and when the fault emergency processing work order arrives at the target processing node, a fault emergency processing reminder is sent to the processing terminal corresponding to the target processing node; the fault emergency feedback information sent by the processing terminal is obtained, and the fault emergency feedback information is stored in the standard work order flow process, and the fault emergency processing work order is continued to be pushed according to the flow path until the abnormal event in the target abnormal event set is resolved.

[0035] It can be seen that in the embodiment of the present application, the multi-dimensional monitoring data collected by the monitoring agent is obtained, and the abnormal diagnosis analysis is performed based on the multi-dimensional monitoring data to determine multiple abnormal events. In order to more accurately lock the root cause of the fault, avoid wasting time and energy on minor abnormal events, and improve the accuracy of subsequent fault location and emergency treatment, therefore, a correlation analysis is performed based on multiple abnormal events to determine the target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from multiple abnormal events, so that the target abnormal event set screened out is directly related to the main abnormal event. Then, the target abnormal event set is analyzed for fault location and emergency treatment using the scenario rule library to determine the fault root source information and emergency treatment process. The scenario rule library is used to quickly find emergency treatment cases similar to the target abnormal event set, which shortens the time period of fault location and emergency treatment analysis to a certain extent, and also improves the accuracy of fault root source location and emergency treatment process. Finally, a standard work order flow process is automatically created based on the emergency treatment process, and the work order flow is performed based on the fault root source information, the emergency treatment process and the standard work order flow process until the abnormal event in the target abnormal event set is resolved.

[0036] Furthermore, in order to shorten the time period for fault location and emergency processing analysis and improve the utilization rate of historical processing experience, in the embodiment of the present application, the construction method of the scenario rule library includes: Acquire multiple standard abnormal event processing processes, extract key features based on each standard abnormal event processing process, and determine standard abnormal event features, wherein the standard abnormal event features include: abnormal event description, processing action, processing steps, and processing results; A knowledge graph is constructed based on the characteristics of each standard abnormal event to obtain an abnormal event knowledge graph, and the abnormal event knowledge graph is stored in a scenario-based rule base. The graph nodes in the abnormal event knowledge graph represent abnormal event descriptions, processing actions, and processing results, and the graph edges represent the associations between graph nodes based on the processing steps. When it is detected that there is an abnormal event processing process to be supplemented, a supplementary graph is constructed based on the abnormal event processing process to be supplemented to obtain a supplementary knowledge graph, and the supplementary knowledge graph is added to the scenario-based rule base. The supplementary graph construction is used to expand the scale of the abnormal event knowledge graph to cover multiple fault scenarios and solutions.

[0037] For the embodiment of the present application, the scenario-based rule base is a rule base that stores relevant emergency solutions for a variety of different fault scenarios. The relationship between faults and solutions in the scenario-based rule base is displayed in the form of an intuitive graphical knowledge graph, which is convenient for quickly finding emergency response cases similar to the target abnormal event set, shortening the time cycle of fault location and emergency response analysis to a certain extent, and reducing the business interruption time caused by faults, so as to reduce the losses caused by business interruptions. At the same time, a dynamic update mechanism of the knowledge graph is also set up to facilitate the scenario-based rule base to continuously adapt to new abnormal events and processing methods, and improve the utilization rate of historical processing experience.

[0038] Specifically, multiple standard abnormal event processing processes are obtained, and the standard abnormal event processing process is a fault handling process that has completed abnormal event processing. Then, natural language processing technology is used to extract key features of each standard abnormal event processing process to determine the standard abnormal event features, where the standard abnormal event features include: abnormal event description, processing action, processing steps, and processing results. A knowledge graph is constructed based on each standard abnormal event feature to obtain a local knowledge graph corresponding to each standard abnormal event feature. The graph nodes in the local knowledge graph represent the abnormal event description, processing action, and processing result, and the graph edges represent the association between the graph nodes based on the processing steps. Then, according to the association relationship between multiple standard abnormal events, the abnormal event description nodes of multiple local knowledge graphs are connected to jointly form an abnormal event knowledge graph.

[0039] Furthermore, in the actual working process of the computer room, abnormal event scenarios that do not exist in the scenario rule base will continue to emerge. In order to enable the scenario rule base to continuously adapt to new abnormal events and processing methods, and maintain its timeliness and practicality, a dynamic update mechanism of the knowledge graph is introduced, so that the scenario rule base can cover more abnormal event scenarios and solutions, and cope with more complex and changeable abnormal situations. Therefore, when it is detected that there is an abnormal event processing flow to be supplemented, a supplementary graph is constructed based on the abnormal event processing flow to be supplemented to obtain a supplementary knowledge graph. The abnormal event processing flow to be supplemented is the abnormal event and processing method corresponding to the abnormal event scenario not covered in the scenario rule base. The process of constructing the supplementary graph is consistent with the process of constructing the knowledge graph for standard abnormal events. Here, the embodiment of the present application will not be repeated. Furthermore, the supplementary knowledge graph is added to the abnormal event knowledge graph as a local knowledge graph, and is stored in the scenario rule base together, wherein the supplementary graph is constructed to expand the scale of the abnormal event knowledge graph, covering multiple fault scenarios and solutions.

[0040] It can be seen that in the embodiment of the present application, multiple standard abnormal event processing processes are obtained, key features are extracted based on each standard abnormal event processing process, and standard abnormal event features are determined. Then, a knowledge graph is constructed based on each standard abnormal event feature to obtain an abnormal event knowledge graph, and the abnormal event knowledge graph is stored in a scenario rule base, wherein the graph nodes in the abnormal event knowledge graph represent abnormal event descriptions, processing actions and processing results, and the graph edges represent the associations between graph nodes based on the processing steps. Furthermore, when it is detected that there is an abnormal event processing process to be supplemented, a supplementary graph is constructed based on the abnormal event processing process to be supplemented to obtain a supplementary knowledge graph, and the supplementary knowledge graph is added to the scenario rule base, wherein the supplementary graph construction is used to expand the scale of the abnormal event knowledge graph, covering multiple fault scenarios and solutions. The scenario rule base facilitates the rapid search for emergency treatment cases similar to the target abnormal event set, shortens the time cycle of fault location and emergency treatment analysis to a certain extent, and at the same time, a dynamic update mechanism of the knowledge graph is set, which facilitates the scenario rule base to continuously adapt to new abnormal events and processing methods, and improves the utilization rate of historical processing experience.

[0041] Furthermore, in order to improve the efficiency of positioning and analysis and ensure the accuracy and effectiveness of the emergency handling process, in the embodiment of the present application, a scenario-based rule library is used to perform fault positioning and emergency handling analysis on the target abnormal event set to determine the fault root cause information and the emergency handling process, including: Based on each major abnormal event in the target abnormal event set, match the abnormal event description in the abnormal event knowledge graph in the scenario rule base to determine the target graph node corresponding to each major abnormal event; Based on the positional relationship of each target graph node in the abnormal event knowledge graph, the root cause information of the fault is determined, and the root source graph node and scenario rule library corresponding to the root source information of the fault are selected to extract the processing flow and determine the emergency processing flow.

[0042] For the embodiments of the present application, the related technologies often rely on manual judgment and experience when performing fault location and emergency processing operations, which may cause the processing results to be subjective and uncertain. In order to reduce human errors and improve the efficiency and accuracy of fault location and emergency processing analysis, a scenario-based rule library is used to automatically perform fault location and emergency processing analysis operations, which greatly improves the efficiency of location and analysis and ensures the accuracy and effectiveness of the emergency processing process.

[0043] Event analysis is performed based on each major abnormal event in the target abnormal event set, and the abnormal event characteristics corresponding to the major abnormal event are extracted, such as the main abnormal event description and abnormal event attributes, etc. The abnormal event characteristics are matched with the abnormal event description in the abnormal event knowledge graph in the scenario rule base to determine the target graph node corresponding to each major abnormal event, that is, the target graph node corresponding to the abnormal event that has occurred and is closest to the major abnormal event is matched in the abnormal event knowledge graph.

[0044] Furthermore, based on the positional relationship of each target graph node in the abnormal event knowledge graph, the root cause information of the fault is determined, that is, the root cause of the fault is determined by analyzing the connection relationship and hierarchical structure between the target graph nodes. Preferably, the target graph nodes at a deeper level in the abnormal event knowledge graph are selected as the root source graph nodes, and the relevant information represented by the root source graph nodes is selected and recorded as the root source information of the fault. After that, the root source graph nodes are screened and matched in the abnormal event knowledge graph in the scenario rule base, and the processing actions in the emergency processing process are determined based on the connection relationship between the root source graph nodes and the graph nodes corresponding to the corresponding processing actions. At the same time, the processing steps in the emergency processing process are determined based on the connection order between the graph nodes corresponding to the processing actions.

[0045] It can be seen that in the embodiment of the present application, in order to reduce human errors and improve the efficiency and accuracy of fault location and emergency processing analysis, each major abnormal event in the target abnormal event set is matched with the abnormal event description in the abnormal event knowledge graph in the scenario rule base, and the target graph node corresponding to each major abnormal event is determined. Then, based on the positional relationship of each target graph node in the abnormal event knowledge graph, the root cause information of the fault is determined, and the root source graph node corresponding to the root cause information of the fault and the scenario rule base are selected to extract the processing flow and determine the emergency processing flow. Using the scenario rule base to automatically perform fault location and emergency processing analysis operations greatly improves the efficiency of positioning and analysis, and also ensures the accuracy and effectiveness of the emergency processing flow.

[0046] Furthermore, in order to improve the efficiency of emergency handling and ensure the accuracy of emergency handling information transmission and the consistency of the handling process, in an embodiment of the present application, a standard work order flow process is automatically created based on the emergency handling process, including: Determine the department and order of transfer of work orders based on the processing actions and steps in the emergency response process; Create a process based on the work order transfer department and the order of transfer departments to obtain a standard work order flow process.

[0047] For the embodiment of the present application, in order to further improve the work efficiency of emergency handling, avoid distortion of emergency handling information and delay of emergency handling tasks, in the embodiment of the present application, a set of standardized and templated work order circulation system is pre-designed, which can ensure the accuracy of emergency handling information transmission and the continuity of the processing flow. Therefore, a standard work order circulation process is automatically created based on the emergency handling process. Since the emergency handling processes are not the same, the corresponding work order circulation departments and circulation department order in the standard work order circulation process are also different. Therefore, a standard work order circulation process that is highly matched with this emergency handling is created based on the emergency handling process, which helps to ensure accurate information transmission and complete information chain in the emergency handling process.

[0048] Specifically, based on the processing actions in the emergency handling process, the work order transfer department responsible for executing the processing actions is determined, and based on the processing steps in the emergency handling process, the work order transfer order between departments is determined to ensure that the work order can flow smoothly between departments according to the predetermined path. Then, using a work order management system that supports the automatic flow function, the work order automatic flow rules are configured according to the work order flow departments and the flow department sequence determined above, wherein the automatic flow rules include but are not limited to: trigger events, trigger conditions and trigger execution conditions, and the process is created based on the automatic flow rules, work order flow departments and flow departments to obtain a standard work order flow process.

[0049] It can be seen that in the embodiment of the present application, in order to further improve the work efficiency of emergency handling, avoid distortion of emergency handling information and delay of emergency handling tasks, a set of standardized and templated work order circulation system is pre-designed, which can ensure the accuracy of emergency handling information transmission and the consistency of the processing flow. Therefore, based on the processing actions and processing steps in the emergency handling process, the work order circulation department and the circulation department sequence are determined, and then the process is created based on the work order circulation department and the circulation department sequence to obtain a standard work order circulation process.

[0050] Furthermore, in order to more accurately identify the root cause of the fault, in an embodiment of the present application, correlation analysis is performed based on multiple abnormal events to determine a target abnormal event set, including: Perform event correlation analysis on multiple abnormal events using a correlation analysis algorithm to determine the correlation analysis results, and perform clustering processing based on the correlation analysis results to determine the event clustering results; Based on the event clustering results, minor abnormal events are eliminated and the target abnormal event set is determined.

[0051] For the embodiments of the present application, in order to more accurately identify the root cause of the fault, avoid wasting time and energy on minor abnormal events, and improve the accuracy of subsequent fault location and emergency processing, correlation analysis is performed based on multiple abnormal events to determine a target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from multiple abnormal events, so that the screened target abnormal event set are all events directly related to the main abnormal event.

[0052] Specifically, a correlation analysis algorithm is used to perform event correlation analysis on multiple abnormal events to determine the correlation analysis results, wherein the correlation analysis algorithm includes but is not limited to: Pearson correlation coefficient, Spearman rank correlation coefficient, etc. The correlation analysis algorithm is used to calculate the correlation between multiple abnormal events to form a correlation matrix, and a correlation threshold is also pre-stored in the electronic device to facilitate determining which abnormal events have significant correlations based on the correlation threshold. Further, a clustering algorithm is used to cluster multiple abnormal events with significant correlations to determine the event clustering results, in which the associated abnormal events with significant correlations are placed in the same cluster, and the remaining abnormal events with low correlations are listed separately outside the cluster after clustering. Finally, based on the event clustering results, minor abnormal events are eliminated to determine the target abnormal event set, that is, the abnormal events with low correlations listed separately outside the cluster after clustering are eliminated, so that the target abnormal event set is all associated abnormal events with significant correlations.

[0053] It can be seen that in the embodiment of the present application, in order to more accurately identify the root cause of the fault, avoid wasting time and energy on minor abnormal events, and improve the accuracy of subsequent fault location and emergency treatment, a correlation analysis algorithm is used to perform event correlation analysis on multiple abnormal events, determine the correlation analysis results, and perform clustering processing based on the correlation analysis results to determine the event clustering results. Then, minor abnormal events are eliminated based on the event clustering results to determine the target abnormal event set.

[0054] Furthermore, in order to reduce the waiting time caused by human omissions and ensure accurate information transmission and complete information chain in the emergency handling process, in the embodiment of the present application, the work order flow is performed based on the fault root information, the emergency handling process and the standard work order flow process until the abnormal event in the target abnormal event set is resolved, including: When a work order creation instruction is detected, the work order template is obtained, and the work order is filled based on the work order template, fault root cause information, and emergency processing process to obtain a fault emergency processing work order; Push the fault emergency processing work order according to the flow path in the standard work order flow process, and when the fault emergency processing work order reaches the target processing node, send a fault emergency processing reminder to the processing terminal corresponding to the target processing node; Obtain the fault emergency feedback information sent by the processing terminal, store the fault emergency feedback information in the standard work order flow process, and continue to push the fault emergency processing work order according to the flow path until the abnormal event in the target abnormal event set is resolved.

[0055] For the embodiment of the present application, after the standard work order flow process is automatically created based on the emergency handling process, a work order creation instruction is automatically generated. When the work order creation instruction is detected, the work order template is obtained. Various types of work order templates are pre-designed and stored in the electronic device so that different work order templates can adapt to different fault types. The work order template includes but is not limited to: the basic structure of the work order and the common fields of the work order. Then, the work order is filled based on the work order template, the root cause information of the fault, and the emergency handling process to obtain a fault emergency handling work order. That is, in the process of executing the work order filling, the key information in the root cause information of the fault and the emergency handling process is mapped to the corresponding fields in the work order template, and the mapped information is filled into the work order template using an automation tool, and finally a fault emergency handling work order is generated.

[0056] Furthermore, the fault emergency handling work order is pushed along the flow path in the standard work order flow process, and when the fault emergency handling work order reaches the target processing node, a fault emergency handling reminder is sent to the processing terminal corresponding to the target processing node. An automated notification mechanism is set up during the work order flow process, so that when it is transferred to the corresponding target processing node, the relevant personnel can receive the message notification in time and perform the corresponding emergency processing, reducing the waiting time caused by human omissions.

[0057] Then, the relevant personnel can perform the corresponding emergency processing operations according to the fault emergency processing work order received by the processing terminal, and after the emergency processing operation is completed, use the processing terminal to send fault emergency feedback information to the electronic equipment, and store the fault emergency feedback information in the standard work order flow process, and continue to push the fault emergency processing work order according to the flow path until the abnormal event in the target abnormal event set is resolved. The feedback and progress updates of all relevant personnel involved in the entire flow path are automatically recorded, ensuring accurate information transmission and complete information chain in the emergency processing process.

[0058] It can be seen that in the embodiment of the present application, when a work order creation instruction is detected, a work order template is obtained, and the work order is filled based on the work order template, the root cause information of the fault, and the emergency processing process to obtain a fault emergency processing work order. Then, the fault emergency processing work order is promoted according to the flow path in the standard work order flow process, and when the fault emergency processing work order arrives at the target processing node, a fault emergency processing reminder is sent to the processing terminal corresponding to the target processing node. An automated notification mechanism is set up during the work order flow process, so that when it is transferred to the corresponding target processing node, the relevant personnel can receive the message notification in time and perform the corresponding emergency processing, reducing the waiting time caused by human omissions. Then, the fault emergency feedback information sent by the processing terminal is obtained, and the fault emergency feedback information is stored in the standard work order flow process, and the fault emergency processing work order is continued to be promoted according to the flow path until the abnormal event in the target abnormal event set is resolved. The feedback and progress updates of all relevant personnel involved in the entire flow path are automatically recorded, ensuring accurate information transmission and complete information chain in the emergency processing process.

[0059] The above embodiment introduces a data center emergency protection method from the perspective of method flow, and the following embodiment introduces a data center emergency protection system from the perspective of a virtual module or a virtual unit. For details, please refer to the following embodiment.

[0060] The present application embodiment provides a data center emergency protection system, such as Figure 2 As shown, the data center emergency support system may specifically include: The abnormality diagnosis module 210 is used to obtain the multi-dimensional monitoring data collected by the monitoring agent, and perform abnormality diagnosis analysis based on the multi-dimensional monitoring data to determine multiple abnormal events, wherein the multi-dimensional monitoring data includes: power system monitoring data, computer room environment monitoring data, security access control monitoring data, power equipment monitoring data and network monitoring data; A correlation analysis module 220, configured to perform correlation analysis based on multiple abnormal events to determine a target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from the multiple abnormal events; The fault location module 230 is used to perform fault location and emergency processing analysis on the target abnormal event set using the scenario-based rule base to determine the fault root cause information and emergency processing process; The work order flow module 240 is used to automatically create a standard work order flow process based on the emergency handling process, and to circulate the work order based on the fault root cause information, the emergency handling process and the standard work order flow process until the abnormal event in the target abnormal event set is resolved. Among them, the standard work order flow process is used to ensure accurate information transmission and complete information chain in the emergency handling process.

[0061] A possible implementation of the embodiment of the present application also includes: A rule base construction module is used to obtain multiple standard abnormal event processing processes, extract key features based on each standard abnormal event processing process, and determine the standard abnormal event features, wherein the standard abnormal event features include: abnormal event description, processing action, processing steps, and processing results; A knowledge graph is constructed based on the characteristics of each standard abnormal event to obtain an abnormal event knowledge graph, and the abnormal event knowledge graph is stored in a scenario-based rule base. The graph nodes in the abnormal event knowledge graph represent abnormal event descriptions, processing actions, and processing results, and the graph edges represent the associations between graph nodes based on the processing steps. When it is detected that there is an abnormal event processing process to be supplemented, a supplementary graph is constructed based on the abnormal event processing process to be supplemented to obtain a supplementary knowledge graph, and the supplementary knowledge graph is added to the scenario-based rule base, wherein the supplementary graph construction is used to expand the scale of the abnormal event knowledge graph to cover multiple fault scenarios and solutions.

[0062] In a possible implementation of the embodiment of the present application, the fault location module 230, when performing fault location and emergency processing analysis on the target abnormal event set using the scenario-based rule base to determine the fault root cause information and the emergency processing process, is used to: Based on each major abnormal event in the target abnormal event set, match the abnormal event description in the abnormal event knowledge graph in the scenario rule base to determine the target graph node corresponding to each major abnormal event; Based on the positional relationship of each target graph node in the abnormal event knowledge graph, the root cause information of the fault is determined, and the root source graph node and scenario rule library corresponding to the root source information of the fault are selected to extract the processing flow and determine the emergency processing flow.

[0063] In a possible implementation of the embodiment of the present application, the work order transfer module 240, when automatically creating a standard work order transfer process based on the emergency handling process, is used to: Determine the department and order of transfer of work orders based on the processing actions and steps in the emergency response process; Create a process based on the work order transfer department and the order of transfer departments to obtain a standard work order flow process.

[0064] In a possible implementation of the embodiment of the present application, when the correlation analysis module 220 performs correlation analysis based on multiple abnormal events to determine a target abnormal event set, it is used to: Perform event correlation analysis on multiple abnormal events using a correlation analysis algorithm to determine the correlation analysis results, and perform clustering processing based on the correlation analysis results to determine the event clustering results; Based on the event clustering results, minor abnormal events are eliminated and the target abnormal event set is determined.

[0065] In a possible implementation of the embodiment of the present application, the work order transfer module 240 performs work order transfer based on fault root information, emergency processing process and standard work order transfer process until the abnormal event in the target abnormal event set is resolved, and is used to: When a work order creation instruction is detected, the work order template is obtained, and the work order is filled based on the work order template, fault root cause information, and emergency processing process to obtain a fault emergency processing work order; Push the fault emergency processing work order according to the flow path in the standard work order flow process, and when the fault emergency processing work order reaches the target processing node, send a fault emergency processing reminder to the processing terminal corresponding to the target processing node; Obtain the fault emergency feedback information sent by the processing terminal, store the fault emergency feedback information in the standard work order flow process, and continue to push the fault emergency processing work order according to the flow path until the abnormal event in the target abnormal event set is resolved.

[0066] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of a data center emergency support system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0067] An electronic device is provided in an embodiment of the present application, such as Figure 3 As shown, Figure 3The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0068] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0069] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but it does not mean that there is only one bus or only one type of bus.

[0070] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0071] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0072] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0073] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0074] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method in any of the above embodiments is implemented.

[0075] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0076] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data center emergency protection method, characterized in that: include: Acquire multi-dimensional monitoring data collected by the monitoring agent, and perform abnormal diagnosis and analysis based on the multi-dimensional monitoring data to determine multiple abnormal events, wherein the multi-dimensional monitoring data includes: power system monitoring data, computer room environment monitoring data, security access control monitoring data, power equipment monitoring data and network monitoring data; Performing correlation analysis based on the multiple abnormal events to determine a target abnormal event set, wherein the correlation analysis is used to eliminate irrelevant minor abnormal events from the multiple abnormal events; Use the scenario-based rule base to perform fault location and emergency processing analysis on the target abnormal event set to determine the fault root cause information and emergency processing process; A standard work order flow process is automatically created based on the emergency handling process, and work order flow is performed based on the fault root cause information, the emergency handling process and the standard work order flow process until the abnormal event in the target abnormal event set is resolved, wherein the standard work order flow process is used to ensure accurate information transmission and complete information chain in the emergency handling process.

2. The data center emergency protection method according to claim 1, characterized in that: The method for constructing the scenario-based rule library includes: Acquire multiple standard abnormal event processing procedures, extract key features based on each of the standard abnormal event processing procedures, and determine standard abnormal event features, wherein the standard abnormal event features include: abnormal event description, processing action, processing steps, and processing results; A knowledge graph is constructed based on each of the standard abnormal event features to obtain an abnormal event knowledge graph, and the abnormal event knowledge graph is stored in a scenario-based rule base, wherein the graph nodes in the abnormal event knowledge graph represent abnormal event descriptions, processing actions, and processing results, and the graph edges represent the associations between the graph nodes based on the processing steps; When it is detected that there is an abnormal event processing process to be supplemented, a supplementary graph is constructed based on the abnormal event processing process to be supplemented to obtain a supplementary knowledge graph, and the supplementary knowledge graph is added to the scenario-based rule base, wherein the supplementary graph construction is used to expand the scale of the abnormal event knowledge graph to cover multiple fault scenarios and solutions.

3. The data center emergency protection method according to claim 2, characterized in that: Use the scenario-based rule base to perform fault location and emergency processing analysis on the target abnormal event set to determine the fault root cause information and emergency processing process, including: Based on each main abnormal event in the target abnormal event set, matching is performed with the abnormal event description in the abnormal event knowledge graph in the scenario rule base to determine the target graph node corresponding to each main abnormal event; Based on the positional relationship of each target graph node in the abnormal event knowledge graph, the root cause information of the fault is determined, and the root source graph node corresponding to the root source information of the fault and the scenario-based rule base are selected to extract the processing flow and determine the emergency processing flow.

4. The data center emergency protection method according to claim 3, characterized in that: Automatically create a standard work order flow process based on the emergency handling process, including: Based on the processing actions and the processing steps in the emergency processing process, determine the work order transfer department and the transfer department order; A process is created based on the work order transfer department and the order of the transfer departments to obtain a standard work order transfer process.

5. The data center emergency protection method according to claim 1, characterized in that: Performing correlation analysis based on the multiple abnormal events to determine a target abnormal event set includes: Performing event correlation analysis on the plurality of abnormal events using a correlation analysis algorithm to determine a correlation analysis result, and performing clustering processing based on the correlation analysis result to determine an event clustering result; Minor abnormal events are eliminated based on the event clustering result to determine a target abnormal event set.

6. The data center emergency protection method according to claim 1, characterized in that: Based on the fault root information, the emergency handling process and the standard work order flow process, work order flow is performed until the abnormal events in the target abnormal event set are resolved, including: When a work order creation instruction is detected, a work order template is obtained, and the work order is filled based on the work order template, the fault root cause information, and the emergency processing flow to obtain a fault emergency processing work order; Pushing the fault emergency processing work order according to the flow path in the standard work order flow process, and sending a fault emergency processing reminder to the processing terminal corresponding to the target processing node when the fault emergency processing work order arrives at the target processing node; Acquire the fault emergency feedback information sent by the processing terminal, store the fault emergency feedback information in the standard work order flow process, and continue to push the fault emergency processing work order according to the flow path until the abnormal event in the target abnormal event set is resolved.

7. An electronic device, characterized in that: include: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the data center emergency protection method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the data center emergency protection method according to any one of claims 1 to 6.

9. A computer program product, characterized in that The method comprises a computer program, wherein the computer program is executed by a processor to implement the data center emergency protection method according to any one of claims 1 to 6.

Images