Alarm threshold baseline dynamic generation method, medium and device

Abstract

The invention discloses a method for dynamically generating an alarm threshold baseline. The method is used for generating a dynamic threshold baseline. The method comprises the following steps: S1, acquiring semaphore source data of a plurality of complete weeks, and performing similarity classification by taking day as a unit to acquire a plurality of signal data sets; s2, judging whether daily data curves in all the signal data sets conform to normal distribution or not, and if yes, calculating a data expectation mu and a standard deviation sigma in the same time period; if not, returning to the step S1; s3, selecting a coefficient t according to the normal probability table, and calculating a confidence interval according to the data expectation mu and the standard deviation sigma; s4, selecting tolerance R according to the confidence interval, and generating a tolerance interval; and S5, configuring the tolerance interval to an alarm configuration threshold module in real time, and keeping the updating frequency within T seconds. The method has the advantages that timeliness and reasonability are improved, and workload is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of threshold dynamic calculation, and particularly to a method, device and program device for dynamically generating an alarm threshold baseline. Background Art

[0002] With the continuous development of enterprise informatization technology, services generally require multi-service, multi-component and multi-system calls to achieve. In a complex IT environment, there are higher requirements for IT supervision. Among them, the practice of the supervision system for index alarms is to collect the index data information of the monitored services, and judge whether the index data exceeds the upper and lower limits of the set threshold according to the manually set index thresholds for alarm.

[0003] However, this method has the following disadvantages: First, manual setting depends on the work experience of the setters, and the depth of experience will affect the rationality of the threshold. If the threshold is set too high, it will lead to failure to give early warnings, and if it is too low, it will lead to repeated warnings. Second, with the development of systems, environments and technologies, in a multi-service and multi-component environment, it is required that the setters be familiar with more services, components and their relationships, which requires more learning costs, human resources and new monitoring systems. There are also subjectivity and differences in thresholds among operation and maintenance personnel. Third, the threshold will change with aspects such as business, region and season, and the pre-set threshold is no longer reasonable. A reasonable threshold needs to be adjusted dynamically in real time. Fourth, in a multi-service and multi-component distributed environment, the number of monitoring objects is huge, the process of setting thresholds is complex, and the workload of updating threshold settings is huge.

[0004] In the existing related technologies, the method of setting alarm thresholds manually has the problems of low accuracy and large workload; there is an urgent need to propose a method for dynamically generating an alarm threshold baseline. Summary of the Invention

[0005] The object of the present invention is to provide a method, device and program for dynamically generating an alarm threshold baseline, which has the advantages of improving timeliness and rationality while reducing the workload.

[0006] To achieve the above object, the present invention provides a method for dynamically generating an alarm threshold baseline, which aims to generate a dynamic threshold baseline. The method includes: Step S1, obtaining the semaphore source data of multiple complete weeks, classifying them according to similarity on a daily basis, and obtaining several signal data sets; wherein, the semaphore source data includes multiple daily data curves; Step S2, judging whether the daily data curves in all signal data sets conform to the normal distribution. If they conform, calculate the data expectation μ and the standard deviation σ within the same time period; if not, return to Step S1; Step S3, according to the normal probability table, calculate the data expectation μ and the standard deviation σ, then select t as the coefficient of the standard deviation σ, and calculate the confidence interval (upper baseline L up , lower baseline Ldown );Step S4, according to the confidence interval (upper baseline L up , lower baseline L down ), select the tolerance R, and generate the tolerance interval (upper tolerance line T up , lower tolerance line T down ); Step S5, configure the tolerance interval (upper tolerance line T up , lower tolerance line T down ) into the alarm configuration threshold module in real time.

[0007] Preferably, the step S1 includes: Step S11, obtain the semaphore source data of multiple complete weeks; Step S12, based on the data curve of the first day existing in the same week as the benchmark, and based on the time warping function, strip the curves with a similarity difference reaching more than the threshold D; Step S13, check whether there are un-stripped data curves. If so, output the un-stripped data curves as the signal data set and enter Step S15; if not, enter Step S14; Step S14, arrange the stripped data curves in time series to form new semaphore source data, and return to Step S12; Step S15, organize to obtain all signal data sets.

[0008] Preferably, in the step S12, the threshold D = 5%.

[0009] Preferably, in the step S2, it includes: μ = (x1 + x2 +......x n ) / n, where, X n is the nth data sample in the same time period.

[0010] Preferably, in the step S3, the upper baseline L up = μ + σ × t, the lower baseline L down = μ - σ × t.

[0011] Preferably, in the step S3, the selected coefficient t = 2 or t = 3.

[0012] Preferably, in the step S4, the upper tolerance line T up = (1 + R) × L up , the lower tolerance line T down = (1 - R) × L down .

[0013] Preferably, in the step S4, the tolerance R = 5%.

[0014] A computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps in any one of the foregoing methods.

[0015] An apparatus for dynamically generating an alarm threshold baseline, the apparatus at least includes an alarm configuration threshold module, and the alarm configuration threshold module implements the steps in any of the foregoing methods.

[0016] In summary, compared with the prior art, a method, an apparatus, and a program for dynamically generating an alarm threshold baseline provided by the present invention have the following beneficial effects:

[0017] First, before calculation, the present invention only needs to preset the classification attributes of special dates to calculate the threshold baselines of various service indicators, while other technical solutions need to preset the thresholds of each indicator.

[0018] Second, the present invention statistically processes a large amount of data and accurately distinguishes the date-affected indicator data. Other technical solutions use estimated data, and the calculation of the present invention is more accurate.

[0019] Third, the present invention uses real-time calculation, and the time series database provides timely feedback, with little workload for operation and maintenance configuration. Other solutions need to preset the dynamic threshold calculation frequency and match the acquisition frequency of various types of data, resulting in a large workload.

[0020] Fourth, the present invention adds a tolerance line configuration to identify abnormal jitters of monitoring indicators and more accurately identify the normal range of monitoring data, thereby effectively reducing false alarms and missed alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic flow chart of a method for dynamically generating an alarm threshold baseline proposed by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0022] The following will combine the accompanying drawings in the embodiments of the present invention Figure 1 , and will elaborate in detail on the technical solutions, structural features, achieved objectives, and effects in the embodiments of the present invention.

[0023] It should be noted that the drawings adopt a very simplified form and all use non-precise scales, only for conveniently and clearly assisting in explaining the purpose of the embodiments of the present invention, and are not used to limit the limiting conditions of the embodiments of the present invention. Therefore, they do not have technical essence. Any modification of the structure, change of the proportional relationship, or adjustment of the size, without affecting the effects that the present invention can produce and the objectives that can be achieved, should still fall within the scope covered by the technical content disclosed by the present invention.

[0024] It should be noted that in the present invention, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements expressly listed, but also other elements not expressly listed or elements inherent to such process, method, article or device.

[0025] The present invention provides a method for dynamically generating an alarm threshold baseline, which is used for a monitoring system; the alarm threshold baseline of the monitoring system is an important reference standard for judging whether the monitored object is abnormal in the monitoring system. The alarm threshold baseline of the monitoring system refers to one or a set of numerical standards determined by certain algorithms and rules according to the normal operation data and business requirements of the monitored object (such as server performance, network traffic, application program metrics, etc.) in the monitoring system. It represents the range of index values or the change trend of the monitored object in the normal state, and serves as a benchmark for judging whether the system is abnormal. When the actual index value of the monitored object exceeds or is lower than this baseline range, the monitoring system will trigger an alarm to remind relevant personnel of possible problems, so as to take measures in time to avoid further expansion of the problems and causing system failures or business losses. It can also help operation and maintenance personnel and management personnel understand the operating conditions of the system, evaluate the difference between the current performance of the system and the normal level, and provide a basis for system optimization, resource allocation, etc. At the same time, through the dynamic analysis and adjustment of the alarm threshold baseline, it is also possible to predict possible problems in the future of the system and perform preventive maintenance and planning in advance.

[0026] The alarm threshold baseline is generally divided into a static threshold baseline and a dynamic threshold baseline; among them, the static threshold baseline refers to an alarm threshold baseline that remains fixed within a certain period of time. It is applicable to the situation where the operating state of the monitored object is relatively stable and the range of index changes is small. For example, the upper limit of the temperature of some hardware devices is generally fixed in the normal working environment, and a static temperature alarm threshold can be set, and an alarm is triggered when the temperature exceeds this value. The dynamic threshold baseline refers to an alarm threshold baseline that is adjusted in real time or regularly according to factors such as the operating state of the system, business traffic, and time. It can better adapt to complex and changeable system environments and business requirements. For example, in an Internet e-commerce platform, the alarm threshold baselines of indicators such as the number of server connections and response time are dynamically adjusted according to the change of business traffic in different time periods.

[0027] Currently existing alarm threshold baselines include: Based on historical data: Analyze the normal operation data of the monitored object over a period of time in the past, calculate statistics such as the average value and standard deviation, and then determine a reasonable value range as the alarm threshold baseline according to business requirements and experience. For example, for the CPU usage rate of a server, by analyzing the daily average CPU usage rate data in the past month, the average value is calculated to be 30%, and the standard deviation is 5%. The upper limit of the alarm threshold baseline can be set to the average value plus twice the standard deviation, that is, 40%, and the lower limit can be set to 20%. According to business rules: Determine the alarm threshold baseline according to the specific requirements and characteristics of the business. For example, in an e-commerce system, according to business experience and user behavior analysis, the lower limit of the order processing volume per hour is set to 1000 orders. If it is lower than this value, it may mean that there is a problem with the system and an alarm needs to be triggered. Combining industry standards: Refer to the general standards and best practices of similar systems or businesses in the same industry to determine the alarm threshold baseline. For example, in network bandwidth monitoring, according to industry standards, the alarm threshold baseline of network bandwidth utilization is set to 80%. When the utilization rate exceeds 80%, it is considered that there may be a congestion risk in the network.

[0028] As Figure 1 shown, a method for dynamically generating an alarm threshold baseline according to the present invention aims to realize the generation of a dynamic threshold baseline; the method includes:

[0029] Step S1, obtain the semaphore source data of multiple complete weeks, classify them according to similarity on a daily basis, and obtain a number of signal data sets; wherein, the semaphore source data includes multiple daily data curves;

[0030] Among them, the semaphore source data refers to the operation data within a historical period of time, and there are 7 daily data curves within the same week. For example, the semaphore source data of multiple complete weeks is the transaction data volume of 8 consecutive weeks, and then 56 data curves are generated daily. Then, through classification, similar curves are divided into one category, and then situations such as weekdays, holidays, festivals, and special trading days (such as Double Eleven, 618) are generated. In this way, the influence of different sample data on special dates and normal dates is isolated and calculated, and the influence weight of sample data is distinguished. Finally, the semaphore source data is collected and stored in the database.

[0031] Step S2, determine whether the daily data curves in all signal data sets conform to the normal distribution. If they conform, calculate the data expectation μ and standard deviation σ within the same time period; if they do not conform, return to step S1;

[0032] As described above, if data is collected daily, the data curves on the same day will show a trend of normal distribution. Therefore, it is necessary to check whether the data curves in all signal data sets conform to the normal distribution to ensure the accuracy of subsequent operation data.

[0033] Step S3, according to the normal probability table, calculate the data expectation μ and the standard deviation σ, and then select t as the coefficient of the standard deviation σ to calculate the confidence interval (upper baseline L up , lower baseline L down );

[0034] According to the normal distribution probability, when t is 1, the data coverage rate is 75%, when t is 2, the data coverage rate is 95%, and when t is 3, the data coverage rate is 99.7%. It is recommended to choose 2 or 3. This is the prior art and will not be elaborated here.

[0035] In this way, the confidence level can meet the requirements of operation and maintenance management alerts. It is generally considered that the vast majority of historical data is within this interval range, so the data outside the interval is determined as abnormal data. By superimposing the data at different times, the upper and lower limit distribution curves of the data for one day are drawn, that is, the upper baseline L up and the lower baseline L down are obtained.

[0036] Step S4, according to the confidence interval (upper baseline L up , lower baseline L down ), select the tolerance R (adjusted according to actual needs, default is 5% because it has high efficiency at 5%), and generate the tolerance interval (upper tolerance line T up , lower tolerance line T down );

[0037] Based on the tolerance R, the confidence interval is fluctuated up and down to generate the upper tolerance line T up and the lower tolerance line T down . This tolerance line will be used as the threshold to trigger the subsequent alarm generation mechanism.

[0038] Step S5, configure the tolerance interval (upper tolerance line T up , lower tolerance line T down ) into the alarm configuration threshold module in real time.

[0039] Specifically, the step S1 includes:

[0040] Step S11, obtain the signal source data of multiple complete weeks;

[0041] Step S12, based on the data curve of the first day in the same week as the reference, and based on the time warping function, strip the curves with a similarity difference reaching more than the threshold D;

[0042] Step S13: Check if there are unpeeled data curves. If so, output the unpeeled data curves as a signal data set and proceed to Step S15; if not, proceed to Step S14.

[0043] Step S14: Arrange the peeled data curves in time series to form a new signal source data, and return to Step S12.

[0044] Step S15: Organize to obtain all signal data sets.

[0045] Among them, in Step S12, the threshold D = 5%; the Dynamic Time Warping (DTW), also known as dynamic time warping, is an algorithm for processing time series data. DTW is a method for measuring the similarity between two time series. It calculates the similarity measure between them by "warping" or "stretching" one of the series on the time axis so that the two series can achieve the best match. The core idea of this algorithm is to find a time warping path to match the points of the two time series, making the sum of the distances between the matching points the smallest. This path can be regarded as a non-linear transformation of the time axis, which allows elements at different time points to be matched to adapt to the differences in time between the two series.

[0046] Specifically, in Step S2, it includes μ = (x1 + x2 +......x n ) / n, where, X n is the nth data sample in the same time period.

[0047] Specifically, in Step S3, the upper baseline L up = μ + σ × t, and the lower baseline L down = μ - σ × t.

[0048] Specifically, in Step S4, the upper tolerance line T up = (1 + R) × L up , and the lower tolerance line T down = (1 - R) × L down .

[0049] The following are the specific implementation steps of the present invention.

[0050] Obtain the semaphore data of the target service / business system in the target historical time period from the monitoring system. Pull data on a daily basis to ensure that 8 weeks' worth of data is selected year-on-year. For example, if the current time is October 2024, select the data from August to September 2023 (8 weeks year-on-year). Use the curve generated on the first day as the baseline. Use the time warping function to compare the similarity between the daily curves and the baseline curve. If the similarity difference is more than 5%, classify the data curve of that day into another signal data set. Continuously perform this classification operation until all data is processed, obtaining multiple signal data sets.

[0051] Have professionals set labels for these classified data sequences, clearly marking different types such as working days, holidays, festivals, special trading days, etc. For example, label the data related to the National Day holiday as "festival" and the data on the day of Double Eleven as "special trading day". In this way, calculate the influence weights of different types of data on the baseline respectively, and after completion, collect the semaphore source data into the database.

[0052] Judge whether the daily data curves in all signal data sets conform to the normal distribution, and use appropriate statistical test methods to judge whether the data conforms to the normal distribution.

[0053] For data that conforms to the normal distribution, calculate according to the calculation formulas of expectation and standard deviation. For example, if the data obtained in a week at a certain same time point (such as 10 am every day) is X1 = 10, X2 = 12, X3 = 8, X4 = 11, X5 = 9, X6 = 13, X7 = 10, then the expectation μ = 10.57 and the standard deviation σ = 1.64.

[0054] Based on the calculated expectation μ and standard deviation σ, combined with the normal probability table, select an appropriate coefficient t. Assume t = 2 is selected, then the confidence interval is (10.57 - 2 * 1.64, 10.57 + 2 * 1.64) = (7.29, 13.85)

[0055] By superimposing the data at different times, draw the upper and lower limit distribution curves of the data for one day, obtaining the upper baseline as (10.57 + 2 * 1.64 = 13.85) and the lower baseline as (10.57 - 2 * 1.64 = 7.29).

[0056] Assume that according to the actual business requirements, the preset tolerance is 5%. Then the upper tolerance line T up = 14.54, and the lower tolerance line T down = 6.93.

[0057] The calculated upper and lower tolerance line data are configured in real time to the alarm configuration threshold module. When the real-time monitoring value exceeds the upper tolerance line or is lower than the lower tolerance line, according to the characteristics of the performance indicators, the corresponding alarm generation mechanism is triggered. For example, if the performance indicator is the server CPU usage rate, when the real-time monitoring value is higher than 14.54% or lower than 6.93%, an abnormal alarm for CPU usage rate is triggered.

[0058] Although the content of the present invention has been described in detail through the above preferred embodiments, it should be recognized that the above description should not be considered as a limitation of the present invention. After those skilled in the art have read the above content, various modifications and alternatives to the present invention will be obvious. Therefore, the protection scope of the present invention should be defined by the appended claims.

Claims

1. A method for dynamically generating an alarm threshold baseline, characterized in that, lies in realizing the generation of a dynamic threshold baseline, the method comprising: Step S1, obtaining signal source data of multiple complete weeks, classifying the similarity on a daily basis, and obtaining a number of signal data sets; wherein, the signal source data includes multiple daily data curves; Step S2, determining whether the daily data curves in all signal data sets conform to a normal distribution. If they conform, calculating the data expectation μ and standard deviation σ within the same time period; if not, returning to Step S1; Step S3: According to the normal probability table, calculate the data expectation μ and the standard deviation σ. Then select t as the coefficient of the standard deviation σ and calculate the confidence interval (upper baseline L up , lower baseline L down ); Step S4, according to the confidence interval (upper baseline L up , lower baseline L down ), select the tolerance R, and generate the tolerance interval (upper tolerance line T up , lower tolerance line T down ); Step S5, configure the tolerance interval (upper tolerance line T up , lower tolerance line T down ) to the alarm configuration threshold module in real time.

2. The method for dynamically generating an alarm threshold baseline according to claim 1, wherein The said Step S1 includes: Step S11, obtaining signal source data of multiple complete weeks; Step S12, taking the data curve of the first day in the same week as a benchmark, and stripping the curves with a similarity difference reaching more than the threshold D based on the time warping function; Step S13, checking whether there are data curves that have not been stripped. If so, outputting the data curves that have not been stripped as signal data sets and entering Step S15; if not, entering Step S14; Step S14, arranging the stripped data curves in time series to form new signal source data, and returning to Step S12; Step S15, sorting out all signal data sets.

3. The method for dynamically generating an alarm threshold baseline according to claim 2, wherein In the said Step S12, the threshold D = 5%.

4. A method for dynamically generating an alarm threshold baseline according to claim 3, characterized in that, In the step S2, it includes: μ = (x1 + x2 +...... x n ) / n, where X n is the nth data sample within the same time period.

5. A method for dynamically generating an alarm threshold baseline according to claim 4, characterized in that, In the said step S3, the upper baseline L up = μ + σ × t, and the lower baseline L down = μ - σ × t.

6. The method for dynamically generating an alarm threshold baseline according to claim 5, characterized in that In the said Step S3, the selected coefficient t = 2 or t = 3.

7. The method for dynamically generating an alarm threshold baseline according to claim 6, wherein In the step S4, the upper tolerance line T up =(1 + R)×L up , the lower tolerance line T down =(1 - R)×L down .

8. A method for dynamically generating an alarm threshold baseline according to claim 7, characterized in that, In the said Step S4, the tolerance R = 5%.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the said computer program is executed by a processor, it realizes the steps in the method according to any one of claims 1 to 8.

10. A device for the dynamic alarm threshold baseline, characterized in that, The said device includes at least one alarm configuration threshold module, and the alarm configuration threshold module realizes the steps in the method according to any one of claims 1 to 8.

Images