Operation and maintenance alarm method and system for printing equipment based on operation log big data mining

Abstract

The application discloses a printing equipment operation and maintenance alarm method and system based on operation log big data mining, relates to the technical field of printing equipment operation and maintenance alarm and big data analysis, and acquires multi-source operation logs of printing equipment, and performs event processing according to a preset log mapping table to form unified log events; a device operation window is constructed according to a device identifier, an event time and a preset continuous operation determination rule; in combination with a device operation benchmark and a normal fluctuation baseline, load interpretation judgment is performed on log fluctuation in the window, abnormal residual characteristics that cannot be interpreted by normal high load are extracted, and operation and maintenance alarm information is generated according to continuous appearance, reappearance after automatic processing and similar historical maintenance confirmation situations, so that normal high load fluctuation and failure precursors are distinguished, and the timeliness and accuracy of alarm are improved.

Description

Technical Field

[0001] This invention relates to the field of document printing equipment operation and maintenance alarm and big data analysis technology, and in particular to a document printing equipment operation and maintenance alarm method and system based on big data mining of operation logs. Background Technology

[0002] With the development of office informatization and centralized operation and maintenance management, printing equipment such as printers, copiers, and multifunction printers are widely deployed in government and enterprise offices, education, healthcare, finance, and industrial parks. For users with a large number of devices distributed over a wide area, the operational stability of these devices directly affects daily document output efficiency and maintenance service response efficiency. To reduce on-site inspection and manual troubleshooting costs, printing equipment is typically connected to an equipment management platform or remote operation and maintenance platform, which centrally manages the equipment's operating status, task execution, fault alarms, and maintenance processes. As the number of printing devices and their operating time increase, the equipment management platform continuously accumulates equipment-side operation logs, platform-side management logs, automatic processing logs, and maintenance records. Big data analytics is needed to collect, statistically analyze, and correlate this operational data from different sources to identify patterns in the changing operational status of the printing equipment.

[0003] Existing document printing equipment maintenance systems typically collect operational logs generated during equipment operation through equipment controllers, equipment management interfaces, or remote management platforms. These logs then generate alarm information based on preset error codes, consumable thresholds, component lifespan thresholds, or failure frequency thresholds. Some systems can also automatically handle operational anomalies such as communication errors, task failures, queue congestion, equipment restarts, color calibration, printhead cleaning, or task switching, thus providing alerts and recovery for general operational anomalies. However, during long-term operation of document printing equipment, paper jams, imaging anomalies, consumable anomalies, and high-load anomalies are often not directly reflected by a single log entry, but rather are related to the temporal combination of multiple operational logs. Existing alarm methods based on fixed thresholds or single error codes struggle to distinguish between log fluctuations caused by normal high-load operation and the abnormal evolution characteristics before a failure occurs, leading to problems such as delayed, false, or missed alarms in maintenance alerts.

[0004] For example, Chinese invention patent CN103064905B discloses a log management method for CNC systems. This method can achieve centralized management and traceable query of log information by classifying, caching, listing, allowing users to confirm and view the logs, and replaying them according to the operation process. This solves the problems of scattered log records, data loss after shutdown, and lack of statistical analysis for machining application scenarios in existing CNC systems.

[0005] However, the aforementioned existing technology has at least the following technical problems: While existing document printing equipment maintenance systems can collect operational logs through equipment controllers, equipment management interfaces, or remote management platforms, and generate alarm information based on error codes, consumable thresholds, lifespan thresholds, or failure frequency thresholds, the sources, formats, and meanings of logs generated by different document printing devices over long-term operation are not entirely consistent. Some logs originate from equipment-side status reports, some from remote management platforms, and some from automatic processing results or maintenance records. Existing alarm methods, when analyzed, tend to rely directly on single error codes, single thresholds, or single recovery results, making it difficult to unify multi-source operational logs from the same device during continuous operation into a single time sequence for correlation analysis. This results in a lack of stable comparative basis between normal operation fluctuations and early signs of failure.

[0006] On the other hand, printing equipment may exhibit phenomena such as concentrated tasks, increased status changes, increased automatic processing actions, or dense logs in a short period when operating under high load. These phenomena do not necessarily indicate that the equipment is about to malfunction. However, paper jams, imaging abnormalities, or consumable malfunctions may also manifest similar fluctuation characteristics in the operation log. Existing alarm methods based on fixed thresholds or single error codes are insufficient to combine the historical operating status of the specific printing equipment with the current continuous operation process to determine whether the current log fluctuations are acceptable under normal high-load operation. This can easily lead to misjudging normal high-load fluctuations as malfunctions, or mistaking hidden fault precursors in high-load operation for normal fluctuations.

[0007] Meanwhile, some malfunctions in printing equipment may be temporarily resolved by automatic processing actions such as automatic retry, automatic calibration, automatic cleaning, task recovery, or equipment restart after they occur. Existing operation and maintenance systems can usually record the results of automatic processing, but when judging alarms, they tend to use "successful automatic recovery" as the basis for the end of the current malfunction. However, the early stages of paper jams, imaging malfunctions, or consumable malfunctions may manifest as short-term recurrence after automatic recovery, repeated occurrence of the same object, or continuous occurrence across multiple consecutive operation processes. If the recurrence and persistence relationships before and after automatic processing are not further analyzed, the early signs of the fault can easily be masked by the automatic recovery actions, leading to delayed alarms, false alarms, or missed alarms.

[0008] Therefore, the technical problem that needs to be solved is: how to improve the timeliness and accuracy of printing equipment maintenance alarms by utilizing the time sequence combination relationship between multi-source operation logs, combined with the equipment operation baseline and normal fluctuation baseline, on the basis that the existing printing equipment already has the ability to collect logs, alarm error codes, and partially automatic recovery, and by using the equipment operation baseline and normal fluctuation baseline to distinguish between log fluctuations caused by normal high load operation and fault precursors such as paper jams, imaging abnormalities, or consumable abnormalities. Summary of the Invention

[0009] This invention provides a method and system for issuing alarms for printing equipment based on big data mining of operating logs. Addressing the problem that existing printing equipment alarms mainly rely on error codes, fixed thresholds, or single automatic recovery results, making it difficult to distinguish between log fluctuations caused by normal high-load operation and precursors to paper jams, imaging anomalies, or consumable failures, this invention performs event-based processing of multi-source operating logs of the printing equipment, constructs equipment operation windows, and combines equipment operation benchmarks and normal fluctuation baselines for load interpretation and judgment. For log fluctuations that cannot be explained by normal operation under the corresponding load level, abnormal residual features are generated. Then, based on the continuous occurrence of abnormal residual features, their automatic recurrence after processing, and confirmation of similar situations in historical maintenance, operation alarm information is generated, thereby improving the timeliness and accuracy of printing equipment operation alarms.

[0010] According to one aspect of the present invention, a method for issuing maintenance alarms for document printing equipment based on big data mining of operating logs is provided. The method includes: acquiring multi-source operating logs of the document printing equipment, and performing event-based processing on the multi-source operating logs according to a preset log mapping table to form unified log events; aggregating the unified log events based on the equipment identifier, forming an event time sequence based on the event time, and dividing the unified log events of the same document printing equipment during continuous operation into equipment operating windows according to a preset continuous operation judgment rule; for the current equipment operating window, combining the equipment operating benchmark and normal fluctuation baseline of the corresponding document printing equipment, performing load interpretation judgment on the log fluctuations within the current equipment operating window to determine the load interpretation status; after determining the load interpretation status, identifying log fluctuations in the current equipment operating window that cannot be explained by normal operation under the corresponding load level, and locating the log fluctuations to the corresponding unified log events to form abnormal residual features; judging the fault precursor evolution status of the current equipment operating window based on the abnormal residual features, and generating maintenance alarm information when the fault precursor evolution conditions are met.

[0011] According to another aspect of the present invention, a document printing equipment operation and maintenance alarm system based on big data mining of operation logs is provided. The system includes a unified log event processing module, a device operation window construction module, a load interpretation status determination module, an abnormal residual feature extraction module, and an operation and maintenance alarm generation module. The unified log event processing module is used to process multi-source operation logs of the document printing equipment into event-based events, forming unified log events. The device operation window construction module is used to divide unified log events of the same document printing equipment during continuous operation into device operation windows. The load interpretation status determination module is used to determine the load interpretation status by combining the device operation baseline and the normal fluctuation baseline. The abnormal residual feature extraction module is used to locate log fluctuations that cannot be explained by normal operation under the corresponding load level to the corresponding unified log event and form abnormal residual features. The operation and maintenance alarm generation module is used to determine the fault precursor evolution status of the current device operation window based on the abnormal residual features, and generate operation and maintenance alarm information when the fault precursor evolution conditions are met.

[0012] The beneficial effects achieved by the technical solutions provided in the embodiments of the present invention include at least the following: (1) The present invention converts multi-source operation logs such as device reporting logs, remote management platform logs, automatic processing logs and maintenance records into unified log events by pre-setting a log mapping table, and constructs a device operation window according to device identifier and event time, so that operation records from different sources and in different formats can be correlated and analyzed in the same continuous operation process, avoiding isolated alarm judgment based solely on a single error code or a single threshold.

[0013] (2) The present invention uses the equipment operation benchmark, preset load level table and normal fluctuation baseline to interpret and judge the log fluctuation within the current equipment operation window. It can distinguish between acceptable log fluctuation caused by normal high load operation and abnormal fluctuation beyond the normal high load range, thereby reducing the probability of false alarms in high load task concentration scenarios.

[0014] (3) The present invention locates the log fluctuations that cannot be explained by normal operation under the corresponding load level to the corresponding unified log event and forms abnormal residual features, so that the weak abnormal changes before paper jams, imaging abnormalities or consumable abnormalities occur can be extracted from the normal operation fluctuations, thereby improving the accuracy of fault precursor identification.

[0015] (4) Based on the continuous occurrence of abnormal residual features in multiple equipment operation windows, automatic processing and reproduction, and historical maintenance confirmation of similar situations, the present invention determines the evolution state of the fault precursor and generates operation and maintenance alarm information. This can avoid using an automatic recovery result as the basis for the termination of the abnormality and improve the timeliness and reliability of the operation and maintenance alarm of the printing equipment. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a document printing equipment operation and maintenance alarm method based on big data mining of operation logs according to Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of identifying out-of-range log fluctuation items based on an acceptable fluctuation range according to Embodiment 1 of the present invention; Figure 3 This is a schematic diagram showing the degree of deviation of abnormal residual features from the highest deviation from the device operating window according to Embodiment 1 of the present invention; Figure 4 This is a schematic diagram illustrating the cross-device operation window transfer relationship of abnormal residual features according to Embodiment 1 of the present invention. Figure 5 This is a schematic diagram of the co-occurrence similarity of abnormal residual feature windows according to Embodiment 1 of the present invention; Figure 6 This is a framework diagram of a document printing equipment operation and maintenance alarm system based on big data mining of operation logs, provided according to Embodiment 1 of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0019] Embodiment 1 of the present invention: The first aspect of this embodiment provides a method for alarming the operation and maintenance of printing equipment based on big data mining of operating logs, applied to a printing equipment operation and maintenance platform. In this embodiment, the printing equipment includes printers, copiers, or multifunction printers. The printing equipment operation and maintenance platform is connected to the printing equipment's device management interface, remote management platform interface, log upload channel, maintenance work order system, and maintenance record database, for receiving multi-source operating logs generated during the operation of the printing equipment, and identifying whether there are any signs of impending failure in the current printing equipment based on the multi-source operating logs.

[0020] like Figure 1As shown in the flowchart of the document printing equipment operation and maintenance alarm method based on big data mining of operation logs according to Embodiment 1 of the present invention, the method first obtains multi-source operation logs of the document printing equipment and forms a unified log event through a preset log mapping table; then, it constructs a device operation window according to the device identifier and event time; subsequently, it determines whether the log fluctuations in the current device operation window can be explained by normal high-load operation by combining the device operation benchmark and the normal fluctuation baseline; for log fluctuations that cannot be explained by normal operation under the corresponding load level, they are located to the corresponding unified log event and an abnormal residual feature is formed; finally, the evolution state of the fault precursor is determined according to the continuous occurrence of the abnormal residual feature, the automatic processing and recurrence, and the similarity confirmed by historical maintenance, and operation and maintenance alarm information is generated when the fault precursor evolution conditions are met.

[0021] S1: Obtain multi-source operation logs of the printing equipment, and perform event-based processing on the multi-source operation logs according to the preset log mapping table to form a unified log event.

[0022] In this embodiment, multi-source operation logs refer to raw records from multiple data sources used to reflect the operating status of the printing equipment. Multi-source operation logs include equipment-side operation logs, platform-side management logs, automatic processing logs, and maintenance records. Equipment-side operation logs are generated by the printing equipment when tasks are executed, status changes occur, anomalies are reported, consumable status changes occur, or component lifespan changes occur. The data source is the printing equipment's device management interface or log upload channel. Platform-side management logs are generated by the remote management platform when tasks are issued, tasks fail, queues are blocked, communication is abnormal, the equipment's online status changes, or the equipment restarts. The data source is the remote management platform interface. Automatic processing logs are generated by the printing equipment or the remote management platform after automatic retry, automatic calibration, automatic cleaning, task recovery, or equipment restart. The data source is the automatic processing record field or the platform processing result field. Maintenance records are generated by the maintenance work order system or maintenance record library after maintenance is completed. The data source is the maintenance work order associated with the equipment identifier, the maintenance result field, and the maintenance time field.

[0023] After acquiring the multi-source operation logs, each log entry is parsed to extract the device identifier, log time, log type, log content, and status information. The device identifier comes from the device reporting field, the platform device identifier field, or the device identifier field in the maintenance record; the log time comes from the original log timestamp; the log type comes from the original log type, error code field, or platform operation field in the original log; the log content comes from the log body, status field, or processing result field; and the status information comes from the device status, task status, abnormal status, consumable status, or automatic processing status.

[0024] A pre-defined log mapping table is stored in the document printing equipment operation and maintenance platform. It includes log source, original log type, original status field, event type, event attribution item, event status value, attribute tags, and processing status conversion rules. Based on the pre-defined log mapping table, log time is converted to event time in a unified time format, log type is converted to event type, event attribution item is determined based on log type and log content, status information is converted to event status value, and device identifier is retained, forming a unified log event. If the original log contains a running session identifier or task process identifier, the running session identifier or task process identifier is written as a window auxiliary identifier into the unified log event; if the original log corresponds to automatic processing or maintenance processing, the corresponding processing information is converted to a processing status. A unified log event includes device identifier, event time, event type, event attribution item, and event status value, and may include window auxiliary identifiers and processing status. This allows running logs from different sources and in different formats to participate in subsequent analysis according to the same event expression.

[0025] S2 collects unified log events based on device identifiers, forms an event time sequence based on event time, and divides the unified log events of the same printing device during continuous operation into device operation windows according to preset continuous operation judgment rules.

[0026] After unified log events are generated, they are aggregated according to device identifiers. Unified log events with the same device identifier are grouped into the same device event set. Then, the unified log events in the same device event set are sorted in chronological order to form an event time series. The device operation window represents the set of unified log events generated by the same printing device during a continuous operation period. It is used as the unit of analysis for subsequent log fluctuation statistics, load interpretation and judgment, and abnormal residual feature extraction.

[0027] Pre-defined continuous operation judgment rules are stored in the document printing equipment operation and maintenance platform, including window auxiliary identifier consistency judgment, event time interval judgment, and boundary event judgment. When judging adjacent unified log events in the event time series, the window auxiliary identifier, event time, event type, and event status value of the adjacent unified log events are read. When adjacent unified log events have the same window auxiliary identifier, they are determined to belong to the same continuous operation process. When adjacent unified log events have different window auxiliary identifiers, the previous continuous operation process is determined to have ended, and the subsequent unified log event is used as the start event of the new equipment operation window.

[0028] When adjacent unified log events do not contain window auxiliary identifiers, the two adjacent unified log events are read in chronological order of their event times. The event time interval is obtained by subtracting the event time of the preceding unified log event from the event time of the following unified log event. Simultaneously, the event type and event status values ​​of adjacent unified log events are read and matched against preset boundary event rules to determine if a boundary event has occurred. Boundary events are unified log events that indicate the end, interruption, reset, or interruption of the operation process by maintenance processing.

[0029] When the event time interval does not exceed the preset interval threshold and no boundary event occurs, adjacent unified log events are determined to belong to the same continuous running process. When the event time interval exceeds the preset interval threshold or a boundary event occurs, the previous continuous running process is determined to have ended, and the subsequent unified log event is used as the starting event of a new device running window. This forms a device running window, each including a device identifier, window start time, window end time, and a set of unified log events. The window start time is determined by the earliest event time within the window, and the window end time is determined by the latest event time within the window. S3, for the current device running window, combined with the corresponding document printing device's device running baseline and normal fluctuation baseline, load interpretation judgment is performed on the log fluctuations within the current device running window to determine the load interpretation status.

[0030] For the current device operation window, the attribute tags of the unified log events within the window are read according to the preset log mapping table. Unified log events with load attribute tags are identified as load identification events, and unified log events with status fluctuation attribute tags are identified as status fluctuation events. Load identification events are used to reflect task execution intensity or continuous operation intensity, while status fluctuation events are used to reflect status changes, abnormal states, recovery states, or recurring states other than normal task execution.

[0031] The system reads the corresponding printing equipment's operating baseline based on the equipment identifier. The operating baseline is associated with the equipment identifier and pre-stored in the printing equipment operation and maintenance platform, including a preset load level table, load statistics criteria, and log fluctuation item statistics criteria. The load statistics criteria define the statistical rules for the number of load identifier events, load duration, and the number of load events per unit time. The log fluctuation item statistics criteria define the statistical objects, grouping fields, and statistical items for status fluctuation events. The grouping fields include event type, event attribution, and event status value. The statistical items include the frequency of occurrence calculated according to a preset standard duration, the number of consecutive occurrence windows, the number of times the event recurs after automatic processing, and the number of times the event status value changes.

[0032] The load descriptor is calculated by counting load-identifying events within the current device's operating window according to the load statistics criteria. The load descriptor includes the number of load-identifying events, the load duration, and the number of load events per unit time. Specifically, the number of load-identifying events is obtained by counting the number of unified log events with load attribute tags within the current device's operating window; the load duration is obtained by reading the event time of each load-identifying event and subtracting the event time of the earliest load-identifying event from the event time of the latest event; when there are no load-identifying events within the current device's operating window, the number of load-identifying events, the load duration, and the number of load events per unit time are all recorded as 0; when there is only one load-identifying event within the current device's operating window, or when the time difference between the event time of the latest and the earliest load-identifying events is 0, a preset minimum statistical duration is used as the load duration; when the load duration is greater than 0, the number of load events per unit time is obtained by dividing the number of load-identifying events by the load duration.

[0033] The load descriptor quantity, load duration, and number of load events per unit time are compared with the range corresponding to each load level in the preset load level table. When all three fall within the range corresponding to the same load level, that load level is determined as the load level of the current device running window. When none of the three fall within the range corresponding to the same load level, candidate load levels corresponding to the load descriptor quantity, load duration, and number of load events per unit time are determined respectively, and the candidate load level that appears most frequently is determined as the load level of the current device running window. When there are multiple candidate load levels that appear the same number of times, the candidate load level with the higher load level is determined as the load level of the current device running window.

[0034] Simultaneously, according to the statistical criteria for log fluctuation items, status fluctuation events within the current device operating window are categorized and statistically analyzed based on event type and event attribution, resulting in a log fluctuation descriptive quantity. The log fluctuation descriptive quantity includes at least one current log fluctuation item, which includes at least one of the following: frequency fluctuation, consecutive window number fluctuation, automatic processing recurrence frequency fluctuation, and event status value change frequency fluctuation. When there are no status fluctuation events within the current device operating window, the values ​​of the frequency fluctuation, consecutive window number fluctuation, automatic processing recurrence frequency fluctuation, and event status value change frequency fluctuation are all recorded as 0, and the current device operating window is recorded as a stateless fluctuation window; the stateless fluctuation window continues to participate in subsequent comparisons with the normal fluctuation baseline. The frequency fluctuation item is obtained by counting the number of status fluctuation events with the same event type and the same event attribution within the current device operating window, and then adjusting the count to a preset standard duration based on the duration of the current device operating window. Specifically, the number of state fluctuation events is divided by the duration of the current device operating window, and then multiplied by a preset standard duration to obtain the frequency fluctuation item statistical value. When the duration of the current device operating window is 0, a preset minimum statistical duration is used as the duration of the current device operating window. The preset standard duration and the preset minimum statistical duration are pre-stored in the log fluctuation item statistical caliber. The consecutive window number fluctuation item is obtained by reading the current device operating window and its predecessor device operating windows, and counting the number of consecutive windows with the same event type and the same event attribute according to the time order of the device operating windows. The automatic processing recurrence number fluctuation item is obtained by reading the unified log event with the processing status of automatic processing completed, and counting the number of times the same event type, the same event attribute, and the same event status value reappears within a preset observation window. The event status value change number fluctuation item is obtained by reading the event status values ​​of the state fluctuation events under the same event type and the same event attribute, and counting the number of times the event status values ​​change according to the event time order.

[0035] This embodiment uses big data analysis to process the historical device operation window of the corresponding printing equipment, and classifies and statistically analyzes the historical operation data according to the load level and log fluctuation items to obtain the historical value distribution of log fluctuation items under each load level.

[0036] Obtain the normal fluctuation baseline corresponding to the current load level. The normal fluctuation baseline is derived from the historical device operation window of the corresponding printing device and is used to represent the acceptable log fluctuation range under the same load level. After obtaining the historical device operation window of the corresponding printing device, remove historical device operation windows that have generated maintenance confirmation faults, and remove historical device operation windows that have generated maintenance confirmation faults within the subsequent preset observation period to obtain candidate historical device operation windows. Maintenance confirmation faults are derived from the maintenance record database or the maintenance result field in the maintenance work order.

[0037] According to the load statistics caliber, the load identification events within the candidate historical device operation windows are statistically analyzed to obtain the load descriptor quantity of the candidate historical device operation windows. The load level of the candidate historical device operation windows is determined according to the same preset load level table, following the same load level determination rules as the current device operation window. Candidate historical device operation windows with load levels consistent with the current device operation window are then selected as normal sample windows of the same load level. According to the log fluctuation item statistics caliber, the status fluctuation events in each normal sample window of the same load level are classified and statistically analyzed to obtain the window values ​​for the frequency fluctuation item, the number of consecutively occurring window fluctuation items, the number of times the event status value changes after automatic processing fluctuation items, and the number of times the event status value changes fluctuation items for each normal sample window of the same load level. For the same log fluctuation item, the corresponding window value is read one by one according to the normal sample windows of the same load level, and the window values ​​of multiple normal sample windows of the same load level are aggregated into a historical value set. The historical value distribution is statistically analyzed based on the historical value set, and the preset quantile range or preset boundary range of the historical value distribution is determined as the acceptable fluctuation range under the corresponding load level. By associating load level, log fluctuation items, and acceptable fluctuation range, a normal fluctuation baseline is formed.

[0038] Based on the load level of the current device operating window, the acceptable fluctuation range for the corresponding load level is read from the normal fluctuation baseline, and the current log fluctuation item is compared with the corresponding range boundary. If the current log fluctuation item falls within the corresponding range boundary, an acceptable flag is generated; if the current log fluctuation item exceeds the corresponding range boundary, an out-of-range flag is generated. If all current log fluctuation items correspond to the acceptable flag, the load interpretation status of the current device operating window is determined to be a normal fluctuation interpretable state; if at least one current log fluctuation item corresponds to the out-of-range flag, the load interpretation status of the current device operating window is determined to be a normal fluctuation uninterpretable state, and the current log fluctuation item corresponding to the out-of-range flag and its corresponding status fluctuation event are determined to be log fluctuations that cannot be explained by normal operation under the corresponding load level. Figure 2The diagram illustrates the identification of out-of-range log fluctuation items based on acceptable fluctuation range according to Embodiment 1 of the present invention. Taking frequency fluctuation items as an example, the horizontal axis represents the device operating window number, and the vertical axis represents the frequency fluctuation statistics of status fluctuation events with the same event type and the same event affiliation within each device operating window, calculated according to a preset standard duration, in units of times. The dashed line represents the acceptable upper limit of frequency fluctuation items corresponding to the current load level, read from the normal fluctuation baseline. When the frequency fluctuation item statistical value is not higher than the acceptable upper limit, an acceptable mark is generated for the frequency fluctuation item; when the frequency fluctuation item statistical value is higher than the acceptable upper limit, an out-of-range mark is generated for the frequency fluctuation item. The marked points in the diagram represent the device operating window where the out-of-range mark is generated.

[0039] S4. After determining the load interpretation status, identify log fluctuations in the current device operation window that cannot be explained by normal operation under the corresponding load level, and locate the log fluctuations to the corresponding unified log event to form abnormal residual characteristics.

[0040] After determining the load interpretation status, if the load interpretation status of the current device operating window is normal fluctuation interpretable, then it is determined that the current device operating window does not have log fluctuations that cannot be explained by normal operation under the corresponding load level, does not form abnormal residual characteristics, and the current device operating window is recorded as a normal high load interpretable window. If the load interpretation status of the current device operating window is normal fluctuation uninterpretable, then it is determined that the current device operating window has log fluctuations that cannot be explained by normal operation under the corresponding load level, and the current log fluctuation item marked as out of range and the status fluctuation event corresponding to the current log fluctuation item are read. The current log fluctuation item includes at least one of the following: frequency fluctuation item, number of consecutive occurrences of a window fluctuation item, number of recurrences after automatic processing fluctuation item, and number of event status value changes fluctuation item.

[0041] Based on the event type, event attribution, and event status value of the status fluctuation event, search for unified log events with the same event type, event attribution, and event status value within the current device operation window, and identify the found unified log events as target unified log events. When the same current log fluctuation item corresponds to multiple target unified log events, associate the multiple target unified log events according to the event time to form a residual event set.

[0042] For different types of current log fluctuation items, a corresponding method is used to determine the residual event set. For frequency fluctuation items, multiple unified log events of the same event type and the same event attribution within the current device operating window are aggregated, and when their occurrence frequency exceeds the acceptable fluctuation range, they are determined as the residual event set. For consecutive window number fluctuation items, status fluctuation events of the same event type and the same event attribution within the current device operating window and the preceding device operating window are read to determine the consecutive window number; when the consecutive window number exceeds the acceptable fluctuation range, unified log events of the same event type and the same event attribution within the current device operating window are determined as the residual event set. For automatic processing recurrence frequency fluctuation items, unified log events of the same event type, the same event attribution, and the same event status value that reappear in the preset observation window after automatic processing is displayed are read; when the recurrence frequency exceeds the acceptable fluctuation range, the corresponding unified log events within the current device operating window are determined as the residual event set.

[0043] After determining the target unified log event or residual event set, the statistical result of the current log fluctuation item is compared with the acceptable fluctuation range corresponding to the same log fluctuation item in the normal fluctuation baseline to determine deviation information. If the statistical result of the current log fluctuation item is higher than the upper boundary of the corresponding acceptable fluctuation range, the deviation direction is determined as upward excess, and the difference between the statistical result and the upper boundary is determined as the degree of deviation; if the statistical result of the current log fluctuation item is lower than the lower boundary of the corresponding acceptable fluctuation range, the deviation direction is determined as downward excess, and the difference between the lower boundary and the statistical result is determined as the degree of deviation; the degree of deviation is a non-negative value used to represent the magnitude by which the current log fluctuation item exceeds the boundary of the corresponding acceptable fluctuation range. If the statistical result of the current log fluctuation item falls within the corresponding acceptable fluctuation range, no corresponding deviation information is generated. Based on the target unified log event in the target unified log event or residual event set, the residual event type, residual event attribution item, and residual event status value are determined; based on the event time of the target unified log event or residual event set in the current device operating window, the occurrence time and deviation sequence position are determined. When the residual event set contains at least two target unified log events, the target unified log events are arranged in chronological order. The deviation duration is obtained by subtracting the event time of the earliest target unified log event from the event time of the latest target unified log event. Similarly, the adjacent occurrence interval is obtained by subtracting the event time of the preceding target unified log event from the event time of the following two adjacent target unified log events. When multiple adjacent occurrence intervals exist, they are arranged in chronological order to form an adjacent occurrence interval set. When the residual event set contains only one target unified log event, the deviation duration is recorded as 0, and the adjacent occurrence interval is marked as having no adjacent interval. The occurrence frequency is determined based on the number of target unified log events or the residual event set. The presence of a recurring state after automatic processing is determined based on the processing status of each target unified log event in the target unified log event or the residual event set.

[0044] At least two of the following parameters are associated with the residual event type, residual event attribution, residual event status value, deviation direction, deviation degree, deviation duration, deviation sequence position, occurrence time, occurrence frequency, adjacent occurrence interval, and recurrence status after automatic processing: these are then linked according to the corresponding target unified log event or residual event set to form abnormal residual features. These abnormal residual features represent abnormal changes that still exist within the current device operating window after excluding the effects of normal high-load operation, and serve as the basis for subsequent judgment of the evolution state of fault precursors. For example... Figure 3The diagram shown is a sorting diagram of the deviation degree of abnormal residual features from the highest deviation from the device operation window according to Embodiment 1 of the present invention. The target device operation window is the current device operation window used to display the deviation degree of abnormal residual features. In the diagram, the numbers starting with "E" on the vertical axis represent different types of abnormal residual features, and the horizontal axis represents the deviation degree determined according to the aforementioned rules. The deviation degree is the difference between the statistical result of the current log fluctuation item and the upper or lower boundary of the corresponding acceptable fluctuation range; the larger the value, the greater the magnitude by which the corresponding current log fluctuation item exceeds the boundary of the acceptable fluctuation range. The abnormal residual features are arranged from highest to lowest deviation degree. This diagram is used to illustrate the differences in the deviation degree of different abnormal residual features within the same device operation window.

[0045] S5 determines the pre-fault evolution status of the current equipment operation window based on abnormal residual characteristics, and generates operation and maintenance alarm information when the pre-fault evolution conditions are met.

[0046] When no abnormal residual features are formed in the current device operation window, it is determined that the current device operation window does not meet the conditions for the evolution of fault precursors, and no corresponding operation and maintenance alarm information is generated. When abnormal residual features are formed in the current device operation window, the abnormal residual features in the current device operation window and the previous device operation window of the same printing device are read, and an abnormal residual feature sequence is formed according to the time order of the device operation windows. The previous device operation window comes from the historical device operation window under the same device identifier and whose event time is earlier than the current device operation window. The previous device operation window is only used to determine the continuous occurrence of abnormal residual features in multiple device operation windows and does not change the set of residual events already formed in the current device operation window.

[0047] The conditions for continuous evolution, recurrence, and historical similarity are determined based on the sequence of anomalous residual features. When anomalous residual features corresponding to the same event attribution or event type appear consecutively in at least a preset number of equipment operation windows, and the degree of deviation does not decrease, the anomalous residual features are deemed to meet the conditions for continuous evolution. The consecutively appearing data comes from the sequence of anomalous residual features in the current equipment operation window and the preceding equipment operation window. Whether the degree of deviation decreases is determined by comparing the degree of deviation of the same anomalous residual features in adjacent equipment operation windows. For example... Figure 4The diagram illustrates the cross-device operation window transfer relationship of abnormal residual features according to Embodiment 1 of the present invention. The numbers beginning with "E" in the diagram represent different abnormal residual feature types. The abnormal residual feature type is determined by a combination of the event type, event attribution item, and event status value of the unified log event, and does not represent the order of steps. The device operation windows of the same printing device are arranged in chronological order. When one abnormal residual feature appears in a previous device operation window and another abnormal residual feature appears in a subsequent adjacent device operation window, a directed line is established between the two abnormal residual features, pointing from the former to the latter. When the same abnormal residual feature appears consecutively in adjacent device operation windows, a self-loop is established for that abnormal residual feature. The direction of the arrows indicates the temporal sequence of the device operation windows, not a causal relationship; the node size, line thickness, and node position are only for graphical illustration and do not represent the frequency, deviation, or importance of the abnormal residual feature. This diagram is used to illustrate the continuous appearance and transfer relationship of abnormal residual features in consecutive device operation windows, providing a reference for judging continuous evolution conditions.

[0048] When a unified log event corresponding to an anomaly residual characteristic reappears within a preset observation window after automatic processing, the anomaly residual characteristic is deemed to meet the recurrence and evolution conditions. The automatic processing completion time is determined based on the processing completion time field in the original automatic processing log; if the original automatic processing log does not contain a processing completion time field, the automatic processing completion time is determined based on the event time of the unified log event whose processing status is "automatically processed and completed." The preset observation window is pre-configured by the document printing equipment operation and maintenance platform. The reappearing data comes from unified log events with the same event type, the same event attribution item, and the same event status value within the preset observation window after the automatic processing completion time.

[0049] The abnormal residual feature sequence is considered to meet the historical similarity evolution condition when at least two of the following four criteria are consistent with the abnormal residual feature sequence before the historical maintenance confirmed fault: event type, event attribution, deviation direction, and occurrence order. The abnormal residual feature sequence before the historical maintenance confirmed fault comes from the equipment operation window corresponding to the historical fault confirmed by the maintenance results in the maintenance record database. For example... Figure 5The diagram illustrates the co-occurrence similarity of abnormal residual features according to Embodiment 1 of the present invention. In the diagram, numbers starting with "E" on both the horizontal and vertical axes represent different types of abnormal residual features, and the color intensity indicates the co-occurrence similarity of two abnormal residual features appearing together within the same equipment operating window. For any two abnormal residual features, the number of equipment operating windows containing either of these features and the number of equipment operating windows simultaneously containing both features are counted. The number of equipment operating windows simultaneously containing both features is divided by the number of equipment operating windows containing either of these features to obtain the window co-occurrence similarity. The window co-occurrence similarity ranges from 0 to 1; a higher value indicates a greater degree of co-occurrence of the two abnormal residual features within the same equipment operating window. The window co-occurrence similarity is calculated pairwise for each abnormal residual feature and arranged according to the type of abnormal residual feature to form a window co-occurrence similarity matrix. This matrix is ​​used to identify the combinational relationships between abnormal residual features, providing a reference for determining whether the current abnormal residual feature sequence is similar to the abnormal residual feature sequence before the historical maintenance confirmed fault.

[0050] When at least one of the following conditions is met—continuous evolution, recurrence, and historical similarity—the fault precursor evolution state of the current equipment operating window is recorded as meeting the fault precursor evolution condition. When none of the above conditions are met, the fault precursor evolution state of the current equipment operating window is recorded as not meeting the fault precursor evolution condition. When the fault precursor evolution state meets the fault precursor evolution condition, an operation and maintenance alarm is generated. The operation and maintenance alarm includes the alarm type, alarm level, and triggering reason. The alarm type is determined based on the residual event type and residual event attribution item in the abnormal residual characteristics. When the residual event attribution item is a paper path related event, the alarm type is determined as a paper path abnormality precursor alarm; when the residual event attribution item is an imaging related event, the alarm type is determined as an imaging abnormality precursor alarm; when the residual event attribution item is a consumables related event, the alarm type is determined as a consumables abnormality precursor alarm. The alarm level is determined based on the number of evolutionary conditions met, the degree of deviation, and the number of consecutive occurrence windows. When the continuous evolution condition, the recurring evolution condition, and the historically similar evolution condition are met simultaneously, or when the degree of deviation reaches the preset high-level deviation range, the alarm level is determined to be a high-level alarm. When two of the continuous evolution condition, the recurring evolution condition, and the historically similar evolution condition are met, or when the number of consecutive occurrence windows reaches the preset medium-level consecutive window number, the alarm level is determined to be a medium-level alarm. When only one of the continuous evolution condition, the recurring evolution condition, and the historically similar evolution condition is met, the alarm level is determined to be a low-level alarm. The triggering cause is generated based on the actual evolution conditions and the corresponding abnormal residual characteristics. When the continuous evolution condition is met, the triggering cause includes the number of equipment operation windows in which the abnormal residual characteristics appear consecutively. When the recurrence evolution condition is met, the triggering cause includes the event type, event attribution item, and event status value that reappear after automatic processing. When the historical similarity evolution condition is met, the triggering cause includes the event type, event attribution item, deviation direction, or occurrence order that is consistent with the abnormal residual characteristic sequence before the historical maintenance confirmed fault.

[0051] Through this embodiment, the document printing equipment operation and maintenance platform can unify multi-source operation logs into unified log events, and use the equipment operation window as the unit of analysis. First, it excludes log fluctuations that can be explained by normal high-load operation, and then forms abnormal residual characteristics for log fluctuations that cannot be explained by normal operation under the corresponding load level. Furthermore, it generates operation and maintenance alarm information based on continuous occurrence, automatic processing and reproduction, and similar situations confirmed by historical maintenance, thereby improving the timeliness and accuracy of document printing equipment operation and maintenance alarms.

[0052] This embodiment also provides a document printing equipment operation and maintenance alarm system based on big data mining of operation logs, such as... Figure 6The diagram shown is a framework diagram of a document printing equipment operation and maintenance alarm system based on big data mining of operation logs according to Embodiment 1 of the present invention. It includes a unified log event processing module, an equipment operation window construction module, a load interpretation status determination module, an abnormal residual feature extraction module, and an operation and maintenance alarm generation module.

[0053] The unified log event processing module is used to acquire multi-source operation logs of document printing devices and perform event-based processing on the multi-source operation logs according to a preset log mapping table to form unified log events.

[0054] The device operation window construction module is used to collect unified log events based on device identifiers, form event time sequences based on event times, and divide unified log events of the same printing device during continuous operation into device operation windows according to preset continuous operation judgment rules.

[0055] The load interpretation status determination module is used to determine the load interpretation status by analyzing the log fluctuations within the current device operating window, based on the corresponding document printing device's operating baseline and normal fluctuation baseline.

[0056] The abnormal residual feature extraction module is used to identify log fluctuations in the current device operating window that cannot be explained by normal operation under the corresponding load level after determining the load interpretation status, and to locate the log fluctuations to the corresponding unified log events to form abnormal residual features.

[0057] The maintenance alarm generation module is used to determine the pre-fault evolution status of the current equipment operation window based on abnormal residual characteristics, and generate maintenance alarm information when the pre-fault evolution conditions are met.

[0058] Embodiment 2 of the present invention: Based on Embodiment 1, this embodiment further provides an alarm feedback correction method based on maintenance confirmation results.

[0059] In this embodiment, after generating maintenance alarm information, the alarm information is sent to the maintenance work order system. The maintenance work order system generates a maintenance work order based on the alarm information. The maintenance work order includes the device identifier, alarm type, alarm level, triggering reason, abnormal residual characteristics, device operating window identifier, and alarm generation time. After maintenance personnel complete on-site or remote processing, they write the maintenance processing result into the maintenance work order system. The maintenance processing result includes the maintenance confirmation status, actual fault type, actual maintenance object, maintenance action, maintenance completion time, and maintenance conclusion. The maintenance confirmation status indicates whether the maintenance alarm has been confirmed by the maintenance result; the maintenance confirmation status includes fault confirmation status and non-fault confirmation status.

[0060] When maintenance personnel confirm that the printing equipment has a paper jam, imaging abnormality, consumable abnormality, paper path abnormality, component lifespan abnormality, or other faults consistent with the alarm type, the maintenance work order system will write the maintenance confirmation status to "fault confirmed status" and record the actual fault type and the actual maintenance object. When maintenance personnel confirm that the printing equipment has not actually malfunctioned, or that the alarm only corresponds to normal high-load operation fluctuations, the maintenance work order system will write the maintenance confirmation status to "non-fault confirmed status" and record the non-fault cause. The maintenance record database will associate and store the maintenance results with the equipment identifier, equipment operation window identifier, and corresponding abnormal residual characteristics.

[0061] Upon receiving the maintenance result, the maintenance confirmation status is read, and it is determined whether the normal fluctuation baseline needs to be corrected based on the maintenance confirmation status. If the maintenance confirmation status is a non-fault confirmation status, and the corresponding abnormal residual characteristics originate from log fluctuation items outside the range under the inexplicable normal fluctuation status, then the device's operating window is marked as a recyclable sample window. A recyclable sample window indicates that although there were log fluctuation items outside the range during the original judgment process, after confirmation by the maintenance result, these log fluctuation items actually belong to normal operating fluctuations.

[0062] For recyclable sample windows, the load level, log fluctuation items, and log fluctuation description values ​​of the window are read, and the window is added to the candidate normal sample window set under the corresponding load level. Subsequently, according to the statistical caliber of log fluctuation items, the window values ​​of log fluctuation items in each sample window in the sample window set under the corresponding load level are statistically analyzed. The window values ​​of the same log fluctuation item in multiple sample windows are aggregated, the historical value distribution of the corresponding log fluctuation item is updated, and the acceptable fluctuation range is adjusted according to the updated historical value distribution. The adjustment method is as follows: if the log fluctuation item in the recyclable sample window is repeatedly confirmed as non-faulty by the maintenance results, and the value of the log fluctuation item is close to the boundary of the original acceptable fluctuation range, then the boundary of the acceptable fluctuation range corresponding to the log fluctuation item is expanded by a preset correction margin; if the log fluctuation item only appears once, or the corresponding window has not reached the preset number of recyclings, then the acceptable fluctuation range is not adjusted, and the window is only saved as an observation sample.

[0063] If the maintenance confirmation status is a fault confirmation status, the corresponding equipment operation window will not be added to the normal sample window set of the same load level. The abnormal residual features corresponding to the fault confirmation status are read, and these features are associated with the actual fault type, the actual maintenance object, and the maintenance completion time to form a maintenance confirmation abnormal sample. The maintenance confirmation abnormal sample represents a fault precursor sample that has been confirmed by the maintenance results; the data source is the abnormal residual features and the maintenance processing results.

[0064] The fault precursor evolution conditions are revised based on maintenance confirmation anomaly samples. Specifically, the event type, event attribution, deviation direction, deviation degree, occurrence order, number of consecutive occurrence windows, and automatic processing recurrence status in the maintenance confirmation anomaly samples are read and compared with the currently stored fault precursor evolution conditions. If the abnormal residual features in the maintenance confirmation anomaly sample are the same as or similar to a certain fault precursor evolution condition, and the maintenance confirmation status is a fault confirmation status, the trigger priority of that fault precursor evolution condition is increased. If multiple maintenance processing results indicate that a certain combination of abnormal residual features does not correspond to an actual fault, the trigger priority corresponding to that combination of abnormal residual features is decreased, or the combination of abnormal residual features is saved as an observation condition and not directly generated as an operation and maintenance alarm information.

[0065] When a subsequent equipment operation window enters the alarm judgment phase, the fault precursor evolution status of the current equipment operation window is determined based on the corrected normal fluctuation baseline and fault precursor evolution conditions. When the continuous evolution condition, recurring evolution condition, or historically similar evolution condition is met, and the corresponding abnormal residual feature combination meets the corrected triggering requirements, an operation and maintenance alarm message is generated; when the corresponding evolution condition is met but the corrected triggering requirements are not met, the corresponding abnormal residual features are recorded and the system continues to wait for the recurrence or continuous occurrence of results in subsequent equipment operation windows.

[0066] In this embodiment, the system does not end the judgment after a single alarm, but feeds back the maintenance confirmation result to the normal fluctuation baseline and the fault precursor evolution conditions. For alarm results confirmed as normal high load fluctuations, the acceptable fluctuation range under the corresponding load level can be expanded, reducing subsequent false alarms; for alarm results confirmed as true fault precursors, the correlation between the corresponding abnormal residual characteristics and fault precursor evolution conditions can be strengthened, improving the timeliness and accuracy of identifying similar fault precursors. The difference between this embodiment and Embodiment 1 is that Embodiment 1 focuses on a complete alarm process, while this embodiment focuses on the feedback correction closed loop after maintenance confirmation, and does not repeat the log event processing and equipment operation window construction process in Embodiment 1.

Claims

1. A method for generating maintenance alarms for printing equipment based on big data mining of operational logs, characterized in that, include: S1. Obtain the multi-source operation logs of the printing equipment, and perform event-based processing on the multi-source operation logs according to the preset log mapping table to form a unified log event; S2. Collect unified log events based on device identifiers, form event time sequences based on event times, and divide unified log events of the same printing device during continuous operation into device operation windows according to preset continuous operation judgment rules. S3. For the current device operation window, combine the device operation benchmark and normal fluctuation baseline of the corresponding document printing device to perform load interpretation judgment on the log fluctuation within the current device operation window and determine the load interpretation status. S4. After determining the load interpretation status, identify log fluctuations in the current device operation window that cannot be explained by normal operation under the corresponding load level, and locate the log fluctuations to the corresponding unified log event to form abnormal residual characteristics. S5. Based on the abnormal residual characteristics, determine the fault precursor evolution status of the current equipment operation window, and generate operation and maintenance alarm information when the fault precursor evolution conditions are met.

2. The method for issuing alarms for document printing equipment based on big data mining of operation logs according to claim 1, characterized in that, The process of acquiring multi-source operation logs of the document printing device and performing event-based processing on the multi-source operation logs according to a preset log mapping table to form unified log events includes: Obtain multi-source operation logs through the device management interface of the printing equipment, the remote management platform interface, or the log upload channel; When the printing equipment actively reports status changes, abnormal statuses, or automatic processing statuses, it receives the corresponding reporting logs. If a maintenance record exists, it reads the maintenance record associated with the equipment identifier. Each multi-source operation log is parsed to extract the device identifier, log time, log type, log content, and status information. Based on the preset log mapping table, the log time is converted into an event time in a unified time format, the log type is converted into an event type, the event attribute is determined based on the log type and log content, the status information is converted into an event status value, and the device identifier is retained to form a unified log event. The unified log event includes device identifier, event time, event type, event attribution item, and event status value. When the unified log event includes a running session identifier or task process identifier, it also includes a window auxiliary identifier. When the unified log event corresponds to automatic processing or maintenance processing, it also includes a processing status.

3. The document printing equipment operation and maintenance alarm method based on big data mining of operation logs according to claim 1, characterized in that, The step of dividing the unified log events of the same printing device during continuous operation into device operation windows according to the preset continuous operation determination rules includes: Unified log events are aggregated according to device identifiers and then formed into an event time sequence based on event time. Read the window auxiliary identifier, event time, event type, and event status value from adjacent unified log events; When adjacent unified log events have the same window auxiliary identifier, it is determined that the adjacent unified log events belong to the same continuous running process; When adjacent unified log events have different window auxiliary identifiers, the previous continuous running process is determined to have ended, and the unified log events that occur afterward are used as the start events of the new device running window. When adjacent unified log events do not contain window auxiliary identifiers, if the time interval between adjacent unified log events does not exceed the preset interval threshold and no boundary event occurs, then the adjacent unified log events are determined to belong to the same continuous running process. When the time interval between adjacent unified log events exceeds the preset interval threshold, or when a boundary event occurs, the previous continuous running process is determined to have ended, and the unified log event that occurs afterward is used as the start event of a new device running window. The window auxiliary identifier includes a running session identifier or a task process identifier, and the boundary event is a unified log event indicating that the running process has ended, been interrupted, reset, or been interrupted by maintenance processing.

4. The method for issuing alarms for document printing equipment based on big data mining of operation logs according to claim 1, characterized in that, The process of interpreting and judging log fluctuations within the current device operating window includes: The attribute tags of the unified log events in the current device running window are read according to the preset log mapping table, and the unified log events with load attribute tags are identified as load identification events, and the unified log events with state fluctuation attribute tags are identified as state fluctuation events. The corresponding document printing device's operating baseline is read based on the device identifier. The device operating baseline includes a preset load level table, load statistics caliber, and log fluctuation item statistics caliber. According to the load statistics criteria, the load identification events in the current device operation window are statistically analyzed to obtain the load description quantity of the current device operation window. The load description quantity includes the number of load identification events, the load duration, and the number of load events per unit time. The preset load level table in the device operation baseline is read. The preset load level table includes load levels and the range of load identification events, load duration range and load event range per unit time corresponding to each load level. The load description quantity is matched with the preset load level table, and the matched load level is determined as the load level of the current device operation window. According to the statistical criteria for log fluctuation items, the status fluctuation events within the current device operation window are classified and statistically analyzed according to event type and event attribution to obtain the log fluctuation description quantity of the current device operation window. The log fluctuation description quantity includes at least one current log fluctuation item. Obtain the normal fluctuation baseline corresponding to the load level, and determine the load interpretation status based on the log fluctuation description volume and the normal fluctuation baseline.

5. The document printing equipment operation and maintenance alarm method based on big data mining of operation logs according to claim 4, characterized in that, The step of obtaining the normal fluctuation baseline corresponding to the load level includes: Obtain the historical device operation windows of the corresponding printing equipment, remove historical device operation windows that have generated maintenance confirmation faults, and remove historical device operation windows that have generated maintenance confirmation faults within the subsequent preset observation period to obtain candidate historical device operation windows; Based on the load statistics criteria in the device operation benchmark, the load identification events in the candidate historical device operation window are statistically analyzed to obtain the load description quantity of the candidate historical device operation window. Read the preset load level table and match the load description of the candidate historical device operation window with the preset load level table to determine the load level of the candidate historical device operation window; From the candidate historical device operation window, select the candidate historical device operation window whose load level, determined according to the same preset load level table, is consistent with the load level of the current device operation window, and use it as the normal sample window of the same load level. According to the statistical criteria for log fluctuation items, the status fluctuation events in each normal sample window of the same load level are classified and statistically analyzed to obtain the window value of each log fluctuation item in each normal sample window of the same load level. The window values ​​of the same log fluctuation item in multiple normal sample windows of the same load level are collected to form the historical value distribution of the corresponding log fluctuation item, and the preset quantile range or preset boundary range of the historical value distribution is determined as the acceptable fluctuation range under the corresponding load level. The load level, log fluctuation items, and acceptable fluctuation range are correlated to form a normal fluctuation baseline corresponding to the load level.

6. The method for issuing alarms for document printing equipment based on big data mining of operation logs according to claim 4, characterized in that, The process of determining the load interpretation status based on the log fluctuation descriptive value and the normal fluctuation baseline includes: Based on the load level of the current device operating window, the acceptable fluctuation range under the corresponding load level is read from the normal fluctuation baseline. The normal fluctuation baseline is established separately according to different load levels, and the acceptable fluctuation range includes the range boundary corresponding to each log fluctuation item. Read at least one current log fluctuation item from the log fluctuation description of the current device running window. The current log fluctuation item includes at least one of the following: frequency fluctuation item, number of consecutive occurrence windows fluctuation item, number of recurrences after automatic processing fluctuation item, and number of event status value changes fluctuation item. Each current log fluctuation item is compared with its corresponding range boundary. If the current log fluctuation item falls within the corresponding range boundary, an acceptable mark is generated for the current log fluctuation item. If the current log fluctuation item exceeds the corresponding range boundary, an out-of-range mark is generated for the current log fluctuation item. If all current log fluctuation items correspond to the acceptable flag, then the load interpretation status of the current device running window is determined to be a normal fluctuation interpretable status. If at least one current log fluctuation item corresponds to an out-of-range flag, the load interpretation status of the current device operating window is determined to be a normal fluctuation unexplainable state, and the current log fluctuation item corresponding to the out-of-range flag and its corresponding status fluctuation event are determined to be log fluctuations that cannot be explained by normal operation under the corresponding load level.

7. The document printing equipment operation and maintenance alarm method based on big data mining of operation logs according to claim 6, characterized in that, The step of locating the log fluctuation to the corresponding unified log event includes: Read the current log fluctuation item corresponding to the log fluctuation that is determined to be inexplicable by normal operation under the corresponding load level, and read the status fluctuation event corresponding to the current log fluctuation item; Based on the event type, event attribution, and event status value of the status fluctuation event, search for unified log events with the same event type, the same event attribution, and the same event status value within the current device operation window, and determine the found unified log events as target unified log events; When the same current log fluctuation item corresponds to multiple target unified log events, the multiple target unified log events are associated according to the event time to form a residual event set; The target unified log event or the set of residual events is compared with the acceptable fluctuation range corresponding to the same log fluctuation item in the normal fluctuation baseline to determine the deviation information of the target unified log event or the set of residual events relative to the normal fluctuation baseline.

8. The method for issuing alarms for document printing equipment based on big data mining of operation logs according to claim 7, characterized in that, The formation of abnormal residual features includes: Based on the deviation information, at least one of the following is determined: residual event type, residual event attribution item, residual event status value, deviation direction, deviation degree, deviation duration, and deviation sequence position; Based on the event time of the target unified log event or residual event set, determine the occurrence time and deviation sequence position of the deviation information within the current device operating window; Based on the number of the target unified log events or residual event set, determine the number of times the deviation information appears within the current device operating window; The adjacent occurrence interval of the deviation information is determined based on the event time interval between adjacent target unified log events; Based on the processing status of the corresponding unified log event, determine whether the deviation information has a recurrence status after automatic processing; At least two of the following residual event types, residual event attribution items, residual event status values, deviation direction, deviation degree, deviation duration, deviation sequence position, occurrence time, occurrence frequency, adjacent occurrence interval, and automatic processing recurrence status are associated with the corresponding target unified log events or residual event sets to form abnormal residual features.

9. The method for issuing alarms for document printing equipment based on big data mining of operation logs according to claim 8, characterized in that, The method of determining the pre-fault evolution status of the current equipment operating window based on abnormal residual characteristics, and generating operation and maintenance alarm information when the pre-fault evolution conditions are met, includes: Read the abnormal residual features in the current device operation window and the previous device operation window of the same device, and form an abnormal residual feature sequence according to the time order of the device operation windows; When the abnormal residual features corresponding to the same event attribution item or the same event type appear in no less than a preset number of consecutive device operation windows, and the degree of deviation does not decrease, it is determined that the abnormal residual features meet the conditions for continuous evolution. When the unified log event corresponding to the abnormal residual feature reappears in the preset observation window after automatic processing, it is determined that the abnormal residual feature meets the reproduction and evolution conditions. When the current abnormal residual feature sequence is consistent with the abnormal residual feature sequence before the historical maintenance confirmed fault in at least two of the event type, event attribution, deviation direction and occurrence order, it is determined that the abnormal residual feature satisfies the historical similarity evolution condition. When at least one of the continuous evolution condition, the recurrence evolution condition, and the historical similarity evolution condition is met, the fault precursor evolution state of the current equipment operation window is recorded as meeting the fault precursor evolution condition; otherwise, the fault precursor evolution state of the current equipment operation window is recorded as not meeting the fault precursor evolution condition. When the fault precursor evolution state in the current equipment operation window meets the fault precursor evolution conditions, an operation and maintenance alarm is generated based on the met continuous evolution conditions, recurring evolution conditions, or historical similar evolution conditions, as well as the corresponding abnormal residual characteristics. The operation and maintenance alarm information includes alarm type, alarm level, and triggering reason.

10. A document printing equipment operation and maintenance alarm system based on big data mining of operation logs, characterized in that, It includes a unified log event processing module, a device operation window construction module, a load interpretation status determination module, an abnormal residual feature extraction module, and an operation and maintenance alarm generation module; The unified log event processing module is used to acquire multi-source operation logs of the printing equipment and perform event-based processing on the multi-source operation logs according to a preset log mapping table to form unified log events. The device operation window construction module is used to collect unified log events based on device identifiers, form event time sequences based on event times, and divide unified log events of the same printing device during continuous operation into device operation windows according to preset continuous operation judgment rules. The load interpretation status determination module is used to determine the load interpretation status by judging the log fluctuations within the current device operation window based on the device operation benchmark and normal fluctuation baseline of the corresponding document printing device, and in accordance with the current device operation window. The abnormal residual feature extraction module is used to determine, after determining the load interpretation status, log fluctuations in the current device operation window that cannot be explained by normal operation under the corresponding load level, and to locate the log fluctuations to the corresponding unified log events to form abnormal residual features; The maintenance alarm generation module is used to determine the pre-fault evolution status of the current equipment operation window based on abnormal residual characteristics, and generate maintenance alarm information when the pre-fault evolution conditions are met.

Images