Method and apparatus for detecting transaction monitoring access integrity and alert configuration completeness

Abstract

The application discloses a kind of transaction monitoring access integrity and alarm configuration completeness detection method and device, wherein the method comprises: obtaining IT asset data from configuration management database, the IT asset data includes the monitoring object data of monitoring system;Monitoring configuration data and monitoring collection data are obtained from monitoring system;According to pre-configured rule base, dispatch rule engine to IT asset data, monitoring configuration data and monitoring collection data are executed automatic analysis, and the detection result of transaction monitoring access integrity and alarm configuration completeness is obtained;The pre-configured rule base is used to: detect the monitoring object not accessed in IT asset data monitoring system;Verify the validity of the monitoring object accessed in monitoring system;Check whether the preset business index is configured in monitoring configuration data;According to monitoring collection data, the rationality of alarm threshold and alarm frequency is evaluated.The application can automatically detect the abnormal situation of transaction monitoring system.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for detecting the integrity of transaction monitoring access and the completeness of alarm configuration. Background Technology

[0002] Online transaction monitoring is an indispensable core module in banking information systems. It monitors key indicators such as transaction success rate, transaction response time, and transaction throughput to ensure the security, stability, compliance, and efficiency of banking operations. With the increasing prevalence of distributed architectures and rising business complexity, the role of monitoring systems in fault detection and root cause analysis is becoming increasingly important, leading to higher requirements for their reliability and completeness.

[0003] Existing technologies largely focus on optimizing the internal performance of monitoring systems, aiming to improve the quality and efficiency of the "observation results." Specifically, they mainly concentrate on the following directions: first, expanding the monitoring coverage by connecting more data sources to increase the breadth of observation; second, optimizing data processing efficiency by reducing latency and increasing throughput through streaming computing, heterogeneous storage, and other means; and third, enriching alarm judgment strategies by introducing multi-dimensional thresholds and intelligent algorithms to improve alarm accuracy.

[0004] However, all the above-mentioned technical solutions share a common technical flaw: they focus on optimizing the "observation results" of the monitoring system while neglecting the verification of the "observation behavior" itself. This fails to address issues such as missed or false alarms caused by missing monitoring configurations, configuration failures, or inconsistent configuration standards. When new nodes are not synchronously connected to the monitoring system, when protocol upgrades result in parsing failures, or when alarm thresholds are set too leniently, the monitoring system may still display normal "observation results," effectively creating a monitoring blind spot. Such problems typically rely on manual inspections or passive discovery after a fault occurs, lacking proactive verification and governance mechanisms. Summary of the Invention

[0005] This invention provides a method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration, used to automatically detect abnormal situations in the transaction monitoring system. The method includes: Retrieve IT asset data from the configuration management database, including monitoring object data from the monitoring system; retrieve monitoring configuration data and monitoring collection data from the monitoring system. Based on a pre-configured rule base, the scheduling rule engine performs automated analysis on IT asset data, monitoring configuration data, and monitoring collection data to obtain detection results for transaction monitoring access integrity and alarm configuration completeness; the pre-configured rule base is used for: transaction monitoring access integrity check and alarm configuration completeness check; The transaction monitoring access integrity check includes: detecting monitoring objects in IT asset data that are not connected to the monitoring system; and verifying the validity of monitoring objects that are already connected to the monitoring system. The alarm configuration completeness check includes: checking whether preset business indicators are configured in the monitoring configuration data; and evaluating the rationality of alarm thresholds and alarm frequencies based on the monitoring data collected.

[0006] This invention also provides a detection device for the integrity of transaction monitoring access and the completeness of alarm configuration, used to automatically detect abnormal situations in the transaction monitoring system. The device includes: The data acquisition module is used to: acquire IT asset data from the configuration management database, wherein the IT asset data includes monitoring object data of the monitoring system; and acquire monitoring configuration data and monitoring collection data from the monitoring system. The transaction monitoring and detection module is used to: schedule the rule engine to perform automated analysis on IT asset data, monitoring configuration data, and monitoring collection data according to a pre-configured rule base, and obtain detection results for transaction monitoring access integrity and alarm configuration completeness; the pre-configured rule base is used for: transaction monitoring access integrity check and alarm configuration completeness check; The transaction monitoring access integrity check includes: detecting monitoring objects in IT asset data that are not connected to the monitoring system; and verifying the validity of monitoring objects that are already connected to the monitoring system. The alarm configuration completeness check includes: checking whether preset business indicators are configured in the monitoring configuration data; and evaluating the rationality of alarm thresholds and alarm frequencies based on the monitoring data collected.

[0007] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration.

[0008] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration.

[0009] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned detection method for transaction monitoring access integrity and alarm configuration completeness.

[0010] Compared with existing technologies that optimize the internal data processing path of monitoring systems, this invention obtains IT asset data from the configuration management database and monitoring configuration data and monitoring collection data from the monitoring system. Through a scheduling rule engine, it performs automated detection based on a rule base containing rules for transaction monitoring access integrity checks and alarm configuration completeness checks, thereby achieving proactive verification of the monitoring system's "observation behavior" itself. On the one hand, it automatically detects monitoring objects that have not yet been connected to the monitoring system and verifies the validity of those already connected, eliminating monitoring blind spots caused by missing or invalid configurations at the source. On the other hand, it combines monitoring collection data to evaluate the rationality of alarm thresholds and frequencies, avoiding missed or false alarms caused by improper static configurations. This invention automatically detects anomalies in the transaction monitoring system, shifting the focus of monitoring reliability from reactive discovery to proactive prevention, significantly improving the completeness and automation level of the transaction monitoring system. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a flowchart illustrating the detection method for transaction monitoring access integrity and alarm configuration completeness in this embodiment of the invention. Figure 2 This is an example diagram illustrating the detection process for transaction monitoring access integrity and alarm configuration completeness in an embodiment of the present invention; Figure 3 This is a flowchart of multi-source data correlation analysis in an embodiment of the present invention; Figure 4 This is another example diagram illustrating the detection process for transaction monitoring access integrity and alarm configuration completeness in this embodiment of the invention; Figure 5 This is a schematic diagram of a detection device for the integrity of transaction monitoring access and the completeness of alarm configuration in an embodiment of the present invention. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0013] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0014] In current large-scale distributed system architectures, transaction monitoring is a critical link in ensuring business continuity and stability. Network bypass mirroring technology is typically used to collect network traffic data without affecting the main business flow, and to monitor and issue alerts for metrics such as transaction performance, success rate, and response time. However, existing technologies mainly suffer from the following problems: 1. Difficulty in ensuring access integrity: Whether the business systems that need to be monitored are connected to the monitoring system and whether the access nodes are comprehensive (such as missing newly added nodes) often relies on manual registration and verification, which is easy to overlook.

[0015] 2. Comprehensive configuration cannot be verified automatically: Whether key indicators (such as success rate and response time) are configured, whether alarm thresholds are set reasonably, and whether alarm frequency is appropriate are usually checked manually by consulting configuration documents or interfaces, which is inefficient and prone to errors.

[0016] 3. Lack of continuous verification of monitoring effectiveness: Whether there is real traffic and whether the monitoring actually captures data after the business system is connected to the monitoring system are often only discovered passively after a problem occurs.

[0017] 4. Difficulty in uniformly managing configuration compliance: Alarm thresholds and frequency settings vary across different business systems or teams, lacking a unified mechanism for verifying reasonableness.

[0018] To overcome the problems existing in the prior art, this invention proposes a method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration, ensuring the integrity, accuracy and effectiveness of the entire transaction monitoring process from access to alarm.

[0019] Figure 1 This is a flowchart illustrating the detection method for transaction monitoring access integrity and alarm configuration completeness in an embodiment of the present invention. Figure 1 As shown, this method can be implemented by following these steps: Step 101: Obtain IT asset data from the configuration management database, including monitoring object data of the monitoring system; obtain monitoring configuration data and monitoring collection data from the monitoring system; Step 102: Based on the pre-configured rule base, the scheduling rule engine performs automated analysis on IT asset data, monitoring configuration data, and monitoring collection data to obtain the detection results of transaction monitoring access integrity and alarm configuration completeness; the pre-configured rule base is used for: transaction monitoring access integrity check and alarm configuration completeness check; The transaction monitoring access integrity check includes: detecting monitoring objects in IT asset data that are not connected to the monitoring system; and verifying the validity of monitoring objects that are already connected to the monitoring system. The alarm configuration completeness check includes: checking whether preset business indicators are configured in the monitoring configuration data; and evaluating the rationality of alarm thresholds and alarm frequencies based on the monitoring data collected.

[0020] Compared with existing technologies that optimize the internal data processing path of monitoring systems, this invention obtains IT asset data from the configuration management database and monitoring configuration data and monitoring collection data from the monitoring system. Through a scheduling rule engine, it performs automated detection based on a rule base containing rules for transaction monitoring access integrity checks and alarm configuration completeness checks, thereby achieving proactive verification of the monitoring system's "observation behavior" itself. On the one hand, it automatically detects monitoring objects that have not yet been connected to the monitoring system and verifies the validity of those already connected, eliminating monitoring blind spots caused by missing or invalid configurations at the source. On the other hand, it combines monitoring collection data to evaluate the rationality of alarm thresholds and frequencies, avoiding missed or false alarms caused by improper static configurations. This invention automatically detects anomalies in the transaction monitoring system, shifting the focus of monitoring reliability from reactive discovery to proactive prevention, significantly improving the completeness and automation level of the transaction monitoring system.

[0021] First, in this embodiment of the invention, IT asset data is obtained from the configuration management database CMDB, which includes monitoring object data of the monitoring system; monitoring configuration data and monitoring collection data are obtained from the monitoring system.

[0022] In one embodiment, IT asset data in the CMDB, monitoring configuration data in the monitoring system, and monitoring collection data are acquired synchronously.

[0023] For the key aspects of monitoring access and alarm configuration, this embodiment of the invention designs a series of automatically executable checks and incorporates reasonableness judgment rules in the rule base.

[0024] In this embodiment of the invention, based on a pre-configured rule base, the scheduling rule engine performs automated analysis on IT asset data, monitoring configuration data, and monitoring collection data to obtain detection results for transaction monitoring access integrity and alarm configuration completeness. The pre-configured rule base is used for: transaction monitoring access integrity checks and alarm configuration completeness checks. The transaction monitoring access integrity check includes: detecting monitoring objects in the IT asset data that are not connected to the monitoring system; verifying the validity of monitoring objects that are connected to the monitoring system. The alarm configuration completeness check includes: checking whether preset business indicators are configured in the monitoring configuration data; and evaluating the rationality of alarm thresholds and alarm frequencies based on the monitoring collection data.

[0025] For example, a hierarchical triggering mechanism can be used when executing rules, such as a hybrid mode of real-time triggering, timed triggering, and event triggering.

[0026] In another embodiment, the detection results of transaction monitoring access integrity and alarm configuration completeness can be set as hierarchical alarms and visualized. Specifically, the inspection results are divided into "serious", "important", and "general" levels and displayed in the form of dashboards, reports, etc.

[0027] For complex anomaly detection results, maintenance work orders are automatically generated, assigned to the relevant responsible persons, and tracked until the loop is closed.

[0028] Figure 2 This is an example diagram illustrating the detection process for transaction monitoring access integrity and alarm configuration completeness in an embodiment of the present invention. Figure 2 As shown, the process mainly includes four stages: First, the data source, which obtains the business system list from the CMDB, transaction indicator data and monitoring configuration data from the monitoring system, and establishes a mapping relationship between the monitoring asset list and the data collection source; second, the rule base, which designs multi-level inspection items and machine control (automatically controlled by computer) rules, including system-level access inspection rules, node-level integrity inspection rules and alarm threshold verification rules; third, the execution engine, which implements a periodic automated inspection mechanism, which can be achieved by using scheduled tasks or event-triggered execution; finally, the output detection results can include hierarchical visualization reports and automatically generated and dispatched work orders.

[0029] Figure 3 This is a flowchart of multi-source data correlation analysis in an embodiment of the present invention.

[0030] To improve the efficiency of inspection rule execution and ensure the consistency of inspection benchmarks, a mapping relationship between the monitored asset list and the data collection source can be established. In one embodiment, such as... Figure 3 As shown, you can also perform correlation analysis on multi-source data such as IT asset data, monitoring configuration data, and monitoring collection data. The specific steps are as follows: Step 301: Link and store the IT asset data, monitoring configuration data, and monitoring collection data corresponding to the same asset to establish a multi-source fusion dataset; Step 302: Based on the pre-configured rule base, and with the multi-source fusion dataset as input, schedule the rule engine to perform automated analysis to obtain the detection results of transaction monitoring access integrity and alarm configuration completeness.

[0031] For example, using a multi-data source interface adapter can adapt to data from different sources, such as CMDB, monitoring configuration database, traffic analysis system, operation and maintenance management platform, etc.

[0032] For example, a multi-source fusion dataset can be a three-dimensional verification matrix composed of IT asset data, monitoring configuration data, and monitoring collection data.

[0033] In this embodiment of the invention, a series of automated control and inspection items for monitoring access integrity are designed, mainly including two categories: system-level access inspection and node-level integrity inspection.

[0034] In one embodiment, detecting monitoring objects in IT asset data that are not connected to the monitoring system includes: based on business system information in the IT asset data and business system information already connected to the monitoring system in the monitoring configuration data, detecting business system information in the IT asset data that is not connected to the monitoring system. At the "business system" level, accurately identifying business systems not connected to the monitoring scope.

[0035] For business systems that have been connected to the monitoring system, node-level inspection items for the business systems have also been designed.

[0036] In one embodiment, detecting monitoring objects not connected to the monitoring system in IT asset data includes: determining business systems already connected to the monitoring system based on monitoring configuration data; and detecting server node information not connected to the monitoring system in the IT asset data based on the corresponding server node information of the business systems already connected to the monitoring system in the IT asset data and the monitoring data. For "business systems already connected to the monitoring scope," server nodes not connected to the monitoring scope are accurately identified at the "server node" level.

[0037] For example, after a business system was expanded, five new server nodes were added, but the monitoring system did not update its monitoring configuration accordingly. The latest application node list (20 nodes in total) for the business system was retrieved from the CMDB and compared with the node list actually collected by the monitoring system (only 15 nodes). The rule engine automatically marked the five unconnected nodes, triggering a "critical" level anomaly check. A visual report and pending work orders for the unconnected nodes were automatically generated, avoiding blind spots in transaction performance caused by missed node connections and reducing fault detection time from several days of manual inspection to just a few hours.

[0038] In one embodiment, verifying the validity of the monitored object that has been connected to the monitoring system includes: determining the business system that has been connected to the monitoring system based on the monitoring configuration data; and detecting incorrectly connected server node information in the monitoring collection data based on the system link architecture information of the business system that has been connected to the monitoring system in the IT asset data and the corresponding server node link information in the monitoring collection data.

[0039] By verifying the consistency of the link architecture, server nodes that have been connected to the monitoring system but exist in the wrong link location can be accurately identified, ensuring the accuracy of monitoring data.

[0040] In one embodiment, verifying the validity of the monitored objects already connected to the monitoring system includes: determining the server nodes already connected to the monitoring system based on monitoring configuration data; analyzing the real-time traffic characteristic data of the server nodes already connected to the monitoring system in the monitoring collection data; if the real-time traffic characteristic data does not conform to the preset business traffic characteristics, the server nodes already connected to the monitoring system are determined to be abnormal nodes. This effectively identifies monitoring blind spots caused by data collection failures. Abnormalities may include "collection anomalies" and "business anomalies."

[0041] For example, in a certain channel system, three nodes consistently had no transaction traffic, but monitoring showed them as "normal." During peak business hours, it was detected that these nodes in the channel system lacked data packets matching the business characteristics. The rule engine, combined with tags in the CMDB data, identified these nodes as "silent nodes," triggering an "important" level anomaly check. It automatically generated a visual report and pending work orders listing the nodes with no transaction traffic, thus avoiding potential business interruption risks and improving monitoring coverage.

[0042] In one embodiment, evaluating the rationality of alarm thresholds and alarm frequencies based on monitoring and collected data includes: generating alarm thresholds using a time series prediction algorithm based on historical traffic characteristic data in the monitoring and collected data; if the difference between the alarm thresholds generated by the time series prediction algorithm and the alarm thresholds configured in the monitoring configuration data exceeds a preset range, then the alarm thresholds in the monitoring configuration data are determined to be unreasonable.

[0043] By analyzing traffic characteristic data through time series prediction algorithms, alarm thresholds that conform to the dynamic changes in business can be generated and compared with the currently statically configured thresholds. This can proactively detect the risk of missed or false alarms that may be caused by improper threshold settings.

[0044] For example, a system's success rate alarm threshold is fixed at 96%, but it doesn't account for changes in operational metrics due to business fluctuations. By extracting real-time traffic characteristic data from the past week for the relevant business scenarios, and calculating the success rate's 99.9% confidence interval as [99.5%, 100%] based on a time series analysis model, the rule engine determines that the current threshold (96%) is lower than the actual business level and recommends adjusting it to 99%. It automatically generates a visual report and a pending work order showing the success rate configuration and recommended threshold, achieving automatic provision of recommended thresholds without manual review. Furthermore, the automatically generated, highly sensitive monitoring metrics make it easier to detect business system anomalies, and the false alarm rate is very low.

[0045] In one embodiment, evaluating the rationality of alarm thresholds and alarm frequencies based on monitoring and collected data includes: determining whether a preset alarm frequency limit is exceeded based on the number of times the same alarm is triggered within a unit time period in the monitoring and collected data; if the alarm frequency limit is exceeded, determining whether an alarm storm has occurred by combining the alarm convergence rules or alarm aggregation rules in the monitoring configuration data.

[0046] By monitoring the actual frequency of alarms and combining the alarm convergence and aggregation rules in the monitoring configuration data, the risk of "alarm storms" can be effectively identified and prevented, thereby improving the availability and operational efficiency of the alarm system.

[0047] Figure 4 This is another example diagram illustrating the detection process for transaction monitoring access integrity and alarm configuration completeness in an embodiment of the present invention. The specific detection process for transaction monitoring access integrity and alarm configuration completeness is as follows: Figure 4 As shown: First, the inspection task is started. Then, the inspection task control component obtains data from the CMDB and monitoring configuration data from the monitoring system, and calls the rule engine to perform anomaly rule matching. If the anomaly rule matching fails, the corresponding data is marked as normal and a weekly report summary is generated. If the anomaly rule matching succeeds, anomaly records are generated, the level of the anomaly record is determined (e.g., red alarm, orange alarm, and yellow alarm), a visual report is generated based on the graded processing results, and a work order is automatically generated to achieve closed-loop processing of monitoring and detection.

[0048] The method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration proposed in this embodiment of the invention has at least the following beneficial effects: 1. Improve monitoring reliability: Through automated control, fundamentally avoid human oversight and ensure that all critical business processes and nodes are effectively monitored.

[0049] 2. Improve operation and maintenance efficiency: Transform manual inspections into automatic inspections, saving a lot of manpower and increasing efficiency by more than 80%.

[0050] 3. Optimize alarm quality: Through a threshold rationality verification mechanism driven by historical data, alarms are more accurate, reducing false alarms and missed alarms. False alarms are reduced by more than 60%, and missed alarms are reduced by more than 90%.

[0051] 4. Achieve configuration standardization: Promote the unification and optimization of monitoring and alarm configurations through the built-in rationality judgment rules in the rule base.

[0052] 5. Shorter fault detection time: The time to detect monitoring blind spots has been reduced from several days to several hours.

[0053] 6. Resource cost optimization: Avoid redundant monitoring configurations and save 20-30% of monitoring resources.

[0054] This invention also provides a detection device for the integrity of transaction monitoring access and the completeness of alarm configuration, as described in the following embodiments. Since the principle by which this device solves the problem is similar to the detection method for the integrity of transaction monitoring access and the completeness of alarm configuration, the implementation of this device can refer to the implementation of the detection method for the integrity of transaction monitoring access and the completeness of alarm configuration; repeated details will not be elaborated further.

[0055] Figure 5 This is a schematic diagram of a detection device for transaction monitoring access integrity and alarm configuration completeness in an embodiment of the present invention. Figure 5 As shown, the device includes: Data acquisition module 501 is used for: acquiring IT asset data from the configuration management database, wherein the IT asset data includes monitoring object data of the monitoring system; and acquiring monitoring configuration data and monitoring collection data from the monitoring system. The transaction monitoring and detection module 502 is used to: schedule the rule engine to perform automated analysis on IT asset data, monitoring configuration data, and monitoring collection data according to a pre-configured rule base, and obtain the detection results of transaction monitoring access integrity and alarm configuration completeness; the pre-configured rule base is used for: transaction monitoring access integrity check and alarm configuration completeness check; The transaction monitoring access integrity check includes: detecting monitoring objects in IT asset data that are not connected to the monitoring system; and verifying the validity of monitoring objects that are already connected to the monitoring system. The alarm configuration completeness check includes: checking whether preset business indicators are configured in the monitoring configuration data; and evaluating the rationality of alarm thresholds and alarm frequencies based on the monitoring data collected.

[0056] In one embodiment, the transaction monitoring and detection module 502 is specifically used for: Link and store IT asset data, monitoring configuration data, and monitoring collection data corresponding to the same asset to establish a multi-source fusion dataset; Based on a pre-configured rule base and using a multi-source fusion dataset as input, the rule engine is scheduled to perform automated analysis to obtain detection results for the integrity of transaction monitoring access and the completeness of alarm configuration.

[0057] In one embodiment, the monitored objects in the detected IT asset data that are not connected to the monitoring system include: Based on the business system information in the IT asset data and the business system information that has been connected to the monitoring system in the monitoring configuration data, detect the business system information in the IT asset data that has not been connected to the monitoring system.

[0058] In one embodiment, the monitored objects in the detected IT asset data that are not connected to the monitoring system include: Based on the monitoring configuration data, identify the business systems that have been connected to the monitoring system; Based on the business systems already connected to the monitoring system, detect server node information in the IT asset data and the corresponding server node information in the monitoring data that is not connected to the monitoring system.

[0059] In one embodiment, verifying the validity of the monitored object already connected to the monitoring system includes: Based on the monitoring configuration data, identify the business systems that have been connected to the monitoring system; Based on the system link architecture information in the IT asset data and the corresponding server node link information in the monitoring data of the business systems already connected to the monitoring system, detect the information of incorrectly connected server nodes in the monitoring data.

[0060] In one embodiment, verifying the validity of the monitored object already connected to the monitoring system includes: Based on the monitoring configuration data, identify the server nodes that have been connected to the monitoring system; Analyze the real-time traffic characteristics of server nodes connected to the monitoring system in the monitoring data. If the real-time traffic characteristics do not conform to the preset business traffic characteristics, the server nodes connected to the monitoring system are identified as abnormal nodes.

[0061] In one embodiment, evaluating the reasonableness of alarm thresholds and alarm frequencies based on monitoring and data collection includes: Based on historical traffic characteristics data from the monitoring and collection data, alarm thresholds are generated using a time series prediction algorithm; If the difference between the alarm threshold generated by the time series prediction algorithm and the alarm threshold configured in the monitoring configuration data exceeds the preset range, then the alarm threshold in the monitoring configuration data is deemed unreasonable.

[0062] In one embodiment, evaluating the reasonableness of alarm thresholds and alarm frequencies based on monitoring and data collection includes: Based on the number of times the same alarm is triggered within a unit of time in the monitoring data, determine whether it exceeds the preset alarm frequency limit. If the alarm frequency exceeds the upper limit, the alarm convergence rule or alarm aggregation rule in the monitoring configuration data will be used to determine whether an alarm storm has occurred.

[0063] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration.

[0064] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration.

[0065] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned detection method for transaction monitoring access integrity and alarm configuration completeness.

[0066] Compared with existing technologies that optimize the internal data processing path of monitoring systems, this invention obtains IT asset data from the configuration management database and monitoring configuration data and monitoring collection data from the monitoring system. Through a scheduling rule engine, it performs automated detection based on a rule base containing rules for transaction monitoring access integrity checks and alarm configuration completeness checks, thereby achieving proactive verification of the monitoring system's "observation behavior" itself. On the one hand, it automatically detects monitoring objects that have not yet been connected to the monitoring system and verifies the validity of those already connected, eliminating monitoring blind spots caused by missing or invalid configurations at the source. On the other hand, it combines monitoring collection data to evaluate the rationality of alarm thresholds and frequencies, avoiding missed or false alarms caused by improper static configurations. This invention automatically detects anomalies in the transaction monitoring system, shifting the focus of monitoring reliability from reactive discovery to proactive prevention, significantly improving the completeness and automation level of the transaction monitoring system.

[0067] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0069] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0070] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0071] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting the integrity of transaction monitoring access and the completeness of alarm configuration, characterized in that, include: Retrieve IT asset data from the configuration management database, including monitoring object data from the monitoring system; retrieve monitoring configuration data and monitoring collection data from the monitoring system. Based on a pre-configured rule base, the scheduling rule engine performs automated analysis on IT asset data, monitoring configuration data, and monitoring collection data to obtain detection results for transaction monitoring access integrity and alarm configuration completeness; the pre-configured rule base is used for: transaction monitoring access integrity check and alarm configuration completeness check; The transaction monitoring access integrity check includes: detecting monitoring objects in IT asset data that are not connected to the monitoring system; and verifying the validity of monitoring objects that are already connected to the monitoring system. The alarm configuration completeness check includes: checking whether preset business indicators are configured in the monitoring configuration data; and evaluating the rationality of alarm thresholds and alarm frequencies based on the monitoring data collected.

2. The method as described in claim 1, characterized in that, Based on a pre-configured rule base, the scheduling rule engine performs automated analysis on IT asset data, monitoring configuration data, and monitoring collection data to obtain detection results for the completeness of transaction monitoring access and alarm configuration, including: Link and store IT asset data, monitoring configuration data, and monitoring collection data corresponding to the same asset to establish a multi-source fusion dataset; Based on a pre-configured rule base and using a multi-source fusion dataset as input, the rule engine is scheduled to perform automated analysis to obtain detection results for the integrity of transaction monitoring access and the completeness of alarm configuration.

3. The method as described in claim 1, characterized in that, The monitored objects in the detected IT asset data that are not connected to the monitoring system include: Based on the business system information in the IT asset data and the business system information that has been connected to the monitoring system in the monitoring configuration data, detect the business system information in the IT asset data that has not been connected to the monitoring system.

4. The method as described in claim 1, characterized in that, The monitored objects in the detected IT asset data that are not connected to the monitoring system include: Based on the monitoring configuration data, identify the business systems that have been connected to the monitoring system; Based on the business systems already connected to the monitoring system, detect server node information in the IT asset data and the corresponding server node information in the monitoring data that is not connected to the monitoring system.

5. The method as described in claim 1, characterized in that, The verification of the validity of the monitored objects already connected to the monitoring system includes: Based on the monitoring configuration data, identify the business systems that have been connected to the monitoring system; Based on the system link architecture information in the IT asset data and the corresponding server node link information in the monitoring data of the business systems already connected to the monitoring system, detect the information of incorrectly connected server nodes in the monitoring data.

6. The method as described in claim 1, characterized in that, The verification of the validity of the monitored objects already connected to the monitoring system includes: Based on the monitoring configuration data, identify the server nodes that have been connected to the monitoring system; Analyze the real-time traffic characteristics of server nodes connected to the monitoring system in the monitoring data. If the real-time traffic characteristics do not conform to the preset business traffic characteristics, the server nodes connected to the monitoring system are identified as abnormal nodes.

7. The method as described in claim 1, characterized in that, The evaluation of the rationality of alarm thresholds and alarm frequencies based on monitoring and data collection includes: Based on historical traffic characteristics data from the monitoring and collection data, alarm thresholds are generated using a time series prediction algorithm; If the difference between the alarm threshold generated by the time series prediction algorithm and the alarm threshold configured in the monitoring configuration data exceeds the preset range, then the alarm threshold in the monitoring configuration data is deemed unreasonable.

8. The method as described in claim 1, characterized in that, The evaluation of the rationality of alarm thresholds and alarm frequencies based on monitoring and data collection includes: Based on the number of times the same alarm is triggered within a unit of time in the monitoring data, determine whether it exceeds the preset alarm frequency limit. If the alarm frequency exceeds the upper limit, the alarm convergence rule or alarm aggregation rule in the monitoring configuration data will be used to determine whether an alarm storm has occurred.

9. A detection device for the integrity of transaction monitoring access and the completeness of alarm configuration, characterized in that, include: The data acquisition module is used to: acquire IT asset data from the configuration management database, wherein the IT asset data includes monitoring object data of the monitoring system; and acquire monitoring configuration data and monitoring collection data from the monitoring system. The transaction monitoring and detection module is used to: schedule the rule engine to perform automated analysis on IT asset data, monitoring configuration data, and monitoring collection data according to a pre-configured rule base, and obtain detection results for transaction monitoring access integrity and alarm configuration completeness; the pre-configured rule base is used for: transaction monitoring access integrity check and alarm configuration completeness check; The transaction monitoring access integrity check includes: detecting monitoring objects in IT asset data that are not connected to the monitoring system; and verifying the validity of monitoring objects that are already connected to the monitoring system. The alarm configuration completeness check includes: checking whether preset business indicators are configured in the monitoring configuration data; and evaluating the rationality of alarm thresholds and alarm frequencies based on the monitoring data collected.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

12. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images