Monitoring method, system, device, equipment, storage medium and program product

Abstract

The embodiment of the invention provides a monitoring method, system and device, equipment, a storage medium and a program product. The method comprises the following steps: determining an adjustment alarm time of a corresponding monitoring index according to a trigger time of each alarm in a preset historical time period and a corresponding processing strategy, and determining an adjustment alarm threshold of the corresponding monitoring index according to monitoring data of each alarm in the preset historical time period and the corresponding processing strategy to obtain an alarm condition, the real-time monitoring source data of the local service system is acquired, the monitoring data corresponding to each monitoring index is determined according to the real-time monitoring source data, the monitoring data is analyzed based on the alarm conditions corresponding to different monitoring indexes, and the alarm information is output when the corresponding monitoring data is determined to meet the corresponding alarm conditions. The method is used for achieving the effects of enhancing monitoring on the security platform, and improving the effectiveness of monitoring and the reliability of alarm information.

Description

Technical Field

[0001] The present application relates to the field of data monitoring technology, and in particular to a monitoring method, system, device, equipment, storage medium and program product. Background Art

[0002] A securities platform is a platform that provides securities to users. When a securities platform fails, it is difficult to provide effective services to users. Therefore, it is necessary to monitor the securities platform so that abnormalities can be discovered and handled in a timely manner.

[0003] In the prior art, the log information of the application system and / or the operating system of the application that interacts with the above-mentioned securities platform is collected in real time through a monitoring system, the indicator data and / or operating status of the current securities platform is determined based on the obtained log information, and an alarm is issued when the preset alarm rules are met.

[0004] However, due to the large differences in business volume in different periods, the business indicators involved in the application system and / or operating system vary greatly at different times. Therefore, it is difficult for existing technologies to promptly identify anomalies of securities platforms in complex business scenarios, thereby reducing the reliability and effectiveness of monitoring securities platforms. Summary of the invention

[0005] The embodiments of the present application provide a monitoring method, system, device, equipment, storage medium and program product to enhance the monitoring of a securities platform and improve the reliability and effectiveness of monitoring.

[0006] In a first aspect, an embodiment of the present application provides a monitoring method, comprising:

[0007] Obtain real-time monitoring source data of local business systems;

[0008] Determine the monitoring data corresponding to each monitoring indicator based on the real-time monitoring source data. The monitoring indicators include system performance indicators, network performance indicators and time indicators.

[0009] Determine whether the monitoring data meets the corresponding alarm conditions, and output alarm information when it is determined that the conditions are met; the alarm conditions include the adjustment alarm time and adjustment alarm threshold corresponding to each monitoring indicator; wherein, for any monitoring indicator, the adjustment alarm time is determined based on the trigger time of each alarm within a preset historical time period and the corresponding processing strategy, and the adjustment alarm threshold is determined by the monitoring data and the corresponding processing strategy at each alarm within the preset historical time period.

[0010] Optionally, before determining whether the monitoring data meets the corresponding alarm condition, an initial alarm condition is obtained, where the initial alarm condition is the alarm condition input by the user last time;

[0011] For any monitoring indicator in the initial alarm condition, determine the alarm event indicating that the monitoring indicator is abnormal within a preset historical time period, obtain the processing strategy corresponding to the alarm event, and determine the strategy type corresponding to the processing strategy;

[0012] When it is determined that the policy type corresponding to the processing policy is the preset policy type, the triggering time of the alarm event is determined; the alarm time corresponding to the monitoring indicator in the initial alarm condition is updated according to the triggering time to obtain the adjustment alarm time corresponding to the monitoring indicator.

[0013] Optionally, when it is determined that the policy type corresponding to the processing policy is a preset policy type, monitoring data corresponding to the alarm event is determined;

[0014] The alarm threshold corresponding to the monitoring indicator in the initial alarm condition is updated according to the monitoring data to obtain the adjustment alarm threshold corresponding to the monitoring indicator.

[0015] Optionally, after obtaining the initial alarm condition, the initial alarm condition is fully synchronized to multiple remote monitoring systems, so that each remote monitoring system stores the initial alarm condition in a corresponding memory table and an upload record table; wherein the remote monitoring system is used to obtain the real-time monitoring source data of the remote business system, and when it is determined based on the initial alarm condition that the monitoring indicator of the real-time monitoring source data is abnormal, the corresponding alarm information is generated and fed back to the local monitoring system;

[0016] An alarm visualization interface corresponding to multiple monitoring indicators is generated according to the alarm information fed back by the remote monitoring system; the alarm visualization interface is used to update the initial alarm condition.

[0017] Optionally, after the initial alarm condition is updated, update data is determined, and the update data is incrementally synchronized to multiple remote monitoring systems, so that each remote system updates the alarm conditions in the memory table and the upload record table.

[0018] In a second aspect, an embodiment of the present application provides a monitoring device, including:

[0019] The acquisition module is used to obtain the real-time monitoring source data of the local business system;

[0020] A processing module, used to determine the monitoring data corresponding to each monitoring indicator according to the real-time monitoring source data, the monitoring indicators including system performance indicators, network performance indicators and time indicators;

[0021] The processing module is also used to determine whether the monitoring data meets the corresponding alarm conditions, and output alarm information when it is determined that the conditions are met; the alarm conditions include the adjustment alarm time and adjustment alarm threshold corresponding to each monitoring indicator; wherein, for any monitoring indicator, the adjustment alarm time is determined based on the trigger time of each alarm within a preset historical time period and the corresponding processing strategy, and the adjustment alarm threshold is determined by the monitoring data and the corresponding processing strategy at each alarm within the preset historical time period.

[0022] Optionally, the acquisition module is further used to acquire an initial alarm condition before determining whether the monitoring data meets the corresponding alarm condition, where the initial alarm condition is the alarm condition input by the user last time;

[0023] For any monitoring indicator in the initial alarm condition, determine the alarm event indicating that the monitoring indicator is abnormal within a preset historical time period, obtain the processing strategy corresponding to the alarm event, and determine the strategy type corresponding to the processing strategy;

[0024] When it is determined that the policy type corresponding to the processing policy is the preset policy type, the triggering time of the alarm event is determined; the alarm time corresponding to the monitoring indicator in the initial alarm condition is updated according to the triggering time to obtain the adjustment alarm time corresponding to the monitoring indicator.

[0025] Optionally, the processing module is further used to determine the monitoring data corresponding to the alarm event when it is determined that the policy type corresponding to the processing policy is a preset policy type;

[0026] The alarm threshold corresponding to the monitoring indicator in the initial alarm condition is updated according to the monitoring data to obtain the adjustment alarm threshold corresponding to the monitoring indicator.

[0027] Optionally, the processing module is further used to synchronize the initial alarm conditions in full to multiple remote monitoring systems after obtaining the initial alarm conditions, so that each remote monitoring system stores the initial alarm conditions in a corresponding memory table and an upload record table; wherein the remote monitoring system is used to obtain the real-time monitoring source data of the remote business system, and when it is determined based on the initial alarm conditions that the monitoring indicators of the real-time monitoring source data are abnormal, it generates corresponding alarm information and feeds it back to the local monitoring system;

[0028] An alarm visualization interface corresponding to multiple monitoring indicators is generated according to the alarm information fed back by the remote monitoring system; the alarm visualization interface is used to update the initial alarm condition.

[0029] Optionally, the processing module is also used to determine the update data after the initial alarm condition is updated, and synchronize the update data increments to multiple remote monitoring systems, so that each remote system updates the alarm conditions in the memory table and the upload record table.

[0030] In a third aspect, an embodiment of the present application provides a monitoring system, including: a local monitoring system and a plurality of remote monitoring systems;

[0031] The remote monitoring system is used to feed back alarm information to the local monitoring system; the local monitoring system is used to execute the above first aspect and / or various possible implementation methods of the first aspect.

[0032] In a fourth aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0033] Memory stores computer-executable instructions;

[0034] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0035] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0036] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0037] The monitoring method, system, device, equipment, storage medium and program product provided by the embodiments of the present application determine the adjustment alarm time of the corresponding monitoring indicator according to the trigger time of each alarm in a preset historical time period and the corresponding processing strategy, and determine the adjustment alarm threshold of the corresponding monitoring indicator according to the monitoring data at each alarm in the preset historical time period and the corresponding processing strategy, obtain the alarm condition, obtain the real-time monitoring source data of the local business system, determine the monitoring data corresponding to each monitoring indicator according to the real-time monitoring source data, and analyze the monitoring data based on the alarm conditions corresponding to different monitoring indicators, and output the alarm information when it is determined that the corresponding monitoring data meets the corresponding alarm condition. The present application enhances the monitoring of the securities platform, improves the effectiveness of the monitoring and the reliability of the alarm information. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0039] Figure 1 A schematic diagram of an application scenario of the monitoring method provided in this application;

[0040] Figure 2Schematic diagram of the monitoring method provided in this application Figure 1 ;

[0041] Figure 3 A schematic diagram of the structure of the monitoring system provided for this application;

[0042] Figure 4 Schematic diagram of the monitoring method provided in this application Figure 2 ;

[0043] Figure 5 A schematic diagram of the structure of the monitoring device provided in this application;

[0044] Figure 6 A schematic diagram of the structure of the electronic device provided in this application.

[0045] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0046] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0047] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0048] The securities platform provides securities services to users by interacting with multiple business systems, such as fund clearing systems, customer management systems, etc. The above business systems are distributed in different locations. Figure 1 A schematic diagram of an application scenario of the monitoring method provided in this application, such as Figure 1 As shown, in order to enhance the stability of the securities platform, it is necessary to monitor the operating status of multiple business systems in the securities platform so as to perform fault repair in a timely manner when there are abnormalities in the operating status.

[0049] The existing technology monitors the system performance data of each business system in real time through the monitoring system to analyze the operating status of the business system and issue an alarm when it is determined that the system performance data meets the alarm rules of the system performance indicators. However, the existing monitoring system is difficult to monitor the business systems of complex businesses in a timely and comprehensive manner, and it is difficult to fully identify the anomalies of the securities platform, which is easy to cause false alarms and reduce the effectiveness and reliability of the alarms.

[0050] The monitoring method provided by the present application obtains the real-time monitoring source data of the local business system, and classifies the real-time monitoring source data to obtain the monitoring data corresponding to each monitoring indicator, obtains the alarm time, monitoring data and processing strategy when each monitoring indicator in the preset historical time period generates the adjustment alarm time and adjustment alarm threshold of the monitoring indicator according to the alarm time and processing strategy corresponding to the monitoring indicator, thereby verifying the currently collected monitoring data based on the obtained adjustment alarm time and adjustment alarm threshold, and generating the alarm information corresponding to the monitoring indicator when it is determined that the monitoring data meets the adjustment alarm time and adjustment alarm threshold. In addition, the adjustment alarm time and adjustment alarm threshold are synchronized to each remote business system, so that the remote monitoring system obtains the real-time monitoring source data of the remote business system, determines whether the real-time monitoring source data meets the synchronized alarm conditions, and when the conditions are met, the corresponding alarm information is fed back to the local monitoring system, so that the local monitoring system generates multiple alarm visualization interfaces corresponding to the monitoring indicators according to the alarm information of each remote monitoring system, thereby enhancing the monitoring of the securities platform, improving the reliability and effectiveness of monitoring, further improving the accurate judgment of the abnormal state of the securities platform, and improving the accuracy and reliability of the alarm information.

[0051] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0052] Figure 2 Schematic diagram of the monitoring method provided in this application Figure 1 ,like Figure 2 As shown, the method includes:

[0053] S201. Obtain real-time monitoring source data of the local business system.

[0054] More specifically, the real-time monitoring source data of the local business system is obtained through the local monitoring system.

[0055] Optionally, the real-time monitoring source data includes monitoring data corresponding to multiple monitoring indicators.

[0056] S202: Determine monitoring data corresponding to each monitoring indicator according to real-time monitoring source data.

[0057] More specifically, the monitoring data corresponding to each monitoring indicator is determined according to the real-time monitoring source data, and the monitoring indicators include system performance indicators, network performance indicators and time indicators.

[0058] Exemplarily, based on the collected real-time monitoring source data and various monitoring indicators of the local business system, the real-time monitoring source data is classified and processed to obtain monitoring data corresponding to each monitoring indicator. For example, the monitoring data corresponding to the system performance indicator is resource usage data (such as CPU usage data, memory usage data, and disk usage data), the monitoring data corresponding to the network performance indicator is network performance data (such as network bandwidth, network delay, and packet loss rate), and the monitoring data corresponding to the time indicator is the collection timestamp.

[0059] S203: When it is determined that the monitoring data meets the corresponding alarm condition, output alarm information, where the alarm condition includes an adjustment alarm time and an adjustment alarm threshold corresponding to each monitoring indicator.

[0060] More specifically, it is determined whether the monitoring data meets the corresponding alarm conditions, and when it is determined that the conditions are met, the alarm information is output; the alarm conditions include the adjustment alarm time and adjustment alarm threshold corresponding to each monitoring indicator; for any monitoring indicator, the adjustment alarm time is determined based on the trigger time of each alarm within a preset historical time period and the corresponding processing strategy, and the adjustment alarm threshold is determined by the monitoring data and the corresponding processing strategy at each alarm within the preset historical time period.

[0061] Optionally, before determining whether the monitoring data meets the corresponding alarm condition, the initial alarm condition is obtained, and the initial alarm condition is the alarm condition entered by the user last time; for any monitoring indicator in the initial alarm condition, the alarm event indicating that the monitoring indicator is abnormal within a preset historical time period is determined, and the processing strategy corresponding to the alarm event is obtained, and the policy type corresponding to the processing strategy is determined; when it is determined that the policy type corresponding to the processing strategy is the preset policy type, the trigger time of the alarm event is determined; the alarm time corresponding to the monitoring indicator in the initial alarm condition is updated according to the trigger time, and the adjustment alarm time corresponding to the monitoring indicator is obtained.

[0062] Optionally, when it is determined that the policy type corresponding to the processing policy is a preset policy type, the monitoring data corresponding to the alarm event is determined; the alarm threshold corresponding to the monitoring indicator in the initial alarm condition is updated according to the monitoring data to obtain the adjusted alarm threshold corresponding to the monitoring indicator.

[0063] Exemplarily, the above processing strategy is an operation and maintenance processing plan made by the operation and maintenance personnel based on the alarm information displayed on the local monitoring system.

[0064] In a possible embodiment, the user inputs the initial alarm condition to the local monitoring system, and the local monitoring system determines the corresponding adjustment alarm time and adjustment alarm threshold based on the system performance index, network performance index and time index in the initial alarm condition. For example, multiple alarm events within a preset historical time period of 30 days are obtained, and the trigger time of each alarm event and the processing strategy after the alarm are determined, and whether there is a processing strategy with a policy type of the preset policy type (such as an ignore operation). If it is determined that the trigger time corresponding to the alarm event using the above-mentioned ignore operation is within the time period of 11:00-11:30, and the corresponding monitoring indicator is a system performance indicator, then the time period of 11:00-11:30 is deleted from the alarm time corresponding to the system performance indicator in the initial alarm condition to obtain the adjustment alarm time of the system performance indicator. If it is determined that the monitoring indicator of the alarm event for which the ignore operation is adopted is the network performance indicator, and the corresponding network delays are 200ms and 300ms respectively, then the alarm threshold corresponding to the network performance indicator in the initial alarm condition is updated to more than 300ms, and the adjusted alarm threshold of the network performance indicator is obtained, thereby obtaining the alarm condition for monitoring the business system.

[0065] In a possible embodiment, the monitoring data corresponding to each monitoring indicator of the local business system collected in real time is analyzed to determine the monitoring indicator value corresponding to the monitoring data, and compared with the alarm condition obtained in the previous embodiment, and whether an alarm is needed is determined based on the comparison result. For example, when the CPU utilization rate of the local business system is 90%, the network delay is 250ms, and the collection timestamp is 11:30 am, it is determined that the collection timestamp of the CPU utilization rate of the local business system is not within the range of the adjustment alarm time, and the CPU utilization rate exceeds the initial alarm threshold (80%) corresponding to the system performance indicator. At this time, it is determined that the system performance indicator of the current local business system is abnormal. In addition, the network delay exceeds the initial alarm threshold (200ms) corresponding to the network performance indicator but does not exceed the adjustment alarm threshold (300ms). At this time, it is determined that the network performance indicator of the current local business system is normal, and the alarm information of the system performance indicator is generated.

[0066] This embodiment optimizes the current initial alarm conditions based on the initial alarm conditions and further according to the processing strategy of historical alarm events, thereby solving the problem of monitoring indicators being in a high alarm state for a long time due to the increase in customer volume or order volume, meeting the alarm needs in complex scenarios, and dynamically and adaptively adjusting the alarm conditions to avoid excessive or repeated alarms, reduce labor costs, and improve operation and maintenance efficiency.

[0067] Optionally, the alarm information in the embodiment of the present application is automatically generated and triggered when the monitoring data of the corresponding monitoring indicator reaches the adjustment alarm threshold. The alarm forms include alarms of different levels (e.g., low, medium, and high), which reflect the abnormality of the securities platform through alarms of different levels, thereby enhancing the operation and maintenance management of the securities platform.

[0068] Optionally, the alarm form of each level includes but is not limited to voice notification, web page interface pop-up window, and API interface push to third-party system or application software.

[0069] Optionally, after obtaining the initial alarm condition, the initial alarm condition is fully synchronized to multiple remote monitoring systems, so that each remote monitoring system stores the initial alarm condition in the corresponding memory table and upload record table; wherein the remote monitoring system is used to obtain the real-time monitoring source data of the remote business system, and when it is determined based on the initial alarm condition that the monitoring indicator of the real-time monitoring source data is abnormal, the corresponding alarm information is generated and fed back to the local monitoring system; and multiple alarm visualization interfaces corresponding to the monitoring indicators are generated according to the alarm information fed back by the remote monitoring system. The alarm visualization interface is used to update the initial alarm condition.

[0070] Optionally, after the initial alarm condition is updated, update data is determined, and the update data is incrementally synchronized to multiple remote monitoring systems, so that each remote system updates the alarm conditions in the memory table and the upload record table.

[0071] In a possible embodiment, after the local monitoring system obtains the initial alarm condition, the initial alarm condition is fully synchronized to multiple remote monitoring systems, so that each remote monitoring system stores the initial alarm condition in the memory table and in the upload record table at the same time. Data is collected for the monitored remote business system, and after obtaining the real-time monitoring source data, the initial alarm condition is obtained by polling the upload record table, and it is determined according to the initial alarm condition whether the real-time monitoring source data indicates that the remote business system is abnormal. When the abnormality is determined, an alarm message is generated and fed back to the local monitoring system. The local monitoring system performs classification processing of the indicator dimension according to the alarm information corresponding to the local business system and each remote business system, that is, the alarm information of different monitoring indicators is classified and presented, thereby generating a multi-dimensional alarm visualization interface. The alarm visualization interface displays the abnormal indicator status of the current business system, which is convenient for operation and maintenance personnel to determine an effective processing strategy and process related alarm events based on the processing strategy.

[0072] Exemplarily, the initial alarm condition is modified in a targeted manner through the indicator status of each business system displayed on the alarm visualization interface, thereby obtaining an updated initial alarm condition.

[0073] In a possible embodiment, based on the processing strategy for alarm events within a preset historical time period, the adjustment alarm time and adjustment alarm threshold corresponding to each monitoring indicator are determined, and the adjustment alarm time and adjustment alarm threshold increments are synchronized to multiple remote monitoring systems, so that each remote monitoring system updates the initial alarm conditions stored in the memory table with the adjustment alarm time and adjustment alarm threshold. At the same time, the initial alarm conditions stored in the upload record table are updated, so that after each remote monitoring system obtains the real-time monitoring source data, it can judge the abnormal situation of the real-time monitoring source data by polling the updated adjustment alarm time and adjustment alarm threshold in the upload record table.

[0074] This embodiment synchronizes the initial alarm conditions in full to each off-site monitoring system, and synchronizes the updated alarm condition increments to each off-site monitoring system, so that each off-site system can promptly analyze the real-time monitoring source data based on reliable and effective alarm conditions, thereby enhancing the effectiveness and reliability of off-site alarms. After the off-site monitoring system receives the synchronized alarm conditions, it stores them in a memory table and an upload record table respectively, so as to support real-time updating of the memory table through the upload record table, thereby further enhancing the reliability of off-site monitoring and off-site alarms.

[0075] Optionally, the local monitoring system generates a visual interface based on graphical technology for the alarm information of multiple monitoring indicators to display the real-time status and historical operation status of each business system. The trend chart of each monitoring indicator can be viewed through the visual interface to improve the speed of locating performance bottlenecks or abnormal nodes of the securities platform, thereby improving operation and maintenance efficiency.

[0076] Optionally, after an alarm is triggered, the local monitoring system generates automatic or semi-automatic operation and maintenance suggestions based on the alarm information, including but not limited to executing preset recovery strategies (such as restarting and expanding resources), popping up common processing methods or log analysis results, so that operation and maintenance personnel can quickly troubleshoot problems and perform fault repairs through remote access functions, thereby further improving the stability of the securities platform.

[0077] The monitoring method provided in the embodiment of the present application obtains updated alarm conditions according to the trigger time, monitoring data and processing strategy of each alarm in a preset historical time period, and analyzes the real-time monitoring source data under multiple monitoring indicators based on the alarm conditions, thereby realizing multi-dimensional alarms, enhancing the monitoring of the securities platform, and improving the effectiveness of monitoring and the reliability of alarm information.

[0078] The present application also provides a monitoring system, which includes a local monitoring system and multiple remote monitoring systems; the remote monitoring system is used to feed back alarm information to the local monitoring system; and the local monitoring system is used to implement the above method.

[0079] Figure 3The schematic diagram of the monitoring system provided for this application is as follows: Figure 3 As shown, the monitoring system includes a local monitoring system and a remote monitoring system, wherein the local monitoring system includes a local processing unit, a local memory table and a display unit, and the remote monitoring system includes a remote processing unit and a remote memory table of a corresponding region.

[0080] In one possible embodiment, for Figure 3 The monitoring system shown provides a detailed description of the monitoring method, which is as follows: monitor the local business system through the local monitoring system, that is, obtain the real-time monitoring source data of the local business system through the local processing unit, and analyze and process the real-time monitoring source data of the local business system to obtain monitoring data corresponding to multiple monitoring indicators. After comparing with the alarm conditions in the local database, the monitoring data that meets the alarm conditions will generate alarm information corresponding to the monitoring indicator and send it to the display unit.

[0081] Optionally, the alarm conditions stored in the local memory table are synchronized to the remote memory table.

[0082] Optionally, the off-site business system is monitored by an off-site monitoring system, that is, the real-time monitoring source data of the off-site business system is obtained by an off-site processing unit, and the real-time monitoring source data of the off-site business system is analyzed and processed to obtain monitoring data corresponding to multiple monitoring indicators. After comparing with the alarm conditions in the off-site database, the monitoring data that meets the alarm conditions is used to generate alarm information corresponding to the monitoring indicator, which is synchronized to the local memory table through the off-site memory table, and the alarm information of the off-site business system is obtained from the local memory table by the local processing unit and sent to the display unit.

[0083] Optionally, the alarm information of the local business system and the alarm information of the remote business system are uniformly displayed in the system interface through a display unit.

[0084] Optionally, the local monitoring system is seamlessly integrated with a third-party monitoring system, a log management system, and an operation and maintenance automation platform. The local monitoring system ensures the scalability and compatibility of the local monitoring system by providing an open API interface, thereby improving the monitoring and management of distributed business systems of different scales and architectures.

[0085] In a possible embodiment, the local monitoring system further includes a local configuration table and a local upload record table, and the remote monitoring system further includes a remote configuration table and a remote upload record table. Figure 4 Schematic diagram of the monitoring method provided in this application Figure 2 ,like Figure 4As shown, for the scenario of updating the business management standard, the user modifies the current alarm condition through the interface of the local monitoring system, and the local monitoring system stores the modified alarm condition in the local configuration table and the local upload record table respectively, so as to synchronize the modified alarm condition to the remote configuration table through the local configuration table, and synchronize the modified alarm condition to the remote upload record table through the local upload record table. The local upload record table in this embodiment is stored on a persistent storage device, such as a local database; the remote upload record table is stored on a persistent storage device, such as a remote database.

[0086] Optionally, after the local monitoring system is restarted, the data in the local configuration table (such as alarm conditions) is fully loaded into the local memory table through the local processing unit, and the real-time monitoring source data is analyzed by the local processing unit based on the alarm conditions in the local memory table to improve the data analysis efficiency of the local monitoring system and reduce the alarm delay. Exemplarily, after the local processing unit of the local monitoring system obtains the real-time monitoring source data of the local business system, the local upload record table is polled by the local processing unit to determine whether there is unprocessed local upload record content in the local memory table. When it is determined that there is unprocessed local upload record content, the unprocessed local upload record content is synchronized to the local memory table and the local configuration table respectively. In this embodiment, the unprocessed local upload record content refers to the data corresponding to the alarm conditions that have been synchronized to the local upload record table and not synchronized to the local memory table.

[0087] Optionally, after the off-site monitoring system is restarted, the data (such as alarm conditions) in the off-site configuration table are fully loaded into the off-site memory table in the off-site processing unit through the off-site processing unit, and the real-time monitoring source data is analyzed by the off-site processing unit to improve the data analysis efficiency of the local monitoring system and reduce the alarm delay. Exemplarily, after the off-site processing unit of the off-site monitoring system obtains the real-time monitoring source data of the off-site business system, the off-site upload record table is polled by the off-site processing unit to determine whether there is unprocessed off-site upload record content in the off-site memory table. When it is determined that there is unprocessed off-site upload record content, the unprocessed off-site upload record content is synchronized to the off-site memory table and the off-site configuration table respectively. In this embodiment, the unprocessed off-site upload record content refers to the data corresponding to the alarm condition that has been synchronized from the local upload record table to the off-site upload record table and has not been synchronized to the off-site memory table.

[0088] This embodiment achieves data consistency between memory tables and upload record tables in various locations, ensures real-time updating of alarm conditions in local memory tables and remote memory tables, improves the effectiveness and reliability of alarm conditions, and further improves the accuracy of monitoring business systems in various locations.

[0089] Figure 5A schematic diagram of the structure of the monitoring device provided in this application, such as Figure 5 As shown, the monitoring device 50 provided in this embodiment includes:

[0090] The acquisition module 501 is used to acquire the real-time monitoring source data of the local business system;

[0091] Processing module 502, used to determine monitoring data corresponding to each monitoring indicator according to real-time monitoring source data, where the monitoring indicators include system performance indicators, network performance indicators and time indicators;

[0092] Processing module 502 is also used to determine whether the monitoring data meets the corresponding alarm conditions, and output alarm information when it is determined that the conditions are met; the alarm conditions include the adjustment alarm time and adjustment alarm threshold corresponding to each monitoring indicator; wherein, for any monitoring indicator, the adjustment alarm time is determined based on the trigger time of each alarm within a preset historical time period and the corresponding processing strategy, and the adjustment alarm threshold is determined by the monitoring data and the corresponding processing strategy at each alarm within the preset historical time period.

[0093] Optionally, the acquisition module 501 is further used to acquire an initial alarm condition before determining whether the monitoring data meets the corresponding alarm condition, where the initial alarm condition is the alarm condition input by the user last time;

[0094] For any monitoring indicator in the initial alarm condition, determine the alarm event indicating that the monitoring indicator is abnormal within a preset historical time period, obtain the processing strategy corresponding to the alarm event, and determine the strategy type corresponding to the processing strategy;

[0095] When it is determined that the policy type corresponding to the processing policy is the preset policy type, the triggering time of the alarm event is determined; the alarm time corresponding to the monitoring indicator in the initial alarm condition is updated according to the triggering time to obtain the adjustment alarm time corresponding to the monitoring indicator.

[0096] Optionally, the processing module 502 is further configured to determine the monitoring data corresponding to the alarm event when it is determined that the policy type corresponding to the processing policy is a preset policy type;

[0097] The alarm threshold corresponding to the monitoring indicator in the initial alarm condition is updated according to the monitoring data to obtain the adjustment alarm threshold corresponding to the monitoring indicator.

[0098] Optionally, the processing module 502 is further used to synchronize the initial alarm condition in full to multiple remote monitoring systems after obtaining the initial alarm condition, so that each remote monitoring system stores the initial alarm condition in a corresponding memory table and an upload record table; wherein the remote monitoring system is used to obtain the real-time monitoring source data of the remote business system, and when it is determined based on the initial alarm condition that the monitoring indicator of the real-time monitoring source data is abnormal, it generates corresponding alarm information and feeds it back to the local monitoring system;

[0099] An alarm visualization interface corresponding to multiple monitoring indicators is generated according to the alarm information fed back by the remote monitoring system; the alarm visualization interface is used to update the initial alarm condition.

[0100] Optionally, the processing module 502 is further used to determine the update data after the initial alarm condition is updated, and synchronize the update data increments to multiple remote monitoring systems, so that each remote system updates the alarm conditions in the memory table and the upload record table.

[0101] The monitoring device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0102] Figure 6 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes: at least one processor 601 and a memory 602. Optionally, the device 60 also includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus 604.

[0103] In a specific implementation process, at least one processor 601 executes the computer execution instructions stored in the memory 602, so that at least one processor 601 executes the above method.

[0104] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0105] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0106] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0107] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0108] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0109] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0110] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0111] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0112] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0113] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0114] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0115] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0116] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0117] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A monitoring method, characterized in that: include: Obtain real-time monitoring source data of local business systems; Determine the monitoring data corresponding to each monitoring indicator according to the real-time monitoring source data, wherein the monitoring indicators include system performance indicators, network performance indicators and time indicators; Determine whether the monitoring data meets the corresponding alarm conditions, and output alarm information when it is determined that the conditions are met; the alarm conditions include the adjustment alarm time and adjustment alarm threshold corresponding to each monitoring indicator; wherein, for any monitoring indicator, the adjustment alarm time is determined based on the trigger time of each alarm within a preset historical time period and the corresponding processing strategy, and the adjustment alarm threshold is determined by the monitoring data and the corresponding processing strategy at each alarm within the preset historical time period.

2. The method according to claim 1, characterized in that Also includes: Before determining whether the monitoring data satisfies the corresponding alarm condition, obtaining an initial alarm condition, wherein the initial alarm condition is the alarm condition input by the user last time; For any monitoring indicator in the initial alarm condition, determine an alarm event indicating that the monitoring indicator is abnormal within a preset historical time period, obtain a processing strategy corresponding to the alarm event, and determine a strategy type corresponding to the processing strategy; When it is determined that the policy type corresponding to the processing policy is the preset policy type, the trigger time of the alarm event is determined; the alarm time corresponding to the monitoring indicator in the initial alarm condition is updated according to the trigger time to obtain the adjusted alarm time corresponding to the monitoring indicator.

3. The method according to claim 2, characterized in that Also includes: When it is determined that the policy type corresponding to the processing policy is a preset policy type, determining the monitoring data corresponding to the alarm event; The alarm threshold corresponding to the monitoring indicator in the initial alarm condition is updated according to the monitoring data to obtain an adjusted alarm threshold corresponding to the monitoring indicator.

4. The method according to claim 2, characterized in that: Also includes: After obtaining the initial alarm condition, the initial alarm condition is fully synchronized to multiple remote monitoring systems, so that each remote monitoring system stores the initial alarm condition in a corresponding memory table and an upload record table; wherein the remote monitoring system is used to obtain the real-time monitoring source data of the remote business system, and when it is determined based on the initial alarm condition that the monitoring indicator of the real-time monitoring source data is abnormal, the corresponding alarm information is generated and fed back to the local monitoring system; An alarm visualization interface corresponding to a plurality of monitoring indicators is generated according to the alarm information fed back by the remote monitoring system; the alarm visualization interface is used to update the initial alarm condition.

5. The method according to any one of claims 2 to 4, characterized in that: Also includes: After the initial alarm condition is updated, update data is determined, and the update data is incrementally synchronized to multiple remote monitoring systems, so that each remote system updates the alarm condition in the memory table and the upload record table.

6. A monitoring system, characterized in that: include: A local monitoring system and multiple remote monitoring systems; the remote monitoring system is used to feed back alarm information to the local monitoring system; The local monitoring system is used to execute the method according to any one of claims 1-5.

7. A monitoring device, characterized in that: include: The acquisition module is used to obtain the real-time monitoring source data of the local business system; A processing module, used to determine monitoring data corresponding to each monitoring indicator according to the real-time monitoring source data, wherein the monitoring indicators include system performance indicators, network performance indicators and time indicators; The processing module is also used to determine whether the monitoring data meets the corresponding alarm conditions, and output alarm information when it is determined that the conditions are met; the alarm conditions include the adjustment alarm time and adjustment alarm threshold corresponding to each monitoring indicator; wherein, for any monitoring indicator, the adjustment alarm time is determined by the alarm time and the corresponding processing strategy for each time within a preset historical time period, and the adjustment alarm threshold is determined by the monitoring data and the corresponding processing strategy for each alarm within the preset historical time period.

8. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 5 when being executed by a processor.

Images