Database alarm positioning method, device, equipment, medium and product

Abstract

The invention discloses a database alarm positioning method, device and equipment, a medium and a product. The method comprises the following steps: when a real-time alarm event in a target database is monitored, obtaining real-time operation data of each database node in the target database; performing event analysis on the real-time alarm event to obtain a first event feature keyword of the real-time alarm event; performing data analysis on each piece of real-time operation data to obtain a first key data index corresponding to each piece of real-time operation data; determining a target alarm path of the real-time alarm event based on a pre-constructed target alarm positioning knowledge graph according to the first event feature keyword and each first key data index; and determining alarm positioning information of the real-time alarm event according to the target alarm path. According to the scheme of the embodiment, path reasoning and positioning identification of the alarm event can be realized according to the pre-constructed alarm positioning knowledge graph, and the identification efficiency and accuracy of the database alarm event are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database, and particularly relates to a database alarm positioning method, device, equipment, medium and product. BACKGROUND

[0002] With the popularity of cloud computing and big data technology, distributed databases have become the infrastructure of enterprise core data management. The data stored in the distributed database often presents an "island" feature, and it is difficult to effectively analyze the alarm events that occur.

[0003] At present, for the alarm events that occur in the distributed database, most of them depend on the manual experience of database operation and maintenance personnel to determine the node position of the alarm events that may occur in the database. When determining the node position of the alarm events by manual means, it is limited to the regular parameter settings of the database and the active alarm events of the database, and the degree of utilization of the key indicator data in the distributed database is insufficient, lacking joint analysis and correlation analysis. That is, when an alarm event occurs in the distributed database, the operation and maintenance personnel usually maintain at a shallow level of the database, and cannot deeply mine the root cause of the problem, making it difficult to meet the needs of quickly positioning and recovering the alarm event position in the complex scenario of the distributed database.

[0004] Therefore, how to realize the path reasoning and positioning identification of the alarm event, and improve the identification efficiency and accuracy of the database alarm event, has become a problem that needs to be solved by the technical personnel in the field. SUMMARY

[0005] The present application provides a database alarm positioning method, device, equipment, medium and product to realize the path reasoning and positioning identification of the alarm event, and improve the identification efficiency and accuracy of the database alarm event.

[0006] According to an aspect of the present application, a database alarm positioning method is provided, comprising:

[0007] When a real-time alarm event in a target database is monitored, real-time running data of each database node in the target database is obtained;

[0008] The real-time alarm event is event-analyzed to obtain a first event feature keyword of the real-time alarm event, and each real-time running data is data-analyzed to obtain a first key data indicator corresponding to each real-time running data;

[0009] According to the first event feature keyword and each first key data indicator, a target alarm path of the real-time alarm event is determined based on a pre-constructed target alarm positioning knowledge graph;

[0010] According to the target alarm path, alarm positioning information of the real-time alarm event is determined.

[0011] According to another aspect of the present application, a database alarm positioning apparatus is provided, comprising:

[0012] A running data acquisition module is configured to acquire real-time running data of each database node in a target database when a real-time alarm event in the target database is monitored.

[0013] An analysis module is configured to perform event analysis on the real-time alarm event to obtain a first event characteristic keyword of the real-time alarm event, and perform data analysis on each real-time running data to obtain a first key data index corresponding to each real-time running data.

[0014] An alarm path acquisition module is configured to determine a target alarm path of the real-time alarm event based on a pre-constructed target alarm positioning knowledge graph according to the first event characteristic keyword and each first key data index.

[0015] An alarm positioning information determination module is configured to determine alarm positioning information of the real-time alarm event according to the target alarm path.

[0016] According to another aspect of the present application, an electronic device is provided, comprising:

[0017] at least one processor; and

[0018] a memory in communication with the at least one processor; wherein

[0019] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the database alarm positioning method according to any one of the embodiments of the present application.

[0020] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to implement the database alarm positioning method according to any one of the embodiments of the present application when executed by the processor.

[0021] According to another aspect of the present application, a computer program product is provided, which comprises a computer program for implementing the database alarm positioning method according to any one of the embodiments of the present application when executed by a processor.

[0022] The technical scheme of the embodiment of the present application, when the real-time alarm event in the target database is monitored, the real-time running data of each database node in the target database is acquired; the real-time alarm event is analyzed to obtain the first event characteristic keyword of the real-time alarm event; and the data analysis is performed on each real-time running data to obtain the first key data index corresponding to each real-time running data respectively; according to the first event characteristic keyword and each first key data index, the target alarm path of the real-time alarm event is determined based on the pre-constructed target alarm positioning knowledge graph; and according to the target alarm path, the alarm positioning information of the real-time alarm event is determined. The embodiment scheme can realize the path reasoning and positioning identification of the alarm event according to the monitored alarm event and the acquired real-time running data and based on the pre-constructed alarm positioning knowledge graph, and the identification efficiency and accuracy of the database alarm event are improved.

[0023] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0025] Figure 1 is a flow chart of a database alarm positioning method according to the first embodiment of the present application;

[0026] Figure 2 is a flow chart of a database alarm positioning method according to the second embodiment of the present application;

[0027] Figure 3 is a structural schematic diagram of a database alarm positioning device according to the third embodiment of the present application;

[0028] Figure 4 is a structural schematic diagram of an electronic device for implementing the database alarm positioning method of the embodiment of the present application. DETAILED DESCRIPTION

[0029] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of embodiments of the present application, rather than all embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work should fall within the protection scope of the present application.

[0030] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in other than the order illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a list of steps or units need not be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to such processes, methods, products or devices.

[0031] Embodiment one

[0032] Figure 1 A flowchart of a database alarm positioning method is provided for the first embodiment of the present application. The present embodiment can be applicable to the case that the utilization of the key indicator data of the database is insufficient, and the positioning efficiency of the alarm event is low and the accuracy is poor. The method can be executed by a database alarm positioning device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device. As shown in the figure, the method comprises: Figure 1

[0033] S110, when a real-time alarm event in the target database is monitored, real-time running data of each database node in the target database is acquired.

[0034] The real-time alarm event can be an abnormal condition in the database that affects the performance of the database, and can specifically include a connection alarm event, such as a database connection number exceeding a limit, a storage alarm event, such as insufficient disk space, and a transaction error alarm event, such as transaction rollback and deadlock.

[0035] ​The real-time running data can include CPU (Central Processing Unit) usage, memory occupation, disk space, network traffic, process state, log information, and the like. Specifically, when a real-time alarm event in the database is monitored, running data of each database node in the database at a time stamp of the alarm time can be acquired according to the time stamp. For example, the real-time alarm event can be a data write failure or insufficient disk storage space, and the acquired running data can include process state and log information of data writing, disk space, and network traffic.

[0036] S120, performing event analysis on the real-time alarm event to obtain first event feature keywords of the real-time alarm event, and performing data analysis on each real-time running data to obtain first key data indicators corresponding to each real-time running data, respectively.

[0037] The event feature keywords can be data phrases that can be used to describe and extract specific event information of the alarm event, and the key data indicators can be data points in the running data that can be used to measure and evaluate the alarm event.

[0038] The event analysis can specifically preprocess alarm event information in the acquired real-time alarm event, and the preprocessing can specifically include classification analysis and formatting processing, so that the obtained event information can be identified and can serve as data support for alarm event analysis, and first event feature keywords in the real-time alarm event information are obtained. For example, continuing the above example, if the real-time alarm event is a data write failure or insufficient disk storage space, the first event feature keywords of the real-time alarm event can include write failure and insufficient space by performing classification analysis and formatting processing on the alarm event information in the real-time alarm event.

[0039] The first key data indicators can be data indicators in the real-time running data that can be associated with the alarm event. Specifically, the acquired real-time running data of each database node can be classified and formatted according to the monitored real-time alarm event, so that the first key data indicators in the real-time running data that are associated with the real-time alarm event are obtained. For example, continuing the above example, if the acquired real-time running data of each data node includes process state and log information of data writing, disk space, and network traffic, the first key data indicators associated with the real-time alarm event can include process state and disk space.

[0040] S130, determining a target alarm path of the real-time alarm event based on a pre-constructed target alarm positioning knowledge graph according to the first event feature keywords and the first key data indicators.

[0041] The target alarm positioning knowledge graph can be a structured data tool for positioning an event source of an alarm event.

[0042] The alarm path can be a generation path of the alarm event, and can specifically include an alarm event phenomenon node, an event auxiliary factor node, and an event root cause node. The target alarm path can be a propagation path between the alarm event phenomenon node and the event root cause node of the real-time alarm event. The event auxiliary factor node can be an intermediate node that plays an auxiliary role in the alarm propagation path of the alarm event, and the event root cause node can indicate a root cause of the alarm event. For example, the real-time alarm event is "a database instance on a certain server has high CPU utilization", and the alarm event phenomenon node in the real-time alarm event can be high CPU utilization, the event auxiliary factor node can be increased network delay, and the event root cause node can be insufficient memory. Specifically, the first event feature keyword and the first key data indicator obtained can be mapped to nodes in the target alarm positioning knowledge graph, and an association relationship between the nodes can be established to obtain a topology structure of the alarm event positioning knowledge graph of the real-time alarm event. According to the obtained topology structure of the alarm event positioning knowledge graph of the real-time alarm event, the alarm path of the real-time alarm event can be obtained. It should be noted that the alarm path can be a directed sequence composed of multiple nodes and association relationships between the nodes, indicating that from any alarm event phenomenon node, a complete reasoning chain can be traced to the event root cause node through a plurality of event auxiliary factor nodes.

[0043] S140, determining alarm positioning information of the real-time alarm event according to the target alarm path.

[0044] The alarm positioning information can include an alarm event generation node and an alarm impact range. Specifically, the alarm path of the real-time alarm event can be tracked according to a relationship reasoning mechanism in the knowledge graph to identify the event root cause node of the real-time alarm event, thereby forming an alarm diagnosis suggestion output of the real-time alarm event. The alarm diagnosis suggestion output can include an alarm event generation node, an alarm impact range, and an alarm recommended repair measure.

[0045] An optional solution of this embodiment can be combined with one or more solutions in this embodiment. Optionally, the construction process of the target alarm positioning knowledge graph includes: obtaining at least one historical alarm event and its corresponding historical running data of the target database in a historical time period, and obtaining the association relationship between each historical alarm event and its corresponding historical running data; performing event analysis on each historical alarm event to obtain the second event feature keyword of each historical alarm event; and performing data analysis on each historical running data of the corresponding historical alarm event to obtain the second key data index of each historical running data; obtaining the event triple of the corresponding historical alarm event according to the second event feature keyword and the second key data index of the corresponding historical alarm event, and the association relationship between the corresponding historical alarm event and its corresponding historical running data; and generating the target alarm positioning knowledge graph according to the event triple of each historical alarm event.

[0046] Among them, the different historical alarm events and the historical running data corresponding to each historical alarm event of the data in the historical time period can be obtained, and the association relationship between each historical alarm event and the historical running data can be obtained. The association relationship between the specific historical alarm event and the historical running data can be directly queried.

[0047] Among them, the existing alarm event records in the target database can be cleaned and standardized to obtain the second event feature keyword in the historical alarm event. At the same time, the historical running data corresponding to each historical alarm event can be classified and analyzed and formatted to obtain the second key index data in the historical running data. Further, the obtained second event feature keyword and second key index data can be input into the knowledge graph system, and the association relationship between the second event feature keyword and the second key index data is used to construct the event triple of the historical alarm event. According to the event triple of each historical alarm event, the target alarm positioning knowledge graph is constructed to form the data structure of the event node and the alarm path of the historical alarm event.

[0048] The technical scheme of the embodiment of the application, when a real-time alarm event in a target database is monitored, real-time running data of each database node in the target database is acquired; the real-time alarm event is analyzed to obtain a first event characteristic keyword of the real-time alarm event; and each real-time running data is analyzed to obtain a first key data index corresponding to each real-time running data respectively; according to the first event characteristic keyword and each first key data index, a target alarm path of the real-time alarm event is determined based on a pre-constructed target alarm positioning knowledge graph; and according to the target alarm path, alarm positioning information of the real-time alarm event is determined. The embodiment scheme can realize path reasoning and positioning identification of an alarm event based on the pre-constructed alarm positioning knowledge graph according to the monitored alarm event and the acquired real-time running data, and the identification efficiency and accuracy of a database alarm event are improved.

[0049] Embodiment two

[0050] Figure 2 A flowchart of a database alarm positioning method provided by the second embodiment of the application, the embodiment is further optimized on the basis of the above-mentioned embodiment.

[0051] Further, the step of "determining the target alarm path of the real-time alarm event based on the pre-constructed target alarm positioning knowledge graph according to the first event characteristic keyword and each first key data index" is refined as "constructing a current alarm positioning knowledge graph of the real-time alarm event according to the first event characteristic keyword and each first key data index; performing alarm path matching on the pre-constructed target alarm positioning knowledge graph according to the current alarm positioning knowledge graph to obtain an alarm path matching result; and determining the target alarm path of the real-time alarm event according to the alarm path matching result." to perfect the positioning mode of the database alarm. As shown in the following formula (I), the method comprises: Figure 2

[0052] S210, when a real-time alarm event in a target database is monitored, real-time running data of each database node in the target database is acquired.

[0053] S220, the real-time alarm event is analyzed to obtain a first event characteristic keyword of the real-time alarm event; and each real-time running data is analyzed to obtain a first key data index corresponding to each real-time running data respectively.

[0054] S230, a current alarm positioning knowledge graph of the real-time alarm event is constructed according to the first event characteristic keyword and each first key data index.

[0055] ​The current alarm positioning knowledge graph can be constructed according to event information of a real-time alarm event, and is a knowledge data graph for positioning an alarm position. Specifically, the first event feature keyword of the obtained real-time alarm event and the first key data index corresponding to each real-time running data can be mapped to a node in the data graph, and a positioning knowledge graph of the real-time alarm event can be constructed according to the association relationship between the real-time alarm event and the real-time running data.

[0056] In S240, the target alarm positioning knowledge graph constructed in advance is matched with the current alarm positioning knowledge graph to obtain an alarm path matching result.

[0057] Specifically, the positioning knowledge graph of the real-time alarm event can be matched with the target alarm positioning knowledge graph constructed in advance. The specific matching method can be a graph traversal algorithm, a rule matching mechanism or a graph neural network, and the event phenomenon node of the real-time alarm event can be used as a starting point to obtain the event root cause node of the real-time alarm event through the event auxiliary factor node of the real-time alarm event, so as to obtain the alarm path result of the real-time alarm event.

[0058] Optionally, the target alarm positioning knowledge graph constructed in advance is matched with the current alarm positioning knowledge graph to obtain an alarm path matching result, including: determining at least one candidate alarm path corresponding to the real-time alarm event according to the current alarm positioning knowledge graph; matching each candidate alarm path with a reference alarm path in the target alarm positioning knowledge graph constructed in advance to obtain a path similarity between each candidate alarm path and each reference alarm path; and determining the alarm path matching result according to the path similarity.

[0059] The candidate alarm path can be a possible propagation path between the alarm event phenomenon node and the event root cause node. Specifically, the alarm event can include multiple event auxiliary factor nodes and multiple event root cause nodes, and the multiple event auxiliary factor nodes and the multiple event root cause nodes included in the alarm event can be sequentially imported into the nodes in the knowledge graph to construct a possible event alarm path in the knowledge graph.

[0060] The reference alarm path can be a propagation path from the alarm event phenomenon node to the event root cause node obtained from a historical alarm event, and can be obtained according to the historical alarm event and the running data of each data node corresponding to the historical alarm event.

[0061] Further, the obtained possible event alarm path can be matched with the reference alarm path in the target alarm positioning knowledge graph in sequence, and the similarity between the possible alarm path and the reference alarm path is obtained, and according to the obtained similarity, the alarm path matching result of the real-time alarm event is determined. For example, according to the alarm event phenomenon node, the event auxiliary factor node and the event root cause node of the real-time alarm event, it can be determined that the candidate alarm path includes path A, path B and path C, and each candidate path is matched with the reference alarm path for similarity, and the alarm path matching result is obtained, wherein the path similarity between path A and the reference path can be 85%, the path similarity between path B and the reference path can be 55%, and the path similarity between path C and the reference path can be 10%. The present embodiment does not make specific limitation.

[0062] S250, determining the target alarm path of the real-time alarm event according to the alarm path matching result.

[0063] Specifically, the target alarm path of the real-time alarm event can be determined from the candidate alarm path according to the alarm path matching result. For example, as in the above example, the path similarity between path A and the reference path in the candidate alarm path can be 90%, the path similarity between path B and the reference path can be 43%, and the path similarity between path C and the reference path can be 10%. Therefore, the candidate path A can be determined as the target alarm path of the real-time alarm event.

[0064] Optionally, the target alarm path of the real-time alarm event is determined according to the alarm path matching result, including: determining whether there is a matching alarm path matched with the real-time alarm event in the target alarm positioning knowledge graph according to the alarm path matching result; if yes, determining the target alarm path of the real-time alarm event according to the matching alarm path and based on the first event feature keyword and the first key data index.

[0065] According to the path matching result, the path similarity between the possible alarm path of the real-time alarm event and the reference alarm path in the target alarm positioning knowledge graph can be obtained, and the matching alarm path matched with the real-time alarm event can be determined according to the path similarity, such as the path similarity is not less than 70%. Therefore, it can be determined that there is a matching alarm path matched with the real-time alarm event in the target alarm positioning knowledge graph. Specifically, the path similarity can match the alarm event phenomenon node, the event auxiliary factor node and the event root cause node in the candidate alarm path of the real-time alarm event with the reference alarm event phenomenon node, the reference event auxiliary factor node and the reference event root cause node in the reference alarm path, and the matching result between the nodes is calculated according to the matching result.

[0066] Further, when it is determined that there is a matching alarm path in the target alarm positioning knowledge graph that matches the real-time alarm event, the first event feature keyword and the first key data indicator of the real-time alarm event can be imported into the node in the matching alarm path, so as to obtain the target alarm path of the real-time alarm event.

[0067] Optionally, after determining whether there is a matching alarm path in the target alarm positioning knowledge graph that matches the real-time alarm event according to the alarm path matching result, the method further includes: if the target alarm positioning knowledge graph does not contain a matching alarm path that matches the real-time alarm event, updating the target alarm positioning knowledge graph by using the first event feature keyword and the first key data indicator.

[0068] Specifically, when it is determined that there is no matching alarm path in the target alarm positioning knowledge graph that matches the real-time alarm event, the first event feature keyword and the first key data indicator can be obtained in combination with the association relationship between the real-time alarm event and the real-time running data to obtain an event triple of the real-time alarm event. Further, the obtained event triple of the real-time alarm event is imported into the target alarm positioning knowledge graph to update the target alarm positioning knowledge graph.

[0069] S260, determining alarm positioning information of the real-time alarm event according to the target alarm path.

[0070] The technical scheme of the embodiment of the application can construct a current alarm positioning knowledge graph of a real-time alarm event according to the first event feature keyword and the first key data indicators, perform alarm path matching on a target alarm positioning knowledge graph constructed in advance according to the current alarm positioning knowledge graph to obtain an alarm path matching result, determine a target alarm path of the real-time alarm event according to the alarm path matching result, and determine alarm positioning information of the real-time alarm event according to the target alarm path. The technical scheme can obtain a current alarm positioning knowledge graph of a real-time alarm event according to the obtained first event feature keyword of the real-time alarm event and the first key data indicators of the real-time running data, and perform matching with a target alarm positioning knowledge graph, so as to determine alarm positioning information of the real-time alarm event, realize intelligent perception, path reasoning and root cause identification of an alarm event in a distributed database system, and further improve the accuracy and efficiency of alarm event positioning.

[0071] Embodiment Three

[0072] Figure 3A structural schematic diagram of a database alarm positioning device provided by Embodiment Three of the present application. The database alarm positioning device provided by the present application can be used to improve the efficiency and accuracy of positioning alarm events in the case of insufficient utilization of key indicator data of a database. The database alarm positioning device can be realized in the form of hardware and / or software, as shown in the figure, and specifically includes a running data acquisition module 310, an analysis module 320, an alarm path acquisition module 330, and an alarm positioning information determination module 340. Among them, Figure 3

[0073] The running data acquisition module 310 is configured to acquire real-time running data of each database node in the target database when a real-time alarm event in the target database is monitored.

[0074] The analysis module 320 is configured to perform event analysis on the real-time alarm event to obtain a first event feature keyword of the real-time alarm event; and perform data analysis on each real-time running data to obtain a first key data indicator corresponding to each real-time running data.

[0075] The alarm path acquisition module 330 is configured to determine a target alarm path of the real-time alarm event based on a pre-constructed target alarm positioning knowledge graph according to the first event feature keyword and each first key data indicator.

[0076] The alarm positioning information determination module 340 is configured to determine alarm positioning information of the real-time alarm event according to the target alarm path.

[0077] The present scheme can realize path reasoning and positioning recognition of alarm events based on a pre-constructed alarm positioning knowledge graph according to the monitored alarm event and the acquired real-time running data, thereby improving the recognition efficiency and accuracy of database alarm events.

[0078] Optionally, the alarm path acquisition module 330 includes:

[0079] An alarm positioning knowledge graph construction unit is configured to construct a current alarm positioning knowledge graph of the real-time alarm event according to the first event feature keyword and each first key data indicator.

[0080] An alarm path matching unit is configured to perform alarm path matching on a pre-constructed target alarm positioning knowledge graph according to the current alarm positioning knowledge graph to obtain an alarm path matching result.

[0081] A target alarm path determination unit is configured to determine a target alarm path of the real-time alarm event according to the alarm path matching result.

[0082] ​Optionally, the alarm path matching unit is specifically used to determine at least one candidate alarm path corresponding to the real-time alarm event based on the current alarm location knowledge graph.

[0083] Each candidate alarm path is matched with a reference alarm path in a pre-constructed target alarm location knowledge graph to obtain the path similarity between each candidate alarm path and each reference alarm path.

[0084] The alarm path matching result is determined based on the path similarity.

[0085] Optionally, the target alarm path determination unit includes:

[0086] The alarm path matching subunit is used to determine, based on the alarm path matching result, whether there is a matching alarm path in the target alarm location knowledge graph that matches the real-time alarm event;

[0087] The target alarm path determination subunit is used to determine the target alarm path of the real-time alarm event based on the matching alarm path and the first event feature keywords and the first key data indicators if it is determined that there is a matching alarm path in the target alarm location knowledge graph that matches the real-time alarm event.

[0088] Optionally, the target alarm path determination subunit is further configured to, after determining whether there is a matching alarm path matching the real-time alarm event in the target alarm location knowledge graph based on the alarm path matching result, update the target alarm location knowledge graph using the first event feature keywords and the first key data indicators if the target alarm location knowledge graph does not contain a matching alarm path matching the real-time alarm event.

[0089] Optionally, the device also includes a target alarm location knowledge graph construction module;

[0090] The target alarm location knowledge graph construction module is used to obtain at least one historical alarm event and its corresponding historical operation data in the target database under a historical time period, and to obtain the association relationship between each historical alarm event and its corresponding historical operation data.

[0091] Event analysis is performed on each of the historical alarm events to obtain the second event feature keywords of each of the historical alarm events; and data analysis is performed on each of the historical operation data of the corresponding historical alarm events to obtain the second key data indicators of each of the historical operation data.

[0092] According to the second event feature keyword and the second key data index of the corresponding historical alarm event, and the association relationship between the corresponding historical alarm event and the corresponding historical running data, an event triple of the corresponding historical alarm event is obtained;

[0093] According to the event triples of the historical alarm events, a target alarm positioning knowledge graph is generated.

[0094] The database alarm positioning device provided in the embodiments of the present application can execute the database alarm positioning method provided in any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0095] Embodiment four

[0096] Figure 4 A structural schematic diagram of an electronic device 40 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0097] As shown in Figure 4 The electronic device 40 includes at least one processor 41, and a memory, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., which is communicatively connected to the at least one processor 41, wherein the memory stores a computer program that can be executed by the at least one processor. The processor 41 can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 into the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0098] A plurality of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a magnetic disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0099] The processor 41 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 performs various methods and processes described above, such as the database alert localization method.

[0100] In some embodiments, the database alert localization method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 48. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded onto the RAM 43 and executed by the processor 41, one or more steps of the database alert localization method described above can be performed. Alternatively, in other embodiments, the processor 41 can be configured to perform the database alert localization method by any other appropriate means, such as by means of firmware.

[0101] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0102] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer program, when executed, can cause instructions defined in the flow charts and / or block diagrams to be implemented. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, and partially on a remote machine or entirely on a remote machine or server.

[0103] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0104] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0105] The systems and techniques described herein can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described herein, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0106] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0107] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be executed in parallel, executed in series, or executed in different orders, as long as the desired results of the technical solutions of the present disclosure can be achieved, and the present disclosure is not limited herein.

[0108] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A database alarm location method, characterized in that, include: When a real-time alarm event is detected in the target database, the real-time operating data of each database node in the target database is obtained; The real-time alarm event is parsed to obtain the first event feature keyword of the real-time alarm event; Furthermore, the real-time operating data is parsed to obtain the first key data indicator corresponding to each of the real-time operating data. Based on the first event feature keywords and each of the first key data indicators, and using a pre-built target alarm location knowledge graph, the target alarm path of the real-time alarm event is determined. Based on the target alarm path, determine the alarm location information of the real-time alarm event.

2. The method according to claim 1, characterized in that, The step of determining the target alarm path of the real-time alarm event based on the first event feature keywords and each of the first key data indicators, and on a pre-constructed target alarm location knowledge graph, includes: Based on the first event feature keywords and each of the first key data indicators, construct a current alarm location knowledge graph for the real-time alarm event; Based on the current alarm location knowledge graph, alarm path matching is performed on the pre-constructed target alarm location knowledge graph to obtain alarm path matching results; Based on the alarm path matching results, the target alarm path of the real-time alarm event is determined.

3. The method according to claim 2, characterized in that, The step of performing alarm path matching on a pre-constructed target alarm location knowledge graph based on the current alarm location knowledge graph to obtain alarm path matching results includes: Based on the current alarm location knowledge graph, at least one candidate alarm path corresponding to the real-time alarm event is determined; Each candidate alarm path is matched with a reference alarm path in a pre-constructed target alarm location knowledge graph to obtain the path similarity between each candidate alarm path and each reference alarm path. The alarm path matching result is determined based on the path similarity.

4. The method according to claim 2, characterized in that, Determining the target alarm path for the real-time alarm event based on the alarm path matching result includes: Based on the alarm path matching results, determine whether there is a matching alarm path in the target alarm location knowledge graph that matches the real-time alarm event; If so, the target alarm path of the real-time alarm event is determined based on the matched alarm path and the first event feature keywords and the first key data indicators.

5. The method according to claim 4, characterized in that, After determining whether a matching alarm path exists in the target alarm location knowledge graph that matches the real-time alarm event based on the alarm path matching result, the method further includes: If the target alarm location knowledge graph does not contain a matching alarm path that matches the real-time alarm event, then the target alarm location knowledge graph is updated using the first event feature keywords and the first key data indicators.

6. The method according to claim 1, characterized in that, The process of constructing the target alarm location knowledge graph includes: Obtain at least one historical alarm event and its corresponding historical operation data from the target database within a historical time period, and obtain the correlation between each historical alarm event and its corresponding historical operation data; Event analysis is performed on each of the historical alarm events to obtain the second event feature keywords of each of the historical alarm events; and data analysis is performed on each of the historical operation data of the corresponding historical alarm events to obtain the second key data indicators of each of the historical operation data. Based on the second event feature keywords and second key data indicators of the corresponding historical alarm events, as well as the correlation between the corresponding historical alarm events and their corresponding historical operating data, the event triplet of the corresponding historical alarm events is obtained. Based on the event triples of each historical alarm event, a target alarm location knowledge graph is generated.

7. A database alarm location device, characterized in that, include: The running data acquisition module is used to acquire the real-time running data of each database node in the target database when a real-time alarm event is detected in the target database. The parsing module is used to perform event parsing on the real-time alarm event to obtain the first event feature keywords of the real-time alarm event; Furthermore, the real-time operating data is parsed to obtain the first key data indicator corresponding to each of the real-time operating data. The alarm path acquisition module is used to determine the target alarm path of the real-time alarm event based on the first event feature keywords and each of the first key data indicators, and on a pre-built target alarm location knowledge graph. The alarm location information determination module is used to determine the alarm location information of the real-time alarm event based on the target alarm path.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that is executed by the at least one processor, such that the at least one processor is able to perform the database alarm location method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the database alarm location method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the database alarm location method according to any one of claims 1-6.

Images