Monitoring alarm method and system supporting multi-entity multi-dimensional correlation analysis
By constructing entity association factors for hierarchical classification and using a differentiated search engine for fault tracing, the problem of misjudgment in fault tracing in distributed systems is solved, and efficient and accurate fault root cause localization is achieved.
Patent Information
- Application Number
- CN202511843116.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-02-13
AI Technical Summary
In existing technologies, distributed systems treat edge entities and central entities with a single search logic, which cannot match the fault propagation characteristics of different entities, resulting in incomplete extraction of fault tracing features and the risk of misjudgment.
By constructing entity association factors for hierarchical classification, peripheral entities and central entities are identified. A depth-priority search engine and a breadth-priority search engine are used for fault tracing to obtain multi-dimensional monitoring data. A fault propagation model is then used for root cause analysis.
It improves the accuracy and efficiency of fault tracing, reduces the risk of misjudgment, and enhances the completeness of fault propagation feature extraction and the accuracy of root cause localization.
Smart Images
Figure CN121530815A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of fault monitoring and alarm technology, specifically to a monitoring and alarm method and system that supports multi-entity, multi-dimensional correlation analysis. Background Technology
[0002] With the rapid development of cloud computing, the Internet of Things, and the Industrial Internet, distributed systems, as the core architecture of key areas such as financial transactions, energy dispatch, and intelligent manufacturing, contain an exponentially growing number of entities such as edge devices, central nodes, and network links. The relationships between these entities are also becoming increasingly complex. As a result, the failure of any entity can spread rapidly through related links, causing systemic risks. Therefore, the accuracy of monitoring and alarms and the efficiency of fault tracing directly determine the reliability and business continuity of the system.
[0003] Conventional monitoring models based on single entities and single-dimensional indicators are no longer suitable for the multi-entity collaboration and multi-factor coupling characteristics of distributed systems. Specifically, fault tracing relies heavily on basic data such as performance indicators, leading to incomplete extraction of fault propagation features and large deviations in root cause judgment. Regardless of whether the fault occurs in a core node or an edge device, a single search and tracing logic is used. However, using breadth search for edge entities can easily lead to data redundancy, while using depth search for central entities can easily miss related faults. In addition, the attributes of edge and central entities are not fixed. Some edge entities may evolve into critical nodes due to frequent faults or synchronization anomalies, further exacerbating the risk of misjudgment in fault tracing. In short, there is an urgent need for an intelligent monitoring and alarm technology that can integrate entity relationships and distinguish entity types to ensure the stable operation of distributed systems.
[0004] In summary, existing technologies suffer from several technical problems: they rely on a single search logic to address different entity failures, treat peripheral entities and central entities equally, fail to match the failure propagation characteristics of different entities, and rely heavily on basic data such as performance indicators for failure tracing, resulting in incomplete extraction of failure propagation features and the risk of misjudgment in failure tracing. Summary of the Invention
[0005] This application provides a monitoring and alarm method and system that supports multi-entity, multi-dimensional correlation analysis. It aims to solve the technical problems in the existing technology, such as using a single search logic to deal with different entity failures, treating peripheral entities and central entities equally, failing to match the failure propagation characteristics of different entities, relying too much on basic data such as performance indicators for failure tracing, resulting in incomplete extraction of failure propagation features and the risk of misjudgment in failure tracing.
[0006] In view of the above problems, the technical solution to achieve the present application is as follows: In a first aspect, this application provides a monitoring and alarm method supporting multi-entity, multi-dimensional correlation analysis. The method includes: constructing entity correlation factors; hierarchically classifying a distributed entity set according to the entity correlation factors to obtain a first type of entity and a second type of entity, wherein the first type of entity is an edge entity and the second type of entity is a central entity; receiving a fault event tracing request and identifying the category of the fault entity corresponding to the fault event tracing request; when the category of the fault entity is the first type of entity, performing fault tracing of edge multi-dimensional monitoring data using an edge correlation tracing mechanism to obtain a first edge tracing alarm, wherein the edge correlation tracing mechanism is a fault propagation model based on a deep priority search engine; and when the category of the fault entity is the second type of entity, performing fault tracing of central multi-dimensional monitoring data using a central correlation tracing mechanism to obtain a first central tracing alarm, wherein the central correlation tracing mechanism is a fault propagation model based on a breadth priority search engine.
[0007] Preferably, the entity association factors include the number of dependent nodes of the entity, the frequency of event interactions, the synchronicity of performance index fluctuations, and the node degree and betweenness centrality of the graph structure; according to the entity association factors, the comprehensive association index of each entity in the distributed entity set is collected, and according to each comprehensive association index, entities that are greater than or equal to a preset association threshold are marked as central entities, and entities that are less than the preset association threshold are marked as edge entities, and the first type of entity and the second type of entity are output.
[0008] Preferably, the edge local subgraph of the faulty entity is extracted; based on the edge local subgraph, the faulty entity is pushed onto the stack as a starting point in the depth-priority search engine to construct a depth-priority search stack; the depth-priority search engine is used to identify the first depth search path in the depth-priority search stack and read the multi-dimensional monitoring data of the corresponding entity on the first depth search path, the first depth search path being an entity access sequence constructed in real time during the depth-priority search process; the multi-dimensional monitoring data of the corresponding entity on the first depth search path is input into a pre-trained fault propagation model for fault tracing to obtain the first edge tracing alarm information.
[0009] Preferably, the multi-dimensional monitoring data includes performance monitoring response indicators, log monitoring data, configuration deployment update monitoring data, and health status; fault propagation features are extracted from the multi-dimensional monitoring data to obtain multi-dimensional fault propagation feature vectors; the fault propagation model is used to compare the multi-dimensional fault propagation feature vectors in terms of time sequence, causal strength, and propagation delay to obtain root cause probabilities; fault tracing is performed according to the root cause probabilities to generate first edge tracing alarm information.
[0010] Preferably, a central local subgraph of the faulty entity is extracted; based on the central local subgraph, the faulty entity is pushed onto the stack in the breadth-first search engine as a starting point to construct a breadth-first search stack; the breadth-first search engine is used to identify the first breadth-first search path in the breadth-first search stack and read the multi-dimensional monitoring data of the corresponding entity on the first breadth-first search path, the first breadth-first search path being an entity access sequence constructed in real time during the breadth-first search process; the multi-dimensional monitoring data of the corresponding entity on the first breadth-first search path is input into a pre-trained fault propagation model for fault tracing to obtain the first central tracing alarm information.
[0011] Preferably, the edge local subgraph includes directly related upstream and downstream entities, and the center local subgraph includes directly and indirectly related upstream and downstream entities.
[0012] Preferably, the number of faults occurring and the synchronicity of fault occurrence of the edge entity are monitored; when the number of faults occurring is greater than a preset number of occurrences and the synchronicity of fault occurrence is greater than a preset threshold, the edge marker of the current entity is overwritten with the center marker.
[0013] In a second aspect, this application provides a monitoring and alarm system supporting multi-entity, multi-dimensional correlation analysis. The system includes: an entity correlation factor construction module: constructing entity correlation factors, hierarchically classifying a distributed entity set according to the entity correlation factors, and obtaining a first type of entity and a second type of entity, wherein the first type of entity is an edge entity and the second type of entity is a central entity; a fault event tracing request receiving module: receiving fault event tracing requests and identifying the category of the fault entity corresponding to the fault event tracing request; a first fault tracing module: when the category of the fault entity is the first type of entity, performing fault tracing of edge multi-dimensional monitoring data using an edge correlation tracing mechanism to obtain first edge tracing alarm information, wherein the edge correlation tracing mechanism is a fault propagation model based on a deep priority search engine; and a second fault tracing module: when the category of the fault entity is the second type of entity, performing fault tracing of central multi-dimensional monitoring data using a central correlation tracing mechanism to obtain first central tracing alarm information, wherein the central correlation tracing mechanism is a fault propagation model based on a breadth priority search engine.
[0014] In summary, one or more technical solutions provided in this application realize the construction of entity hierarchical standards based on entity association factors, improve the accuracy of identifying edge entities and central entities, adopt a depth-first tracing mechanism for edge entities and a breadth-first tracing mechanism for central entities, and effectively reduce the risk of misjudgment in fault tracing through the implicit fusion of differentiated tracing mechanisms and multi-dimensional data, thereby improving the efficiency of fault tracing, the completeness of fault propagation feature extraction, and ultimately improving the accuracy of root cause localization. Attached Figure Description
[0015] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0016] Figure 1 This application provides a flowchart illustrating a monitoring and alarm method that supports multi-entity, multi-dimensional correlation analysis.
[0017] Figure 2 This application provides a structural diagram of a monitoring and alarm system that supports multi-entity, multi-dimensional correlation analysis.
[0018] Explanation of reference numerals in the attached diagram: Entity association factor construction module M100, fault event tracing request receiving module M200, first fault tracing module M300, second fault tracing module M400. Detailed Implementation
[0019] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. It should be understood that this application is not limited to the exemplary embodiments described herein. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application. It should also be noted that, for ease of description, only the parts related to this application are shown in the accompanying drawings, not all of them.
[0020] Example 1: The present application will be described in detail below with reference to the accompanying drawings, as follows... Figure 1 As shown, this application provides a monitoring and alarm method that supports multi-entity, multi-dimensional correlation analysis, wherein the method includes: S1: Construct entity association factors, and hierarchically divide the distributed entity set according to the entity association factors to obtain a first type of entity and a second type of entity. The first type of entity is a peripheral entity and the second type of entity is a central entity.
[0021] Specifically, entity association factors refer to quantitative indicators used to measure the degree of association between entities in a distributed system. These include the number of nodes that an entity depends on, the frequency of event interactions, the synchronicity of performance index fluctuations, and the node degree and betweenness centrality of the graph structure. Through these entity association factors, entities in the distributed system are comprehensively evaluated to determine their importance and association within the system. Hierarchy refers to dividing the distributed entity set into different levels based on the values of entity association factors, so as to differentiate the treatment of entities at different levels. The first type of entity refers to entities with a low degree of association and relatively independent in the system; the second type of entity refers to entities with a high degree of association and located at the core of the system.
[0022] Execution steps: The relationships between entities are complex and multidimensional. By constructing entity relationship factors and performing hierarchical classification, we can achieve accurate identification and classification of different entities. Specifically, this includes: collecting comprehensive relationship indicators of each entity in the distributed entity set, including the number of entity dependent nodes and the frequency of event interactions; and marking entities with comprehensive relationship indicators greater than or equal to the preset relationship threshold as central entities and entities with relationship indicators less than the preset relationship threshold as edge entities.
[0023] Preferably, by accurately distinguishing between edge entities and central entities, different fault tracing mechanisms can be adopted for different types of entities, reducing unnecessary waste of computing resources in subsequent processing, thereby improving the efficiency and accuracy of fault tracing and providing a basis for differentiated fault tracing.
[0024] S2: Receive a fault event tracing request and identify the category of the fault entity corresponding to the fault event tracing request.
[0025] Specifically, a fault event tracing request is a request signal triggered by the system after a fault is detected, used to start the fault tracing process. It usually includes the time and location of the fault and preliminary fault information. Identifying the type of the fault entity means determining whether the specific entity that caused the fault belongs to the peripheral entity or the central entity based on the information in the fault event tracing request. This requires combining the previously constructed entity association factors and hierarchical results to quickly locate the type of the fault entity.
[0026] Execution steps: Receiving a fault event tracing request is the starting point of the fault handling process. Specifically, it includes: after a fault event is detected by monitoring tools such as log analysis and performance monitoring, a fault event tracing request is generated and sent to the fault handling module. After receiving the request, the fault handling module quickly identifies whether the fault entity belongs to the edge entity or the central entity based on the fault entity information contained in the request and the pre-built entity layering results. Specifically, the fault entity information includes the entity's identifier and location.
[0027] Preferably, by quickly identifying the category of the faulty entity, when the system detects that a node has failed, it can quickly identify whether the node is an edge entity or a central entity, select an appropriate fault tracing mechanism, reduce fault handling time, thereby improving the efficiency and accuracy of fault handling, and provide accurate target entity types for differentiated fault tracing.
[0028] S3: When the faulty entity is classified as a first-class entity, an edge-related tracing mechanism is used to perform fault tracing of edge multi-dimensional monitoring data and obtain first edge tracing alarm information. The edge-related tracing mechanism is a fault propagation model based on a deep priority search engine. S4: When the faulty entity is classified as a second-class entity, a center-related tracing mechanism is used to perform fault tracing of center multi-dimensional monitoring data and obtain first center tracing alarm information. The center-related tracing mechanism is a fault propagation model based on a breadth priority search engine.
[0029] Specifically, the edge-related tracing mechanism refers to a fault tracing method designed for edge entities. Its core is a fault propagation model based on a depth-first search engine. Depth-first search starts from the starting node and searches as deep as possible along the path until the target node is found or the path ends. In fault tracing, depth-first search can focus on core related links and reduce data redundancy. The center-related tracing mechanism refers to a fault tracing method designed for central entities. Its core is a fault propagation model based on a breadth-first search engine. Breadth-first search is an algorithm that starts from the starting node and traverses all adjacent nodes layer by layer. In fault tracing, breadth-first search can comprehensively cover related nodes and avoid fault omissions. Multi-dimensional monitoring data refers to system operation data collected from different angles, including performance indicators, log data, configuration update data, etc., providing a rich source of information for fault tracing. The fault propagation model is a mathematical model used to analyze the propagation path and impact range of faults in the system. By inputting multi-dimensional monitoring data, the fault propagation model can calculate the probability of the root cause of the fault.
[0030] Execution steps: When a faulty entity is identified as an edge entity, the edge association tracing mechanism is activated, which specifically includes: extracting the edge local subgraph of the faulty entity, including directly related upstream and downstream entities; pushing the faulty entity as the starting point onto the stack to construct a depth-first search stack; the depth-first search engine searches along the path, constructs the depth search path in real time, and reads the multi-dimensional monitoring data of the entities on the path; inputting the edge multi-dimensional monitoring data corresponding to the first type of entity into the fault propagation model for fault tracing, and generating the first edge tracing alarm information.
[0031] When a faulty entity is identified as a central entity, a central association tracing mechanism is initiated. This mechanism includes: extracting the central local subgraph of the faulty entity, including directly and indirectly related upstream and downstream entities; pushing the faulty entity onto a stack as the starting point to construct a breadth-first search stack; traversing related nodes layer by layer using a breadth-first search engine to construct a breadth-first search path in real time and reading multi-dimensional monitoring data of entities along the path; inputting the central multi-dimensional monitoring data corresponding to the second type of entity into the fault propagation model for fault tracing and generating a first central tracing alarm message.
[0032] Preferably, the edge association tracing mechanism is a fault propagation model based on a depth-first search engine, and the center association tracing mechanism is a fault propagation model based on a breadth-first search engine. The function of the edge association tracing mechanism and the center association tracing mechanism is to select an appropriate search strategy according to the entity category, thereby improving the efficiency and accuracy of fault tracing. Furthermore, for edge entities, depth-first search can quickly focus on the core association links, reduce unnecessary data processing, and improve tracing efficiency; for center entities, breadth-first search can fully cover association nodes and avoid missing potential fault points.
[0033] Comparative Explanation: The edge association tracing mechanism is a fault propagation model based on a depth-priority search engine. Specifically, since edge entities have fewer associated nodes, a depth-priority search engine is used to quickly trace the root cause of the fault. Furthermore, the depth-priority search engine will first delve into a dependency path to check if there is an associated root cause. If not found, it will backtrack and try other paths. The center association tracing mechanism is a fault propagation model based on a breadth-priority search engine. Specifically, the central entity has complex associations and needs to extensively explore possible fault propagation paths to avoid local optima that may be caused by depth-first search.
[0034] Furthermore, the distributed entity set is hierarchically divided according to the entity association factor to obtain a first type of entity and a second type of entity. The method of this application includes: The entity association factors include the number of dependent nodes of an entity, the frequency of event interactions, the synchronicity of performance index fluctuations, and the node degree and betweenness centrality of the graph structure. According to the entity association factors, the comprehensive association index of each entity in the distributed entity set is collected. According to each comprehensive association index, entities with a value greater than or equal to a preset association threshold are marked as central entities, and entities with a value less than the preset association threshold are marked as edge entities. The first type of entity and the second type of entity are output.
[0035] Specifically, the number of dependent nodes of an entity refers to the number of other entities that an entity depends on, reflecting the complexity of the entity's dependencies in the system; the frequency of event interactions refers to the frequency of interaction events between entities, such as data transmission and service calls, reflecting the degree of active interaction between entities; the synchronicity of performance index fluctuations refers to the degree of synchronicity of fluctuations in different entity performance indicators such as response time and throughput, reflecting the performance correlation between entities; the node degree of the graph structure refers to the number of edges connected to a certain entity in the system graph structure, reflecting the number of connections of that entity; betweenness centrality refers to the frequency with which a node acts as a mediator of the shortest path in the graph structure, reflecting the importance and control capability of that node in the entire system; the comprehensive correlation index refers to the index obtained by comprehensively calculating the above multiple correlation factors, used to quantify the correlation degree of each entity; and the preset correlation threshold refers to the pre-set threshold used to distinguish between central entities and peripheral entities.
[0036] Execution steps: By collecting and calculating entity association factors, accurate entity classification can be achieved. Specifically, this includes: for each entity in the distributed entity set, collecting association factor data such as the number of dependent nodes, event interaction frequency, performance index fluctuation synchronization, node degree, and betweenness centrality; comprehensively calculating the collected association factor data to obtain a comprehensive association index for each entity, for example, using a weighted summation method to allocate weights according to the importance of different factors; classifying entities according to a preset association threshold, further marking entities with a comprehensive association index greater than or equal to the preset association threshold as central entities, and entities with a comprehensive association index less than the preset association threshold as peripheral entities; and outputting the classification results, namely, two categories of entities: Category 1 entities and Category 2 entities.
[0037] Preferably, by accurately distinguishing between edge entities and central entities, different fault tracing mechanisms can be adopted for different types of entities, which can significantly improve the efficiency of fault tracing, reduce unnecessary waste of computing resources, and thus improve the efficiency and accuracy of fault handling, providing a basis for differentiated fault tracing.
[0038] Furthermore, by employing an edge-related tracing mechanism to perform fault tracing of multi-dimensional edge monitoring data and obtaining first edge tracing alarm information, the method of this application includes: Extract the edge local subgraph of the faulty entity; based on the edge local subgraph, push the faulty entity as the starting point into the stack of the depth-priority search engine to construct a depth-priority search stack; the depth-priority search engine is used to identify the first depth search path in the depth-priority search stack and read the multi-dimensional monitoring data of the corresponding entity on the first depth search path, the first depth search path being the entity access sequence constructed in real time during the depth-priority search process; input the multi-dimensional monitoring data of the corresponding entity on the first depth search path into a pre-trained fault propagation model for fault tracing and obtain the first edge tracing alarm information.
[0039] Specifically, the edge local subgraph refers to a subgraph centered on the faulty entity, extracted from its directly related upstream and downstream entities. It reflects the local topology of the faulty entity within the system, facilitating the focus on core related links. The depth-first search stack stores the nodes accessed during the depth-first search process, recording the search path starting from the faulty entity in fault tracing. The first depth search path refers to the entity access sequence constructed in real-time during the depth-first search process, reflecting the possible propagation path of the fault. Multi-dimensional monitoring data includes performance monitoring response indicators, log monitoring data, configuration deployment update monitoring data, and health status, reflecting the system's operating status from different perspectives and providing rich information for fault tracing. The fault propagation model is a pre-trained model used to analyze the propagation path and impact range of faults within the system. By inputting multi-dimensional monitoring data, the fault propagation model can calculate the probability of the root cause of the fault.
[0040] Execution steps: Centered on the faulty entity, extract its directly related upstream and downstream entities to form an edge local subgraph. For example, if the faulty entity is an edge server, the local subgraph includes gateway devices and some terminal devices directly connected to it. Push the faulty entity onto the stack as the starting point to initialize a depth-first search stack, which stores nodes accessed during the search process. The depth-first search engine starts from the faulty entity and searches as deeply as possible, starting with first-level nodes, then their child nodes, and finally their child nodes, constructing a first depth-first search path. During the depth-first search, read multi-dimensional monitoring data for each entity on the path. Input the multi-dimensional monitoring data of the corresponding entities on the first depth-first search path into the fault propagation model. The fault propagation model analyzes the fault propagation characteristics in the data, calculates the probability of the root cause of the fault, and generates the first edge tracing alarm information based on the output of the fault propagation model.
[0041] Preferably, when facing failures of edge entities, the core related links are quickly focused to reduce data redundancy and improve the efficiency and accuracy of fault tracing. Through depth-first search, the most likely fault propagation path can be traced, avoiding the large amount of irrelevant data processing that may be caused by breadth-first search. Furthermore, depth-first search can quickly locate the root cause of the fault and reduce invalid data processing. At the same time, through the input of multi-dimensional monitoring data, the fault propagation model can more accurately identify the cause of the fault and improve the accuracy of fault root cause location.
[0042] Furthermore, the multi-dimensional monitoring data of the corresponding entities on the first depth search path are input into a pre-trained fault propagation model for fault tracing. The method of this application includes: The multi-dimensional monitoring data includes performance monitoring response indicators, log monitoring data, configuration deployment update monitoring data, and health status. Fault propagation features are extracted from the multi-dimensional monitoring data to obtain multi-dimensional fault propagation feature vectors. The fault propagation model is used to compare the multi-dimensional fault propagation feature vectors in terms of time sequence, causal strength, and propagation delay to obtain root cause probabilities. Fault tracing is performed according to the root cause probabilities to generate first edge tracing alarm information.
[0043] Specifically, performance monitoring response metrics refer to performance-related data of various entities in the system, such as response time, throughput, CPU utilization, and memory usage, reflecting the performance of entities during operation; log monitoring data refers to log information generated during system operation, including operation logs, error logs, and system event logs, which record detailed information about system operation and are an important basis for fault analysis; configuration deployment update monitoring data refers to the configuration information and deployment update records of entities in the system, such as software version updates and configuration parameter changes, which helps determine whether a fault is related to configuration or updates.
[0044] Health status refers to the overall operational status of an entity, usually represented by a health score or status label. Common status labels include normal, warning, and fault. Fault propagation feature extraction refers to extracting features related to fault propagation from multi-dimensional monitoring data to form a feature vector. Fault propagation features include sudden changes in performance indicators, abnormal patterns in logs, and the time points of configuration changes. Root cause probability refers to the likelihood of a fault's root cause calculated by the fault propagation model. The fault propagation model analyzes the temporal sequence, causal strength, and propagation delay of fault propagation based on the feature vector to determine the most likely cause of the fault.
[0045] Execution steps: Collect multi-dimensional monitoring data of the faulty entity and its related entities. The multi-dimensional monitoring data includes performance monitoring response indicators, log monitoring data, configuration deployment update monitoring data, and health status. Analyze the collected multi-dimensional monitoring data to extract features related to fault propagation. Furthermore, extract the time points of response time mutations from performance indicators, the frequency of error codes from logs, and the time differences before and after changes from configuration data. These features related to fault propagation are integrated into a multi-dimensional fault propagation feature vector.
[0046] The multi-dimensional fault propagation feature vector is input into the pre-trained fault propagation model. The fault propagation model calculates the probability of each potential root cause of the fault by analyzing the time sequence, causal strength and propagation delay in the multi-dimensional fault propagation feature vector. Specifically, the propagation delay refers to the time interval between the fault propagating from the upstream entity to the downstream entity. Based on the root cause probability output by the fault propagation model, fault tracing is performed to generate the first edge tracing alarm information, which clearly indicates the most likely cause of the fault and its scope of influence.
[0047] Preferably, conventional methods often rely on single-dimensional data such as performance indicators, which are prone to misjudgment due to data bias. This application, through comprehensive analysis of multi-dimensional data, can more comprehensively reflect the fault propagation process and improve the accuracy and reliability of fault root cause location. In addition, through comprehensive analysis of time sequence, causal strength and propagation delay by the fault propagation model, the risk of misjudgment can be further reduced and the fault handling time can be shortened.
[0048] Furthermore, this application method employs a central correlation tracing mechanism to perform fault tracing of multi-dimensional monitoring data from the central authority and obtains first-center tracing alarm information. The method includes: Extract the central local subgraph of the faulty entity; based on the central local subgraph, push the faulty entity as the starting point into the breadth-first search stack in the breadth-first search engine to construct a breadth-first search stack; the breadth-first search engine is used to identify the first breadth-first search path in the breadth-first search stack and read the multi-dimensional monitoring data of the corresponding entity on the first breadth-first search path, the first breadth-first search path being the entity access sequence constructed in real time during the breadth-first search process; input the multi-dimensional monitoring data of the corresponding entity on the first breadth-first search path into a pre-trained fault propagation model for fault tracing and obtain the first central tracing alarm information.
[0049] Specifically, the central local subgraph refers to a subgraph centered on the faulty entity, extracting its directly and indirectly related upstream and downstream entities. Compared to the peripheral local subgraph, the central local subgraph has a wider coverage and can reflect the complex relationships between the faulty entity in the system. The breadth-first search stack is used to store the nodes visited during the breadth-first search process. In fault tracing, the associated nodes of the faulty entity are traversed layer by layer through the breadth-first search stack. The first breadth-first search path refers to the entity visit sequence constructed in real time during the breadth-first search process, reflecting the possible range of fault propagation and ensuring that all associated nodes are covered. The fault propagation model is a pre-trained model used to analyze the propagation path and impact range of faults in the system. By inputting multi-dimensional monitoring data, the fault propagation model can calculate the probability of each potential root cause of the fault.
[0050] Execution steps: Taking the faulty entity as the center, extract its directly and indirectly related upstream and downstream entities to form a central local subgraph. For example, if the faulty entity is the core data center, the local subgraph includes servers and storage devices directly connected to it, as well as other key devices indirectly connected through intermediate nodes. Push the faulty entity as the starting point onto the stack to initialize the breadth-first search stack. The breadth-first search stack is used to store the nodes visited layer by layer during the search process.
[0051] The breadth-priority search engine starts with the faulty entity, traverses and searches N first-level nodes to construct the first breadth-priority search path, and expands layer by layer using the same logic, sequentially traversing the child nodes of M first-level nodes and the child nodes of U first-level node child nodes. During the search process, it reads multi-dimensional monitoring data of each entity on the first breadth-priority search path. The multi-dimensional monitoring data of the corresponding entities on the first breadth-priority search path are input into the fault propagation model. The fault propagation model calculates the probability of the root cause of the fault by analyzing the fault propagation characteristics in the data. Based on the output of the fault propagation model, it generates the first center traceability alarm information.
[0052] Preferably, for the failure of the central entity, a breadth-first search is used to traverse all possible failure propagation paths layer by layer, fully covering its associated nodes, avoiding failure omissions, ensuring that no potential failure points are missed, and improving the accuracy and reliability of failure tracing. Furthermore, in a distributed system, the failure propagation path of the central entity involves multiple levels, including directly and indirectly related nodes. Correspondingly, by inputting multi-dimensional monitoring data, the failure propagation model can more accurately identify the cause of the failure and improve the accuracy of root cause location. In addition, through breadth-first search, the impact range of the failure can be more comprehensively assessed, thereby enabling more effective resource scheduling and failure repair.
[0053] Furthermore, the method of this application also includes: The edge local subgraph includes directly related upstream and downstream entities, and the central local subgraph includes directly and indirectly related upstream and downstream entities.
[0054] Specifically, a directly related upstream entity refers to an entity that has a direct data or functional dependency on the target entity and is located upstream of the target entity. For example, in a data flow, the upstream entity is the data provider. A directly related downstream entity refers to an entity that has a direct data or functional dependency on the target entity and is located downstream of the target entity. For example, in a data flow, the downstream entity is the data receiver. An indirectly related upstream entity refers to an upstream entity that has a dependency on the target entity through an intermediate entity, and an indirectly related downstream entity refers to a downstream entity that has a dependency on the target entity through an intermediate entity. Furthermore, indirect association involves multi-hop connections.
[0055] Execution steps: For edge entities, extract their directly related upstream and downstream entities. For example, if an edge entity is an edge server, its directly upstream entity might be a gateway device, and its directly downstream entity might be a terminal device. For central entities, extract their directly and indirectly related upstream and downstream entities to construct a central local subgraph. Furthermore, if the central entity is a core data center, its directly related entities might be directly connected servers, and its indirectly related entities might be other data centers connected through intermediate routing devices. In the fault tracing process, the edge local subgraph is used to focus on core related links to reduce data redundancy; the central local subgraph is used to comprehensively cover related nodes to avoid fault omissions.
[0056] Preferably, for edge entities, since their relationships are relatively simple, directly related upstream and downstream entities are sufficient to cover the fault propagation path. Furthermore, in distributed systems, the fault propagation path of edge entities typically only involves directly related upstream and downstream entities. Therefore, extracting directly related upstream and downstream entities significantly reduces unnecessary data processing and improves fault tracing efficiency. For central entities, since their relationships are complex and may involve multi-hop connections, it is necessary to extract both directly and indirectly related upstream and downstream entities. Furthermore, in distributed systems, the fault propagation path of central entities may involve multiple layers of indirectly related nodes. Therefore, extracting a wider range of related nodes ensures that no potential fault points are missed. In summary, in the above steps, selecting an appropriate local subgraph range based on the entity category improves the efficiency and accuracy of fault tracing.
[0057] Furthermore, after marking entities smaller than the preset association threshold as edge entities, the method of this application further includes: Monitor the number of faults and the synchronicity of fault occurrences of the edge entity; when the number of fault occurrences exceeds a preset number and the synchronicity of fault occurrences exceeds a preset threshold, overwrite the edge marker of the current entity with the center marker.
[0058] Specifically, the number of failures refers to the frequency of a failure of a certain edge entity within a certain time window, used to measure the failure frequency of an entity and reflect its stability; the synchronicity of failures refers to the degree to which multiple edge entities fail simultaneously within a similar time period, used to measure whether the failures are propagated or related, reflecting the potential systemic risks in the system; edge marker overlay as center marker means that when the number of failures and synchronicity of a certain edge entity exceed a preset threshold, it is reclassified from an edge entity as a center entity, reflecting that the importance and relatedness of the entity in the system have changed.
[0059] Execution steps: Continuously monitor the number of failures for each edge entity and record the timestamps of each failure; calculate the synchronicity of failures by analyzing the timestamps of multiple edge entities, for example, using time windows to count whether multiple entities fail within the same time window to monitor the number of failures and synchronicity; preset thresholds for the number of failures and the synchronicity of failures; when the number of failures for an edge entity exceeds the preset threshold and the synchronicity of failures exceeds the threshold, trigger a label update; update the label of the current edge entity from edge entity to center entity. This label update operation will be synchronized to the entity classification database, and subsequent fault tracing and monitoring strategies will be adjusted according to the new classification.
[0060] Preferably, by monitoring the number of fault occurrences and synchronicity, edge entities that become more important due to frequent faults or fault propagation can be identified in a timely manner. When edge entities repeatedly fail or multiple edge nodes fail synchronously, further, if the threshold for the number of fault occurrences of an edge entity is 5 times / hour and the synchronicity threshold is 70%, if monitoring finds that an edge entity has experienced 6 faults in 1 hour, and each fault occurs synchronously with other edge entities, with a synchronicity of 75%, then the entity's label is updated from edge entity to central entity. By dynamically adjusting the entity classification, the system adapts to changes in entity correlation and importance during system operation, improves the system's adaptability and reliability, and reduces the risk of fault omissions due to inaccurate entity classification.
[0061] In summary, the beneficial effects of the embodiments of this application are: By employing entity association factors, the distributed entity set is hierarchically layered according to these factors, resulting in first-class and second-class entities. The first-class entities are edge entities, and the second-class entities are central entities. Fault event tracing requests are received, and the category of the fault entity corresponding to the tracing request is identified. When the fault entity belongs to the first-class entity, an edge association tracing mechanism is used to perform fault tracing of edge multi-dimensional monitoring data, obtaining the first edge tracing alarm information. This edge association tracing mechanism is a fault propagation model based on a deep priority search engine. When the fault entity belongs to the second-class entity, a central association tracing mechanism is used to perform fault tracing of central multi-dimensional monitoring data, obtaining the first central tracing alarm information. This central association tracing mechanism is a fault propagation model based on a breadth priority search engine. This application provides a monitoring and alarm method and system that supports multi-entity, multi-dimensional correlation analysis. It achieves the technical effect of constructing entity hierarchical standards based on entity correlation factors, improving the accuracy of identifying edge entities and central entities, adopting a depth-first tracing mechanism for edge entities and a breadth-first tracing mechanism for central entities, and effectively reducing the risk of misjudgment in fault tracing through differentiated tracing mechanisms and implicit fusion of multi-dimensional data, improving fault tracing efficiency and the completeness of fault propagation feature extraction, thereby improving the accuracy of root cause localization.
[0062] Example 2, based on the same inventive concept as the monitoring and alarm method supporting multi-entity, multi-dimensional correlation analysis in the foregoing examples, such as... Figure 2 As shown in the embodiment of this application, a monitoring and alarm system supporting multi-entity, multi-dimensional correlation analysis is provided, wherein the system includes: Entity association factor construction module M100: Constructs entity association factors, and hierarchically divides the distributed entity set according to the entity association factors to obtain a first type of entity and a second type of entity. The first type of entity is a peripheral entity and the second type of entity is a central entity.
[0063] Fault event tracing request receiving module M200: Receives fault event tracing requests and identifies the category of the fault entity corresponding to the fault event tracing request.
[0064] First fault tracing module M300: When the fault entity is classified as a first type of entity, the edge association tracing mechanism is used to perform fault tracing of edge multi-dimensional monitoring data and obtain the first edge tracing alarm information. The edge association tracing mechanism is a fault propagation model based on a deep priority search engine.
[0065] The second fault tracing module M400: When the fault entity is classified as a second type of entity, the central association tracing mechanism is used to perform fault tracing of the central multi-dimensional monitoring data and obtain the first central tracing alarm information. The central association tracing mechanism is a fault propagation model based on a breadth-priority search engine.
[0066] Furthermore, the entity association factor construction module M100 is used to perform the following method: The entity association factors include the number of dependent nodes of an entity, the frequency of event interactions, the synchronicity of performance index fluctuations, and the node degree and betweenness centrality of the graph structure. According to the entity association factors, the comprehensive association index of each entity in the distributed entity set is collected. According to each comprehensive association index, entities with a value greater than or equal to a preset association threshold are marked as central entities, and entities with a value less than the preset association threshold are marked as edge entities. The first type of entity and the second type of entity are output.
[0067] Furthermore, the first fault tracing module M300 is used to execute the following method: Extract the edge local subgraph of the faulty entity; based on the edge local subgraph, push the faulty entity as the starting point into the stack of the depth-priority search engine to construct a depth-priority search stack; the depth-priority search engine is used to identify the first depth search path in the depth-priority search stack and read the multi-dimensional monitoring data of the corresponding entity on the first depth search path, the first depth search path being the entity access sequence constructed in real time during the depth-priority search process; input the multi-dimensional monitoring data of the corresponding entity on the first depth search path into a pre-trained fault propagation model for fault tracing and obtain the first edge tracing alarm information.
[0068] Furthermore, the first fault tracing module M300 is also used to perform the following method: The multi-dimensional monitoring data includes performance monitoring response indicators, log monitoring data, configuration deployment update monitoring data, and health status. Fault propagation features are extracted from the multi-dimensional monitoring data to obtain multi-dimensional fault propagation feature vectors. The fault propagation model is used to compare the multi-dimensional fault propagation feature vectors in terms of time sequence, causal strength, and propagation delay to obtain root cause probabilities. Fault tracing is performed according to the root cause probabilities to generate first edge tracing alarm information.
[0069] Furthermore, the second fault tracing module M400 is used to perform the following method: Extract the central local subgraph of the faulty entity; based on the central local subgraph, push the faulty entity as the starting point into the breadth-first search stack in the breadth-first search engine to construct a breadth-first search stack; the breadth-first search engine is used to identify the first breadth-first search path in the breadth-first search stack and read the multi-dimensional monitoring data of the corresponding entity on the first breadth-first search path, the first breadth-first search path being the entity access sequence constructed in real time during the breadth-first search process; input the multi-dimensional monitoring data of the corresponding entity on the first breadth-first search path into a pre-trained fault propagation model for fault tracing and obtain the first central tracing alarm information.
[0070] Furthermore, the second fault tracing module M400 is also used to perform the following methods: The edge local subgraph includes directly related upstream and downstream entities, and the central local subgraph includes directly and indirectly related upstream and downstream entities.
[0071] Furthermore, the entity association factor construction module M100 is also used to perform the following method: Monitor the number of faults and the synchronicity of fault occurrences of the edge entity; when the number of fault occurrences exceeds a preset number and the synchronicity of fault occurrences exceeds a preset threshold, overwrite the edge marker of the current entity with the center marker.
[0072] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Figure 1 The monitoring and alarm method and specific examples supporting multi-entity multi-dimensional correlation analysis in Example 1 are also applicable to the monitoring and alarm system supporting multi-entity multi-dimensional correlation analysis in this embodiment. Through the foregoing detailed description of the monitoring and alarm method supporting multi-entity multi-dimensional correlation analysis, those skilled in the art can clearly understand the monitoring and alarm system supporting multi-entity multi-dimensional correlation analysis in this embodiment. Therefore, for the sake of brevity, it will not be described in detail here.
[0073] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
[0074] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of this application and its equivalents, this application also intends to include such modifications and variations.
Claims
1. A monitoring and alarm method supporting multi-entity, multi-dimensional correlation analysis, characterized in that, The method includes: Construct an entity association factor, and hierarchically divide the distributed entity set according to the entity association factor to obtain a first type of entity and a second type of entity. The first type of entity is the edge entity, and the second type of entity is the central entity. Receive a fault event tracing request and identify the category of the fault entity corresponding to the fault event tracing request; When the faulty entity is classified as a first type of entity, the edge association tracing mechanism is used to perform fault tracing of multi-dimensional edge monitoring data and obtain the first edge tracing alarm information. The edge association tracing mechanism is a fault propagation model based on a deep priority search engine. When the faulty entity is classified as a second type of entity, a central association tracing mechanism is used to perform fault tracing of the central multi-dimensional monitoring data and obtain the first central tracing alarm information. The central association tracing mechanism is a fault propagation model based on a breadth-priority search engine.
2. The method as described in claim 1, characterized in that, The distributed entity set is hierarchically classified according to the entity association factor to obtain the first type of entities and the second type of entities. The method includes: The entity association factors include the number of entity-dependent nodes, the frequency of event interactions, the synchronicity of performance index fluctuations, and the node degree and betweenness centrality of the graph structure. Collect comprehensive association indicators for each entity in the distributed entity set according to the entity association factor. Mark entities with a comprehensive association indicator greater than or equal to a preset association threshold as central entities and entities with an association index less than the preset association threshold as edge entities. Output the first type of entity and the second type of entity.
3. The method as described in claim 1, characterized in that, The method employs an edge-related tracing mechanism to perform fault tracing of multi-dimensional edge monitoring data and obtain the first edge tracing alarm information. The method includes: Extract the edge local subgraph of the faulty entity; Based on the edge local subgraph, the faulty entity is pushed onto the stack as the starting point in the depth-first search engine to construct a depth-first search stack. The depth priority search engine is used to identify the first depth search path in the depth priority search stack and read the multi-dimensional monitoring data of the corresponding entity on the first depth search path. The first depth search path is an entity access sequence constructed in real time during the depth priority search process. The multi-dimensional monitoring data of the corresponding entities on the first depth search path are input into the pre-trained fault propagation model for fault tracing to obtain the first edge tracing alarm information.
4. The method as described in claim 3, characterized in that, The multi-dimensional monitoring data of the corresponding entities on the first depth search path are input into a pre-trained fault propagation model for fault tracing. include: The multi-dimensional monitoring data includes performance monitoring response metrics, log monitoring data, configuration deployment and update monitoring data, and health status. Fault propagation features are extracted from the multi-dimensional monitoring data to obtain multi-dimensional fault propagation feature vectors. The fault propagation model is used to compare the multi-dimensional fault propagation feature vectors in terms of time sequence, causal intensity, and propagation delay to obtain the root cause probability. Fault tracing is performed according to the root cause probability to generate a first edge tracing alarm message.
5. The method as described in claim 3, characterized in that, The fault tracing mechanism is used to perform fault tracing of multi-dimensional monitoring data from the center and obtain the first center's tracing alarm information. The method includes: Extract the central local subgraph of the faulty entity; Based on the central local subgraph, the faulty entity is pushed onto the stack as the starting point in the breadth-first search engine to construct a breadth-first search stack; The breadth-first search engine is used to identify the first breadth-first search path in the breadth-first search stack and read the multi-dimensional monitoring data of the corresponding entities on the first breadth-first search path. The first breadth-first search path is an entity access sequence constructed in real time during the breadth-first search process. The multi-dimensional monitoring data of the corresponding entities on the first breadth search path are input into the pre-trained fault propagation model for fault tracing to obtain the first center traceability alarm information.
6. The method as described in claim 5, characterized in that, The edge local subgraph includes directly related upstream and downstream entities, and the center local subgraph includes directly and indirectly related upstream and downstream entities.
7. The method as described in claim 2, characterized in that, After marking entities smaller than the preset association threshold as edge entities, the method further includes: Monitor the number of failures and the synchronicity of failure occurrences of the edge entities; When the number of fault occurrences exceeds a preset number of occurrences and the synchronicity of fault occurrences exceeds a preset threshold, the edge marker of the current entity is overwritten with the center marker.
8. A monitoring and alarm system that supports multi-entity, multi-dimensional correlation analysis, characterized in that: The system is used to implement the monitoring and alarm method supporting multi-entity multi-dimensional correlation analysis as described in any one of claims 1-7, wherein the system comprises: Entity association factor construction module: Constructs entity association factors, and hierarchically divides the distributed entity set according to the entity association factors to obtain a first type of entity and a second type of entity. The first type of entity is the edge entity and the second type of entity is the central entity. Fault event tracing request receiving module: receives fault event tracing requests and identifies the category of the fault entity corresponding to the fault event tracing request; First fault tracing module: When the fault entity is classified as a first type of entity, the edge association tracing mechanism is used to perform fault tracing of edge multi-dimensional monitoring data and obtain the first edge tracing alarm information. The edge association tracing mechanism is a fault propagation model based on a deep priority search engine. The second fault tracing module: When the fault entity is classified as a second type of entity, the central association tracing mechanism is used to perform fault tracing of the central multi-dimensional monitoring data and obtain the first central tracing alarm information. The central association tracing mechanism is a fault propagation model based on a breadth-priority search engine.