Automatic analysis method and device for abnormal event, equipment and medium

Abstract

The invention discloses an automatic analysis method and device for an abnormal event, equipment and a medium, and the method comprises the steps: obtaining initial data associated with the abnormal event in response to a plurality of abnormal event triggering mechanisms; performing initial analysis on the abnormal event based on the initial data to obtain a service to which the abnormal event belongs, and dynamically calling analysis data of different data sources based on the service to which the abnormal event belongs; and performing deep analysis on the abnormal event based on the analysis data to obtain a target processing strategy corresponding to the abnormal event, thereby effectively improving the efficiency and accuracy of abnormal positioning, and providing powerful support for rapid recovery of a system.

Description

Technical Field

[0001] The present disclosure generally relates to the field of exception handling technology, and more particularly to a method, apparatus, device, and medium for automatically analyzing abnormal events. Background Art

[0002] Exception logs are a common form of error reporting on software platforms. Relatively mature exception analysis and processing methods exist in related technologies, such as rule-based log matching and filtering, statistical analysis and aggregation, and link tracing and distributed log analysis. However, these analysis methods rely heavily on manual intervention or can only handle specific exception types, resulting in poor generalization. Summary of the Invention

[0003] In view of the above-mentioned defects or deficiencies in the prior art, it is desired to provide a method, device, equipment and medium for automatic analysis of abnormal logs, which can effectively improve the efficiency and accuracy of abnormality location and provide strong support for the rapid recovery of the system.

[0004] In a first aspect, an embodiment of the present application provides a method for automatically analyzing abnormal events, comprising:

[0005] In response to a plurality of abnormal event triggering mechanisms, obtaining initial data associated with the abnormal event;

[0006] Performing an initial analysis on the abnormal event based on the initial data to obtain a service to which the abnormal event belongs, and dynamically calling analysis data from different data sources based on the service to which the abnormal event belongs;

[0007] Based on the analysis data, the abnormal event is deeply analyzed to obtain a target processing strategy corresponding to the abnormal event.

[0008] In some embodiments, dynamically calling analysis data from different data sources based on the service includes:

[0009] Based on the service to which the abnormal event belongs, determining the associated service corresponding to the service;

[0010] Based on the time node of the abnormal event, the analysis data corresponding to each of the related services is dynamically called.

[0011] In some embodiments, the performing of an in-depth analysis on the abnormal event based on the analysis data to obtain a target processing strategy corresponding to the abnormal event includes:

[0012] Inputting the analysis data into a rule-based deep model, wherein the rule-based deep model is trained based on historical abnormal events and business rules;

[0013] The target processing strategy obtained by the rule-depth model based on the analysis data is obtained.

[0014] In some embodiments, it further includes:

[0015] Determining the priority of the abnormal event based on the rule-depth model;

[0016] Based on the priority of the abnormal event, the target processing strategy corresponding to the abnormal event is determined.

[0017] In some embodiments, it further includes:

[0018] Based on the target processing strategy, an abnormal work order and / or abnormal alarm corresponding to the abnormal event is generated in the enterprise-level management system.

[0019] In some embodiments, it further includes:

[0020] Based on the abnormal event and the target processing strategy, a visual reach chart is drawn.

[0021] In a second aspect, an embodiment of the present application provides an automatic analysis device for abnormal events, comprising:

[0022] A response module, configured to obtain initial data associated with the abnormal event in response to a plurality of abnormal event triggering mechanisms;

[0023] A calling module, configured to perform an initial analysis on the abnormal event based on the initial data, obtain the service to which the abnormal event belongs, and dynamically call analysis data from different data sources based on the service to which it belongs;

[0024] The analysis module is used to perform an in-depth analysis of the abnormal event based on the analysis data to obtain a target processing strategy corresponding to the abnormal event.

[0025] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the embodiment of the present application when executing the program.

[0026] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the method described in the embodiment of the present application.

[0027] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, it implements the method described in the embodiment of the present application.

[0028] The automatic analysis method, device, equipment and medium of abnormal events proposed in the embodiments of the present application can automatically trigger the analysis of abnormal events and make decisions on target processing strategies based on multiple abnormal event triggering mechanisms without human intervention, effectively improving the self-healing ability and response efficiency of the system, and at the same time, when dealing with complex and unknown abnormal events, it can provide more accurate and efficient abnormal analysis and processing. Moreover, the embodiments of the present application can dynamically call the analysis data of different data sources based on the initial data of the abnormal event to conduct in-depth analysis of the target processing strategy, realize cross-data source linkage analysis, thereby comprehensively improving the accuracy and traceability of abnormal analysis, avoiding the limitations of relying on a single data source for abnormal analysis, and can timely and accurately perform abnormal analysis on related services, improving the fault tolerance and stability of the system.

[0029] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0031] Figure 1 A schematic diagram showing a flow chart of an automatic analysis method for abnormal events provided by an embodiment of the present application is shown;

[0032] Figure 2 A schematic diagram showing a flow chart of an automatic analysis method for abnormal events provided by another embodiment of the present application is shown;

[0033] Figure 3 A schematic diagram showing a chart reaching an abnormal event provided by an embodiment of the present application is shown;

[0034] Figure 4 A block diagram of an automatic analysis device for abnormal events provided by an embodiment of the present application is shown;

[0035] Figure 5 A block diagram of an automatic analysis device for abnormal events provided by another embodiment of the present application is shown;

[0036] Figure 6 A schematic diagram of the structure of a computer system of an electronic device or server suitable for implementing an embodiment of the present application is shown. DETAILED DESCRIPTION

[0037] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the invention are shown in the accompanying drawings.

[0038] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] Exception log processing is a common exception handling method. Related technologies generally use rule-based log matching and screening, statistical analysis and aggregation, link tracing, and distributed log analysis to handle exception logs.

[0040] Exemplary, rule-based log matching and screening analysis methods are log analysis methods based on different rules such as keywords and regular expressions, which are widely used in existing tools. Developers filter and classify according to specific keywords (such as "error", "exception", etc.) in the exception log. This method is effective for quickly locating some obvious exceptions. However, there are problems such as a strong dependence on manual configuration, and it is only applicable to known exceptions, and has poor recognition capabilities for unknown exceptions or complex problems. For example, some failure modes may not have clear exception tags or keywords in the log, resulting in the inability of rule-based analysis methods to effectively capture them. Alternatively, a large number of irrelevant logs (noise data) are matched when matching keywords or regular expressions, resulting in frequent alarm triggering, operation and maintenance personnel being overwhelmed, and even ignoring real exceptions.

[0041] Statistical analysis and aggregation methods involve developers counting the number of errors generated by an application over a specific period of time. If the number increases abnormally, an alert is automatically triggered. However, when log data is high-dimensional, such as involving multiple fields, multiple services, or multiple systems, simple statistical aggregation often fails to reveal the underlying causes of the anomaly, such as abnormal interactions or changes in external systems.

[0042] Analysis methods based on traceback and distributed logs use traceback information to correlate logs with other relevant information in the request flow for distributed systems to locate faults. Although traceback technology can provide cross-service log correlation, in practice, analyzing traceback data often requires manual intervention.

[0043] While tracing technology can provide cross-service log correlation, in practice, analyzing tracing data often requires manual intervention. Manual analysis of tracing data is often time-consuming and error-prone, hindering the full benefits of tracing. This is especially true when addressing complex failures or large-scale systems, where manual intervention can lead to delayed responses.

[0044] Based on this, the present application proposes a method, device, equipment and medium for automatic analysis of abnormal events. By performing initial analysis on the initial data of abnormal events, it is possible to dynamically call data from different data sources, realize dynamic automatic analysis based on multi-dimensional abnormal data, and improve the efficiency and accuracy of abnormal event analysis.

[0045] In order to further illustrate the technical solutions provided by the embodiments of the present application, this is described in detail below with reference to the accompanying drawings and specific embodiments. Although the embodiments of the present application provide the method operation instruction steps shown in the following embodiments or drawings, more or fewer operation instruction steps may be included in the method based on conventional or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiments of the present application. The method may be executed in the order of the methods shown in the embodiments or drawings or in parallel during the actual processing process or when the device is executed.

[0046] It should be noted that the acquisition or use of data in the embodiments of this application requires the user's consent. The relevant data can only be obtained after the user's authorization and permission, and the acquisition or use of the data complies with the provisions of relevant laws and regulations.

[0047] Please refer to Figure 1 , Figure 1 FIG. 1 is a flow chart showing an automatic analysis method for abnormal events provided by an embodiment of the present application. Figure 1 and Figure 2 As shown, the method includes:

[0048] Step 101: In response to various abnormal event triggering mechanisms, initial data associated with the abnormal event is acquired.

[0049] It should be noted that the embodiment of the present application is configured with multiple abnormal event triggering mechanisms at the front end of the abnormal event analysis service, including but not limited to rule-based log matching and screening, statistical analysis and aggregation, link tracking and distributed log analysis, IM messaging, and scheduled tasks. In other words, the embodiment of the present application uses a flexible event-driven approach to trigger the automatic analysis of abnormal events.

[0050] For example, when rule-based log screening is used to trigger abnormal events, unified log analysis rules can be set to automatically screen and classify abnormal logs and quickly locate potential problems.

[0051] Among them, the initial data associated with the abnormal event is the relevant data for abnormal event identification, including but not limited to the log used to identify the abnormal event, the relevant data corresponding to the log, etc., which is not specifically limited in this application.

[0052] Specifically, in the embodiments of the present application, a variety of abnormal event triggering mechanisms are used to capture abnormal information in a timely manner and trigger subsequent analysis processes.

[0053] Step 102 : Perform an initial analysis on the abnormal event based on the initial data to obtain the service to which the abnormal event belongs, and dynamically call analysis data from different data sources based on the service to which it belongs.

[0054] In some embodiments, the initial data obtained through various abnormal event triggering mechanisms are standardized to obtain standardized data for identification, and type identification is performed based on the standardized data to determine the service to which the abnormal log that triggered the abnormal event belongs.

[0055] It should be understood that in the embodiment of the present application, by analyzing the service to which the abnormal event belongs, dynamic calling of cross-service data between the belonging service and the associated service is achieved to obtain analysis data from different data sources.

[0056] Specifically, after obtaining the initial data, the abnormal event is initially analyzed based on the initial data to obtain the service to which the abnormal event belongs. Then, based on the service to which the abnormal event belongs, the associated services corresponding to the service are determined. Based on the time node of the abnormal event, the analysis data corresponding to each associated service is dynamically called to facilitate in-depth analysis of the abnormal time based on the analysis data.

[0057] The analysis data includes but is not limited to the associated data generated by each associated service within a preset time period before and after the abnormal event, including but not limited to log data, database data, and full-link trace.

[0058] Step 103: Based on the analysis data, perform an in-depth analysis on the abnormal event to obtain a target processing strategy corresponding to the abnormal event.

[0059] In some embodiments, based on the analysis data, an in-depth analysis is performed on the abnormal event to obtain a target processing strategy corresponding to the abnormal event, including: inputting the analysis data into a rule-depth model, and obtaining a target processing strategy obtained by the rule-depth model based on the analysis data.

[0060] Among them, the rule-depth model is trained based on historical abnormal events and business rules.

[0061] That is to say, a large number of historical abnormal events and business rules, as well as the processing strategies obtained by manual analysis, are first obtained to train the rule-deep model, so that the rule-deep model can obtain reasonable target processing strategies based on the analysis data of abnormal events.

[0062] In some embodiments, the target processing policy includes a processing policy corresponding to a priority level.

[0063] Specifically, the priority of the abnormal event can be determined based on the rule-depth model, and then the target processing strategy corresponding to the abnormal event can be determined based on the priority of the abnormal event.

[0064] The target processing strategy includes but is not limited to one or more of calling external service verification, rollback operation, and triggering alarm.

[0065] For example, low-priority, repetitive or consistent abnormal patterns can be identified through rule-depth models, thereby reducing the system, reducing the interference of irrelevant events, and improving the system's high precision and response efficiency.

[0066] Therefore, the automatic analysis method of abnormal events proposed in the embodiment of the present application can automatically trigger the analysis of abnormal events and make decisions on target processing strategies based on multiple abnormal event triggering mechanisms without manual participation, effectively improving the self-healing ability and response efficiency of the system, and at the same time, when dealing with complex and unknown abnormal events, it can provide more accurate and efficient abnormal analysis and processing. Moreover, the embodiment of the present application can dynamically call the analysis data of different data sources based on the initial data of the abnormal event to conduct in-depth analysis of the target processing strategy, realize cross-data source linkage analysis, thereby comprehensively improving the accuracy and traceability of abnormal analysis, avoiding the limitations of relying on a single data source for abnormal analysis, and can timely and accurately perform abnormal analysis on related services, improving the fault tolerance and stability of the system.

[0067] In some feasible embodiments, in order to further improve the effectiveness of abnormal event triggering alarms, this application, in addition to traditional message delivery methods (including but not limited to IM messages, emails, text messages, phone calls, etc.), also includes generating abnormal work orders corresponding to abnormal events in the enterprise-level management system based on target processing strategies.

[0068] Among them, the enterprise-level management system has a corresponding relationship with the associated services. The abnormal work order includes but is not limited to creating a work order, assigning tasks, etc., so as to generate a work order in the enterprise-level system of the associated service corresponding to the abnormal event, thereby achieving the purpose of alerting the relevant abnormal handling personnel of the associated service, further ensuring that the abnormal event can be effectively handled in the associated service, and avoiding the associated services that are not directly affected by the abnormal event from triggering new abnormal events after the abnormal event occurs.

[0069] In one feasible embodiment, the automatic analysis method for abnormal events disclosed in the embodiments of this application further plots the processed abnormal events and the target processing strategies into a visual contact chart. This data visualization method clearly presents the background, root cause, and processing process of the abnormal event to operation and maintenance personnel, helping them quickly understand and locate the problem.

[0070] For example, Figure 3 As shown, the logical chain when the abnormal event is caused by a conflict in the user's repayment behavior is disclosed. Based on this diagram, the operation and maintenance personnel can quickly understand and locate the abnormality.

[0071] It should be noted that although the operations of the present method are described in a particular order in the drawings, this does not require or imply that the operations must be performed in this particular order, or that all illustrated operations must be performed to achieve desirable results.

[0072] Figure 4 A block diagram of an automatic analysis device for abnormal events provided by an embodiment of the present application is shown.

[0073] like Figure 4 As shown, the automatic analysis device 10 for abnormal events proposed in the embodiment of the present application includes:

[0074] A response module 11 is configured to obtain initial data associated with an abnormal event in response to various abnormal event triggering mechanisms;

[0075] A calling module 12 is configured to perform an initial analysis on the abnormal event based on the initial data, obtain the service to which the abnormal event belongs, and dynamically call analysis data from different data sources based on the service to which the abnormal event belongs;

[0076] The analysis module 13 is configured to perform an in-depth analysis of the abnormal event based on the analysis data to obtain a target processing strategy corresponding to the abnormal event.

[0077] In some embodiments, the calling module 12 is further configured to:

[0078] Based on the service to which the abnormal event belongs, determining the associated service corresponding to the service;

[0079] Based on the time node of the abnormal event, the analysis data corresponding to each of the related services is dynamically called.

[0080] In some embodiments, the analysis module 13 is further configured to:

[0081] Inputting the analysis data into a rule-based deep model, wherein the rule-based deep model is trained based on historical abnormal events and business rules;

[0082] The target processing strategy obtained by the rule-depth model based on the analysis data is obtained.

[0083] In some embodiments, the analysis module 13 is further configured to:

[0084] Determining the priority of the abnormal event based on the rule-depth model;

[0085] Based on the priority of the abnormal event, the target processing strategy corresponding to the abnormal event is determined.

[0086] like Figure 5 As shown, the automatic analysis device 10 for abnormal events proposed in the embodiment of the present application includes: a contact module 14,

[0087] The contact module 14 is used to generate an abnormal work order and / or abnormal alarm corresponding to the abnormal event in the enterprise-level management system based on the target processing strategy.

[0088] In some embodiments, the access module 14 is further configured to:

[0089] Based on the abnormal event and the target processing strategy, a visual reach chart is drawn.

[0090] Optionally, multiple functional modules are connected through a unified API interface.

[0091] It should be understood that the modules or modules described in the automatic analysis device 10 for abnormal events are similar to those described in the reference Figure 1 The various steps in the described method correspond to each other. Therefore, the operations and features described above for the method are also applicable to the automatic analysis device 10 for abnormal events and the modules contained therein, and will not be repeated here. The automatic analysis device 10 for abnormal events can be pre-implemented in the browser or other security applications of the electronic device, or can be loaded into the browser or security application of the electronic device by downloading or other means. The corresponding modules in the automatic analysis device 10 for abnormal events can cooperate with the modules in the electronic device to implement the solution of the embodiment of the present application.

[0092] The several modules or units mentioned in the detailed description above are not necessarily divided into one module or unit. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0093] Reference below Figure 6 , Figure 6A schematic diagram of the structure of a computer system of an electronic device or server suitable for implementing the embodiments of the present application is shown.

[0094] like Figure 6 As shown, the computer system includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 602 or the program loaded from the storage part 608 into the random access memory (RAM) 603. Various programs and data required for the operation instructions of the system are also stored in the RAM 603. The CPU 601, ROM 602 and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0095] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, and the like; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 608 including a hard disk; and a communication section 609 including a network interface card such as a LAN card or a modem. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 610 as needed, so that a computer program read therefrom can be installed into the storage section 608 as needed.

[0096] In particular, according to the embodiment of the present application, the above reference flow chart Figure 2 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from a removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present application are executed.

[0097] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical cable, RF, or any suitable combination thereof.

[0098] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operating instructions of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the aforementioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than the order marked in the accompanying drawings. For example, the boxes represented by two connections can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operating instruction, or can be implemented using a combination of dedicated hardware and computer instructions.

[0099] The units or modules involved in the embodiments described in the present application can be implemented by software or by hardware. The units or modules described can also be set in a processor. For example, they can be described as: a processor includes a response module, a call module and an analysis module. Among them, the names of these units or modules do not constitute a limitation of the units or modules themselves under certain circumstances. For example, the response module can also be described as "responding to multiple abnormal event triggering mechanisms, obtaining initial data associated with the abnormal event."

[0100] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments, or may exist independently and not be incorporated into the electronic device. The computer-readable storage medium stores one or more programs, which, when used by one or more processors, execute the automatic analysis method for abnormal events described in the present application.

[0101] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the aforementioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for automatic analysis of abnormal events, characterized in that: include: In response to a plurality of abnormal event triggering mechanisms, obtaining initial data associated with the abnormal event; Performing an initial analysis on the abnormal event based on the initial data to obtain a service to which the abnormal event belongs, and dynamically calling analysis data from different data sources based on the service to which the abnormal event belongs; Based on the analysis data, the abnormal event is deeply analyzed to obtain a target processing strategy corresponding to the abnormal event.

2. The automatic analysis method of abnormal events according to claim 1, characterized in that: The dynamically calling of analysis data from different data sources based on the service includes: Based on the service to which the abnormal event belongs, determining the associated service corresponding to the service; Based on the time node of the abnormal event, the analysis data corresponding to each of the related services is dynamically called.

3. The automatic analysis method of abnormal events according to claim 1, characterized in that: The in-depth analysis of the abnormal event based on the analysis data to obtain a target processing strategy corresponding to the abnormal event includes: Inputting the analysis data into a rule-based deep model, wherein the rule-based deep model is trained based on historical abnormal events and business rules; The target processing strategy obtained by the rule-depth model based on the analysis data is obtained.

4. The automatic analysis method of abnormal events according to claim 3, characterized in that: Also includes: Determining the priority of the abnormal event based on the rule-depth model; Based on the priority of the abnormal event, the target processing strategy corresponding to the abnormal event is determined.

5. The automatic analysis method of abnormal events according to claim 1, characterized in that: Also includes: Based on the target processing strategy, an abnormal work order and / or abnormal alarm corresponding to the abnormal event is generated in the enterprise-level management system.

6. The automatic analysis method of abnormal events according to claim 1, characterized in that: Also includes: Based on the abnormal event and the target processing strategy, a visual reach chart is drawn.

7. An automatic analysis device for abnormal events, characterized in that: include: A response module, configured to obtain initial data associated with the abnormal event in response to a plurality of abnormal event triggering mechanisms; A calling module, configured to perform an initial analysis on the abnormal event based on the initial data, obtain the service to which the abnormal event belongs, and dynamically call analysis data from different data sources based on the service to which it belongs; The analysis module is used to perform an in-depth analysis of the abnormal event based on the analysis data to obtain a target processing strategy corresponding to the abnormal event.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the automatic analysis method for abnormal events according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the automatic analysis method for abnormal events according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for automatically analyzing abnormal events according to any one of claims 1 to 6 is implemented.

Images