Event data alarm method, device and product

Abstract

The invention provides an event data alarm method, device and product, and belongs to the technical field of cloud computing. The method comprises the following steps: acquiring event data alarm configuration of a user, wherein the event data alarm configuration comprises event data information, an alarm constraint number and alarm constraint time; monitoring reported target event data according to the event data information, adding the target event data into an event data cache region, and determining whether the data quantity of the target event data in the event data cache region meets the alarm constraint quantity or not; when the data quantity meets the alarm constraint quantity, sliding a preset alarm sliding window in the event data cache region, and determining whether the target event data in the event data cache region meets the alarm constraint time or not; and when the target event data in the event data cache region meets the alarm constraint time, sending an alarm notification to a user. The invention aims to efficiently and reliably give an alarm for the event data.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of cloud computing, in particular, to an event data alarm method, device and product. BACKGROUND

[0002] With the rapid development and application of cloud computing and distributed architecture, various services and resource pools are deployed on heterogeneous cloud platforms. A large amount of event data representing system health and security is generated during the operation of services. Real-time processing and analysis of these event data are of great significance for improving system stability, ensuring data security, optimizing resource utilization, and providing good user experience.

[0003] In order to effectively manage and respond to these event data, an alarm mechanism needs to be set to monitor event data and timely trigger alarms to notify operation and maintenance personnel or automatically trigger response measures to ensure that problems can be quickly identified and solved. However, there is still a lack of an efficient and reliable method for alarming event data. SUMMARY

[0004] Embodiments of the present application provide an event data alarm method, device and product, aiming to efficiently and reliably alarm event data.

[0005] In a first aspect, an event data alarm method is provided, which comprises: obtaining an event data alarm configuration of a user, wherein the event data alarm configuration comprises event data information, an alarm constraint number and an alarm constraint time; monitoring target event data reported according to the event data information, adding the target event data to an event data cache area, and determining whether a data number of the target event data in the event data cache area meets the alarm constraint number; when the data number meets the alarm constraint number, sliding a preset alarm sliding window in the event data cache area, and determining whether the target event data in the event data cache area meets an alarm constraint time; when the target event data in the event data cache area meets the alarm constraint time, sending an alarm notification to the user.

[0006] Optionally, the event data information comprises an event category, a specific event identifier, a resource pool identifier and an event device identifier.

[0007] Optionally, monitoring target event data reported according to the event data information, and adding the target event data to an event data cache area comprises: generating a query statement corresponding to the target event data according to the event data information; In the current alarm period, according to the query statement corresponding to the target event data, the target event data reported in the last alarm period is queried in the event data storage cluster; When the target event data reported in the last alarm period is not queried, the current alarm period is suspended; When the target event data reported in the last alarm period is queried, the target event data is added to the event data cache area, and the same target event data in the event data cache area is de-duplicated.

[0008] Optionally, determining whether the data quantity of the target event data in the event data cache area meets the alarm constraint quantity comprises: When the data quantity of the target event data in the event data cache area is greater than or equal to the alarm constraint quantity, the data quantity meets the alarm constraint quantity; When the data quantity of the target event data in the event data cache area is less than the alarm constraint quantity, the data quantity does not meet the alarm constraint quantity, and the current alarm period is suspended.

[0009] Optionally, when the data quantity meets the alarm constraint quantity, a preset alarm sliding window is slid in the event data cache area, and whether the target event data in the event data cache area meets the alarm constraint time is determined, comprising: When the data quantity meets the alarm constraint quantity, the target event data is sorted in ascending order according to the event time in the event data cache area; A preset alarm sliding window is slid in the event data cache area, and the size of the alarm sliding window is determined according to the alarm constraint time; In the process of sliding the alarm sliding window, it is determined whether the difference between the event time of the first target event data and the event time of the last target event data in the alarm sliding window is less than or equal to the alarm constraint time; When the difference between the event time of the first target event data and the event time of the last target event data in the alarm sliding window is greater than the alarm constraint time, the alarm sliding window is updated; When the difference between the event time of the first target event data and the event time of the last target event data in the alarm sliding window is less than or equal to the alarm constraint time, the target event data in the event data cache area meets the alarm constraint time.

[0010] Optionally, after sending the alarm notification to the user, the method further comprises: In the event data cache area, the aged target event data is determined; delete the aged target event data from the event data cache area.

[0011] Optionally, in the event data cache area, determining the aged target event data comprises: in the event data cache area, when the index of any target event data is less than the current start index of the alarm sliding window, the target event data is determined as the aged target event data; or, for any target event data, when the difference between the current time and the event time of the target event data is greater than the target multiple of the alarm constraint time, the target event data is determined as the aged target event data.

[0012] In a second aspect, the embodiments of the present application provide an event data alarm device, the device comprises: an alarm configuration obtaining module, configured to obtain the event data alarm configuration of a user, wherein the event data alarm configuration comprises event data information, alarm constraint quantity and alarm constraint time; a first processing module, configured to monitor the target event data reported according to the event data information, add the target event data into the event data cache area, and determine whether the data quantity of the target event data in the event data cache area meets the alarm constraint quantity; a second processing module, configured to slide a preset alarm sliding window in the event data cache area when the data quantity meets the alarm constraint quantity, and determine whether the target event data in the event data cache area meets the alarm constraint time; an alarm notification module, configured to send an alarm notification to the user when the target event data in the event data cache area meets the alarm constraint time.

[0013] In a third aspect, the embodiments of the present application provide an electronic device, comprising a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction is executed by the processor to implement the event data alarm method in the first aspect.

[0014] In a fourth aspect, the embodiments of the present application provide a readable storage medium, wherein the readable storage medium stores a program or instruction, and the program or instruction is executed by a processor to implement the event data alarm method in the first aspect.

[0015] Advantages: The method provided in this application embodiment obtains the user's event data alarm configuration, which includes event data information, alarm constraint quantity, and alarm constraint time. Then, based on the event data information, it monitors and reports target event data, adds the target event data to an event data cache, and determines whether the amount of target event data in the event data cache meets the alarm constraint quantity. When the amount of data meets the alarm constraint quantity, it slides a preset alarm sliding window in the event data cache to determine whether the target event data in the event data cache meets the alarm constraint time. When the target event data in the event data cache meets the alarm constraint time, it sends an alarm notification to the user.

[0016] Based on this method, users can flexibly and dynamically update the event data alarm configuration to meet different alarm requirements for event data. When the amount of data meets the alarm constraint, the preset alarm sliding window can quickly and efficiently determine whether the target event data meets the alarm constraint time, thereby enabling efficient and reliable alarms for event data. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the architecture of a cloud computing cluster proposed in an embodiment of this application; Figure 2 This is a flowchart of the steps of an event data alarm method proposed in an embodiment of this application; Figure 3 This is an execution flowchart of an event data alarm method provided in an embodiment of this application; Figure 4 This is a functional block diagram of an event data alarm device proposed in an embodiment of this application; Figure 5 This is a schematic diagram of an electronic device according to an embodiment of this application; Figure 6 This is a schematic diagram of a readable storage medium provided in an embodiment of this application; Figure 7 This is a schematic diagram of a computer program product proposed in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0021] Elasticsearch: An open-source distributed search and analytics engine built on Apache Lucene. It is typically used for full-text search, log analysis, and real-time data processing. Elasticsearch can handle both structured and unstructured data, provides powerful query capabilities, and boasts high performance and scalability. CloudEvent: A standardized format for describing event data, designed to ensure effective interoperability and communication between different cloud services and systems, and to simplify event delivery in event-driven architectures; event-collector: An event data collector that receives, validates, and stores event data in Elasticsearch; Resource pooling: The ability to virtualize physical resources (such as computing, storage, and network resources) and allocate them to multiple users or applications on demand. Through resource pooling, service providers can utilize hardware resources more efficiently and provide flexibility and dynamic allocation of resources. Central Zone: A centralized data center area or network architecture in which different cloud services, storage, and computing resources are centrally managed and coordinated; in a cloud environment, the central zone is designed to improve security, management efficiency, and reduce latency. In modern cloud computing environments, with the widespread application of distributed architectures, various services and resource pools are deployed on heterogeneous cloud platforms. The operation of these services generates a large amount of event data. Event data includes not only the normal operating status of the system, but also important information such as faults, anomalies, and potential security issues. Real-time processing and analysis of this event data is of great significance for improving system stability, ensuring data security, optimizing resource utilization, and providing a good user experience.

[0022] To effectively manage and respond to this event data, an alarm mechanism is usually set up to monitor key indicators and the health of the system. When the event data meets the preset rules, the alarm system will promptly trigger an alarm to notify the operation and maintenance personnel or automatically trigger response measures to ensure that the problem can be quickly identified and resolved.

[0023] Currently, most monitoring and alerting systems rely on metrics from Zabbix, Nagios, and Prometheus, with few supporting complete alerting strategies that include event strings. Alternatively, they may depend solely on static rules and periodic polling to obtain event data for alerting, failing to meet the need for flexible alert configuration. On the other hand, while log-based storage and analysis tools (such as Elasticsearch) offer powerful query capabilities and data visualization, existing technologies still face challenges in dynamic event processing and alert triggering mechanisms.

[0024] Therefore, there is an urgent need for an event data alarm method that can perform real-time analysis and judgment on event data reported from various resource pools, and trigger alarms efficiently and reliably.

[0025] The following description, in conjunction with the accompanying drawings, details an event data alarm method provided by this application through specific embodiments and application scenarios.

[0026] Reference Figure 1 This diagram illustrates an architecture of a cloud computing cluster provided in an embodiment of this application. The cloud computing cluster includes multiple resource pools 1-n and a central area. The central area includes an event data receiving cluster, an event data storage cluster, and an event data alarm cluster. To ensure high availability, the event data receiving cluster may include multiple event data node receivers, i.e., event-collector 1-n. The event data storage cluster is built based on Elasticsearch and may include multiple event data storage nodes, i.e., Elasticsearch 1-n. The event data alarm cluster may include multiple alarm nodes, i.e., alarm-engine 1-n.

[0027] In the cloud computing cluster, based on the stateless clustered deployment of event-collector and alert-engine, as well as the Elasticsearch cluster mode and its powerful full-text search capabilities, the central service group has the ability to connect to large-scale resource pool event data, and is scalable, making it suitable for large-scale resource pool scenarios.

[0028] Each of the multiple resource pools 1-n is used to report the generated event data to any event data node receiver (event-collector) in the event data receiving cluster of the central area. After the data is validated for legality, it is written to the event data storage cluster. For example, the legality validation includes checking whether any event data conforms to a preset event data format. When it conforms to the preset event data format, the legality validation is passed. In actual implementation, other legality validations can also be set. This application embodiment does not impose any restrictions.

[0029] Users can define event data alarm configurations according to the needs of actual applications. The event data alarm cluster can monitor and alarm the event data in the event data storage cluster according to the event data alarm configuration.

[0030] Reference Figure 2 The diagram illustrates a flowchart of an event data alarm method provided in an embodiment of this application. The method can be applied to the aforementioned cloud computing cluster, and specifically includes the following steps: S101: Obtain the user's event data alarm configuration, which includes event data information, alarm constraint quantity, and alarm constraint time.

[0031] Event data includes, but is not limited to, running status information, fault information, and anomaly information. For example, event data reported by any resource pool in a cloud computing cluster includes virtual machine lifecycle event data and cloud disk backup event data.

[0032] In actual implementation, the format of event data can be set according to the needs of the actual application. In this embodiment, the event data can adopt the CloudEvent data format.

[0033] For example, CloudEvent data formats may include the following: version: CloudEvent version number; id: A unique identifier for the event, in string format; job: Event category, such as virtual machine events and network events, in string format; metric: A specific event identifier, a string, e.g., "vm_reboot"; data: Custom event details data, in JSON format; idc: Resource pool identifier, in string format; time: The time when the event occurred, in ISO 8601 format; instance: The device identifier of the event. For example, for restarting any virtual machine, the device identifier of the event includes the virtual machine UUID, which is a string type. For example, an event data in CloudEvent data format looks like this: { "version":"1.0", "id":"A777888999000", "job":"vm", / / Virtual machine related events "metric":"vm:reboot", / / Virtual machine restart event "idc":"beijing", / / Beijing Resource Pool "time":"2024-08-30T13:52:18.374Z", "instance":"456abcd4587246cb66666", "data":{ "name":"myvm", } } In actual implementation, users can flexibly configure the event data that needs to be monitored and alarmed according to the actual application requirements. Specifically, users can upload event data alarm configurations through a visual page. The event data alarm configurations include event data information, the number of alarm constraints, and the alarm constraint time.

[0034] Among them, event data information is used to characterize the scope of event data that needs to be monitored and alarmed. The event data information includes, but is not limited to, event category, specific event identifier, resource pool identifier, and device identifier of the event.

[0035] The number of alarm constraints and the duration of alarm constraints are user-configured constraints that trigger alarms. The duration of alarm constraints can be set in minutes, hours, or days. For example, it can be set to 5 minutes, 3 hours, or 7 days.

[0036] For example, the event data alarm configuration uses JSON format. Event data alarm configuration A is shown below: { "idc":"beijing", "job":"vm", "metric":"vm:reboot" "instance":"11111111111|222222222222|333333333333", "duration":"5m", "times":10 } The event data information includes: resource pool identifier (idc), event category (job), specific event identifier (metric), and event device identifier (instance). The meanings of these are the same as those in the event data format content. Furthermore, the event device identifier (instance) supports configuring multiple instances simultaneously, with the UUIDs of multiple instances separated by "|". The above event data alarm configuration indicates that event data that meets the event data information should be monitored and alarmed.

[0037] The alarm constraint quantity (times) and alarm constraint duration are combined to determine whether an alarm is triggered. For example, if the alarm constraint quantity (times) is 10 and the alarm constraint duration is 5m, it means that if the virtual machine experiences 3 restart events within 5 minutes, an alarm will be reported.

[0038] In actual implementation, the content of event data, the number of alarm constraints, and the duration of alarm constraints can be set according to the needs of the actual application, and this application embodiment does not impose any restrictions.

[0039] S102: Based on the target event data reported by the event data information monitoring, add the target event data to the event data cache area, and determine whether the number of target event data in the event data cache area meets the alarm constraint number.

[0040] In one feasible implementation, the process of adding the target event data to the event data cache based on the monitored and reported event data information includes the following steps: A1: Generate a query statement corresponding to the target event data based on the event data information.

[0041] Specifically, based on the event data information and the preset query statement template, a query statement corresponding to the target event data is generated.

[0042] Taking the event data alarm configuration A in step S101 as an example, the query statement for the target event data is as follows:

[0043] Where gte and lt represent the time range of the event data to be queried, that is, to query event data within the time range of 2024-08-22T03:30:00-2024-08-22T03:31:00.

[0044] A2: Within the current alarm period, based on the query statement corresponding to the target event data, query the target event data reported in the previous alarm period in the event data storage cluster.

[0045] In actual implementation, the time interval of each alarm cycle can be preset. Within each alarm cycle, an alarm judgment is performed once based on the number of alarm constraints and the alarm constraint time. For example, each alarm cycle can be set to 1 minute, that is, the task of performing an alarm judgment once per minute. In actual implementation, the size of the alarm cycle can be set according to the needs of the actual application. This application embodiment does not impose any restrictions.

[0046] To avoid repeatedly fetching event data, within the current alarm period, new target event data can be obtained only from all event data reported in the previous alarm period using the query statement corresponding to the target event data. Specifically, the time range of the query can be constrained by gte and lt in the above query statement.

[0047] For example, within the 1-minute alarm cycle of 03:31:00 on August 22, 2024, query the event data within the time range of the previous cycle, namely 2024-08-22T03:30:00-2024-08-22T03:31:00, to obtain the target event data.

[0048] Furthermore, to avoid repeatedly acquiring data from both ends of the time range, gte and lt can be set to left closed and right open, i.e., [2024-08-22T03:30:00, 2024-08-22T03:31:00). For the target event data at time 2024-08-22T03:31:00, it will be retrieved in the next alarm cycle.

[0049] A3: If no target event data reported in the previous alarm period is found, the system will hibernate in the current alarm period.

[0050] Specifically, if no target event data reported in the previous alarm period is found, the system can remain dormant for the current alarm period until the current alarm period ends. Sleep time = Total time of each alarm cycle - Execution time within the current alarm cycle; For example, if an alarm cycle is 60s, and no target event data reported in the previous alarm cycle is found, and 10s of the execution time within the current alarm cycle has passed, then sleep time = 60s - 10s = 50s.

[0051] A4: When the target event data reported in the previous alarm period is found, the target event data is added to the event data cache, and duplicate target event data in the event data cache are deduplicated.

[0052] For example, in a cloud computing cluster, an event data cache can be set up in the event data alarm cluster. When the target event data reported in the previous alarm period is retrieved from the event data storage cluster, all the retrieved target event data is first cached in the event data cache.

[0053] Since resource pools and other resources may report the same event data multiple times, we can first deduplicate the same target event data in the event data cache to ensure that there is only one instance of the same target event data in the event data cache.

[0054] Then, it is determined whether the number of target event data in the event data cache meets the alarm constraint number. Specifically, it is determined whether the number of target event data in the event data cache is greater than or equal to the alarm constraint number.

[0055] When the number of target event data in the event data cache is greater than or equal to the number of alarm constraints, the number of data satisfies the number of alarm constraints.

[0056] When the number of target event data in the event data buffer is less than the number of alarm constraints, the number of data does not meet the number of alarm constraints, and the event is put into hibernation during the current alarm period.

[0057] S103: When the amount of data meets the alarm constraint quantity, slide a preset alarm sliding window in the event data buffer to determine whether the target event data in the event data buffer meets the alarm constraint time.

[0058] In one feasible implementation, when the amount of data meets the alarm constraint quantity, the process of sliding a preset alarm sliding window in the event data buffer to determine whether the target event data in the event data buffer meets the alarm constraint time includes the following steps: B1: When the amount of data meets the alarm constraint quantity, the event data in the event data cache is sorted in ascending order according to the event time of the target event data.

[0059] For identical target event data, deduplication is performed, and all target event data in the event data cache are sorted in ascending order according to the event time of each target event data, i.e., the time in the data structure of each target event data.

[0060] B2: Slide the preset alarm sliding window in the event data buffer area.

[0061] Specifically, the size of the alarm sliding window is determined based on the alarm constraint time. For example, the starting index of the alarm sliding window is denoted as start, the ending index of the alarm sliding window is denoted as end, and the end of the alarm sliding window is equal to start + times - 1, where times is the number of alarm constraints.

[0062] B3: During the process of sliding the alarm sliding window, determine whether the difference between the event time of the first target event data and the last target event data in the alarm sliding window is less than or equal to the alarm constraint time.

[0063] When the difference between the event times of the first and last target event data in the alarm sliding window is greater than the alarm constraint time, it indicates that no target event data satisfying the alarm constraint quantity has appeared in a concentrated manner within the alarm constraint time. Therefore, no alarm needs to be issued, and the alarm sliding window is updated, i.e., the alarm sliding window continues to slide. The step size of the alarm sliding window is one target time data.

[0064] When the difference between the event times of the first and last target event data in the alarm sliding window is less than or equal to the alarm constraint time, the target event data in the event data buffer meets the alarm constraint time, indicating that within the alarm constraint time, a number of target event data that meet the alarm constraint requirements appear in a concentrated manner, and an alarm needs to be triggered.

[0065] S104: When the target event data in the event data cache meets the alarm constraint time, an alarm notification is sent to the user.

[0066] In actual implementation, the form of alarm notification can be set according to the needs of the actual application. For example, alarm notification can be displayed on the user's visualization page, or it can be sent through other means such as SMS. This application embodiment does not impose any restrictions.

[0067] In one feasible implementation, after sending an alarm notification to the user, the method further includes: In the event data cache, identify the target event data that is aging, and delete the aging target event data from the event data cache.

[0068] Specifically, the process of determining the target event data to be aged in the event data buffer includes: In the event data cache, when the index of any target event data is less than the current starting index of the alarm sliding window, the target event data is regarded as aged target event data.

[0069] As the alarm sliding window keeps moving forward, target event data that has already been traversed by the alarm sliding window and is located outside the alarm sliding window can be deleted as aging target event data, reducing the cache pressure in the event data cache area.

[0070] Alternatively, for any target event data, if the difference between the current time and the event time of the target event data is greater than a target multiple of the alarm constraint time, the target event data shall be regarded as aged target event data.

[0071] In actual implementation, a mechanism for determining the target event data of aging can also be set according to the needs of actual applications, and this application embodiment does not impose any restrictions.

[0072] Reference Figure 3 The diagram illustrates the execution flowchart of an event data alarm method provided in this application embodiment. Taking the cloud computing cluster provided in this application embodiment as an example, the execution process of this method is as follows: Users send event data alarm configurations to the management center of the event data alarm cluster. The management center of the event data alarm cluster can maintain different event data alarm configurations and can control the start and stop of any event data alarm configuration in response to user operations.

[0073] Within each alarm cycle, the system queries the event data storage cluster for all event data reported in the previous alarm cycle and executes the alarm logic configured for each event data alarm. Specifically, the alarm logic configured for any event data alarm is as follows: First, based on the event data information in the event data alarm configuration, generate a query statement for the target event data; Then, it is determined whether the target event data is found according to the query statement. If the target event data is not found, the alarm will enter a sleep state within the current alarm period. If the target event data is found, the target event data is cached in the event data cache area, and the target event data cached in the event data cache area is deduplicated.

[0074] Next, it is determined that the number of target event data in the event data cache is greater than or equal to the number of alarm constraints; if the number of data is less than the number of alarm constraints, the system enters sleep mode within the current alarm period; if the number of data is greater than or equal to the number of alarm constraints, the target event data is sorted in ascending order according to the event time in the event data cache.

[0075] Then, initialize the start and end positions of the alarm sliding window in the event data buffer. The start index of the alarm sliding window is start=0, and the end index of the alarm sliding window is end=start+times-1, where times is the number of alarm constraints.

[0076] Next, calculate whether the difference between the event times of the first and last target event data in the alarm sliding window is greater than the alarm constraint time. If the difference is greater than the alarm constraint time, update the alarm sliding window: start = start + 1, end = start + times - 1.

[0077] If the difference is less than or equal to the alarm constraint time, an alarm notification is sent to the user, and then the aged target event data is deleted.

[0078] The method provided in this application can support dynamic adjustment of event data alarm configuration and real-time event data alarm. For example, in a large-scale resource pool environment, it can perform efficient and reliable event data alarm processing based on CloudEvent data format and Elasticsearch storage cluster. Furthermore, it can use flexible event data alarm configuration to instantiate Elasticsearch query statements, strictly pull generated event data according to the left-closed and right-open time interval, and use alarm sliding window to detect whether the event data meets the alarm conditions. At the same time, it provides a data aging mechanism combined with alarm sliding window to reduce data caching pressure.

[0079] Reference Figure 4 This diagram illustrates a functional block diagram of an event data alarm device provided in an embodiment of this application. The device includes: The alarm configuration acquisition module 100 is used to acquire the user's event data alarm configuration, which includes event data information, alarm constraint quantity, and alarm constraint time. The first processing module 200 is used to monitor and report target event data according to the event data information, add the target event data to the event data cache, and determine whether the number of target event data in the event data cache meets the alarm constraint number. The second processing module 300 is used to slide a preset alarm sliding window in the event data cache area when the amount of data meets the alarm constraint quantity, and determine whether the target event data in the event data cache area meets the alarm constraint time. The alarm notification module 400 is used to send an alarm notification to the user when the target event data in the event data cache meets the alarm constraint time.

[0080] Optionally, the event data information includes: event category, specific event identifier, resource pool identifier, and device identifier of the event.

[0081] Optionally, the first processing module includes a query and cache unit, used for: Based on the event data information, generate a query statement corresponding to the target event data; Within the current alarm period, based on the query statement corresponding to the target event data, query the target event data reported in the previous alarm period in the event data storage cluster; If no target event data reported in the previous alarm cycle is found, the system will remain dormant during the current alarm cycle. When target event data reported in the previous alarm period is found, the target event data is added to the event data cache, and duplicate target event data in the event data cache are deduplicated.

[0082] Optionally, the first processing module includes a quantity determination unit, used for: When the number of target event data in the event data cache is greater than or equal to the number of alarm constraints, the number of data satisfies the number of alarm constraints. When the number of target event data in the event data buffer is less than the number of alarm constraints, the number of data does not meet the number of alarm constraints, and the event is put into hibernation during the current alarm period.

[0083] Optionally, the second processing module includes a time determination unit, used for: When the amount of data meets the alarm constraint, the event data in the event data cache is sorted in ascending order according to the event time of the target event data; Slide a preset alarm sliding window in the event data buffer area. The size of the alarm sliding window is determined according to the alarm constraint time. During the process of sliding the alarm sliding window, it is determined whether the difference between the event time of the first target event data and the last target event data in the alarm sliding window is less than or equal to the alarm constraint time. When the difference between the event times of the first target event data and the last target event data in the alarm sliding window is greater than the alarm constraint time, the alarm sliding window is updated. When the difference between the event times of the first and last target event data in the alarm sliding window is less than or equal to the alarm constraint time, the target event data in the event data buffer meets the alarm constraint time.

[0084] Optionally, the device further includes an aging data processing module for: In the event data cache, the target event data to be aged is determined; The aged target event data is deleted from the event data cache.

[0085] Optionally, the aging data processing module includes an aging data determination unit, used for: In the event data cache, when the index of any target event data is less than the current starting index of the alarm sliding window, the target event data is regarded as aged target event data. Alternatively, for any target event data, if the difference between the current time and the event time of the target event data is greater than a target multiple of the alarm constraint time, the target event data shall be regarded as aged target event data.

[0086] An event data alarm device in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc. Non-mobile electronic devices can be servers, network attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0087] An event data alarm device in this application embodiment can be a device with an operating system. The operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system.

[0088] Reference Figure 5 The diagram illustrates an electronic device provided in an embodiment of this application. The electronic device includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the various processes of the event data alarm method embodiment described above and achieve the same technical effect.

[0089] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0090] Reference Figure 6The diagram illustrates a readable storage medium provided in an embodiment of this application. The readable storage medium stores a program or instructions, which, when executed by a processor, implement the various processes of the event data alarm method embodiment described above, and achieve the same technical effect.

[0091] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0092] Reference Figure 7 The diagram illustrates a computer program product provided in an embodiment of this application, including a computer program / instruction. When the computer program / instruction is executed by a processor, it implements the various processes of the event data alarm method embodiment described above and achieves the same technical effect.

[0093] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0094] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0095] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. The description of the embodiments above is only for the purpose of helping to understand the method and core idea of ​​this application. Those skilled in the art can make many forms under the guidance of this application without departing from the spirit and scope of protection of the claims, and all of these are within the protection scope of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation and application scope based on the idea of ​​this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An event data alarm method, characterized in that, The method includes: Obtain the user's event data alarm configuration, which includes event data information, alarm constraint quantity, and alarm constraint time; Based on the target event data reported by the event data information monitoring, the target event data is added to the event data cache area, and it is determined whether the number of target event data in the event data cache area meets the alarm constraint number. When the amount of data meets the alarm constraint quantity, slide a preset alarm sliding window in the event data cache area to determine whether the target event data in the event data cache area meets the alarm constraint time. When the target event data in the event data cache meets the alarm constraint time, an alarm notification is sent to the user.

2. The method according to claim 1, characterized in that, The event data information includes: event category, specific event identifier, resource pool identifier, and device identifier of the event.

3. The method according to claim 1, characterized in that, Based on the event data information monitored and reported as target event data, the target event data is added to the event data cache, including: Based on the event data information, generate a query statement corresponding to the target event data; Within the current alarm period, based on the query statement corresponding to the target event data, query the target event data reported in the previous alarm period in the event data storage cluster; If no target event data reported in the previous alarm cycle is found, the system will remain dormant during the current alarm cycle. When target event data reported in the previous alarm period is found, the target event data is added to the event data cache, and duplicate target event data in the event data cache are deduplicated.

4. The method according to claim 3, characterized in that, Determining whether the number of target event data in the event data cache meets the alarm constraint number includes: When the number of target event data in the event data cache is greater than or equal to the number of alarm constraints, the number of data satisfies the number of alarm constraints. When the number of target event data in the event data buffer is less than the number of alarm constraints, the number of data does not meet the number of alarm constraints, and the event is put into hibernation during the current alarm period.

5. The method according to claim 1 or 4, characterized in that, When the amount of data meets the alarm constraint quantity, a preset alarm sliding window is slid in the event data cache to determine whether the target event data in the event data cache meets the alarm constraint time, including: When the amount of data meets the alarm constraint, the event data in the event data cache is sorted in ascending order according to the event time of the target event data; Slide a preset alarm sliding window in the event data buffer area. The size of the alarm sliding window is determined according to the alarm constraint time. During the process of sliding the alarm sliding window, it is determined whether the difference between the event time of the first target event data and the last target event data in the alarm sliding window is less than or equal to the alarm constraint time. When the difference between the event times of the first target event data and the last target event data in the alarm sliding window is greater than the alarm constraint time, the alarm sliding window is updated. When the difference between the event times of the first and last target event data in the alarm sliding window is less than or equal to the alarm constraint time, the target event data in the event data buffer meets the alarm constraint time.

6. The method according to claim 1, characterized in that, After sending an alert notification to the user, the method further includes: In the event data cache, the target event data to be aged is determined; The aged target event data is deleted from the event data cache.

7. The method according to claim 6, characterized in that, In the event data buffer, the target event data to be aged is determined, including: In the event data cache, when the index of any target event data is less than the current starting index of the alarm sliding window, the target event data is regarded as aged target event data. Alternatively, for any target event data, if the difference between the current time and the event time of the target event data is greater than a target multiple of the alarm constraint time, the target event data shall be regarded as aged target event data.

8. An event data alarm device, characterized in that, The device includes: The alarm configuration acquisition module is used to acquire the user's event data alarm configuration, which includes event data information, alarm constraint quantity, and alarm constraint time. The first processing module is used to monitor and report target event data according to the event data information, add the target event data to the event data cache, and determine whether the number of target event data in the event data cache meets the alarm constraint number. The second processing module is used to slide a preset alarm sliding window in the event data cache area when the amount of data meets the alarm constraint quantity, and determine whether the target event data in the event data cache area meets the alarm constraint time. The alarm notification module is used to send an alarm notification to the user when the target event data in the event data cache meets the alarm constraint time.

9. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the event data alarm method as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the event data alarm method as described in any one of claims 1-7.

Images