An operation method, system, server, and storage medium for an operation and maintenance platform.

Abstract

This application relates to a method, system, server, and storage medium for operating a maintenance platform, belonging to the field of maintenance platform technology. The method includes: acquiring monitoring data of the maintenance object in real time; standardizing the monitoring data to obtain unified monitoring data; generating an maintenance data view based on the unified monitoring data; detecting in real time whether the unified monitoring data meets a preset standard threshold; if not, marking the unified monitoring data that does not meet the preset standard threshold to obtain abnormal monitoring data; updating the maintenance data view using the abnormal monitoring data; determining the user role to be pushed to based on the abnormal monitoring data; and pushing the maintenance data view to the user module corresponding to the user role to be pushed to, so that the updated maintenance data view is displayed on the user module. This application has the effect of facilitating the location of anomalies, thereby improving maintenance efficiency.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance platform technology, and in particular to an operation and maintenance platform operation method, system, server and storage medium. Background Technology

[0002] With the rapid development of cloud computing and big data technologies, enterprises have deployed a large number of software and hardware systems and network devices in various aspects of production, management and service, which has led to increasingly complex operation and maintenance objects and continuous growth in data volume. Therefore, ensuring the stable operation of various systems and devices is extremely important.

[0003] In existing operation and maintenance methods, monitoring data typically originates from different platforms, with varying data formats and structures, making unified processing difficult and increasing the complexity of system integration and analysis. Anomaly detection methods rely heavily on manual rule configuration or manual troubleshooting, resulting in slow response times. Especially after anomalies occur, existing operation and maintenance methods lack effective location mechanisms, forcing maintenance personnel to spend significant time analyzing and screening data to pinpoint the location of the anomaly, hindering rapid anomaly localization and impacting overall operation and maintenance efficiency. Summary of the Invention

[0004] To facilitate the location of anomalies and improve operational efficiency, this application provides an operation method, system, server, and storage medium for an operational platform.

[0005] Firstly, this application provides a method for operating an operation and maintenance platform, employing the following technical solution:

[0006] A method for operating an operations and maintenance platform, comprising:

[0007] Real-time acquisition of monitoring data for objects under operation and maintenance;

[0008] The monitoring data is standardized to obtain unified monitoring data;

[0009] An operation and maintenance data view is generated based on the unified monitoring data;

[0010] Real-time detection of whether the unified monitoring data meets preset standard thresholds;

[0011] If not, then the unified monitoring data that does not meet the preset standard threshold will be marked to obtain abnormal monitoring data;

[0012] Update the operation and maintenance data view using the aforementioned anomaly monitoring data;

[0013] The user role to be pushed to is determined based on the abnormal monitoring data.

[0014] The operation and maintenance data view is pushed to the user module corresponding to the user role to be pushed, so that the updated operation and maintenance data view is displayed on the user module.

[0015] By adopting the above technical solution, monitoring data of the operation and maintenance objects is acquired in real time. After standardizing the monitoring data, unified monitoring data is obtained. Unified monitoring data that does not meet the preset standard threshold is marked to obtain abnormal monitoring data. The operation and maintenance data view is updated using abnormal monitoring data, so that abnormal situations can be quickly identified and located, and displayed intuitively on the user module in a visual form, which makes it easy for the corresponding operation and maintenance personnel to quickly locate and handle abnormal situations.

[0016] Optionally, obtain the abnormal attribute information of the abnormal monitoring data, including resource identifier, abnormal type and generation time;

[0017] Within a preset time window, determine whether there is any abnormal monitoring data in the cache that has the same resource identifier and abnormal type as the current abnormal monitoring data;

[0018] If not, the current abnormal monitoring data is written to the abnormal event list;

[0019] If so, retrieve the earliest occurrence of the abnormal monitoring data in the cache that has the same resource identifier and abnormal type as the current abnormal monitoring data, and obtain the earliest abnormal monitoring data;

[0020] Determine whether the difference between the generation time of the current abnormal monitoring data and the generation time of the earliest abnormal monitoring data is greater than a preset time interval;

[0021] If the value is greater than the specified value, the current abnormal monitoring data will be written into the abnormal event list.

[0022] If it is not greater than, then the earliest abnormal monitoring data is written into the abnormal event list;

[0023] Update the operations and maintenance data view using the list of exception events.

[0024] By adopting the above technical solution, if monitoring data with the same resource identifier and anomaly type as the current abnormal monitoring data exists within a preset time window, it indicates that the current abnormal monitoring data is duplicated. Updating the operation and maintenance data view using all cached abnormal monitoring data could easily lead to the push of duplicate operation and maintenance data views. Therefore, based on this situation, only the earliest abnormal monitoring data is written to the abnormal event list and the abnormal event list is used to update the operation and maintenance data view, which can reduce the probability of pushing duplicate operation and maintenance data views. On the other hand, if the difference between the generation time of the current abnormal monitoring data and the generation time of the earliest abnormal monitoring data is greater than a preset time interval, it indicates that the abnormal event corresponding to the current abnormal monitoring data can be considered an independent event. Therefore, the current abnormal monitoring data needs to be written to the abnormal event list, which can reduce the probability of missed anomalies and help operation and maintenance personnel quickly locate critical abnormal events.

[0025] Optionally, the abnormal monitoring data in the abnormal event list can be aggregated and analyzed according to the resource identifier and the abnormal type to obtain the occurrence frequency. The occurrence frequency refers to the number of times abnormal monitoring data with the same resource identifier and the abnormal type occur within a preset period.

[0026] Determine whether the occurrence frequency is greater than a preset high-frequency threshold;

[0027] If the frequency is greater than the specified frequency, the abnormal monitoring data corresponding to the frequency of occurrence will be marked as high-frequency alarm data.

[0028] Add a severity level field to the high-frequency alarm data;

[0029] Update the list of abnormal events using the high-frequency alarm data after adding the severity level field;

[0030] Update the operations and maintenance data view with the updated list of exception events.

[0031] By adopting the above technical solution, abnormal monitoring data can be aggregated and analyzed based on resource identifiers and anomaly types to obtain the occurrence frequency. When the occurrence frequency is greater than a preset high-frequency threshold, the abnormal monitoring data is marked as high-frequency alarm data and a severity level field is added to the high-frequency alarm data. The abnormal event list is updated according to the high-frequency alarm data, so that the operation and maintenance data view can display the view corresponding to the severity level field, thereby enhancing the response speed of operation and maintenance personnel and improving the efficiency of operation and maintenance work.

[0032] Optionally, based on a preset business graph, the actual business associated with the abnormal monitoring data in the abnormal event list can be obtained;

[0033] Obtain the business level of the actual business;

[0034] The number of actual services associated with each of the current abnormal monitoring data is counted to obtain the number of services;

[0035] Determine whether the number of the stated services is not greater than one;

[0036] If not, the overall business impact ranking of the actual business is obtained according to the preset scoring method;

[0037] If so, then a weighted score is obtained for each actual business based on the business level and the anomaly type.

[0038] The weighted impact score is used to update the sorting of the abnormal monitoring data in the abnormal event list.

[0039] By adopting the above technical solution, based on the preset business map, the actual business associated with the anomaly monitoring data is obtained. When the number of businesses is no more than one, the business level and anomaly type are combined for weighted processing to obtain a weighted impact score. The anomaly monitoring data in the anomaly events are sorted according to the weighted impact score, so that the sorting results of the anomaly events can better reflect the importance of the actual business and the degree of failure impact. The anomaly monitoring data with a high weighted impact score can be refreshed to the top position in the operation and maintenance data view, which helps operation and maintenance personnel to prioritize the handling of anomaly events with a greater impact on the actual business.

[0040] Optionally, the step of obtaining the comprehensive business impact ranking of the actual business according to a preset scoring method includes:

[0041] Based on the business level, obtain the business impact score of the actual business;

[0042] The first ranking of the actual business is obtained based on the business impact score;

[0043] The first weighted score is obtained by weighting the anomaly type and business impact score corresponding to each actual business;

[0044] The average value of the first weighted score is used to obtain the comprehensive impact score.

[0045] The second sorting of the abnormal monitoring data is obtained based on the comprehensive impact score;

[0046] A comprehensive sort is obtained based on the first sort and the second sort;

[0047] The sorting of the abnormal monitoring data in the abnormal event list is updated using the comprehensive sorting.

[0048] By adopting the above technical solution, a business impact score of the actual business is obtained, and weighted according to the anomaly type corresponding to the actual business to obtain a first weighted score. After averaging the first weighted score, a second comprehensive impact score of the actual anomaly monitoring is obtained. The anomaly monitoring data is then sorted according to the comprehensive impact score to obtain a second ranking. In addition, the second ranking of the actual business associated with each anomaly monitoring data is obtained according to the business impact score. The second ranking is used as a sub-ranking of the first ranking to obtain a comprehensive ranking. The ranking of the anomaly monitoring data in the anomaly event list is updated according to the comprehensive ranking. This ensures that when an anomaly monitoring data is associated with multiple actual businesses, the anomaly monitoring data corresponding to the actual business with a greater impact can be located at the top of the anomaly event list, and thus appear at the top of the operation and maintenance data view, so that operation and maintenance personnel can handle it first.

[0049] Optionally, in the operation and maintenance data view, the resource node corresponding to the abnormal monitoring data is located based on the resource identifier;

[0050] Add an anomaly display icon corresponding to the anomaly monitoring data to the resource node;

[0051] The anomaly display icon is updated based on the comprehensive impact score and using preset color coding rules.

[0052] By adopting the above technical solution, in the operation and maintenance data view, the resource node corresponding to the abnormal monitoring data is located according to the resource identifier, and an abnormal display icon is added to the resource node. The icon is updated and displayed by combining the comprehensive impact score and using the preset color coding rules. This makes the resource node more obvious in the operation and maintenance data view when an abnormal state occurs, which helps operation and maintenance personnel to discover and deal with it in a timely manner.

[0053] Optionally, the user module may be received processing operation information.

[0054] The processing operation information is parsed to obtain a parsing result, which includes the operation type, operation time, and operation result.

[0055] Based on the analysis results, an operation and maintenance processing record is generated;

[0056] The operation and maintenance records are associated with the corresponding abnormal monitoring data to form an event processing chain;

[0057] The event handling chain is stored in a preset database.

[0058] By adopting the above technical solution, the process of operation and maintenance personnel handling anomalies can be recorded, linked with anomaly monitoring data, forming a complete event handling chain, and stored in the database. This provides a reference for encountering the same or similar anomalies in the future, thereby improving the efficiency and accuracy of operation and maintenance work.

[0059] Secondly, this application provides an operation and maintenance platform operating system, which adopts the following technical solution:

[0060] An operation and maintenance platform operating system includes:

[0061] The acquisition module is used to acquire monitoring data;

[0062] A memory for storing programs containing the operating methods of the operation and maintenance platform;

[0063] The processor and memory programs can be loaded and executed by the processor to implement the operation and maintenance platform's operating method.

[0064] By adopting the above technical solution, monitoring data of the operation and maintenance objects is acquired in real time. After standardizing the monitoring data, unified monitoring data is obtained. Unified monitoring data that does not meet the preset standard threshold is marked to obtain abnormal monitoring data. The operation and maintenance data view is updated using abnormal monitoring data, so that abnormal situations can be quickly identified and located, and displayed intuitively on the user module in a visual form, which makes it easy for the corresponding operation and maintenance personnel to quickly locate and handle abnormal situations.

[0065] Thirdly, this application provides a server that adopts the following technical solution:

[0066] A server running an operation and maintenance platform, the server including a memory and a processor, the memory storing a computer program that can be loaded by the processor and executed by any of the methods described above.

[0067] Fourthly, this application provides a computer storage medium capable of storing corresponding programs, which facilitates the location of anomalies and improves operational efficiency. The technical solution adopted is as follows:

[0068] A computer-readable storage medium storing a computer program that can be loaded by a processor and execute the operating method of any of the above-mentioned operation and maintenance platforms.

[0069] In summary, this application includes at least one of the following beneficial technical effects:

[0070] By acquiring real-time monitoring data of the operation and maintenance objects, and after standardizing the monitoring data, unified monitoring data is obtained. Among them, unified monitoring data that does not meet the preset standard threshold is marked to obtain abnormal monitoring data. The operation and maintenance data view is updated with abnormal monitoring data, so that abnormal situations can be quickly identified and located, and displayed intuitively on the user module in a visual form, which makes it easy for the corresponding operation and maintenance personnel to quickly locate and handle abnormal situations.

[0071] Within a preset time window, if monitoring data with the same resource identifier and anomaly type as the current anomaly monitoring data exists, it indicates that the current anomaly monitoring data is duplicated. Updating the operations and maintenance (O&M) data view using all cached anomaly monitoring data could easily lead to the push of duplicate O&M data views. Therefore, in this case, only the earliest anomaly monitoring data is written to the anomaly event list, and the O&M data view is updated using the anomaly event list, which can reduce the probability of pushing duplicate O&M data views. On the other hand, if the difference between the generation time of the current anomaly monitoring data and the generation time of the earliest anomaly monitoring data is greater than a preset time interval, it indicates that the anomaly event corresponding to the current anomaly monitoring data can be considered an independent event. Therefore, the current anomaly monitoring data needs to be written to the anomaly event list, which can reduce the probability of missed anomaly reports and help O&M personnel quickly locate critical anomaly events.

[0072] Based on a pre-defined business graph, the actual business associated with the anomaly monitoring data is obtained. When the number of businesses is no more than one, a weighted score is obtained by combining the business level and anomaly type. The anomaly monitoring data in the anomaly events is then sorted according to the weighted impact score, so that the sorting results of the anomaly events can better reflect the importance of the actual business and the degree of failure impact. The anomaly monitoring data with a high weighted impact score can be refreshed to the top position in the operation and maintenance data view, which helps operation and maintenance personnel to prioritize the handling of anomaly events with a greater impact on the actual business. Attached Figure Description

[0073] Figure 1 This is a flowchart illustrating the operation method of an operation and maintenance platform according to an embodiment of this application.

[0074] Figure 2 This is a flowchart illustrating an abnormal data deduplication method in an embodiment of this application.

[0075] Figure 3 This is a flowchart illustrating a high-frequency event processing method in an embodiment of this application.

[0076] Figure 4 This is a flowchart illustrating a sorting method based on actual business operations in an embodiment of this application.

[0077] Figure 5 This is a flowchart illustrating the steps of sorting abnormal monitoring data according to a preset sorting method in an embodiment of this application.

[0078] Figure 6 This is a flowchart illustrating an abnormal information display method in an embodiment of this application.

[0079] Figure 7 This is a flowchart illustrating an exception recording method in an embodiment of this application. Detailed Implementation

[0080] To make the purpose, technical solution, and advantages of this application clearer, the following description is provided in conjunction with the appendix. Figure 1 - Appendix Figure 7 The present application will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application.

[0081] This application discloses a method for operating an operation and maintenance platform.

[0082] Reference Figure 1 The operation and maintenance platform includes the following methods:

[0083] Step S101: Obtain real-time monitoring data of the objects under operation and maintenance.

[0084] Operation and maintenance objects refer to IT resources and equipment monitored and managed through the operation and maintenance platform, including servers, databases, network devices, and applications. Each operation and maintenance object has a unique identifier and is configured with collectable status indicators.

[0085] Monitoring data refers to operational status data collected from the objects being monitored through the operations and maintenance platform. This includes server status data, database status data, network device status data, and application status data. Server status data reflects server resource usage and workload, including CPU utilization, memory usage, disk read / write speed, number of processes, and runtime. Database status data assesses the health of the database, including database connections, queries per second, transactions per second, master-slave synchronization latency, and lock wait time. Network device status data includes operational status data for network switches, routers, firewalls, etc., such as port traffic, bandwidth utilization, packet loss rate, network latency, and fault alarm codes. Application status data reflects the application's operational status and potential anomalies, including response time, error codes, exception stack traces, and service start / stop status.

[0086] Step S102: Standardize the monitoring data to obtain unified monitoring data.

[0087] Standardization processing refers to the operations of converting raw monitoring data from different sources and in different formats, unifying units, mapping fields, aligning timestamps, and correcting outliers according to a preset data structure.

[0088] Unified monitoring data refers to monitoring data that has undergone standardized processing and has a unified data structure, unit, fields, and timestamp.

[0089] In some embodiments, the operations and maintenance platform can also collect monitoring data from multiple operations and maintenance environment nodes in public cloud, dedicated cloud, and hybrid cloud environments. The format of this monitoring data may include JSON, XML, CSV, etc., and the field names and units are not consistent. Therefore, it is necessary to standardize the monitoring data. For example, fields such as "cpu_usage" and "cpu_utilization" can be uniformly mapped to "CPU utilization".

[0090] Step S103: Generate an operation and maintenance data view based on the unified monitoring data.

[0091] The operation and maintenance platform has a visual interface, which includes several sub-interfaces for displaying the running status of each operation and maintenance object.

[0092] After acquiring unified monitoring data, the system renders the data using a graphics engine component, generating a corresponding operations and maintenance (O&M) data view. This view displays server status data, database status data, network device status data, and application status data for the O&M objects within a sub-interface. The O&M platform refreshes the O&M data view in real-time within the visualization interface.

[0093] Step S104: Real-time detection of whether the unified monitoring data meets the preset standard threshold.

[0094] The preset standard threshold is a preset constant, which is a reference range set for each unified monitoring data and is used to determine whether the operation and maintenance object is in an abnormal state.

[0095] For example, the operation and maintenance platform receives the following partial data from the unified monitoring data received from server node A0001: {"Resource ID": "A0001"; "CPU Utilization": 88; "Memory Usage": 65; "Network Latency": 150}. Part of the preset standard thresholds are {"CPU Utilization Threshold": 80; "Network Latency Threshold": 120}. By comparing the unified monitoring data of server node A0001 with the preset standard thresholds, it finds that the CPU utilization is greater than the CPU utilization threshold and the network latency is greater than the network latency threshold. That is, the unified monitoring data does not meet the preset standard thresholds, and step S105 needs to be executed.

[0096] Step S105: If not, mark the unified monitoring data that does not meet the preset standard threshold to obtain abnormal monitoring data.

[0097] On the other hand, if the unified monitoring data meets the preset standard threshold, no processing is performed.

[0098] If not, it indicates that the unified monitoring data does not meet the preset standard threshold, therefore it is necessary to mark the unified monitoring data as abnormal to obtain abnormal monitoring data. Further, the names of fields that do not meet the preset standard threshold are extracted from the abnormal monitoring data to obtain abnormal fields, and these abnormal fields are added to the abnormal monitoring data.

[0099] Step S106: Update the operation and maintenance data view using abnormal monitoring data.

[0100] After acquiring anomaly monitoring data, the system calls the graphics engine component and updates the operations and maintenance data view based on the anomaly monitoring data. Update methods include: highlighting the anomaly status in the sub-interface corresponding to the operations and maintenance object; adding anomaly markers to the sub-interface corresponding to the operations and maintenance object; displaying a comparison of the current value of the anomaly field with the preset standard threshold; and displaying an anomaly summary list.

[0101] For example, if the CPU utilization of server node A0002 exceeds the preset standard threshold of 80% in the unified monitoring data, the unified monitoring data is marked as abnormal monitoring data, and the operation and maintenance data view is updated. A red mark is displayed in the sub-interface corresponding to server node A0002, and an information box containing the abnormal type (high CPU utilization), actual value (CPU utilization: 95%), and threshold (CPU utilization threshold 80%) pops up.

[0102] Step S107: Determine the user role to be pushed based on the abnormal monitoring data.

[0103] User roles refer to the identities of users with different permissions in the operation and maintenance platform, including system administrators, server administrators, database administrators, network device administrators, and application maintenance personnel.

[0104] The user role to be pushed refers to the user role corresponding to the abnormal data determined based on the abnormal data appearing in the current abnormal monitoring data. For example, if there is abnormal data in the server status data of the abnormal monitoring data, that is, data that does not meet the preset standard threshold, then it is determined that the abnormal monitoring data belongs to the server administrator, and therefore the user role to be pushed is the server administrator.

[0105] Step S108: Push the operation and maintenance data view to the user module corresponding to the user role to be pushed, so that the updated operation and maintenance data view is displayed on the user module.

[0106] The operations and maintenance platform is configured with different user modules for different user roles. Each user module contains an operations and maintenance window interface corresponding to its user role, where the operations and maintenance data view is displayed. After determining the user role to be pushed to, the updated operations and maintenance data view is pushed to their corresponding operations and maintenance window interface, enabling different user roles to quickly identify and handle anomalies.

[0107] By adopting the above technical solution, monitoring data of the operation and maintenance objects is acquired in real time. After standardizing the monitoring data, unified monitoring data is obtained. Unified monitoring data that does not meet the preset standard threshold is marked to obtain abnormal monitoring data. The operation and maintenance data view is updated using abnormal monitoring data, so that abnormal situations can be quickly identified and located, and displayed intuitively on the user module in a visual form, which makes it easy for the corresponding operation and maintenance personnel to quickly locate and handle abnormal situations.

[0108] In the following embodiments, there is a situation where the same type of abnormal monitoring data is generated in a short period of time, resulting in the push of duplicate operation and maintenance data views. This causes operation and maintenance personnel to be overwhelmed with responses and makes it difficult to identify key anomalies. To improve this situation, this application provides an abnormal data deduplication method, referring to... Figure 2 The method includes:

[0109] Step S201: Obtain the abnormal attribute information of the abnormal monitoring data. The abnormal attribute information includes resource identifier, abnormal type and generation time.

[0110] Attribute information refers to the characteristics used to describe the abnormal data that appears in the abnormal monitoring data. Attribute information includes resource identifier, abnormal type and generation time.

[0111] The resource identifier refers to the unique identifier of the operation and maintenance object. For example, there is a server node with a resource ID of "A0001". Therefore, A0001 is the unique identifier of the server node. If the server node encounters an abnormality during operation, the resource identifier is the unique identifier A0001 of the server node.

[0112] The exception type indicates the type of abnormal data. The field content for the exception type can be manually configured by administrators or developers. Exception types include CPU overrun, insufficient memory, high network latency, database connection failure, and response timeout. For example, if server node A0001 has a CPU utilization of 90%, exceeding the CPU utilization threshold of 80%, the exception type can be set to "CPU overrun." Here, "CPU overrun" is the value of the exception type field, which is manually configured by administrators or developers. When server status data in the exception monitoring data meets the condition "CPU utilization > CPU utilization threshold," the system will automatically match this rule and populate the corresponding exception type.

[0113] The generation time refers to the time when abnormal data appears in the abnormal monitoring data, and it is usually saved in the form of a timestamp.

[0114] Step S202: Within a preset time window, determine whether there is any abnormal monitoring data in the cache that has the same resource identifier and abnormal type as the current abnormal monitoring data.

[0115] The preset time window is a fixed constant representing a specified time range, which can be adjusted according to actual needs. In this embodiment, the time range represented by the preset time window can be set to 5 minutes.

[0116] Current anomaly monitoring data refers to the anomaly monitoring data generated at the current moment.

[0117] After receiving a new abnormal monitoring data, the operation and maintenance platform will extract the resource identifier and abnormal type of the abnormal monitoring data. Within a preset time window, it will search for all abnormal monitoring data in the cache in chronological order, extract the corresponding resource identifier and abnormal type, and compare them with the resource identifier and abnormal type of the current abnormal monitoring data. It will determine whether there is any abnormal monitoring data with the same resource identifier and abnormal type as the current abnormal monitoring data. If not, it is considered a new abnormal monitoring data; if it is, it is considered a duplicate abnormal monitoring data.

[0118] Step S203: If not, write the current abnormal monitoring data into the abnormal event list.

[0119] The abnormal event list refers to a structured data list used to record abnormal monitoring data. The order of abnormal monitoring data in the abnormal event list can reflect the order in which the abnormal monitoring data appears in the sub-interfaces of the visualization interface.

[0120] If not, it means that there is no abnormal monitoring data in the cache with the same resource identifier and abnormal type as the current abnormal monitoring data. In other words, the current abnormal monitoring data is new abnormal monitoring data, so the current abnormal monitoring data is written to the abnormal event list.

[0121] Step S204: If yes, then obtain the earliest occurrence of the abnormal monitoring data in the cache that has the same resource identifier and abnormal type as the current abnormal monitoring data, and obtain the earliest abnormal monitoring data.

[0122] The earliest anomaly monitoring data refers to the anomaly monitoring data with the same resource identifier and anomaly type as the current anomaly monitoring data in the cache, which is the anomaly monitoring data generated earliest. It represents the first occurrence time of this type of anomaly within a preset time window and is used to determine whether new anomaly monitoring data can be generated.

[0123] If so, it means that there is abnormal monitoring data in the cache with the same resource identifier and abnormal type as the current abnormal monitoring data. In this case, within a preset time window, the first abnormal monitoring data with the same resource identifier and abnormal type as the current abnormal monitoring data is extracted from the cache to obtain the latest abnormal monitoring data.

[0124] For example, the current abnormal monitoring data has the following abnormal attribute information: {"Resource Identifier": A0001; "Abnormal Type": CPU Over-limit; "Generation Time": 2025.5.21, 13:59:33}. The cache contains abnormal monitoring data a with the following abnormal attribute information: {"Resource Identifier": A0001; "Abnormal Type": CPU Over-limit; "Generation Time": 2025.5.21, 13:57:23} and abnormal monitoring data b with the following abnormal attribute information: {"Resource Identifier": A0001; "Abnormal Type": CPU Over-limit; "Generation Time": 2025.5.21, 13:55:00}. Abnormal monitoring data b appears earliest in the cache, therefore, the earliest abnormal monitoring data is abnormal monitoring data b.

[0125] Step S205: Determine whether the difference between the generation time of the current abnormal monitoring data and the generation time of the earliest abnormal monitoring data is greater than a preset time interval.

[0126] The preset time interval is a preset constant that can be adjusted according to actual needs. In this embodiment, the preset time interval can be set to 3 minutes.

[0127] The generation time of the current abnormal monitoring data is subtracted from the generation time of the earliest abnormal monitoring data to obtain a time difference. The time difference is compared with a preset time interval. If the time difference is greater than the preset time interval, it means that the abnormal event corresponding to the current abnormal monitoring data can be regarded as a new independent event, so step S206 is executed; if the time difference is less than the preset time interval, it means that the abnormal event corresponding to the current abnormal monitoring data can be regarded as a continuous event, so step S207 is executed.

[0128] Step S206: If the value is greater than the specified value, write the current abnormal monitoring data into the abnormal event list.

[0129] If the difference is greater than the preset time interval, it means that the difference between the generation time of the current abnormal monitoring data and the generation time of the earliest abnormal monitoring data is greater than the preset time interval. In other words, the abnormal event corresponding to the current abnormal monitoring data can be regarded as a new independent event, so the current abnormal monitoring data is written into the abnormal event list.

[0130] Step S207: If it is not greater than, then write the earliest abnormal monitoring data into the abnormal event list.

[0131] If the difference between the generation time of the current abnormal monitoring data and the generation time of the earliest abnormal monitoring data is not greater than the preset time interval, it means that the abnormal event corresponding to the current abnormal monitoring data can be regarded as a continuous event. Therefore, the earliest abnormal monitoring data is written into the abnormal event list.

[0132] Step S208: Update the operation and maintenance data view using the list of exception events.

[0133] By calling the graph engine component to extract abnormal monitoring data from the abnormal event list in chronological order, and using this abnormal monitoring data to update the operation and maintenance data view, the probability of pushing duplicate operation and maintenance data views can be reduced.

[0134] By adopting the above technical solution, if monitoring data with the same resource identifier and anomaly type as the current abnormal monitoring data exists within a preset time window, it indicates that the current abnormal monitoring data is duplicated. Updating the operation and maintenance data view using all cached abnormal monitoring data could easily lead to the push of duplicate operation and maintenance data views. Therefore, based on this situation, only the earliest abnormal monitoring data is written to the abnormal event list and the abnormal event list is used to update the operation and maintenance data view, which can reduce the probability of pushing duplicate operation and maintenance data views. On the other hand, if the difference between the generation time of the current abnormal monitoring data and the generation time of the earliest abnormal monitoring data is greater than a preset time interval, it indicates that the abnormal event corresponding to the current abnormal monitoring data can be considered an independent event. Therefore, the current abnormal monitoring data needs to be written to the abnormal event list, which can reduce the probability of missed anomalies and help operation and maintenance personnel quickly locate critical abnormal events.

[0135] In the following embodiments, if abnormal monitoring data occurs frequently over a period of time, it indicates that the abnormal event corresponding to the abnormal monitoring data is relatively important. If only the earliest abnormal monitoring data is written into the abnormal event list, it is easy for maintenance personnel to be unable to handle the abnormal event in a timely manner. To improve this problem, this application embodiment provides a high-frequency event handling method, referring to... Figure 3 The method includes:

[0136] Step S301: Aggregate and analyze the abnormal monitoring data in the abnormal event list according to the resource identifier and the abnormal type to obtain the occurrence frequency. The occurrence frequency refers to the number of times abnormal monitoring data with the same resource identifier and abnormal type occur within a preset period.

[0137] Aggregate analysis refers to the operation of grouping, statistically analyzing, and classifying a data set according to certain fields. In this step, aggregate analysis is the operation of grouping and statistically analyzing the abnormal monitoring data in the abnormal event list using the "resource identifier" and "abnormal type" in the abnormal attribute information as grouping keys.

[0138] The preset period is a preset time constant that can be adjusted according to actual needs. In this embodiment, the preset period can be set to 2 hours.

[0139] For example, there is a list of abnormal events containing several abnormal monitoring data, and their abnormal attribute information is shown in Table 1.

[0140] Table 1. Abnormal Attribute Information Table

[0141] Resource Identifier Exception types Generation time A0001 CPU overload 2025-05-21 09:05:00 A0002 Insufficient memory 2025-05-21 09:18:00 A0001 Insufficient memory 2025-05-21 10:10:00 A0001 CPU overload 2025-05-21 10:22:00 A0001 CPU overload 2025-05-21 10:41:00 A0001 CPU overload 2025-05-21 10:55:00 A0002 Insufficient memory 2025-05-21 10:58:00 A0001 CPU overload 2025-05-21 10:59:00 A0001 CPU overload 2025-05-21 11:04:00

[0142] After performing aggregate analysis on the above abnormal monitoring data, the results are shown in Table 2.

[0143] Table 2. Results of Aggregation Analysis

[0144] Resource Identifier Exception types Frequency of occurrence A0001 CPU overload 6 A0002 Insufficient memory 2 A0001 Insufficient memory 1

[0145] According to the aggregation analysis results table, the frequency of occurrence of the group key (A0001, CPU overload) is 6, the frequency of occurrence of the group key (A0001, insufficient memory) is 1, and the frequency of occurrence of the group key (A0002, insufficient memory) is 2.

[0146] Step S302: Determine whether the occurrence frequency is greater than the preset high-frequency threshold.

[0147] The preset high-frequency threshold is a preset constant; in this embodiment, the preset high-frequency threshold can be set to 3. By comparing the occurrence frequency with the preset high-frequency threshold, the severity of the abnormal monitoring data corresponding to the occurrence frequency can be reflected.

[0148] Step S303: If the value is greater than the frequency, the abnormal monitoring data corresponding to the frequency of occurrence will be marked as high-frequency alarm data.

[0149] On the other hand, if the frequency of occurrence is not greater than the preset high-frequency threshold, no action is taken.

[0150] If the frequency of occurrence exceeds a preset high-frequency threshold, the abnormal monitoring data corresponding to the frequency exceeding the preset high-frequency threshold will be marked as high-frequency alarm data. Specifically, the abnormal monitoring data includes a "High-Frequency" field, with a value of "Yes / No". If the frequency of occurrence of the corresponding data exceeds the preset high-frequency threshold, the value of the "High-Frequency" field will automatically switch to "Yes", thus marking the abnormal monitoring data as high-frequency alarm data.

[0151] Step S304: Add a severity level field to the high-frequency alarm data.

[0152] The severity level field is manually configured by the administrator or developer. In this embodiment, the values ​​of the severity level field include "High", "Medium", and "Low". When the value of the "High Frequency" field is "Yes", the severity level field corresponding to the occurrence frequency will be matched for the high frequency alarm data, and the severity level field will be added to the high frequency alarm data. Specifically, when the occurrence frequency is 3 ≤ occurrence frequency ≤ 4, the value of the severity level field corresponding to the occurrence frequency is "Low"; when the occurrence frequency is 5 ≤ ​​occurrence frequency ≤ 7, the value of the severity level field corresponding to the occurrence frequency is "Medium"; and when the occurrence frequency is 8 ≤ occurrence frequency, the value of the severity level field corresponding to the occurrence frequency is "High".

[0153] Step S305: Update the list of abnormal events using the high-frequency alarm data with the severity level field added.

[0154] Each piece of abnormal monitoring data has a unique identifier ID, which is the identifier ID of the high-frequency alarm data. Based on the identifier ID of the high-frequency alarm data, the corresponding abnormal monitoring data is found in the abnormal event list, and the high-frequency alarm data is used to update the abnormal monitoring data, adding a severity level field to the original abnormal monitoring data.

[0155] Step S306: Update the operations and maintenance data view with the updated list of exception events.

[0156] By invoking the graphics engine component, abnormal monitoring data is extracted from the abnormal event list in chronological order. The system can generate corresponding alarm icons based on the severity level field to indicate the severity of the abnormal monitoring data. For example, the alarm icon color for a severity level value of "High" can be set to red, the alarm icon color for a severity level value of "Medium" can be set to yellow, and the alarm icon color for a severity level value of "Low" can be set to green.

[0157] By adopting the above technical solution, abnormal monitoring data can be aggregated and analyzed based on resource identifiers and anomaly types to obtain the occurrence frequency. When the occurrence frequency is greater than a preset high-frequency threshold, the abnormal monitoring data is marked as high-frequency alarm data and a severity level field is added to the high-frequency alarm data. The abnormal event list is updated according to the high-frequency alarm data, so that the operation and maintenance data view can display the view corresponding to the severity level field, thereby enhancing the response speed of operation and maintenance personnel and improving the efficiency of operation and maintenance work.

[0158] In the following embodiments, the business level of actual business needs to be used as an important indicator when handling abnormal events. However, the abnormal event monitoring data in the abnormal event list is stored in chronological order, which does not take into account the actual business factor. To improve this situation, this application embodiment provides a sorting method based on actual business, referring to... Figure 4 The method includes:

[0159] Step S401: Based on the preset business map, obtain the actual business associated with the abnormal monitoring data in the abnormal event list.

[0160] The pre-built business graph refers to a pre-constructed operation and maintenance topology model that records the dependencies between operation and maintenance objects (servers, databases, network devices, and applications) and actual business operations. These dependencies can be manually configured by developers. Specifically, by traversing the abnormal monitoring data in the abnormal event list and extracting its resource identifier, the actual business operations related to the resource identifier can be obtained from the pre-built business graph—that is, the actual business operations associated with the abnormal monitoring data.

[0161] Step S402: Obtain the business level of the actual business.

[0162] The business level field represents the importance of the actual business within the operations and maintenance system. This field can be manually configured by administrators or developers. Examples of business level field values ​​include: critical business, general business, and low-level business.

[0163] Step S403: Count the number of actual services associated with each current abnormal monitoring data to obtain the number of services.

[0164] Each piece of abnormal monitoring data can be identified by its resource identifier in a preset business graph, which can then be used to find one or more actual businesses associated with the abnormal monitoring data. This allows for the counting of the number of actual businesses associated with the abnormal monitoring data, i.e., the number of businesses.

[0165] Step S404: Determine whether the number of business transactions is not greater than one.

[0166] Specifically, after obtaining the number of services corresponding to all abnormal monitoring data, if the number of all services is not greater than one, step S405 is executed; if there is a service number greater than one among all the service numbers, step S406 is executed.

[0167] Step S405: If not, sort the abnormal monitoring data according to the preset sorting method.

[0168] If not, it indicates that there are cases where the number of services is greater than one among all service quantities. Therefore, the abnormal monitoring data is sorted according to the preset sorting method, and the abnormal event list can be sorted according to the comprehensive business impact, thereby changing the update order of the abnormal monitoring data in the operation and maintenance data view. For specific steps on sorting the abnormal monitoring data according to the preset sorting method, please refer to [link to relevant documentation]. Figure 5 The steps in the embodiments.

[0169] Step S406: If so, perform weighted processing based on business level and exception type to obtain the weighted impact score corresponding to each actual business.

[0170] If so, it indicates that the number of services is not greater than one, meaning that each abnormal monitoring event corresponds to only one actual service in the preset service graph. The weights of service level and abnormal type are preset values. The service level weight can be determined based on the service level field, and the abnormal type weight can be determined based on the abnormal type field.

[0171] Weighted impact score = Business level score × Business level weight + Anomaly type score × Anomaly type weight.

[0172] For example, the business level weight can be set to 0.4, and the exception type weight can be set to 0.6.

[0173] The score for critical business operations is 80, for general business operations it is 70, and for low-level business operations it is 50. The anomaly types include CPU overrun, insufficient memory, high network latency, database connection failure, and response timeout. The score for CPU overrun is 80, for insufficient memory it is 75, for high network latency it is 65, for database connection failure it is 90, and for response timeout it is 70.

[0174] Anomaly monitoring data c has the following abnormal attribute information: {"Resource Identifier": B0002; "Abnormal Type": Database connection failure; "Generation Time": 2025-05-20 09:05:00}. The associated actual business is "Payment Settlement Business," with a business level of critical business. The critical business score is 80, and the abnormal type score is 90. The weighted impact score of abnormal monitoring data c is 80 × 0.4 + 90 × 0.6 = 86.

[0175] An abnormal monitoring data d contains abnormal attribute information: {"Resource Identifier": B0003; "Abnormal Type": CPU Overlimit; "Generation Time": 2025-05-20 10:02:00}. The associated actual business is "Report Calculation Business", the business level is general business, the general business score is 70, and the abnormal type score is 80. The weighted impact score of abnormal monitoring data d = 70 × 0.4 + 80 × 0.6 = 76.

[0176] Anomaly monitoring data e contains abnormal attribute information: {"Resource Identifier": B0004; "Anomaly Type": High Network Latency; "Generation Time": 2025-05-20 11:01:00}. The associated actual business is "Order Submission Business," with a business level of critical business, a critical business score of 80, and anomaly type score of 65. The weighted impact score of abnormal monitoring data e = 80 × 0.4 + 65 × 0.6 = 71.

[0177] Step S407: Update the sorting of the abnormal monitoring data in the abnormal event list using the weighted impact score.

[0178] The abnormal monitoring data are sorted in descending order based on their weighted impact scores, and the abnormal event list is updated using this sorted data. This ensures that the abnormal monitoring data within the list are ordered in descending order based on their weighted impact scores. For example, abnormal monitoring data c has a weighted impact score of 86, abnormal monitoring data d has a weighted impact score of 76, and abnormal monitoring data e has a weighted impact score of 71. Therefore, in the abnormal event list, the order of these three abnormal monitoring data is: abnormal monitoring data c, abnormal monitoring data d, and abnormal monitoring data e.

[0179] By adopting the above technical solution, based on the preset business map, the actual business associated with the anomaly monitoring data is obtained. When the number of businesses is no more than one, the business level and anomaly type are combined for weighted processing to obtain a weighted impact score. The anomaly monitoring data in the anomaly events are sorted according to the weighted impact score, so that the sorting results of the anomaly events can better reflect the importance of the actual business and the degree of failure impact. The anomaly monitoring data with a high weighted impact score can be refreshed to the top position in the operation and maintenance data view, which helps operation and maintenance personnel to prioritize the handling of anomaly events with a greater impact on the actual business.

[0180] Reference Figure 5 The steps for sorting abnormal monitoring data according to a preset sorting method include:

[0181] Step S501: Obtain the business impact score of the actual business based on the business level.

[0182] The business level is divided into three categories: critical business, general business, and low-level business. Critical business scores 80, general business scores 70, and low-level business scores 50. Therefore, the business impact score refers to the score corresponding to the business level. For example, if the business level is general business, then the business impact score for that actual business is 70.

[0183] Step S502: Obtain the first ranking of actual business based on business impact score.

[0184] Based on the condition that there is a case where the number of services is greater than one, meaning that among several abnormal monitoring data, there are at least two actual services associated with the abnormal monitoring data. For example, abnormal monitoring data f is associated with actual services e, g, h, and i; abnormal monitoring data g is associated with actual services e and i; and abnormal associated data h is associated with actual service f. Among these, actual service e is a low-level service, actual service f is a critical service, actual service g and h are both low-level services, and actual service i is a general service. Therefore, the business impact score for actual services e, g, and h is 50, the business impact score for actual service f is 80, and the business impact score for actual service i is 70. The actual services corresponding to the different abnormal monitoring data are sorted in descending order to obtain the first ranking. Therefore, the ranking of the actual services associated with abnormal monitoring data f is (i, e, g, h), where, for actual services with the same business impact score, the ranking is based on the order in which the abnormal monitoring data appeared. The ranking of the actual services associated with abnormal monitoring data g is (i, e). The actual business order associated with the abnormal monitoring data h is (f).

[0185] Step S503: By weighting the anomaly type and business impact score corresponding to each actual business, a first weighted score is obtained.

[0186] In cases where a single monitoring anomaly is associated with several actual business operations, and these operations share the same anomaly type, a weighted score is obtained by weighting the anomaly type and business impact score for each actual business operation. This weighted score reflects the relative importance of the different actual business operations. The anomaly type has a weight of 0.6, and the business impact score has a weight of 0.4. The first weighted score is calculated as: Business Impact Score × Business Impact Score Weight + Anomaly Type Score × Anomaly Type Weight.

[0187] For example, the business impact score of actual business e is 50, the business impact score of actual business f is 80, the business impact score of actual business g is 50, the business impact score of actual business h is 50, and the business impact score of actual business i is 70. The anomaly type of the abnormal monitoring data f is CPU overload, and the anomaly type score is 80. Therefore, the first weighted score associated with the abnormal monitoring data f is {score i: 76, score e: 68, score g: 68, score h: 68}.

[0188] Step S504: Take the average of the first weighted score to obtain the comprehensive impact score.

[0189] The comprehensive impact score is obtained by averaging the first weighted score corresponding to the abnormal monitoring data.

[0190] For example, the average of the first weighted scores associated with abnormal monitoring data f is 70, meaning the overall impact score corresponding to abnormal monitoring data f is 70. The average of the first weighted scores associated with abnormal monitoring data g is 66, meaning the overall impact score corresponding to abnormal monitoring data g is 66. The average of the first weighted scores associated with abnormal monitoring data h is 80, meaning the overall impact score corresponding to abnormal monitoring data h is 80.

[0191] Step S505: Obtain the second sorting of abnormal monitoring data based on the comprehensive impact score.

[0192] After obtaining the comprehensive impact score, the abnormal monitoring data corresponding to the comprehensive impact score are sorted in descending order to obtain the second sort of abnormal monitoring data.

[0193] For example, the comprehensive impact score corresponding to abnormal monitoring data f is 70, the comprehensive impact score corresponding to abnormal monitoring data g is 66, and the comprehensive impact score corresponding to abnormal monitoring data h is 80. Therefore, the second ranking is abnormal monitoring data h, abnormal monitoring data f, and abnormal monitoring data g.

[0194] Step S506: Obtain a comprehensive sort based on the first and second sorts.

[0195] The first ranking represents the order of different actual business operations within the anomaly data monitoring, reflecting the importance of each actual business operation among several related to a single anomaly monitoring data point. The second ranking represents the order of different anomaly monitoring data points, reflecting the priority of the impact of each anomaly event. Therefore, the comprehensive ranking refers to a combined ranking of the anomaly monitoring data and the actual business operations associated with it.

[0196] The first sort can be a sub-sort of the second sort. For example, the second sort is abnormal monitoring data h, abnormal monitoring data f, and abnormal monitoring data g. The first sort includes: the sorting of the actual business associated with abnormal monitoring data f (i, e, g, h), the sorting of the actual business associated with abnormal monitoring data g (i, e), and the sorting of the actual business associated with abnormal monitoring data h (f). Therefore, the comprehensive sort is abnormal monitoring data (f), abnormal monitoring data f(i, e, g, h), and abnormal monitoring data g(i, e).

[0197] Step S507: Update the sorting of the abnormal monitoring data in the abnormal event list using comprehensive sorting.

[0198] After obtaining the overall ranking, the identifier ID of the abnormal monitoring data is extracted, and a sorting number field is added to the abnormal monitoring data according to the overall ranking. The corresponding abnormal monitoring data is found in the abnormal event list by the identifier ID, and the abnormal monitoring data in the abnormal event list is updated using the abnormal monitoring data with the added sorting number. The abnormal event list can automatically sort the abnormal monitoring data according to the sorting number field.

[0199] By adopting the above technical solution, a business impact score of the actual business is obtained, and weighted according to the anomaly type corresponding to the actual business to obtain a first weighted score. After averaging the first weighted score, a second comprehensive impact score of the actual anomaly monitoring is obtained. The anomaly monitoring data is then sorted according to the comprehensive impact score to obtain a second ranking. In addition, the second ranking of the actual business associated with each anomaly monitoring data is obtained according to the business impact score. The second ranking is used as a sub-ranking of the first ranking to obtain a comprehensive ranking. The ranking of the anomaly monitoring data in the anomaly event list is updated according to the comprehensive ranking. This ensures that when an anomaly monitoring data is associated with multiple actual businesses, the anomaly monitoring data corresponding to the actual business with a greater impact can be located at the top of the anomaly event list, and thus appear at the top of the operation and maintenance data view, so that operation and maintenance personnel can handle it first.

[0200] Reference Figure 6This application provides a method for displaying abnormal information, the method including:

[0201] Step S601: In the operation and maintenance data view, locate the resource node corresponding to the abnormal monitoring data based on the resource identifier.

[0202] Resource nodes are visual representations of operational objects within the operational data view. They are presented in an interactive graphical format, supporting user clicks, hover views, and linked navigation. Each resource node has a unique resource ID, and a mapping relationship exists between resource IDs and resource identifiers. This mapping relationship is manually configured by developers. By searching based on the resource identifier, the resource node corresponding to the abnormal monitoring data can be located within the operational view.

[0203] Step S602: Add an anomaly display icon corresponding to the anomaly monitoring data in the resource node.

[0204] Anomaly display icons are visual identifiers attached to resource nodes to indicate whether an anomaly exists on that resource node. These icons are interactive; when a user hovers over them, they display brief information about the corresponding anomaly monitoring data, such as resource identifier, anomaly type, business impact score, and overall impact score. Clicking the icon takes the user to a detailed analysis interface for the anomaly monitoring data, containing comprehensive information about the anomaly.

[0205] Step S603: Update the anomaly display icon based on the comprehensive impact score and using preset color coding rules.

[0206] The preset color coding rules refer to the rules for configuring the colors of the anomaly display icon, which can be manually configured by administrators or developers. For example, when the overall impact score is (85, 100), the anomaly display icon can be configured as red; when the overall impact score is (70, 84), the anomaly display icon can be configured as orange; when the overall impact score is (60, 69), the anomaly display icon can be configured as yellow; and when the overall impact score is (0, 60), the anomaly display icon can be configured as blue.

[0207] For example, on resource node "Network Switch-B0010", there is currently associated abnormal monitoring data. The abnormality type is "High Network Latency", the associated service is "High-Concurrency Video Playback Service", the service level score is 80, the abnormality type score is 65, and the calculated comprehensive impact score is 71. At this time, the abnormality display icon is orange. If the network latency is subsequently detected to have recovered and the comprehensive impact score drops to 58, the abnormality display icon will automatically be updated to blue.

[0208] By adopting the above technical solution, in the operation and maintenance data view, the resource node corresponding to the abnormal monitoring data is located according to the resource identifier, and an abnormal display icon is added to the resource node. The icon is updated and displayed by combining the comprehensive impact score and using the preset color coding rules. This makes the resource node more obvious in the operation and maintenance data view when an abnormal state occurs, which helps operation and maintenance personnel to discover and deal with it in a timely manner.

[0209] In the following embodiments, after the operation and maintenance personnel have processed the abnormal event according to the operation and maintenance data view, similar abnormal events may occur during the subsequent operation of the system. In order to facilitate rapid processing after similar abnormal events occur, this application embodiment provides an abnormal recording method, referring to... Figure 7 The method includes:

[0210] Step S701: Receive processing operation information from the user module.

[0211] Operation processing information refers to the processing data generated when the operation and maintenance personnel corresponding to the user module handle anomalies based on anomaly monitoring data, such as operation type, operation time, operation result, and processing remarks. This processing data can also be obtained from logs and records uploaded by operation and maintenance personnel.

[0212] Step S702: Parse the processing operation information to obtain the parsing result, which includes the operation type, operation time, and operation result.

[0213] After obtaining the processing operation information, the processing operation information is semantically decomposed and format standardized to extract feature values, thereby obtaining the parsing results, including operation type (such as restart, clean, replace, adjust, etc.), operation time (time stamp of the processing behavior), and operation result (success / failure / partial completion).

[0214] Step S703: Generate operation and maintenance processing records based on the parsing results.

[0215] Operation and maintenance processing records refer to standardized data records generated based on processing operation information fed back by user modules.

[0216] After obtaining the parsing results, the record generation interface provided by the operation and maintenance log module is called to fill in fields such as operation type, operation time, and operation result in the parsing results, and attach the current operator ID and resource identification information of the abnormal monitoring data. This information is then uniformly encapsulated into an operation and maintenance processing record and stored in the database.

[0217] Step S704: Associate the operation and maintenance records with the corresponding anomaly monitoring data to form an event processing chain.

[0218] An event processing chain refers to the chain formed by associating operation and maintenance records with corresponding abnormal monitoring data. The operation and maintenance records contain an operation and maintenance record ID, and the identifier ID of the abnormal monitoring data is mapped to the operation and maintenance record ID, thereby associating the operation and maintenance records with the abnormal monitoring data to form an event processing chain.

[0219] Step S705: Store the event handling chain in the preset database.

[0220] The default database refers to a database predefined and configured during the deployment phase of the maintenance platform for long-term storage of operation and maintenance information and anomaly monitoring data. After obtaining the event handling chain, the event handling chain is formatted, for example, converted into a JSON object, and then written to the default database.

[0221] By adopting the above technical solution, the process of operation and maintenance personnel handling anomalies can be recorded, linked with anomaly monitoring data, forming a complete event handling chain, and stored in the database. This provides a reference for encountering the same or similar anomalies in the future, thereby improving the efficiency and accuracy of operation and maintenance work.

[0222] Based on the same inventive concept, embodiments of this application provide an operating system for an operation and maintenance platform, comprising:

[0223] The acquisition module is used to acquire monitoring data;

[0224] Memory, used to store programs that specify how the operation and maintenance platform should run;

[0225] The processor is the method by which programs in memory can be loaded and executed by the processor to implement the operation and maintenance platform.

[0226] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0227] This application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and execute a method for operating an operation and maintenance platform.

[0228] Computer storage media include, for example, USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media that can store program code.

[0229] Based on the same inventive concept, embodiments of this application provide a smart terminal, including a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed to run a method of the platform.

[0230] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0231] The above are all preferred embodiments of this application and are not intended to limit the scope of protection of this application. Any feature disclosed in this specification (including the abstract and drawings) may be replaced by other equivalent or similar features unless specifically stated otherwise. That is, unless specifically stated otherwise, each feature is only one example of a series of equivalent or similar features.

Claims

1. A method for operating an operation and maintenance platform, characterized in that, include: Real-time acquisition of monitoring data for objects under operation and maintenance; The monitoring data is standardized to obtain unified monitoring data; An operation and maintenance data view is generated based on the unified monitoring data; Real-time detection of whether the unified monitoring data meets preset standard thresholds; If not, then the unified monitoring data that does not meet the preset standard threshold will be marked to obtain abnormal monitoring data; Update the operation and maintenance data view using the aforementioned anomaly monitoring data; The user role to be pushed to is determined based on the abnormal monitoring data. The operation and maintenance data view is pushed to the user module corresponding to the user role to be pushed, so that the updated operation and maintenance data view is displayed on the user module. Obtain the abnormal attribute information of the abnormal monitoring data, the abnormal attribute information including resource identifier, abnormal type and generation time; Within a preset time window, determine whether there is any abnormal monitoring data in the cache that has the same resource identifier and abnormal type as the current abnormal monitoring data; If not, the current abnormal monitoring data is written to the abnormal event list; If so, retrieve the earliest occurrence of the abnormal monitoring data in the cache that has the same resource identifier and abnormal type as the current abnormal monitoring data, and obtain the earliest abnormal monitoring data; Determine whether the difference between the generation time of the current abnormal monitoring data and the generation time of the earliest abnormal monitoring data is greater than a preset time interval; If the value is greater than the specified value, the current abnormal monitoring data will be written into the abnormal event list. If it is not greater than, then the earliest abnormal monitoring data is written into the abnormal event list; Update the operations and maintenance data view using the list of exception events.

2. The method for operating an operation and maintenance platform according to claim 1, characterized in that, The method further includes: Based on the resource identifier and the anomaly type, the abnormal monitoring data in the abnormal event list are aggregated and analyzed to obtain the occurrence frequency. The occurrence frequency refers to the number of times abnormal monitoring data with the same resource identifier and the same anomaly type occur within a preset period. Determine whether the occurrence frequency is greater than a preset high-frequency threshold; If the frequency is greater than the specified frequency, the abnormal monitoring data corresponding to the frequency of occurrence will be marked as high-frequency alarm data. Add a severity level field to the high-frequency alarm data; Update the list of abnormal events using the high-frequency alarm data after adding the severity level field; Update the operations and maintenance data view with the updated list of exception events.

3. The method for operating an operation and maintenance platform according to claim 2, characterized in that, The method further includes: Based on a preset business graph, obtain the actual business associated with the abnormal monitoring data in the abnormal event list; Obtain the business level of the actual business; The number of actual services associated with each of the current abnormal monitoring data is counted to obtain the number of services; Determine whether the number of the stated services is not greater than one; If not, the abnormal monitoring data shall be sorted according to the preset sorting method; If so, then a weighted score is obtained for each actual business based on the business level and the anomaly type. The weighted impact score is used to update the sorting of the abnormal monitoring data in the list of abnormal events.

4. The method for operating an operation and maintenance platform according to claim 3, characterized in that, The step of sorting the abnormal monitoring data according to a preset sorting method includes: Based on the business level, obtain the business impact score of the actual business; The first ranking of the actual business is obtained based on the business impact score; The first weighted score is obtained by weighting the anomaly type and business impact score corresponding to each actual business; The average value of the first weighted score is used to obtain the comprehensive impact score. The second sorting of the abnormal monitoring data is obtained based on the comprehensive impact score; A comprehensive sort is obtained based on the first sort and the second sort; The sorting of the abnormal monitoring data in the abnormal event list is updated using the comprehensive sorting.

5. The method for operating an operation and maintenance platform according to claim 4, characterized in that, The method further includes: In the operation and maintenance data view, the resource node corresponding to the abnormal monitoring data is located based on the resource identifier; Add an anomaly display icon corresponding to the anomaly monitoring data to the resource node; The anomaly display icon is updated based on the comprehensive impact score and using preset color coding rules.

6. The method for operating an operation and maintenance platform according to claim 1, characterized in that, The method further includes: Receive processing operation information fed back by the user module; The processing operation information is parsed to obtain a parsing result, which includes the operation type, operation time, and operation result. Based on the analysis results, an operation and maintenance processing record is generated; The operation and maintenance records are associated with the corresponding abnormal monitoring data to form an event processing chain; The event handling chain is stored in a preset database.

7. An operation system for an operation and maintenance platform, characterized in that, The system is used to execute the operation method of the operation and maintenance platform as described in any one of claims 1 to 6, including: The acquisition module is used to acquire monitoring data; A memory for storing programs containing the operating methods of the operation and maintenance platform; The processor and memory programs can be loaded and executed by the processor to implement the operation and maintenance platform's operating method.

8. A server, characterized in that, The server runs an operation and maintenance platform. The server includes a memory and a processor. The memory stores a computer program that can be loaded by the processor and executed according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1 to 6.

Images