A system alarm method and device, electronic equipment and storage medium

Abstract

The application provides a system alarm method and device, electronic equipment and storage medium, including obtaining real-time monitoring target operation data, scoring the health degree of the target operation data and associating alarms through a scoring model and alarm rules contained in a preset strategy knowledge base, and outputting the health degree score result and target alarm result corresponding to the target operation data, wherein the scoring model and alarm rules are dynamically updated based on historical feedback data. According to the application, the scoring model and alarm rules in the strategy knowledge base are dynamically updated according to actual feedback data, the limitations of static models are broken through, the dynamic optimization of the scoring model and alarm rules based on actual operation data is realized, the adaptability of the scoring model and alarm rules to services is improved, the scoring and alarm accuracy is improved, and the operation and maintenance efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of computer software technology, and in particular to a system alarm method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the widespread adoption of distributed systems and microservice architectures, the complexity of modern IT systems is increasing exponentially. To ensure stable system operation, enterprises generally deploy multi-dimensional monitoring and alerting systems to collect real-time data on server, application, and network metrics, and trigger alerts through pre-defined health scoring models.

[0003] The scoring models and threshold rules of existing alarm systems are mostly preset manually, relying on experience-based judgment and lacking the ability to adapt to dynamic changes in business scenarios. In scenarios such as system iteration, traffic fluctuations, or architecture adjustments, static rules are prone to generating a large number of false alarms or missed alarms, resulting in a large number of invalid alarms and reducing fault response efficiency. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a system alarm method, apparatus, electronic device, and storage medium to improve alarm accuracy.

[0005] According to one aspect of the present invention, a system alarm method is provided, the method comprising: Obtain real-time monitoring data of the target operation; The target operating data is scored and associated with alarms based on the scoring model and alarm rules contained in the preset strategy knowledge base to obtain the target score and target alarm results; wherein, the scoring model and the alarm rules are trained based on historical feedback data, and the historical feedback data includes at least the operation data for historical health scores and historical alarm results; Output the target score and the target alarm result.

[0006] In one possible embodiment, the method further includes: receiving target feedback data for the target score and the target alarm result, wherein the target feedback data includes monitoring indicator data, operation type data, and service instance data; The scoring model is trained based on the target feedback data to obtain an updated scoring model, which is then stored in the preset strategy knowledge base. Based on the target feedback data, the alarm thresholds of the monitoring indicators included in the alarm rules are updated and stored in the preset strategy knowledge base.

[0007] In one possible embodiment, the operation type data includes alarm identification data, which includes at least false alarms or alarm confirmations; The step of updating the monitoring metric alarm thresholds included in the alarm rules based on the target feedback data includes: Based on the alarm false alarm and alarm confirmation data, identify high false alarm scenarios and successful handling cases; Based on the target monitoring indicator thresholds included in the high false alarm scenarios and successful handling cases, the target monitoring indicator thresholds are updated.

[0008] In one possible embodiment, the method further includes: generating or updating alarm suppression rules based on the high false alarm scenario, wherein the alarm suppression rules are used to delay alarms.

[0009] In one possible embodiment, the method further includes: associating the target feedback data in the same call chain, and extracting features from the associating feedback data to obtain structured data; The structured data is stored in a preset feedback feature library.

[0010] In one possible embodiment, training the scoring model based on the target feedback data to obtain an updated scoring model includes: The scoring model is incrementally trained or fully retrained based on the structured data in the feedback feature library.

[0011] According to another aspect of the present invention, a system alarm device is provided, the device comprising: The acquisition module is used to acquire real-time monitoring target running data; The scoring and alarm module is used to perform health scoring and associated alarms on the target operating data based on the scoring model and alarm rules contained in the preset strategy knowledge base, so as to obtain the target score and target alarm results; wherein, the scoring model and the alarm rules are trained based on historical feedback data, and the historical feedback data includes at least the operation data for historical health scores and historical alarm results; The output module is used to output the target score and the target alarm result.

[0012] In one possible embodiment, the apparatus further includes: a feedback module, configured to receive target feedback data for the target score and the target alarm result, wherein the target feedback data includes monitoring indicator data, operation type data, and service instance data; The scoring model is trained based on the target feedback data to obtain an updated scoring model, which is then stored in the preset strategy knowledge base. Based on the target feedback data, update the monitoring indicator alarm thresholds contained in the alarm rules and store them in the preset strategy knowledge base; The operation type data includes alarm identification data, which includes at least false alarms or alarm confirmations; The step of updating the monitoring metric alarm thresholds included in the alarm rules based on the target feedback data includes: Based on the alarm false alarm and alarm confirmation data, identify high false alarm scenarios and successful handling cases; Based on the target monitoring indicator thresholds included in the high false alarm scenarios and successful handling cases, the target monitoring indicator thresholds are updated. Based on the high false alarm scenario, an alarm suppression rule is generated or updated, which is used to delay alarms; The feedback module is used to associate the target feedback data in the same call chain and extract features from the associated feedback data to obtain structured data. The structured data is stored in a preset feedback feature library; The step of training the scoring model based on the target feedback data to obtain an updated scoring model includes: The scoring model is incrementally trained or fully retrained based on the structured data in the feedback feature library.

[0013] According to another aspect of the present invention, an electronic device is provided, comprising: Processor; and Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform any of the system alarm methods described above.

[0014] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute any of the system alarm methods described above.

[0015] The embodiments of this invention provide one or more technical solutions that, after acquiring real-time monitored target operational data, perform health scoring and associate alarms on the target operational data using a scoring model and alarm rules contained in a preset strategy knowledge base, and output the corresponding health score and target alarm results. The scoring model and alarm rules are dynamically updated based on historical feedback data. By applying these embodiments, the limitations of static models are overcome by continuously and dynamically updating the scoring model and alarm rules in the strategy knowledge base based on actual feedback data. This achieves dynamic optimization of the scoring model and alarm rules based on actual operational data, improves the adaptability of the scoring model and alarm rules to the service, enhances the accuracy of scoring and alarms, and improves operational efficiency. Attached Figure Description

[0016] Further details, features, and advantages of the invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 A flowchart illustrating the system alarm method provided by the present invention; Figure 2 This is another flowchart illustrating the system alarm method provided by the present invention; Figure 3 A schematic diagram of a system alarm device provided by the present invention; Figure 4 A structural block diagram of an exemplary electronic device that can be used to implement embodiments of the present invention is shown. Detailed Implementation

[0017] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0018] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0019] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc., mentioned in this invention are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0020] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0021] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0022] Currently, in the field of operation and maintenance monitoring, the scoring of system health mainly relies on the following traditional technical solutions: 1. Rule-based scoring based on static thresholds: This method presets fixed threshold ranges for various monitoring indicators (such as CPU utilization and memory utilization). The system assigns different scores based on the range in which the current indicator value falls, and finally calculates a comprehensive health score using a fixed formula such as weighted average.

[0023] 2. Fixed-weight scorecard model: This technique constructs an evaluation system containing multiple indicators and assigns a fixed weight to each indicator. The health score is calculated by linearly weighting the scores of each indicator with their fixed weights. The weights are usually preset by experts based on experience and remain unchanged during system operation.

[0024] 3. Machine learning model without feedback loop: This solution uses historical monitoring data to train an initial machine learning model for health scoring. However, once the model is deployed, its scoring logic becomes fixed, and the system operates in an open loop, unable to use new operational experience generated after the model goes live as input to optimize itself.

[0025] 1. Poor adaptability and high false alarm rate: Rule-based scoring based on static thresholds cannot perceive dynamic changes in business load and gradual changes in the system environment. Its preset thresholds and rules quickly become outdated, resulting in a large number of false alarms during normal business peaks, or failing to provide timely alerts when resources are slowly deteriorating. The scoring results are severely out of sync with the actual health status of the system.

[0026] 2. Rigid Strategy and Knowledge Dependence: Fixed-weight scorecard models employ static and rigid weight allocation strategies. They fail to dynamically adjust the importance of different indicators based on the actual impact of faults or new insights gained by operations experts during the process. This results in a scoring strategy that fails to reflect the latest operational knowledge and becomes disconnected from real-world operational scenarios.

[0027] 3. Inability to continuously evolve and form a knowledge loop: While machine learning models without feedback loops possess rudimentary intelligence, their core flaw lies in the lack of a feedback loop from operational processes to model optimization. The model cannot learn from the confirmation, neglect, and handling actions of operations personnel, preventing the valuable experience of the SRE team from being accumulated and quantified. This leads to stagnation in the model's intelligence level and an inability to achieve continuous self-optimization.

[0028] Based on this, the present invention provides a system alarm method, apparatus, electronic device, and storage medium. The system alarm method provided by the present invention can be applied to any electronic device with alarm function, such as a server, computer, or mobile terminal. The following describes the solution of the present invention with reference to the accompanying drawings: like Figure 1 As shown, Figure 1 A flowchart illustrating the system alarm method provided by the present invention may include the following steps: S101. Obtain the target's operational data under real-time monitoring; S102. Based on the scoring model and alarm rules contained in the preset strategy knowledge base, perform health scoring and associated alarms on the target operation data to obtain target score and target alarm results; wherein, the scoring model and the alarm rules are trained based on historical feedback data, and the historical feedback data includes at least operation data for historical health scores and historical alarm results. S103, Output the target score and the target alarm result.

[0029] In this embodiment of the invention, after acquiring the target operational data under real-time monitoring, a health score and associated alarms are performed on the target operational data using a scoring model and alarm rules contained in a preset strategy knowledge base. The resulting health score and alarm results are then output. The scoring model and alarm rules are dynamically updated based on historical feedback data. By continuously updating the scoring model and alarm rules in the strategy knowledge base based on actual feedback data, this invention overcomes the limitations of static models, achieving dynamic optimization of the scoring model and alarm rules based on actual operational data. This improves the adaptability of the scoring model and alarm rules to the service, enhances the accuracy of scoring and alarms, and improves operational efficiency.

[0030] This invention allows for the real-time collection of service operation data during service execution. This operational data can include service attribute data, monitoring indicator data, etc. Service attribute data may include the language used by the service, port, service capacity information, etc., while monitoring indicator data may include response time, resource usage, etc. As one possible implementation, target operation data of the service can be acquired at preset time intervals. This time interval can be set according to the actual application scenario; for example, the time interval for high-priority services can be set to be shorter, and the time interval for low-priority services can be set to be longer, such as 10 seconds and 30 seconds respectively. This invention can acquire target operation data through any feasible data acquisition method, and this invention does not impose any specific limitations on this.

[0031] The collected target operational data can be input into a preset strategy knowledge base, which contains a scoring model and alarm rules. The scoring model includes multiple scoring dimensions and corresponding weights for each dimension, all of which are trainable parameters. In one possible embodiment, an initial scoring model can be set, containing multiple initial standard items and corresponding initial weights. These initial standard items, i.e., the aforementioned scoring dimensions, can include basic service information, service discovery information, operational monitoring information, and service capacity management information. Basic service information can include the language, port, and functions used by the service. Service discovery information can include upstream and downstream information, such as information about services the service depends on and services that depend on it. Operational monitoring information can include resource usage information, CPU information, and thread information. Service capacity management information can include the capacity allocated to the service and scaling thresholds. The weights corresponding to each standard item can be set according to the actual application scenario; the sum of the weights of all standard items should be 1.

[0032] Alarm rules are used to determine whether to issue alarm information for a service. Specifically, alarm rules can include alarm thresholds for multiple monitoring metrics and alarm suppression rules, such as debouncing periods and alarm masking times. These alarm rules are also trainable parameters. As one possible implementation, the initial alarm thresholds, debouncing periods, and alarm masking times for each monitoring metric can be set according to the actual application scenario.

[0033] The initial scoring model and initial alarm rules mentioned above can be trained based on historical feedback data. This historical feedback data can include the specific operation data performed by the operation and maintenance personnel on the alarm information before the current training time. For example, the historical feedback data can include the annotation results of the operation and maintenance personnel on the alarm and the complete operation data of the alarm. The annotation results can include false alarms, alarm confirmations, etc., and the complete operation data can include the creation, allocation and closure of fault work orders, the specific operation commands executed, such as service restart, configuration rollback, etc., as well as the behavior of ignoring or delaying the processing of alarm information.

[0034] In one possible embodiment, historical feedback data may also include alarm context information, which may include the original health score, underlying monitoring metrics such as CPU load and error log content, as well as environmental characteristics such as alarm time and corresponding service instance. In this way, by deeply binding operations to scenarios, a single feedback behavior is enriched into a training sample with a clear causal relationship, making it possible to analyze the effectiveness of operations in different scenarios.

[0035] The collected historical feedback data can be cleaned and its features extracted. Cleaning can include deduplication, removal of erroneous data, and data association. In this invention, any feasible method for deduplication and removal of erroneous data can be used to clean the historical feedback data; no specific limitation is made here. Data association can involve associating historical feedback data on the same call chain. This same call chain can be determined based on the call relationship between services. For example, if service A calls service B, and service B calls service C, then services A, B, and C are on the same call chain. The historical feedback data of services A, B, and C can be associated. This association can be achieved by storing the historical feedback data of the same call chain as the same array or by storing the historical feedback data of the same call chain using the same data identifier.

[0036] Feature extraction can be performed on historical feedback data according to preset feature fields. These preset feature fields can be pre-set according to the actual application scenario. As one possible implementation, the preset feature fields can include various monitoring indicator data, operation type data, log information, etc. After extracting features from the historical feedback data according to the preset feature fields, various information contained in the historical feedback data can be obtained. The extracted feature information can then be stored in a structured manner. For example, the same features in various historical feedback data can be stored using a unified feature identifier; the features of one historical feedback data point are stored as the same feedback feature. For ease of description, the database used to store feedback features can be called the feedback feature library in this invention. This library acts as a core data transfer station, and its output is no longer messy raw logs, but a refined set of quantitative features that directly points to which system state corresponds to which operation and maintenance judgment. This provides ready-to-use, high-value fuel for model training and rule adjustment in downstream strategy optimization modules.

[0037] The feedback feature library can be updated in real time after new historical feedback data is generated. This invention can include various training trigger conditions, such as training alarm rules and scoring models using batch feedback features at fixed training cycles (e.g., weekly), or immediately initiating training when specific types of urgent feedback (e.g., high-frequency false alarms) are received. This design ensures the timeliness and relevance of the optimization process, enabling the system to respond quickly to the latest practices of the operations team, rather than relying on rigid preset schedules. The training described above can be incremental training or full retraining.

[0038] In this invention, the initial scoring model and alarm rules can be trained separately for different business scenarios to better adapt to actual application scenarios. During the training of the initial scoring model, adjustments can be made based on the features actually contained in historical feedback data. This includes adjusting the standard items included in the scoring model, the weights of each standard item, and the scores of each standard item. For example, the features contained in the historical feedback data can be input into the initial scoring model to obtain the risk score result. This risk score result is then compared with the operation data and label data contained in the feedback data. If the operation data and label data indicate an incorrect risk score, the standard bins, weights, and scoring rules can be adjusted. For instance, new strongly correlated features can be mined from historical feedback data as standard items, and standard items that are irrelevant to the actual results or redundant can be removed, such as deleting weakly correlated features like user gender. Coarse-grained standard items can be broken down into more granular dimensions, such as breaking down service response speed into average response time and timeout rate. Weight adjustment can be achieved by automatically learning feature weights through algorithms such as logistic regression and XGBoost. The effect of weight adjustment can also be verified through A / B testing. The scoring rules for each standard item can be modified according to the actual application scenario. For example, the scoring rule for 7 consecutive days of login can be adjusted to only award points for 7 consecutive days of login and transaction behavior. This can correct the scoring in abnormal scenarios, such as using the default score for the historical behavior item of new users to avoid scoring distortion due to missing data.

[0039] After adjusting the scoring model, the adjusted scoring model can be verified using historical feedback data. If the accuracy of the scoring model increases, the current scoring model can be retained. The accuracy of the scoring model can be reflected by parameters such as AUC and error.

[0040] Training alarm rules can be based on historical feedback data to identify high-frequency false alarm scenarios and successful handling cases, automatically fine-tuning alarm thresholds for specific monitoring metrics, or generating new alarm suppression rules to quickly resolve obvious policy deviations. For example, if service D's monitoring metric data reaches the alarm threshold but is repeatedly marked as a false alarm, the corresponding monitoring metric threshold can be increased. Alarm suppression rules are used to buffer alarm behavior; for example, for high-frequency false alarm scenarios, alarm suppression rules can be adjusted by setting or lengthening the debouncing period, increasing the cumulative number of alarm triggers, etc.

[0041] The updated model and alerting rules can be stored in a strategy knowledge base. This knowledge base serves as the carrier of system intelligence, managing all optimization results in a versioned manner and pushing verified effective strategies to the online scoring and execution engine. This not only completes a full learning loop but also enables the system's decision-making capabilities to continuously improve over time and with accumulated experience, building a core competitive advantage.

[0042] After the target operational data is input into the preset strategy knowledge base, the preset strategy knowledge base can call the latest version of the scoring model and alarm rules to score and alarm the target operational data, obtaining the corresponding target score and target alarm results. In one possible embodiment, the target score may include the scores of each scoring dimension included in the scoring model, and the target alarm results may include the alarm results of each monitoring indicator. This allows the scores of each scoring dimension to be correlated with the alarm results, helping relevant personnel to better understand the service's operational status.

[0043] In one possible implementation, target scores and target alarm results can be simultaneously output through various channels, including visualization on an operations and maintenance monitoring dashboard and push notifications to responsible personnel via a reach platform. This process ensures that optimized strategies are applied to the production environment in a timely manner, transforming data intelligence into practical operations and maintenance decision support.

[0044] The output interface can be seamlessly embedded with feedback entry points, allowing operations and maintenance personnel to directly mark alerts as "confirmed," "false alarms," ​​or provide supplementary handling suggestions while viewing alarm details or health scores. These actions are captured by the system in real time and automatically flow into the feedback collection and processing module as new rounds of operations and maintenance feedback events. This ingenious design makes each decision output the starting point for the next strategy optimization, thereby ensuring the continuous operation of the experience-to-intelligence transformation cycle.

[0045] like Figure 2 As shown, Figure 2 A flowchart illustrating the system alarm method provided by the present invention may include the following steps: The system continuously collects monitoring metrics from servers, applications, and networks, such as CPU utilization, request response time, and error rate. Based on preset models and rules, the health scoring engine calculates the monitoring data, generates a service health score, triggers alarms according to thresholds, and outputs the health score and alarm information, pushing it to operations and maintenance personnel.

[0046] Operations and maintenance personnel receive alarm notifications via email, instant messaging, and other channels, and handle them in three ways based on the actual situation: Confirm and handle: The alarm is genuine and valid, and the fault has been repaired. Mark as a false alarm: The alarm is a false trigger, such as due to overly strict monitoring rules or data fluctuations. Ignore / Other actions: The alarm does not require handling or is a non-core issue. The operation and maintenance personnel associate the handling results with the monitoring context characteristics at the time, such as the metric value that triggered the alarm, the time, and the business scenario, and store them in the feedback feature database.

[0047] The system will determine whether optimization needs to be initiated based on the accumulation of feedback feature library. Specifically, it can be divided into timed activation or activation based on sufficient data volume. That is, it can trigger model retraining at fixed intervals (such as weekly) or when there is enough feedback data. Emergency false alarms and rule optimization: If a large number of false alarms or core rule problems occur in a short period of time, dynamic rule adjustment will be triggered immediately.

[0048] Using data from the feedback feature library as new labels, the health scoring model is retrained, and its parameters are updated. Simultaneously, alarm thresholds or rule logic can be directly adjusted. The optimized model and strategy are updated in the model / strategy knowledge base and invoked in real-time by the health scoring engine, forming a complete closed loop of monitoring → alarming → feedback → optimization → monitoring.

[0049] By applying this embodiment of the invention, the system successfully establishes a dynamic cycle of health scoring—operational operation—strategic optimization—re-scoring by collecting real-time feedback from maintenance personnel during alarm handling and defining it in a structured manner as quantifiable strategy optimization variables. This fundamentally changes the drawbacks of the traditional one-way operation of scoring systems, enabling the system to continuously learn and evolve from practical experience.

[0050] By defining and analyzing various feedback types and their contextual characteristics, the system can automatically transform unstructured operational experience into training data that the model can understand, thereby driving the iterative updates of the scoring model and rules. This approach not only achieves precise adaptation of scoring strategies to real-world operational scenarios but also transforms expert experience into reusable digital assets, effectively enhancing the depth and breadth of intelligent operations and maintenance.

[0051] Based on the same inventive concept, the present invention also provides a system alarm device, such as... Figure 3 As shown, the device 300 may include: The acquisition module 301 is used to acquire the target running data for real-time monitoring; The scoring and alarm module 302 is used to perform health scoring and associated alarms on the target operating data based on the scoring model and alarm rules contained in the preset strategy knowledge base, so as to obtain the target score and target alarm results; wherein, the scoring model and the alarm rules are trained based on historical feedback data, and the historical feedback data includes at least the operation data for historical health scores and historical alarm results; The output module 303 is used to output the target score and the target alarm result.

[0052] In one possible embodiment, the apparatus further includes: a feedback module, configured to receive target feedback data for the target score and the target alarm result, wherein the target feedback data includes monitoring indicator data, operation type data, and service instance data; The scoring model is trained based on the target feedback data to obtain an updated scoring model, which is then stored in the preset strategy knowledge base. Based on the target feedback data, update the monitoring indicator alarm thresholds contained in the alarm rules and store them in the preset strategy knowledge base; The operation type data includes alarm identification data, which includes at least false alarms or alarm confirmations; The step of updating the monitoring metric alarm thresholds included in the alarm rules based on the target feedback data includes: Based on the alarm false alarm and alarm confirmation data, identify high false alarm scenarios and successful handling cases; Based on the target monitoring indicator thresholds included in the high false alarm scenarios and successful handling cases, the target monitoring indicator thresholds are updated. Based on the high false alarm scenario, an alarm suppression rule is generated or updated, which is used to delay alarms; The feedback module is used to associate the target feedback data in the same call chain and extract features from the associated feedback data to obtain structured data. The structured data is stored in a preset feedback feature library; The step of training the scoring model based on the target feedback data to obtain an updated scoring model includes: The scoring model is incrementally trained or fully retrained based on the structured data in the feedback feature library.

[0053] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this invention comply with relevant laws and regulations and do not violate public order and good morals.

[0054] An exemplary embodiment of the present invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the electronic device to perform a method according to an embodiment of the present invention.

[0055] An exemplary embodiment of the present invention also provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0056] An exemplary embodiment of the present invention also provides a computer program product, including a computer program, wherein, when executed by a computer's processor, the computer program is used to cause the computer to perform a method according to an embodiment of the present invention.

[0057] refer to Figure 4 The present invention will now be described in the form of a structural block diagram of an electronic device 400 that can serve as a server or client of the present invention, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0058] like Figure 4 As shown, the electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. The RAM 403 may also store various programs and data required for the operation of the electronic device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0059] Multiple components in electronic device 400 are connected to I / O interface 405, including: input unit 406, output unit 407, storage unit 408, and communication unit 409. Input unit 406 can be any type of device capable of inputting information to electronic device 400. Input unit 406 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 407 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 408 may include, but is not limited to, disks and optical discs. Communication unit 409 allows electronic device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0060] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, any of the system alarm methods described above can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 400 via ROM 402 and / or communication unit 409. In some embodiments, the computing unit 401 can be configured to perform any of the system alarm methods described above by any other suitable means (e.g., by means of firmware).

[0061] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0062] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0063] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0064] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0065] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0066] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

Claims

1. A system alarm method, characterized in that, The method includes: Obtain real-time monitoring data of the target operation; The target operating data is scored and associated with alarms based on the scoring model and alarm rules contained in the preset strategy knowledge base to obtain the target score and target alarm results; wherein, the scoring model and the alarm rules are trained based on historical feedback data, and the historical feedback data includes at least the operation data for historical health scores and historical alarm results; Output the target score and the target alarm result.

2. The method according to claim 1, characterized in that, The method further includes: Receive target feedback data for the target score and the target alarm result, wherein the target feedback data includes monitoring indicator data, operation type data and service instance data; The scoring model is trained based on the target feedback data to obtain an updated scoring model, which is then stored in the preset strategy knowledge base. Based on the target feedback data, the alarm thresholds of the monitoring indicators included in the alarm rules are updated and stored in the preset strategy knowledge base.

3. The method according to claim 2, characterized in that, The operation type data includes alarm identification data, which includes at least false alarms or alarm confirmations; The step of updating the monitoring metric alarm thresholds included in the alarm rules based on the target feedback data includes: Based on the alarm false alarm and alarm confirmation data, identify high false alarm scenarios and successful handling cases; Based on the target monitoring indicator thresholds included in the high false alarm scenarios and successful handling cases, the target monitoring indicator thresholds are updated.

4. The method according to claim 3, characterized in that, The method further includes: Alarm suppression rules are generated or updated based on the high false alarm scenario, and the alarm suppression rules are used to delay alarms.

5. The method according to claim 2, characterized in that, The method further includes: The target feedback data in the same call chain are associated, and the associated feedback data is feature extracted to obtain structured data; The structured data is stored in a preset feedback feature library.

6. The method according to claim 5, characterized in that, The step of training the scoring model based on the target feedback data to obtain an updated scoring model includes: The scoring model is incrementally trained or fully retrained based on the structured data in the feedback feature library.

7. A system alarm device, characterized in that, The device includes: The acquisition module is used to acquire real-time monitoring target running data; The scoring and alarm module is used to perform health scoring and associated alarms on the target operating data based on the scoring model and alarm rules contained in the preset strategy knowledge base, so as to obtain the target score and target alarm results; wherein, the scoring model and the alarm rules are trained based on historical feedback data, and the historical feedback data includes at least the operation data for historical health scores and historical alarm results; The output module is used to output the target score and the target alarm result.

8. The apparatus according to claim 7, characterized in that, The device further includes: The feedback module is used to receive target feedback data for the target score and the target alarm result, wherein the target feedback data includes monitoring indicator data, operation type data and service instance data; The scoring model is trained based on the target feedback data to obtain an updated scoring model, which is then stored in the preset strategy knowledge base. Based on the target feedback data, update the monitoring indicator alarm thresholds contained in the alarm rules and store them in the preset strategy knowledge base; The operation type data includes alarm identification data, which includes at least false alarms or alarm confirmations; The step of updating the monitoring metric alarm thresholds included in the alarm rules based on the target feedback data includes: Based on the alarm false alarm and alarm confirmation data, identify high false alarm scenarios and successful handling cases; Based on the target monitoring indicator thresholds included in the high false alarm scenarios and successful handling cases, the target monitoring indicator thresholds are updated. Based on the high false alarm scenario, an alarm suppression rule is generated or updated, which is used to delay alarms; The feedback module is used to associate the target feedback data in the same call chain and extract features from the associated feedback data to obtain structured data. The structured data is stored in a preset feedback feature library; The step of training the scoring model based on the target feedback data to obtain an updated scoring model includes: The scoring model is incrementally trained or fully retrained based on the structured data in the feedback feature library.

9. An electronic device, comprising: processor; as well as Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1-6.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

Images