Intelligent operation and maintenance auxiliary system and method, electronic device, and storage medium

Abstract

The application provides a kind of intelligent operation and maintenance auxiliary system, method, electronic equipment and storage medium, it is related to intelligent operation and maintenance technical field, the system includes: front end display layer receives original alarm text from multiple heterogeneous monitoring systems, extracts target alarm field by default analysis rule, and sends to business logic layer;Business logic layer takes target alarm field as input parameter, calls external intelligent diagnosis service through intelligent diagnosis platform interface, and receives alarm diagnosis result;Utilize timing scheduler to obtain the average value of multiple historical unit time periods of target monitoring item within a predetermined time window through monitoring system interface in a timely manner, and determine resource trend value accordingly to assess the resource utilization of the monitored host;Through authentication authorization module, data access permissions are managed based on the mapping relationship of users, host groups and hosts;External interface layer provides intelligent diagnosis platform interface and monitoring system interface.The application improves operation and maintenance efficiency and resource evaluation accuracy.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology, specifically to an intelligent operation and maintenance auxiliary system, method, electronic device, and storage medium. Background Technology

[0002] In the field of IT operations and maintenance, monitoring and alarm management and fault diagnosis are core technical aspects that ensure the stable operation of information systems and the continuous availability of business.

[0003] Existing intelligent operation and maintenance frameworks lack unified access and front-end parsing capabilities for alarms from multi-source heterogeneous monitoring systems. Operation and maintenance personnel need to switch between multiple monitoring platforms to view alarm information, which is cumbersome and inefficient. Fault diagnosis relies heavily on historical data to train models or pre-built rule bases, lacking the ability to flexibly and intelligently diagnose alarm texts of arbitrary formats using large language models. Resource assessment uses instantaneous values ​​or inflection point matching methods, which are easily affected by business off-peak periods. Access control can only achieve functional-level access and lacks a data-level domain isolation mechanism, posing data security risks in multi-tenant scenarios. In containerized deployment environments, additional timer containers need to be configured, increasing the complexity of deployment, configuration, and operation and maintenance. Summary of the Invention

[0004] This invention aims to provide an intelligent operation and maintenance auxiliary system, method, electronic device, and storage medium to at least solve the problems existing in the prior art, such as the lack of unified access and front-end parsing capabilities for alarms from multi-source heterogeneous monitoring systems, the inability to perform flexible and intelligent diagnosis of alarm texts, the susceptibility of resource assessment to interference from off-peak business periods, data security risks in multi-tenant scenarios, and high complexity in deployment, configuration, and operation and maintenance.

[0005] The technical solution of the present invention to solve the above-mentioned technical problems is as follows: This invention provides an intelligent operation and maintenance assistance system, comprising a front-end display layer, a business logic layer, and an external interface layer. The business logic layer includes a timer and an authentication and authorization module. The external interface layer provides an intelligent diagnostic platform interface and a monitoring system interface, wherein: The front-end display layer receives raw alarm texts from various heterogeneous monitoring systems, extracts target alarm fields through preset parsing rules, and sends them to the business logic layer. The business logic layer takes the target alarm field as an input parameter, calls an external intelligent diagnostic service through the intelligent diagnostic platform interface, and receives the alarm diagnostic results returned by the external intelligent diagnostic service; it uses the timer scheduler to periodically obtain the average value of multiple historical time periods of the target monitoring item within a preset time window through the monitoring system interface, and determines the resource trend value based on the historical time period average value. The resource trend value is used to evaluate the resource utilization of the monitored host; and it manages data access permissions based on the mapping relationship between users, host groups, and hosts through the authentication and authorization module. The external interface layer is used to provide the interface for the intelligent diagnostic platform and the interface for the monitoring system.

[0006] The technical solution provided by this invention brings at least the following beneficial effects: In the intelligent operation and maintenance assistance system provided by this invention, the front-end display layer receives raw alarm texts from various heterogeneous monitoring systems and extracts target alarm fields according to preset parsing rules, realizing unified access and parsing of multi-source heterogeneous alarms. This solves problems such as scattered alarm data and cumbersome operations, improving the efficiency of operation and maintenance. The business logic layer passes the parsed alarm fields to the intelligent diagnostic platform interface, calls external intelligent diagnostic services to complete fault analysis, and can adapt to alarm texts of any format, realizing flexible and universal intelligent fault diagnosis. The timer scheduler deployed in the business logic layer obtains the average value of multiple historical time periods within a preset time window and calculates resource trend values ​​to evaluate host resource utilization, avoiding evaluation interference caused by load changes during business off-peak periods and improving the accuracy of resource status evaluation. At the same time, the timer scheduler is integrated inside the business logic layer, without relying on the operating system or deploying an additional independent timer container, simplifying the system deployment and configuration process. The authentication and authorization module in the business logic layer manages data access permissions based on the mapping relationship between users, host groups, and hosts. In multi-tenant, multi-business-line shared scenarios, it can strictly isolate the data access scope of users with different roles and reduce the risk of data leakage. In summary, the intelligent operation and maintenance assistance system provided by this invention, through its layered architecture design, achieves unified parsing of multi-source heterogeneous alarms, intelligent fault diagnosis, accurate resource assessment, data-level permission isolation, and built-in timed scheduling, effectively improving operation and maintenance efficiency, assessment accuracy, and data security, while reducing deployment and operation and maintenance costs.

[0007] Based on the above technical solution, the present invention can be further improved as follows.

[0008] Furthermore, the target alarm field includes alarm title, severity level, hostname, and IP address; the front-end display layer is used to: identify the alarm title in the original alarm text through keyword matching; perform word frequency weighting on the severity keywords appearing in the original alarm text based on preset severity keywords and their corresponding weights, and determine the severity level based on the calculation result; extract the value of a predefined field in the original alarm text, and record it as the hostname; and extract the IP address in the original alarm text through IP address matching rules.

[0009] The beneficial effects of this solution are as follows: By combining keyword matching, word frequency weighting, fixed field reading, and IP address matching rules, four core fields—alarm title, severity level, hostname, and IP address—are extracted from the original alarm texts of different heterogeneous monitoring systems. This allows for the conversion of various non-standard alarm texts into a unified standard format, enabling unified access and parsing of multi-source heterogeneous alarms, and providing data support for subsequent intelligent fault diagnosis and other services. Furthermore, by independently completing the parsing work at the front end, the processing pressure on the back end is effectively reduced, improving system operating efficiency and versatility.

[0010] Furthermore, the business logic layer also includes a data persistence module, which is used to store the alarm diagnosis results to a local database.

[0011] The beneficial effects of adopting this solution are as follows: The data persistence module stores the alarm diagnosis results generated by intelligent diagnosis in a unified local database, realizing the local retention and persistent management of diagnostic data. This not only makes it convenient for operation and maintenance personnel to check historical alarms and corresponding fault analysis conclusions at any time, but also accumulates complete historical data for operation and maintenance problem review, fault pattern statistics, and diagnostic model iterative optimization.

[0012] Furthermore, the timed scheduler is used to: periodically obtain the historical unit time-period average value of the target monitoring item within a preset time window through the monitoring system interface, wherein the target monitoring item includes the CPU utilization rate, memory utilization rate, and network traffic of the monitored host; perform a secondary average calculation on the historical unit time-period average value of the target monitoring item within the preset time window to obtain the resource trend value, and store the resource trend value in the local database through the data persistence module.

[0013] The beneficial effects of this solution are as follows: For three core monitoring indicators—host CPU utilization, memory utilization, and network traffic—historical unit time-period averages are collected periodically within a preset time window, and resource trend values ​​are obtained through secondary averaging. This effectively smooths out data fluctuations at a single point in time, avoids misjudgments of resource status caused by abnormally low loads during off-peak periods, and significantly improves the accuracy of host resource utilization assessment. At the same time, the calculated resource trend values ​​are uniformly stored in a local database, which can provide data basis for idle resource management, operation and maintenance strategy formulation, and system capacity planning.

[0014] Furthermore, the timer scheduler is also used to: periodically obtain the host list and its grouping information in the corresponding monitoring system through the monitoring system interface; create host records for newly discovered hosts in the local database through the data persistence module, and create or associate group records for them according to the grouping information.

[0015] The beneficial effects of this solution are as follows: The timed scheduler periodically pulls the host list and group information of the monitoring system, automatically identifies newly added hosts and completes local data archiving and group association, eliminating the need for maintenance personnel to manually enter information and improving maintenance efficiency; at the same time, this solution can also ensure that local host and group data are synchronized with the external monitoring system in real time, providing reliable data support for functions such as access control, data query, and resource statistics.

[0016] Furthermore, the timer scheduler is also used to: periodically obtain the list of triggers and their status values ​​in the corresponding monitoring system through the monitoring system interface, and update the status of the corresponding alarm record in the local database based on the status values.

[0017] The beneficial effects of this solution are as follows: The timer scheduler periodically obtains the triggers and status information of the monitoring system and automatically updates the alarm record status in the local database. This ensures that the local alarm record status is synchronized with the external monitoring system in real time, and promptly cleans up invalid and processed alarm information to ensure that the alarm status is true and valid. At the same time, this process is automatically triggered periodically by the timer scheduler, eliminating the need for manual verification of alarm status one by one, further simplifying the operation and maintenance process and improving alarm management efficiency.

[0018] Furthermore, the authentication and authorization module is used to: establish many-to-many relationships between users, host groups, and hosts; manage users' data access permissions according to preset permission filtering rules; wherein, the preset permission filtering rules include: administrator roles can access all hosts and alarm data; non-administrator roles can only access hosts under their associated host groups and their alarm data; and return an access failure response for unauthorized access requests.

[0019] The beneficial effects of this solution are as follows: The authentication and authorization module establishes a many-to-many mapping relationship between users, host groups, and hosts, and implements fine-grained access control based on this mapping relationship. By distinguishing the data access scope of administrators and ordinary operation and maintenance roles, non-administrator users can only view the host data and alarm information corresponding to their associated host groups, thus achieving data isolation between different businesses and different operation and maintenance personnel. At the same time, unauthorized access requests are intercepted and a failure response is returned, effectively avoiding security risks such as unauthorized access and data leakage, and improving the data security of the intelligent operation and maintenance system.

[0020] Correspondingly, the present invention also provides an intelligent operation and maintenance assistance method, applied to the above-mentioned intelligent operation and maintenance assistance system, comprising: The front-end presentation layer receives raw alarm texts from various heterogeneous monitoring systems, extracts the target alarm fields according to preset parsing rules, and sends them to the business logic layer. The business logic layer takes the target alarm field as an input parameter, calls the external intelligent diagnostic service through the intelligent diagnostic platform interface of the external interface layer, and receives the alarm diagnostic results returned by the external intelligent diagnostic service.

[0021] Furthermore, the method also includes: the business logic layer using a timer scheduler to periodically obtain the average value of multiple historical time periods of the target monitoring item within a preset time window through the monitoring system interface of the external interface layer; determining a resource trend value based on the average value of the historical time periods, the resource trend value being used to evaluate the resource utilization of the monitored host.

[0022] Furthermore, the method also includes: the business logic layer using a timer scheduler to periodically obtain the host list and its grouping information in the corresponding monitoring system through the monitoring system interface; creating host records for newly discovered hosts in the local database, and creating or associating group records for them according to the grouping information.

[0023] Furthermore, the method also includes: the business logic layer uses a timer scheduler to periodically obtain the list of triggers and their status values ​​in the corresponding monitoring system through the monitoring system interface, and updates the status of the corresponding alarm records in the local database based on the status values.

[0024] Furthermore, the method also includes: the business logic layer establishes a many-to-many relationship between users, host groups, and hosts through an authentication and authorization module, and manages users' data access permissions according to preset permission filtering rules; wherein, the preset permission filtering rules include: administrator roles can access all hosts and alarm data; non-administrator roles can only access hosts under their associated host groups and their alarm data; for unauthorized access requests, an access failure response is returned.

[0025] The present invention also provides an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the instructions to implement the above-described intelligent operation and maintenance assistance method.

[0026] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-described intelligent operation and maintenance assistance method. Attached Figure Description

[0027] Figure 1 A schematic block diagram of an intelligent operation and maintenance assistance system provided in one embodiment of the present invention; Figure 2 A schematic block diagram of an intelligent operation and maintenance assistance system provided in another embodiment of the present invention; Figure 3 A flowchart illustrating an intelligent operation and maintenance assistance method provided by the present invention; Figure 4 This is a schematic diagram of an electronic device provided by the present invention. Detailed Implementation

[0028] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0029] Existing intelligent operation and maintenance frameworks lack unified access and front-end parsing capabilities for alarms from multi-source heterogeneous monitoring systems. Operation and maintenance personnel need to switch between multiple monitoring platforms to view alarm information, which is cumbersome and inefficient. Fault diagnosis relies heavily on historical data to train models or pre-built rule bases, lacking the ability to flexibly and intelligently diagnose alarm texts of arbitrary formats using large language models. Resource assessment uses instantaneous values ​​or inflection point matching methods, which are easily affected by business off-peak periods. Access control can only achieve functional-level access and lacks a data-level domain isolation mechanism, posing data security risks in multi-tenant scenarios. In containerized deployment environments, additional timer containers need to be configured, increasing the complexity of deployment, configuration, and operation and maintenance.

[0030] To address the aforementioned problems, this invention proposes an intelligent operation and maintenance assistance system, method, electronic device, and storage medium. The technical solutions of the embodiments of this disclosure are described in detail below: In one embodiment of the present invention, an intelligent operation and maintenance assistance system is provided. (See reference...) Figure 1 As shown, the intelligent operation and maintenance assistance system includes a front-end display layer, a business logic layer, and an external interface layer. The business logic layer includes a timer and an authentication and authorization module. The external interface layer provides interfaces for an intelligent diagnostic platform and a monitoring system. The front-end presentation layer receives raw alarm texts from various heterogeneous monitoring systems, extracts the target alarm fields according to preset parsing rules, and sends them to the business logic layer. The business logic layer takes the target alarm field as input parameters, calls the external intelligent diagnostic service through the intelligent diagnostic platform interface, and receives the alarm diagnostic results returned by the external intelligent diagnostic service; it uses a timer scheduler to periodically obtain the average value of multiple historical time periods of the target monitoring item within a preset time window through the monitoring system interface, and determines the resource trend value based on the historical time period average value. The resource trend value is used to evaluate the resource utilization of the monitored host; and the authentication and authorization module manages data access permissions based on the mapping relationship between users, host groups, and hosts. The external interface layer is used to provide interfaces for the intelligent diagnostic platform and the monitoring system.

[0031] In the intelligent operation and maintenance assistance system provided in the above embodiments, the front-end display layer receives raw alarm texts from various heterogeneous monitoring systems and extracts target alarm fields according to preset parsing rules, realizing unified access and parsing of multi-source heterogeneous alarms. This solves problems such as scattered alarm data and cumbersome operations, improving the efficiency of operation and maintenance. The business logic layer passes the parsed alarm fields to the intelligent diagnostic platform interface, calls external intelligent diagnostic services to complete fault analysis, and can adapt to alarm texts of any format, realizing flexible and universal intelligent fault diagnosis. The timer scheduler deployed in the business logic layer obtains the average value of multiple historical time periods within a preset time window and calculates resource trend values ​​accordingly to evaluate host resource utilization, avoiding evaluation interference caused by load changes during business off-peak periods and improving the accuracy of resource status evaluation. At the same time, the timer scheduler is integrated inside the business logic layer, without relying on the operating system or deploying an additional independent timer container, simplifying the system deployment and configuration process. The authentication and authorization module in the business logic layer manages data access permissions based on the mapping relationship between users, host groups, and hosts. In multi-tenant, multi-business-line shared scenarios, it can strictly isolate the data access scope of users with different roles and reduce the risk of data leakage. In summary, the intelligent operation and maintenance assistance system provided by this invention, through its layered architecture design, achieves unified parsing of multi-source heterogeneous alarms, intelligent fault diagnosis, accurate resource assessment, data-level permission isolation, and built-in timed scheduling, effectively improving operation and maintenance efficiency, assessment accuracy, and data security, while reducing deployment and operation and maintenance costs.

[0032] Below, in another embodiment, combined with Figure 2 Taking the intelligent operation and maintenance system developed based on the Django 6.0 framework as an example, this paper provides a more detailed explanation of the intelligent operation and maintenance auxiliary system, its hierarchical architecture, and functional implementation.

[0033] In this embodiment, the aforementioned front-end presentation layer is located at the top layer of the intelligent operation and maintenance auxiliary system architecture and runs in the user's browser.

[0034] For example, the front-end presentation layer can build a user interface based on the Bootstrap 5 framework and use the ECharts 5 chart library (such as line charts, bar charts, dashboards, etc.) to visualize the operation and maintenance data; and use jQuery to handle Document Object Model (DOM) operations and asynchronous JavaScript and XML (AJAX) requests.

[0035] Specifically, the aforementioned front-end presentation layer includes the following six functional pages: Homepage dashboard, Alarm Diagnosis page, Alarm Management page, Resource Query page, Idle Resource page, and System Management page. Each functional page caters to different operational scenarios and follows the following processing flow: After receiving a user's operation, the front-end presentation layer initiates an AJAX request to the business logic layer to enable the business logic layer to execute corresponding business processing; it then receives the processing result data returned by the business logic layer and completes page rendering; among which: The aforementioned homepage dashboard is used to display the overall operational status. For example, the information displayed in this overall operational status includes key indicator information (such as the total number of current alarms, the number of unrecovered alarms, the number of active hosts, and the number of idle hosts), a pie chart of alarm level distribution, and a resource utilization ranking table.

[0036] Specifically, the homepage dashboard functionality can be implemented as follows: When the page loads, the front-end presentation layer concurrently requests multiple data interfaces from the business logic layer to obtain information on the overall operational status; it receives relevant data on the overall operational status in JSON format returned by the business logic layer and renders it using a chart library; preferably, the page can be set to a timed automatic refresh mechanism (e.g., refresh every 30 seconds) to periodically re-request the above data to obtain monitoring data in a timely manner.

[0037] The alarm diagnosis page described above is an interactive interface for alarm text input and AI diagnosis, enabling unified front-end access and intelligent analysis of alarms from multi-source heterogeneous monitoring systems.

[0038] Specifically, the alarm diagnosis page can receive raw alarm texts from various heterogeneous monitoring systems through a front-end parsing engine, extract target alarm fields through preset parsing rules, and send them to the business logic layer.

[0039] For example, the above-mentioned receiving of raw alarm texts from multiple heterogeneous monitoring systems can be performed in two ways: automatic acquisition and manual pasting. The automatic acquisition method periodically reads raw alarm texts from the local database of the business logic layer. The raw alarm texts in the local database of the business logic layer are periodically collected by the timer through the monitoring system interface and synchronized to the local database. The manual method allows users to directly paste raw alarm texts from any monitoring system into the paste box on the alarm diagnosis page.

[0040] For example, the target alarm field mentioned above may include key field information such as alarm title, severity level, hostname, and IP address.

[0041] The aforementioned preset parsing rules are pre-configured text parsing logic used to extract specified content from the original alarm text and generate standardized target alarm fields.

[0042] Specifically, the aforementioned preset parsing rules may include: identifying alarm titles in the original alarm text through keyword matching; performing word frequency weighting on the severity keywords appearing in the original alarm text based on preset severity keywords and their corresponding weights, and determining the severity level based on the calculation results; extracting the values ​​of predefined fields in the original alarm text and recording them as host names; and extracting IP addresses from the original alarm text through IP address matching rules.

[0043] After parsing the original alarm text to obtain the target alarm field using the above method, the alarm diagnosis page transmits the parsed target alarm field to the business logic layer, so that the business logic layer can call the external intelligent diagnosis service through the intelligent diagnosis platform interface to obtain the alarm diagnosis result; receive the alarm diagnosis result returned by the business logic layer, and complete the page rendering.

[0044] The alarm management page described above provides management functions for alarm information.

[0045] For example, the alarm management page can be configured to request alarm list data from the business logic layer and provide users with operations such as filtering, searching, and status changes for the alarm list data; preferably, when a new unresolved alarm is added, the user can be notified through browser notifications or a flashing page title.

[0046] The resource query page mentioned above allows users to query detailed resource information of the monitored host by hostname, IP address, or host group, such as data related to CPU, memory, and network traffic.

[0047] The aforementioned idle resources page is used to display a list of hosts identified as having low load, providing data for resource reclamation or downsizing.

[0048] The aforementioned system management page is used by administrators to perform operations such as user management, system management, and audit log management.

[0049] The front-end presentation layer, through the above six functional pages, fully covers the core intelligent operation and maintenance scenarios such as operation and maintenance alarm management, alarm diagnosis, resource monitoring, idle identification, and system configuration. It can automatically parse alarm text of any format based on the front-end parsing and extract the target alarm fields. By placing the parsing logic on the front end, it realizes unified access and intelligent parsing of multi-source alarms, so that there is no need to adapt various alarm formats on the server side.

[0050] Furthermore, the aforementioned front-end display page and the business logic layer can communicate via the HyperText Transfer Protocol Representational StateTransfer Application Programming Interface (HTTP REST API), with all dynamic data transmitted in JavaScript Object Notation (JSON) format.

[0051] In this embodiment, the aforementioned business logic layer is located in the middle of the intelligent operation and maintenance auxiliary system architecture, serving as the core hub connecting the front-end presentation layer and the external interface layer. Specifically, this business logic layer includes an authentication and authorization module, a business view module, a timer scheduler, and a data persistence module. Wherein: The aforementioned authentication and authorization module is used to implement access control and security authentication for the intelligent operation and maintenance auxiliary system, specifically including: Role-Based Access Control (RBAC) functionality, for example, can implement the following: Predefined user roles include administrators (admin), operations personnel (ops), and managers (manager), with different data access and operation permissions assigned to each role. The administrator (admin) has the highest system privileges and is responsible for system configuration, overall account and permission management; the manager is responsible for overall operations coordination, data aggregation, and approval management, with permissions limited to the scope of business management; and the operations personnel (ops) are responsible for daily alarm handling, host resource queries, idle resource management, and other front-line operations tasks.

[0052] Specifically, the role-based access control function can implement the above-mentioned data access permission management based on the mapping relationship between users, host groups, and hosts through the following methods: establishing a many-to-many relationship between users, host groups, and hosts; managing users' data access permissions according to preset permission filtering rules; wherein, the preset permission filtering rules include: the administrator role (admin) can access all hosts and alarm data; non-administrator roles (ops and manager) can only access the hosts under their associated host groups and their alarm data; for unauthorized access requests, an access failure response is returned.

[0053] Multi-Factor Authentication (MFA) functionality, for example, can be implemented using a Time-Based One-Time Password (TOTP) algorithm, as follows: after the user enters their account and password, they also need to submit a dynamic verification code to complete the verification, thereby improving login security; Login frequency limit function: Monitors the number of consecutive failed login attempts for the same account or IP address. If the number of consecutive failed login attempts exceeds a preset threshold, the account or IP address will be temporarily locked to prevent brute-force attacks.

[0054] The aforementioned business view module is the core part for handling front-end requests and invoking business logic. It contains six functional sub-modules: alarm diagnosis sub-module, resource query sub-module, idle resource identification sub-module, user management sub-module, system management sub-module, and audit log sub-module. These sub-modules provide business logic support for the functional pages of the front-end presentation layer. Specifically: The alarm diagnosis submodule mentioned above corresponds to the alarm diagnosis page in the front-end display layer. It is used to receive the target alarm fields parsed by the front-end, encapsulate them into a standardized JSON request body, call the AI ​​diagnosis platform interface, trigger the external intelligent diagnosis service, and store the diagnosis results returned by the external intelligent diagnosis service in the local database of the data persistence module.

[0055] The resource query submodule mentioned above corresponds to the resource query page in the front-end presentation layer. It is used to retrieve detailed resource information of the monitored host from the local database based on the query conditions provided by the user (such as hostname, IP address, host group) and return it to the front-end presentation layer in JSON format.

[0056] The aforementioned idle resource identification submodule corresponds to the idle resource page of the front-end display layer. It is used to periodically scan host resource data according to the preset idle judgment threshold, filter out the list of low-load hosts, and return it to the front-end display layer.

[0057] The aforementioned user management, system management, and audit log submodules correspond to user management, system management, and audit log management in the system management page of the front-end presentation layer, respectively. The user management submodule provides user account management functions (such as adding, deleting, modifying, and querying), supports assigning user roles, and configuring the association between users and host groups. The system management submodule provides system parameter configuration functions; for example, these system parameters may include alarm synchronization cycle, idle resource judgment threshold, intelligent diagnostic timeout time, host group display name, etc. The audit log submodule records key operation logs (such as user login, role change, permission modification, and batch processing of idle resources), supports filtering and querying by operator, operation time, operation type, etc., meeting security audit and compliance requirements.

[0058] The aforementioned timer is built into the business logic layer and is implemented based on the APScheduler library. When the Web Server Gateway Interface (WSGI) application starts, the timer is automatically loaded and begins to run. It does not rely on operating system-level timers or additional timers, and can adapt to containerized deployment environments.

[0059] Specifically, the above-mentioned timer scheduler registers the following three timed tasks: Task 1: Perform periodic (e.g., every 5 minutes) monitoring data synchronization. For example, this data synchronization task can be implemented as follows: periodically obtain the host list and its grouping information in the corresponding monitoring system through the monitoring system interface; create host records for newly discovered hosts in the local database through the data persistence module, and create or associate group records for them according to the grouping information; and periodically obtain the trigger list and its status values ​​in the corresponding monitoring system through the monitoring system interface, and update the status of the corresponding alarm records in the local database based on the status values.

[0060] Task 2: Periodic scan of idle resources (e.g., executed daily at 2:00 AM). For example, this idle resource scanning task can achieve the following: Mark idle hosts based on the latest calculated resource trend value and a preset idle threshold, and generate a list of idle resources.

[0061] For example, the above resource trend value can be calculated by the following method: the timer scheduler obtains the historical unit time-period average value of the target monitoring item within a preset time window through the monitoring system interface at regular intervals (such as the average value of CPU utilization, memory utilization and network traffic of the monitored host within each hour within the preset time window); the historical unit time-period average value of the target monitoring item within the preset time window is calculated twice to obtain the resource trend value, and the resource trend value is stored in the local database through the data persistence module.

[0062] The above method of marking idle hosts based on the latest calculated resource trend value and a preset idle threshold can achieve the following: Based on the latest calculated resource trend value and the preset idle threshold, monitored hosts with resource trend values ​​lower than the preset idle threshold are marked as idle hosts. For example, when both the CPU utilization trend value and memory utilization trend value of a monitored host are lower than their respective preset idle thresholds, the host is marked as an idle host.

[0063] Task 3: Generate operation and maintenance reports periodically (e.g., daily at 3:00 AM). For example, this operation and maintenance report generation task can achieve the following: summarize data such as alarm statistics, resource utilization, and intelligent diagnostic results from the previous day, and generate operation and maintenance reports.

[0064] The aforementioned data persistence module implements object-relational mapping through Django ORM, uses an SQLite database in the development environment and a PostgreSQL database in the production environment, and is responsible for all database operations.

[0065] In addition, the aforementioned business logic layer communicates downwards with the external interface layer through the HyperText Transfer Protocol Workflow Application Programming Interface (HTTPWorkflow API) and the JavaScript Object Notation - Remote Procedure Call (JSON-RPC) protocol: the HTTPWorkflow API protocol is used to interact with the intelligent diagnostic platform interface; the JSON-RPC protocol is used to interact with the monitoring system.

[0066] In this embodiment, the aforementioned external interface layer is located at the bottom layer of the system architecture, including two types of external system interfaces: a diagnostic platform interface and a monitoring system interface. These interfaces respectively connect to the Dify Artificial Intelligence (AI) platform and the Zabbix monitoring system to achieve external data acquisition and the invocation of AI intelligent analysis capabilities. Specifically: The aforementioned diagnostic platform interface connects to the Dify AI platform, establishing a data interaction channel with the business logic layer via the HTTP Workflow API. Specifically, the Dify AI platform provides multiple capabilities, including alarm diagnostic workflow, natural language interactive query, and knowledge base retrieval, which are invoked and interacted through the HTTP Workflow API, Chat API, and HTTP API, respectively. Based on these functions, when parsing structured data from alarms issued by the business logic layer, the Dify AI platform automatically completes alarm root cause localization, fault impact scope assessment, and outputs standardized fault handling suggestions.

[0067] The aforementioned monitoring system interface connects to the Zabbix monitoring system. A timer schedules data collection according to a preset period, using the JSON-RPC protocol. Specifically, the Zabbix monitoring system provides four types of data query interfaces via the JSON-RPC protocol: the `host.get` interface retrieves a list of hosts and their corresponding group information; the `item.get` interface retrieves a list of monitored items; the `trend.get` interface periodically retrieves trend data for monitored items (e.g., hourly), returning the average (value_avg), minimum (value_min), maximum (value_max), and number of samples (num). Here, `value_avg` is the average value of the monitored items within the current period, `value_min` and `value_max` are the minimum and maximum values ​​of the monitored items within the current period, and `num` is the total number of data samples actually collected for the monitored item within the current period; the `trigger.get` interface queries alarm trigger configurations and real-time alarm status.

[0068] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0069] Correspondingly, the present invention also provides an intelligent operation and maintenance assistance method, which can be applied to any of the intelligent operation and maintenance systems provided by the present invention. (Reference) Figure 3 As shown, this intelligent operation and maintenance assistance method specifically includes the following steps: S310: The front-end presentation layer receives raw alarm texts from various heterogeneous monitoring systems, extracts the target alarm fields through preset parsing rules, and sends them to the business logic layer; S320: The business logic layer takes the target alarm field as an input parameter, calls the external intelligent diagnostic service through the intelligent diagnostic platform interface of the external interface layer, and receives the alarm diagnostic results returned by the external intelligent diagnostic service.

[0070] Furthermore, the intelligent operation and maintenance assistance method provided in this embodiment can also implement the following scheduled tasks through a timer deployed in the business logic layer: The system interface is used to periodically obtain the average value of the target monitoring item over multiple historical time periods within a preset time window; the resource trend value is determined based on the average value of the historical time periods, and the resource trend value is used to evaluate the resource utilization of the monitored host; The system periodically retrieves the host list and its grouping information from the corresponding monitoring system via the monitoring system interface; it creates host records for newly discovered hosts in the local database and creates or associates group records for them based on the grouping information. The system periodically retrieves the list of triggers and their status values ​​from the corresponding monitoring system via the monitoring system interface, and updates the status of the corresponding alarm records in the local database based on the retrieved status values.

[0071] Furthermore, the intelligent operation and maintenance assistance method provided in this embodiment can also realize data access management through the authentication and authorization module deployed in the business logic layer. Specifically, it is implemented by: establishing a many-to-many relationship between users, host groups, and hosts, and managing users' data access permissions according to preset permission filtering rules; wherein, the preset permission filtering rules include: administrator roles can access all hosts and alarm data; non-administrator roles can only access hosts under their associated host groups and their alarm data; for unauthorized access requests, an access failure response is returned.

[0072] Below, in one specific implementation of this embodiment, Figure 2 The intelligent operation and maintenance system shown is an application scenario. The above-mentioned intelligent operation and maintenance assistance method is explained in detail. Specifically, this intelligent operation and maintenance assistance method includes three aspects: alarm diagnosis process, Zabbix data synchronization process, and data access management. The above alarm diagnosis process is implemented through the following steps: S1: The front-end presentation layer receives raw alarm texts from various heterogeneous monitoring systems.

[0073] This specific implementation supports obtaining raw alarm text in the following two ways: Automatic acquisition: The timer periodically collects raw alarm text through the Zabbix monitoring system interface (trigger.get) and synchronizes it to the Alert model in the local database, so that the front-end presentation layer can read alarm information from the Alert model. The aforementioned Alert model is a custom alarm record model in the local database, used to store alarm records, including fields such as alarm ID, alarm title, severity level, hostname, IP address, generation time, status (active / resolved), and associated trigger ID; Manual acquisition: Users can directly paste raw alarm text from any monitoring system (such as Zabbix, Prometheus, AWS CloudWatch, Alibaba Cloud Monitoring, etc.) into the paste box on the alarm diagnosis page in the browser.

[0074] S2: The front-end presentation layer intelligently parses the received raw alarm text.

[0075] This parsing process runs in a JavaScript environment on the browser side, extracting the following four key fields from the original alert text through keyword matching, word frequency weighting, and regular expressions: Alarm title: A preset set of keywords, for example, the keyword set can be: [alarm, alert, ALARM, Firing]; the original alarm text is scanned line by line, and if a line contains any of the above keywords, the content of that line is used as the alarm title.

[0076] Severity Level: Multiple severity keywords are preset, and a corresponding weight value is configured for each keyword; the number of times each severity keyword appears in the original alarm text is counted, and the total score is calculated according to the rule of total score = Σ(keyword weight × number of keyword occurrences); based on the calculated total score, the severity level of the alarm is determined based on the preset mapping logic (such as comparing the calculated total score with the preset severity level judgment threshold).

[0077] Hostname: A predefined set of field names. For example, this set of field names can be defined as follows: [host, hostname, instance]; The value after the field name in the predefined set of field names is extracted and recorded as the hostname.

[0078] IP address: The IP address is obtained by performing a global search in the original alarm text using the regular expression \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.

[0079] S3: The business logic layer encapsulates the parsed alarm data into a standardized JSON request body and calls the Workflow API of the Dify AI platform (endpoint path: / v1 / workflows / run) via the HTTP POST method. The standardized JSON request body includes fields such as alarm title, alarm content, severity level, hostname, and IP address, and the call mode is synchronous blocking.

[0080] S4: After receiving the request, the Dify AI platform executes the preset diagnostic workflow and returns the diagnostic results to the business logic layer. The diagnostic workflow specifically includes: Root cause analysis: Based on alarm characteristics and knowledge base matching, infer the root cause of the fault; Impact assessment: Analyze the scope of resources involved in the alarm and the degree of business impact; Suggestion generation: Output specific processing suggestions and repair steps.

[0081] S5: The business logic layer stores the diagnostic conclusions (including diagnostic results, treatment suggestions, and confidence scores) into the DiagnosisRecord model in the database, and provides a feedback scoring mechanism. The DiagnosisRecord model is a custom diagnostic record model in the local database, used to store AI diagnostic results, including fields such as record ID, associated alarm ID, diagnostic conclusion (root cause analysis, impact assessment, and treatment suggestions), confidence score, user feedback score, and diagnosis time.

[0082] S6: Users can view the complete diagnostic report in their browser, including the root cause analysis conclusions, impact assessment, and recommended treatment measures.

[0083] The Zabbix data synchronization process described above is periodically triggered by a timer (e.g., every 5 minutes), and the local database is updated after synchronization is complete. The triggering node is automatically activated by the timer according to a preset cycle. Specifically, the timer can be an Advanced Python Scheduler (APScheduler); the synchronization process consists of the following three parallel branches: Host synchronization: Call the host.get method of the Zabbix API to obtain a complete list of hosts and their grouping information in the Zabbix monitoring system; for newly discovered hosts, automatically create corresponding records in the local database, and automatically create or associate group records in the HostGroup model according to the host's group affiliation; the HostGroup model mentioned above is a custom host group model in the local database, which serves as an intermediate model between users and hosts to logically group hosts.

[0084] Trend Acquisition: The `item.get` function retrieves a list of monitored items. Then, for each monitored item, `trend.get` is called to retrieve historical trend data within a specified time window. `trend.get` returns the hourly average value (`value_avg`) for each monitored item. A secondary average is calculated across all hourly averages within the specified time window to obtain the trend average value (i.e., the resource trend value mentioned above), which is then written to the corresponding field in the Host model. This trend average value covers three metrics for the monitored host: CPU utilization, memory utilization, and network traffic. The Host model is a custom host model defined in the local database to store resource information for the monitored host, including fields such as host ID, hostname, IP address, host group, CPU utilization trend value, memory utilization trend value, and network traffic trend value.

[0085] Alarm Synchronization: Call trigger.get to retrieve the complete list of triggers in the Zabbix monitoring system, and synchronize the local database according to the trigger status value as follows: When the trigger status value is "Alarming" (value=1), mark the corresponding alarm as active (status=new); when the trigger status value is "Resolved" (value=0), mark the corresponding alarm as resolved (status=resolved); for triggers that exist in the local database but no longer exist in the Zabbix monitoring system (i.e., triggers that have been deleted), the corresponding alarms are also marked as resolved.

[0086] After the above three branches are completed, the database update completion node will be entered, and the single synchronization cycle will end.

[0087] The specific implementation of the above data access management is as follows: This implementation uses the HostGroup model as an intermediate model to establish a many-to-many (M2M) mapping relationship between users and hosts. The data model includes the following three core entities and their relationships: User: Includes role attribute. For example, the role attribute value may include administrator (admin), operations personnel (ops), and manager (manager). Users are associated with host groups through many-to-many relationship fields (such as managed_groups).

[0088] HostGroup: The core unit for data domain isolation, containing fields such as name (English identifier, automatically created during Zabbix synchronization) and display_name (Chinese display name, configured by the administrator); HostGroup is associated with hosts through many-to-many relationship fields (e.g., hosts), and with users through reverse relationship fields (e.g., user_set).

[0089] Host: A managed computing resource that is inversely associated with a host group through a many-to-many relationship field (such as group_refs).

[0090] The permission filtering rules are as follows: the admin role can return all Host data through the get_visible_hosts() method, without being restricted by group; the ops and manager roles can only return Host data in the HostGroup associated with their managed_groups through the get_visible_hosts() method.

[0091] The filtering of alarm data is implemented through the get_visible_alerts() method as follows: admin returns all alarm data; ops / manager first obtains the list of visible hosts, and then filters out alarm records that only contain the obtained visible hosts; unauthorized access returns an HTTP 404 status code instead of 403, avoiding inferring the existence of system resources through response differences and improving security.

[0092] An electronic device of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned intelligent operation and maintenance assistance methods. That is, an electronic device of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store the computer program; the processor is used to execute the intelligent operation and maintenance assistance method shown in any embodiment of the present invention by calling the computer program.

[0093] In one alternative embodiment, an electronic device is provided, such as Figure 4 As shown, Figure 4 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the present invention.

[0094] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0095] Bus 4002 may include a path for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The bus 4002 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0096] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0097] The memory 4003 stores application code (computer program) for executing the present invention, and its execution is controlled by the processor 4001. The processor 4001 executes the application code stored in the memory 4003 to implement the content shown in the foregoing method embodiments.

[0098] Among them, electronic devices can also be terminal devices, which can be any device that can install applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0099] It should be noted that, Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the invention.

[0100] The present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-mentioned intelligent operation and maintenance assistance methods.

[0101] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0102] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned intelligent operation and maintenance assistance method.

[0103] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0104] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0105] The computer-readable storage medium provided by this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EEPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0106] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0107] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0108] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0109] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0110] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An intelligent operation and maintenance auxiliary system, characterized in that, The system comprises a front-end presentation layer, a business logic layer, and an external interface layer. The business logic layer includes a timer and an authentication and authorization module. The external interface layer provides interfaces for an intelligent diagnostic platform and a monitoring system. The front-end display layer receives raw alarm texts from various heterogeneous monitoring systems, extracts target alarm fields through preset parsing rules, and sends them to the business logic layer. The business logic layer takes the target alarm field as an input parameter, calls an external intelligent diagnostic service through the intelligent diagnostic platform interface, and receives the alarm diagnostic results returned by the external intelligent diagnostic service; it uses the timer scheduler to periodically obtain the average value of multiple historical time periods of the target monitoring item within a preset time window through the monitoring system interface, and determines the resource trend value based on the historical time period average value. The resource trend value is used to evaluate the resource utilization of the monitored host; and it manages data access permissions based on the mapping relationship between users, host groups, and hosts through the authentication and authorization module. The external interface layer is used to provide the interface for the intelligent diagnostic platform and the interface for the monitoring system.

2. The intelligent operation and maintenance auxiliary system according to claim 1, characterized in that, The target alarm fields include alarm title, severity level, hostname, and IP address; the front-end presentation layer is used for: The alarm title is identified in the original alarm text by keyword matching; Based on preset severity keywords and their corresponding weights, the severity keywords appearing in the original alarm text are subjected to word frequency weighting calculation, and the severity level is determined based on the calculation result; Extract the values ​​of predefined fields from the original alarm text and record them as the host name; The IP address is extracted from the original alarm text using IP address matching rules.

3. The intelligent operation and maintenance auxiliary system according to claim 1, characterized in that, The business logic layer also includes a data persistence module, which is used to store the alarm diagnosis results to a local database.

4. The intelligent operation and maintenance auxiliary system according to claim 3, characterized in that, The timer scheduler is used for: The monitoring system interface periodically obtains the historical average value of the target monitoring item within a preset time window, which includes the CPU utilization, memory utilization, and network traffic of the monitored host. The historical unit time-period average value of the target monitoring item within the preset time window is calculated twice to obtain the resource trend value, and the resource trend value is stored in the local database through the data persistence module.

5. The intelligent operation and maintenance auxiliary system according to claim 3, characterized in that, The timer scheduler is also used for: The host list and its grouping information in the corresponding monitoring system are periodically obtained through the monitoring system interface. The data persistence module creates host records for newly discovered hosts in the local database and creates or associates group records for them based on the grouping information.

6. The intelligent operation and maintenance auxiliary system according to claim 3, characterized in that, The timer scheduler is also used for: The system periodically retrieves the list of triggers and their status values ​​from the corresponding monitoring system through the monitoring system interface, and updates the status of the corresponding alarm records in the local database based on the status values.

7. The intelligent operation and maintenance auxiliary system according to claim 1, characterized in that, The authentication and authorization module is used for: Establish many-to-many relationships between users, host groups, and hosts; Manage user data access permissions according to preset permission filtering rules; The preset permission filtering rules include: administrator roles can access all hosts and alarm data; non-administrator roles can only access hosts and alarm data under their associated host groups; and an access failure response is returned for unauthorized access requests.

8. An intelligent operation and maintenance assistance method, characterized in that, The system applied to the intelligent operation and maintenance assistance system according to any one of claims 1-7 includes: The front-end presentation layer receives raw alarm texts from various heterogeneous monitoring systems, extracts the target alarm fields according to preset parsing rules, and sends them to the business logic layer. The business logic layer takes the target alarm field as an input parameter, calls the external intelligent diagnostic service through the intelligent diagnostic platform interface of the external interface layer, and receives the alarm diagnosis results returned by the external intelligent diagnostic service.

9. The intelligent operation and maintenance assistance method according to claim 8, characterized in that, The method further includes: The business logic layer uses a timer scheduler to periodically obtain the average value of multiple historical time periods of the target monitoring item within a preset time window through the monitoring system interface of the external interface layer. The resource trend value is determined based on the historical unit time average, and the resource trend value is used to evaluate the resource utilization of the monitored host.

10. The intelligent operation and maintenance assistance method according to claim 8, characterized in that, The method further includes: The business logic layer uses a timer scheduler to periodically obtain the host list and its grouping information from the corresponding monitoring system through the monitoring system interface; Create a host record for the newly discovered host in the local database, and create or associate a group record for it based on the grouping information.

11. The intelligent operation and maintenance assistance method according to claim 8, characterized in that, The method further includes: The business logic layer uses a timer scheduler to periodically obtain the list of triggers and their status values ​​in the corresponding monitoring system through the monitoring system interface, and updates the status of the corresponding alarm records in the local database based on the status values.

12. The intelligent operation and maintenance assistance method according to claim 8, characterized in that, The method further includes: The business logic layer establishes many-to-many relationships between users, host groups, and hosts through the authentication and authorization module, and manages users' data access permissions according to preset permission filtering rules; The preset permission filtering rules include: administrator roles can access all hosts and alarm data; non-administrator roles can only access hosts and alarm data under their associated host groups; and an access failure response is returned for unauthorized access requests.

13. An electronic device, characterized in that, include: processor; Memory for storing the executable instructions of the processor; The processor is configured to execute the instructions to implement the intelligent operation and maintenance assistance method as described in any one of claims 8 to 12.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the intelligent operation and maintenance assistance method according to any one of claims 8 to 12.

Images