A service view alarm trend prediction method based on historical probe log data

Abstract

The application discloses a service view alarm trend prediction method based on historical detection log data, and comprises the following steps: S1, a data collector collects detection logs of a service view of an operation and maintenance system in real time; wherein the detection logs contain key fields of collection time, detection state and delay time; S2, the collected detection logs are persistently stored in a database as a basis for subsequent data analysis; S3, a timing task is started, and the detection logs stored in the database are summarized and analyzed according to a preset time interval to generate summarized statistical data; S4, the summarized statistical data are saved to a statistical table in the database to form historical summarized data as a data basis for alarm prediction; and S5, alarm prediction is calculated based on the historical summarized data. Corresponding systems, electronic equipment and computer readable storage media are also disclosed.

Description

Technical Field

[0001] This invention relates to the field of information technology operation and maintenance management, specifically to a method for predicting alarms in the business view of an operation and maintenance system, and particularly to a method for predicting alarm trends in the business view based on historical probe log data and through intelligent algorithms. Background Technology

[0002] With the rapid development of information technology, modern enterprise operation and maintenance systems have become increasingly complex, encompassing numerous servers, network devices, applications, and business processes. These systems generate massive amounts of monitoring data and alarm information during operation. Traditional operation and maintenance management primarily relies on monitoring tools to capture abnormal system states in real time and to handle emergencies after they occur. This approach is inherently passive and delayed; operation and maintenance personnel often only begin troubleshooting after a failure has occurred, leading to prolonged business interruptions and severely impacting normal enterprise operations.

[0003] Most common operation and maintenance management systems on the market currently adopt threshold alarm mechanisms, which trigger alarms when a certain performance indicator exceeds a preset threshold. While this method is simple and easy to use, it has the following drawbacks: First, threshold settings rely on the experience of operation and maintenance personnel and lack scientific basis; second, static thresholds cannot adapt to dynamic changes in system load, easily leading to false alarms or missed alarms; finally, this method can only provide post-event alarms and cannot achieve pre-event warnings, leaving operation and maintenance personnel in a reactive state.

[0004] Existing technologies include some machine learning-based fault prediction methods, but these methods typically require large amounts of training data, have high model complexity, consume significant computational resources, and often perform poorly in practical applications. This is especially true for alarm prediction at the business view level, which involves multiple system components and complex business logic, making prediction even more challenging. Therefore, the industry urgently needs a simple, effective, computationally efficient, and highly practical method for predicting alarms at the business view level. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and system for predicting alarm trends in business views based on historical probe log data. Based on the probe logs of previous operation and maintenance system business views, and using historical probe log data, the system accurately predicts alarm trends in business views over future time periods through intelligent algorithms. This enables early warning, improves operation and maintenance efficiency, predicts alarms in advance, reduces the troubleshooting workload of operation and maintenance personnel, increases operation and maintenance efficiency and fault handling speed, and reduces operation and maintenance costs.

[0006] This invention provides a method for predicting alarm trends in a business view based on historical probe log data, including:

[0007] S1, the data collector collects the probe logs of the operation and maintenance system's business view in real time; wherein the probe logs contain key fields such as collection time, probe status, and latency time;

[0008] S2, the collected detection logs are persistently stored in the database as the basis for subsequent data analysis;

[0009] S3, start a scheduled task to summarize and analyze the probe logs entering the database at preset time intervals and generate summary statistics;

[0010] S4, the summarized statistical data is saved to a statistical table in the database to form historical summary data, which serves as the data basis for alarm prediction;

[0011] S5, calculate alarm prediction based on the historical aggregated data.

[0012] Preferably, S1 includes:

[0013] S11, The data collector is deployed at each key node of the business system to collect availability status and performance data of the business view at a fixed frequency;

[0014] S12, During the data collection process, the data corresponding to the probe logs of the operation and maintenance system business view is initially cleaned to remove obviously abnormal data points and ensure data quality.

[0015] Preferably, the detection status includes status codes such as normal, timeout, and error; the delay time is used to record the time interval from initiating the detection to receiving the response, in milliseconds.

[0016] Preferably, the database in S2 adopts a time-series database architecture, which is optimized for time-series data and supports efficient data writing and querying; the storage includes: establishing a composite index according to fields such as business view ID and collection time to improve query efficiency; at the same time, the database has a data retention strategy to automatically clean up historical data that exceeds a certain period.

[0017] Preferably, the scheduled task of S3 is automatically triggered at 10:10 AM to aggregate and calculate the probe log data of the previous hour and generate summary statistics. The summary statistics include key indicators such as the summary time point, maximum latency, minimum latency, average latency, and probe success rate. The maximum latency is used to characterize the worst performance of the business view within the statistical period, the minimum latency characterizes the best performance, the average latency characterizes the overall performance level, and the probe success rate characterizes the availability of the business view.

[0018] Preferably, the statistical table is designed to meet the needs of data analysis. In addition to storing basic statistical indicators, it also includes metadata information such as the statistical period and the number of data samples. Data is compressed during storage to reduce storage space usage, and an appropriate data partitioning strategy is established to improve query performance.

[0019] Preferably, S5 includes:

[0020] S51, based on historical aggregated data, predict the performance of the business view at future points in time using a specific algorithm. This specific algorithm utilizes the regularity of historical data from the same period, combined with recent trends, to make predictions; for a specific point in time on a given day, the prediction algorithm is as follows:

[0021] The predicted maximum delay time is obtained by subtracting an adjustment amount from the maximum delay time at the same time last week. This adjustment amount is calculated based on the rate of change between yesterday's maximum delay time and yesterday's maximum delay time at the same time last week. The specific calculation formula is as follows:

[0022] Predicted maximum latency = Maximum latency of last week - (Maximum latency of yesterday of last week - Maximum latency of yesterday) / Maximum latency of yesterday of last week × Maximum latency of last week.

[0023] The same calculation logic is used to predict the minimum latency time:

[0024] Predicted minimum delay time = Minimum delay time of last week - (Minimum delay time of yesterday last week - Minimum delay time of yesterday) / Minimum delay time of yesterday last week × Minimum delay time of last week.

[0025] By iteratively processing all time points of the day and repeating the above calculation process, alarm prediction data for all time points throughout the day can be obtained.

[0026] S52, visualize the predicted performance results as a curve trend graph, so that operation and maintenance personnel can intuitively understand the performance change trend of the business view.

[0027] A second aspect of the present invention is to provide a business view alarm trend prediction system based on historical probe log data, comprising:

[0028] The probe log collection module (101) is used to collect probe logs from the business view of the operation and maintenance system in real time through a data collector; wherein the probe logs contain key fields such as collection time, probe status and delay time;

[0029] The probe log storage module (102) is used to persistently store the collected probe logs in the database as the basis for subsequent data analysis;

[0030] The scheduled summary and analysis module (103) is used to start a scheduled task to summarize and analyze the probe logs entering the database at preset time intervals and generate summary statistics.

[0031] The historical summary data generation module (104) is used to save the summary statistical data into a statistical table in the database to form historical summary data, which serves as the data basis for alarm prediction.

[0032] The alarm prediction module (105) is used to calculate alarm predictions based on the historical summary data.

[0033] A third aspect of the present invention provides an electronic device including a processor and a memory, the memory storing a plurality of instructions, the processor being configured to read the instructions and execute the method as described in the first aspect.

[0034] A fourth aspect of the present invention provides a computer-readable storage medium storing a plurality of instructions which can be read by a processor and executed as described in the first aspect.

[0035] The method, system, and electronic device provided by this invention have the following beneficial effects:

[0036] This method for predicting alarms in the business view of an operations and maintenance (O&M) system involves collecting and storing business view probe logs, summarizing them hourly, and using algorithms to calculate alarm prediction data for all time points of the day. This provides O&M personnel with clear alarm predictions, overcoming the pain point of delayed alarms in traditional O&M systems. It achieves centralized, efficient, stable, and timely O&M results, reducing the troubleshooting workload of O&M personnel, improving O&M efficiency, and lowering O&M costs. It has become an indispensable part of modern O&M management systems, providing companies and O&M personnel with a more efficient, convenient, and stable O&M approach. Specifically, this manifests in:

[0037] (1) Improve system stability and availability, including:

[0038] Preventing failures: By using alarm prediction, the operations team can identify potential failure modes and trends in advance, thereby predicting the timing and probability of future equipment failures. This helps the operations team take necessary preventative measures before failures occur, avoiding or minimizing the impact of failures on business operations.

[0039] Reducing business interruption: Traditional operation and maintenance models typically rely on monitoring tools to capture abnormal equipment status in real time and handle emergencies after they occur. However, this model is often reactive and delayed. Alarm prediction technology, on the other hand, can provide early warnings before failures occur, thereby effectively reducing business interruption time and improving user experience.

[0040] (2) Improve operation and maintenance efficiency and quality, including:

[0041] Intelligent Analysis: Alarm prediction technology, through built-in intelligent algorithms and models, can automatically analyze historical fault data of equipment to identify potential fault modes and trends. This eliminates the need for maintenance personnel to perform tedious manual data analysis and mining, greatly improving work efficiency.

[0042] Precise Fault Location: Alarm prediction technology helps operations and maintenance personnel quickly locate the root cause of faults, reducing troubleshooting time. By analyzing alarm information, operations and maintenance personnel can infer and understand the underlying causes from surface-level problems, thereby making quick and accurate decisions to resolve issues.

[0043] (3) Optimize resource allocation and reduce costs, including:

[0044] Develop preventative maintenance plans: Based on alarm predictions, the operations and maintenance team can develop preventative maintenance plans to regularly inspect and maintain equipment. This helps reduce equipment failures, extend equipment lifespan, and lower maintenance costs.

[0045] Rational allocation of operation and maintenance resources: Through alarm prediction, the operation and maintenance team can understand in advance which devices or systems may be at risk of failure, thereby rationally allocating operation and maintenance resources to ensure the stable operation of critical business.

[0046] (4) Enhance business continuity and competitiveness, including:

[0047] Ensuring business continuity: Alarm prediction technology helps operations teams provide early warnings and take action before failures occur, effectively ensuring business continuity. This is crucial for enterprises that rely on IT systems, as it can prevent business interruptions and losses caused by system failures.

[0048] Enhancing Competitiveness: By improving operational efficiency and quality, optimizing resource allocation, and reducing costs, alarm prediction technology helps enterprises improve overall operational efficiency and competitiveness. In the face of fierce market competition, this will become one of the key advantages for businesses. Attached Figure Description

[0049] Figure 1 This is a flowchart of the business view alarm trend prediction method based on historical detection log data as described in this invention;

[0050] Figure 2 This is a schematic diagram of the business view alarm trend prediction system based on historical detection log data as described in this invention.

[0051] Figure 3 This is a schematic diagram of the electronic device structure described in this invention. Detailed Implementation

[0052] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0053] Example 1

[0054] like Figure 1 As shown, this embodiment provides a method for predicting alarm trends in a business view based on historical probe log data, including:

[0055] S1, the data collector collects the probe logs of the operation and maintenance system's business view in real time; wherein the probe logs contain key fields such as collection time, probe status, and delay time;

[0056] In a preferred embodiment, S1 includes:

[0057] S11, the data collector is deployed at each key node of the business system to collect availability status and performance data of the business view at a fixed frequency (e.g., once per minute);

[0058] S12, During the data collection process, the data corresponding to the probe logs of the operation and maintenance system business view is initially cleaned to remove obviously abnormal data points and ensure data quality.

[0059] In a preferred embodiment, the detection status includes status codes such as normal, timeout, and error; the delay time is used to record the time interval from initiating the detection to receiving the response, in milliseconds.

[0060] S2, the collected probe logs are persistently stored in the database as the basis for subsequent data analysis.

[0061] In a preferred embodiment, the database in S2 adopts a time-series database architecture, which is optimized for time-series data and supports efficient data writing and querying; the storage includes: establishing a composite index according to fields such as business view ID and collection time to improve query efficiency; at the same time, establishing a data retention strategy to automatically clean up historical data that exceeds a certain period of time to avoid excessive growth of storage space.

[0062] S3, start a scheduled task to summarize and analyze the probe logs entering the database at preset time intervals (such as once per hour) and generate summary statistics.

[0063] As a preferred implementation, the scheduled task is automatically triggered at 10:10 AM to aggregate and calculate the probe log data from the previous hour, generating summary statistics. The summary statistics include key indicators such as the summary time point, maximum latency, minimum latency, average latency, and probe success rate. The maximum latency characterizes the worst performance of the business view within the statistical period, the minimum latency characterizes the best performance, the average latency characterizes the overall performance level, and the probe success rate characterizes the availability of the business view.

[0064] S4. The summarized statistical data is saved to a statistical table in the database to form historical summary data, which serves as the data basis for alarm prediction.

[0065] As a preferred implementation, the statistical table is designed with data analysis needs in mind. In addition to storing basic statistical indicators, it also includes metadata information such as the statistical period and the number of data samples. Data is compressed during storage to reduce storage space usage, and an appropriate data partitioning strategy is established to improve query performance.

[0066] S5, calculate alarm prediction based on the historical aggregated data.

[0067] In a preferred embodiment, S5 includes:

[0068] S51, based on historical aggregated data, uses a specific algorithm to predict the performance of the business view at future points in time. The core idea of ​​the specific algorithm is to utilize the regularity of historical data from the same period and combine it with recent trends to make predictions.

[0069] In this embodiment, the prediction algorithm for a specific time point on the same day is as follows:

[0070] The predicted maximum delay time is obtained by subtracting an adjustment amount from the maximum delay time at the same time last week. This adjustment amount is calculated based on the rate of change between yesterday's maximum delay time and yesterday's maximum delay time at the same time last week. The specific calculation formula is as follows:

[0071] Predicted maximum latency = Maximum latency of last week - (Maximum latency of yesterday of last week - Maximum latency of yesterday) / Maximum latency of yesterday of last week × Maximum latency of last week.

[0072] The same calculation logic is used to predict the minimum latency time:

[0073] Predicted minimum delay time = Minimum delay time of last week - (Minimum delay time of yesterday last week - Minimum delay time of yesterday) / Minimum delay time of yesterday last week × Minimum delay time of last week.

[0074] By iteratively processing all time points of the day and repeating the above calculation process, alarm prediction data for all time points throughout the day can be obtained.

[0075] S52, visualize the predicted performance results as a curve trend graph, so that operation and maintenance personnel can intuitively understand the performance change trend of the business view.

[0076] Example 2

[0077] like Figure 2 As shown, this embodiment provides a business view alarm trend prediction system based on historical probe log data, used to implement the method of Embodiment 1, including:

[0078] The probe log collection module 101 is used to collect probe logs from the business view of the operation and maintenance system in real time through a data collector; wherein the probe logs include key fields such as collection time, probe status and delay time;

[0079] The probe log storage module 102 is used to persistently store the collected probe logs in the database as the basis for subsequent data analysis;

[0080] The scheduled summary and analysis module 103 is used to start a scheduled task to summarize and analyze the probe logs entering the database at preset time intervals (such as once per hour) and generate summary statistics.

[0081] The historical summary data generation module 104 is used to save the summary statistical data into a statistical table in the database to form historical summary data, which serves as the data basis for alarm prediction.

[0082] The alarm prediction module 105 is used to calculate alarm predictions based on the historical aggregated data.

[0083] To make the objectives, technical solutions, and advantages of this invention clearer, the embodiments of this invention will be described in great detail and comprehensively below with reference to the accompanying drawings. This invention not only provides the core method flow but also explores various implementation variations, exception handling mechanisms, resource optimization strategies, and adaptation schemes for different database platforms to ensure the robustness, versatility, and industrial applicability of the technical solution.

[0084] This invention provides a data simulation method and system based on database functions and scheduled tasks. Its core concept lies in accurately simulating the unique data environments distributed across various heterogeneous sites on a central operations and maintenance platform (i.e., the "local platform") through a lightweight, highly automated, and resource-controllable technical approach. This method avoids the timeliness, bandwidth, and storage bottlenecks caused by massive physical data transmission. By intelligently extracting the "meta-features" and "behavioral patterns" of the source data and deeply utilizing the native functions and task scheduling capabilities of the database kernel, it generates highly valuable and timely simulated data locally. This provides high-quality, high-coverage data support for software testing, problem reproduction, and early warning model training.

[0085] A preferred embodiment of the present invention relates to a method for predicting alarms in the business view of an operations and maintenance system. This method achieves accurate prediction of performance trends in the business view through systematic data processing and intelligent prediction algorithms. The entire method comprises five main steps, which are closely linked to form a complete data processing and analysis pipeline.

[0086] In step S1, the system collects probe logs through data collectors deployed at various nodes in the business environment. The data collectors are lightweight, support multiple protocols and data formats, and can adapt to different business system environments. The collection frequency is dynamically adjusted according to business importance, with core businesses using a higher collection frequency (e.g., once every 30 seconds) and non-core businesses using a lower frequency (e.g., once every 5 minutes). The collected probe logs contain rich contextual information, including basic collection time, probe status, and latency, as well as fields such as business view ID, probe point location, and response code. Multiple quality control mechanisms are implemented during data collection, including data validity verification, outlier detection, and duplicate data filtering, to ensure the accuracy and integrity of the collected data. The collectors also have reconnection and data caching functions, allowing data to be temporarily stored during network anomalies and retransmitted after network recovery to avoid data loss.

[0087] In step S2, the collected probe logs are persistently stored in a dedicated log database. The database selection takes into account the characteristics of operational data, employing a time-series database as the storage engine. This type of database is deeply optimized for time-series data, supporting high-concurrency writes and fast range queries. The database table structure design fully considers query efficiency, establishing a composite index with the business view ID and collection time as keys, and managing partitions according to time ranges. Data storage uses columnar compression technology, significantly reducing storage space requirements. To balance storage costs and data value, the system establishes an automated data lifecycle management strategy: raw probe logs are retained for 31 days, summarized statistics are retained for 13 months, and expired data is automatically archived or cleaned up. Regular maintenance operations are also implemented at the database level, including index rebuilding, statistical updates, and storage space reclamation, ensuring stable database performance.

[0088] In step S3, the system periodically summarizes and analyzes the probe logs through scheduled tasks. These scheduled tasks are implemented using a distributed task scheduling framework, supporting cluster deployment and failover to ensure reliable task execution. The summary task is automatically triggered at the 10th minute of each hour, processing all probe log data generated in the previous hour. The summary process employs a multi-stage processing architecture: first, it extracts data within a specified time range from the original log table; then, it groups and aggregates data according to the business view ID; and finally, it calculates various statistical indicators. Statistical calculations utilize a streaming processing mode, performing calculations while reading data to avoid large memory overhead. In addition to the basic maximum, minimum, and average latency, the system also calculates statistics such as the standard deviation of latency and the 95th percentile, providing a more comprehensive description of the performance distribution characteristics of the business view. Data quality checks are also performed during the summary process, marking time periods with insufficient or abnormal data to prevent unreliable statistical results from affecting subsequent predictions.

[0089] In step S4, the aggregated statistical data is stored in a dedicated forecasting base table. This table employs a star schema design, containing a fact table and multiple dimension tables to support complex analytical queries. The fact table records statistical indicator values ​​at various time points, while the dimension tables store business view information, time dimension information, and more. An incremental update strategy is used for data storage, inserting only new statistical records without modifying historical data, ensuring data integrity and traceability. To support efficient querying of large-scale data, the system establishes materialized views and a query caching mechanism. Frequently used query results are pre-calculated and cached, significantly improving query response speed. The database is also configured with appropriate logging and monitoring mechanisms to track data access patterns, providing a basis for performance tuning.

[0090] In step S5, the system performs alarm prediction calculations based on historical statistical data. The prediction algorithm employs an improved time series forecasting method, fully considering the periodicity, trend, and randomness of business data. The algorithm implementation consists of four stages: data preparation, feature engineering, prediction calculation, and result post-processing. In the data preparation stage, the system extracts historical data from the statistical tables for the most recent four weeks, including statistical values ​​of the same business view for the same time period on different dates. Integrity checks are performed during data extraction to ensure sufficient historical data to support the prediction calculations.

[0091] The feature engineering phase focused on extracting three types of features: periodic features, reflecting the daily patterns of business operations, obtained by comparing historical data from the same period; trend features, reflecting long-term changes in business operations, obtained by analyzing recent data trends; and anomaly features, identifying abnormal patterns in historical data and detecting outliers using statistical methods. These features collectively form the foundation of the predictive model.

[0092] The prediction calculation phase employs a similarity-based prediction method. For a given point in time to be predicted, the system first searches for similar patterns in historical data, and then makes a prediction based on the development trends of these similar patterns. Specifically, the calculation process for the maximum predicted delay time is as follows: First, the maximum delay time at the same point in time last week is obtained as a baseline value. Then, the rate of change between yesterday's maximum delay time and yesterday's maximum delay time is calculated. Finally, the predicted value is obtained by subtracting the adjustment amount based on the rate of change from the baseline value. The mathematical expression is: Maximum predicted delay time = Maximum delay time last week - (Maximum delay time yesterday's maximum delay time - Maximum delay time yesterday's maximum delay time) / Maximum delay time yesterday's maximum delay time × Maximum delay time last week. The essence of this formula is to predict based on the relative change of historical values ​​for the same period, considering both periodic patterns and recent trends.

[0093] The same calculation logic is used to predict the minimum latency, except that the data source is replaced with the minimum latency instead of the maximum latency. The formula is: Predicted minimum latency = Last week's minimum latency - (Last week's yesterday's minimum latency - Yesterday's minimum latency) / Last week's yesterday's minimum latency × Last week's minimum latency. This symmetrical design ensures the consistency of the prediction results.

[0094] The system performs prediction calculations for each hour of the day through a loop, generating a full-day performance prediction curve. The prediction process also considers the impact of special dates (such as weekends and holidays), employing special processing logic for these dates to improve prediction accuracy.

[0095] The post-processing stage involves validating and smoothing the predicted values. Validation rules include range checks (predicted values ​​should be within a reasonable range), continuity checks (predicted values ​​should not abruptly change between adjacent time points), and consistency checks (maximum delay should be greater than minimum delay). Predicted values ​​that do not meet the validation rules are automatically adjusted or marked as requiring manual review. Smoothing uses a moving average method to eliminate noise in the prediction curve, making the trend clearer.

[0096] The forecast results are ultimately presented to operations and maintenance personnel in a visual format. The system offers multiple view modes, including trend charts, heatmaps, and dashboards. Trend charts display both historical actual values ​​and future forecast values, distinguished by different colors for easy comparison and analysis. Heatmaps present forecast results along two dimensions: time and business perspective, quickly identifying high-risk periods and businesses. Dashboards summarize key forecast metrics, such as expected peak time and maximum forecast latency, helping operations and maintenance personnel quickly grasp the overall situation.

[0097] In addition to basic prediction functions, the system also provides a prediction reliability assessment. Reliability is calculated based on factors such as historical prediction accuracy, data integrity, and pattern stability, helping operations personnel determine the reliability of prediction results. Predictions with low reliability are specifically marked to remind operations personnel to use them with caution.

[0098] The system also supports subscription and notification functions for prediction results. Operations personnel can set monitoring time periods or thresholds; when a predicted value exceeds the threshold, the system will automatically send a notification to ensure timely awareness of potential risks. Notification channels support multiple methods such as email, SMS, and instant messaging to meet notification needs in different scenarios.

[0099] In terms of system architecture, this invention adopts a microservice architecture design, with each functional module deployed independently and communicating through standard interfaces. The data acquisition service is responsible for log collection and preliminary processing, the data storage service manages database operations, the analysis and computing service executes data aggregation and prediction algorithms, and the display service provides the user interface and API interface. This architecture ensures the scalability and maintainability of the system; the failure of a single module will not affect the overall system operation.

[0100] The system also has a comprehensive monitoring and maintenance mechanism. Key business processes are logged in detail for easy troubleshooting. System performance metrics are monitored in real time, including data acquisition latency, computation task execution time, and prediction accuracy. When system anomalies occur, alarms are automatically triggered to ensure timely problem resolution.

[0101] Regarding data security, the system implements strict access controls. Sensitive data is encrypted during storage and transmission, and user access requires authentication and permission verification. Operation logs fully record all data access and modification operations, meeting auditing requirements.

[0102] A specific application example of this invention is its implementation in the operation and maintenance management of a large e-commerce platform. This platform contains hundreds of business views and generates hundreds of millions of probe logs daily. By deploying the predictive method of this invention, the operations and maintenance team can identify performance bottlenecks in advance and adjust resources before peak business periods, significantly reducing the system failure rate. Statistical data shows that after implementation, system availability increased from 99.9% to 99.99%, the number of emergency fault handling incidents decreased by 60%, and the work efficiency of the operations and maintenance team increased by more than 40%.

[0103] Another application example is in the operation and maintenance monitoring of financial systems. Financial operations have extremely high requirements for system stability, and traditional threshold alarms often generate a large number of false alarms, causing great trouble for the operation and maintenance team. After adopting the prediction method of this invention, the system can accurately identify the real risk points, reducing the false alarm rate by 80%. At the same time, early warnings have avoided many major failures, ensuring the continuous and stable operation of the business.

[0104] This invention, through a systematic data processing workflow and intelligent prediction algorithms, achieves accurate prediction of alarms in the business view, providing effective decision support for operations and maintenance management. The method is characterized by its strong practicality, ease of implementation, and significant effectiveness, and has important application value in the operations and maintenance management of modern complex IT environments.

[0105] The present invention also provides a memory that stores multiple instructions for implementing the method as described in Embodiment 1.

[0106] like Figure 3 As shown, the present invention also provides an electronic device, including a processor 301 and a memory 302 connected to the processor 301. The memory 302 stores a plurality of instructions, which can be loaded and executed by the processor to enable the processor to perform the method as described in Embodiment 1.

[0107] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A method for predicting alarm trends in a business view based on historical detection log data, characterized in that, include: S1, the data collector collects the probe logs of the operation and maintenance system's business view in real time; wherein the probe logs contain key fields such as collection time, probe status, and latency time; S2, the collected detection logs are persistently stored in the database as the basis for subsequent data analysis; S3, start a scheduled task to summarize and analyze the probe logs entering the database at preset time intervals and generate summary statistics; S4, the summarized statistical data is saved to a statistical table in the database to form historical summary data, which serves as the data basis for alarm prediction; S5, calculate alarm prediction based on the historical aggregated data; S5 includes: S51, based on historical aggregated data, predict the performance of the business view at future points in time using a specific algorithm; the specific algorithm utilizes the regularity of historical data from the same period and combines it with recent trends to make predictions; for a specific point in time on a given day, the prediction algorithm is as follows: The predicted maximum delay time is obtained by subtracting an adjustment amount from the maximum delay time at the same time last week. This adjustment amount is calculated based on the rate of change between yesterday's maximum delay time and yesterday's maximum delay time at the same time last week. The specific calculation formula is as follows: Predicted maximum latency = Maximum latency of last week - (Maximum latency of yesterday of last week - Maximum latency of yesterday) / Maximum latency of yesterday of last week × Maximum latency of last week; The same calculation logic is used to predict the minimum latency time: Predicted minimum delay time = Minimum delay time last week - (Minimum delay time of yesterday last week - Minimum delay time of yesterday yesterday) / Minimum delay time of yesterday last week × Minimum delay time last week; By iteratively processing all time points of the day and repeating the above calculation process, alarm prediction data for all time points throughout the day can be obtained. S52, visualize the predicted performance results as a curve trend graph, so that operation and maintenance personnel can intuitively understand the performance change trend of the business view.

2. The method for predicting alarm trends in a business view based on historical detection log data according to claim 1, characterized in that, S1 includes: S11, The data collector is deployed at each key node of the business system to collect availability status and performance data of the business view at a fixed frequency; S12, During the data collection process, the data corresponding to the probe logs of the operation and maintenance system business view is initially cleaned to remove obviously abnormal data points and ensure data quality.

3. The method for predicting alarm trends in a business view based on historical detection log data according to claim 2, characterized in that, The detection status includes normal, timeout, and error status codes; the delay time is used to record the time interval from initiating the detection to receiving the response, in milliseconds.

4. The method for predicting alarm trends in a business view based on historical detection log data according to claim 3, characterized in that, The database in S2 adopts a time-series database architecture, which is optimized for time-series data and supports efficient data writing and querying. The storage includes: establishing a composite index based on the business view ID and collection time fields to improve query efficiency; at the same time, the database has a data retention strategy to automatically clean up historical data that has exceeded the expiration date.

5. The method for predicting alarm trends in a business view based on historical detection log data according to claim 4, characterized in that, The scheduled task of S3 is automatically triggered at 10:10 on the hour to aggregate and calculate the probe log data of the previous hour and generate summary statistics. The summary statistics include key indicators such as summary time, maximum latency, minimum latency, average latency, and probe success rate. The maximum latency is used to characterize the worst performance of the business view within the statistical period, the minimum latency is used to characterize the best performance, the average latency is used to characterize the overall performance level, and the probe success rate is used to characterize the availability of the business view.

6. The method for predicting alarm trends in a business view based on historical detection log data according to claim 5, characterized in that, The statistical table is designed based on the needs of data analysis. In addition to storing basic statistical indicators, it also includes metadata information such as the statistical period and the number of data samples. The data is compressed during storage, and a data partitioning strategy is established.

7. A business view alarm trend prediction system based on historical probe log data, used to implement the method according to any one of claims 1-6, characterized in that, include: The probe log collection module (101) is used to collect probe logs from the business view of the operation and maintenance system in real time through a data collector; wherein the probe logs contain key fields such as collection time, probe status and delay time. The probe log storage module (102) is used to persistently store the collected probe logs in the database as the basis for subsequent data analysis; The scheduled summary and analysis module (103) is used to start a scheduled task to summarize and analyze the probe logs entering the database at preset time intervals and generate summary statistics. The historical summary data generation module (104) is used to save the summary statistical data into a statistical table in the database to form historical summary data, which serves as the data basis for alarm prediction. The alarm prediction module (105) is used to calculate alarm predictions based on the historical summary data.

8. An electronic device, characterized in that, It includes a processor and a memory, the memory storing multiple instructions, and the processor being used to read the instructions and execute the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions, which can be read by a processor and executed as described in any one of claims 1-6.

Images