CN111555921B - Method and device for positioning alarm root cause, computer equipment and storage medium - Google Patents

Method and device for positioning alarm root cause, computer equipment and storage medium Download PDF

Info

Publication number
CN111555921B
CN111555921B CN202010357568.4A CN202010357568A CN111555921B CN 111555921 B CN111555921 B CN 111555921B CN 202010357568 A CN202010357568 A CN 202010357568A CN 111555921 B CN111555921 B CN 111555921B
Authority
CN
China
Prior art keywords
alarm
root cause
designated
index
appointed
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202010357568.4A
Other languages
Chinese (zh)
Other versions
CN111555921A (en
Inventor
陈桢博
金戈
徐亮
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Technology Shenzhen Co Ltd
Original Assignee
Ping An Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Technology Shenzhen Co Ltd filed Critical Ping An Technology Shenzhen Co Ltd
Priority to CN202010357568.4A priority Critical patent/CN111555921B/en
Priority to PCT/CN2020/099434 priority patent/WO2021217865A1/en
Publication of CN111555921A publication Critical patent/CN111555921A/en
Application granted granted Critical
Publication of CN111555921B publication Critical patent/CN111555921B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/064—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving time analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/22—Matching criteria, e.g. proximity measures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0677—Localisation of faults

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Mining & Analysis (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Biology (AREA)
  • Evolutionary Computation (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Alarm Systems (AREA)

Abstract

The application discloses a method and a device for positioning an alarm root cause, computer equipment and a storage medium, wherein a specific alarm object in an alarm slice is obtained, and a corresponding alarm cluster is generated; carrying out index aggregation processing on monitoring indexes in a designated alarm object in an alarm cluster to generate an entry index; acquiring first index time sequence data corresponding to a designated alarm object and acquiring second index time sequence data corresponding to the designated alarm object; adjusting the first time window of the first index time sequence data according to the second time window of the second index time sequence data, and calculating the appointed Pearson similarity between the appointed index and the entrance index; according to the appointed Pearson similarity corresponding to each appointed alarm object and the appointed time difference corresponding to each appointed Pearson similarity respectively; and screening at least one designated alarm object from all designated alarm objects to serve as a root cause object of the alarm cluster and outputting the root cause object. The method and the device can quickly generate the root cause object related to the alarm object.

Description

Method and device for positioning alarm root cause, computer equipment and storage medium
Technical Field
The present application relates to the field of network alarm monitoring technologies, and in particular, to a method and an apparatus for locating an alarm root cause, a computer device, and a storage medium.
Background
With the rapid development of science and technology, the business scenes of the current information age are changing day by day, and frequent business function updates and configuration parameter changes can cause endless abnormal alarms, thereby causing potential safety hazards and potential loss. In an operation and maintenance system, a fault generated by an object may cause a plurality of alarms of the object, and a large number of associated alarms caused by a plurality of object faults may exist at each moment. Therefore, how to quickly locate Root Cause and time loss of an abnormal alarm when the abnormal alarm occurs in the operation and maintenance system becomes a problem to be solved urgently. The existing method for positioning the alarm root cause needs operation and maintenance personnel to pay attention to an operation and maintenance system all the time, then segmentation is carried out on the alarm object at a certain time to conclude different problems, root cause analysis is carried out on each problem to judge a fault object, the workload of the operation and maintenance personnel is large, the time consumption of the operation and maintenance work is long, and the operation and maintenance work efficiency is low.
Disclosure of Invention
The application mainly aims to provide a method, a device, computer equipment and a storage medium for positioning an alarm root cause, and aims to solve the technical problems that operation and maintenance personnel need to pay attention to an operation and maintenance system all the time in the existing mode for positioning the alarm root cause, then an alarm object at a certain time is segmented to sum up different problems, root cause analysis is carried out on each problem to judge a fault object, the workload of the operation and maintenance personnel is large, the time consumption of operation and maintenance work is long, and the operation and maintenance work efficiency is low.
The application provides a method for positioning an alarm root cause, which comprises the following steps:
acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice;
acquiring a designated alarm object in the alarm cluster, and performing index aggregation processing on monitoring indexes in the designated alarm object to generate a corresponding entry index, wherein the designated alarm object is any one of all alarm objects in the alarm cluster;
acquiring first index time sequence data corresponding to an appointed index of the appointed alarm object and acquiring second index time sequence data corresponding to an entry index of the appointed alarm object;
according to a second time window of the second index time sequence data, adjusting a first time window of the first index time sequence data according to a first preset rule, and calculating the appointed Pearson similarity between the appointed index and the entrance index;
respectively obtaining appointed Pearson similarity corresponding to each appointed alarm object and appointed time difference corresponding to each appointed Pearson similarity;
and screening at least one designated alarm object from all designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity.
Optionally, the step of obtaining a specific alarm object in the alarm slice and generating an alarm cluster according to the specific alarm object includes:
acquiring a specific alarm object in an alarm slice;
respectively calculating the calling chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;
circularly executing the step of screening out the target alarm objects of which the calling chain distance with the specific alarm object is not more than a preset distance threshold from the alarm slice until no target alarm object of which the calling chain distance with the specific alarm object is not more than the preset distance threshold exists in the alarm slice;
and placing all the target alarm objects and the specific alarm objects obtained by screening into a preset alarm set to obtain the alarm cluster.
Optionally, the step of adjusting, according to a first preset rule, the first time window of the first index time series data according to the second time window of the second index time series data, and calculating a specified pearson similarity between the specified index and the entry index includes:
acquiring a first time window of first index time sequence data and a second time window of second index time sequence data;
according to the second time window and a preset time difference threshold, performing sliding adjustment on the first time window to control the time difference between the first time window and the second time window to be within the range of the time difference threshold, and obtaining a plurality of groups of specified first time windows after sliding adjustment;
calculating the Pearson similarity between the plurality of groups of specified indexes and the entrance index, which respectively correspond to the plurality of groups of specified first time windows according to the plurality of groups of specified first time windows;
screening the pearson similarity with the maximum value from the plurality of groups of pearson similarities;
and determining the pearson similarity with the maximum value as the specified pearson similarity.
Optionally, the step of adjusting, according to a first preset rule, the first time window of the first index time series data according to the second time window of the second index time series data, and calculating a specified pearson similarity between the specified index and the entry index includes:
acquiring a first time window of first index time sequence data and a second time window of second index time sequence data;
according to the second time window and a preset time difference threshold, performing sliding adjustment on the first time window to control the time difference between the first time window and the second time window to be within the range of the time difference threshold, and obtaining a plurality of groups of specified first time windows after sliding adjustment;
calculating the Pearson similarity between the multiple groups of specified indexes and the entry index, which respectively correspond to the multiple groups of specified first time windows according to the multiple groups of specified first time windows;
screening the pearson similarity with the maximum value from the plurality of groups of pearson similarities;
and determining the Pearson similarity with the maximum value as the specified Pearson similarity.
Optionally, the step of taking at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster includes:
sequencing all the root cause judgment probability values in a sequence from high to low to obtain a sequencing result;
starting from the root cause judgment probability values ranked at the top in the sequencing result, sequentially acquiring the appointed root cause judgment probability values of a preset number;
and taking the alarm object corresponding to the acquired appointed root cause judgment probability value as the root cause object of the alarm cluster.
Optionally, the step of, according to all the designated pearson similarities and designated time differences respectively corresponding to each of the designated pearson similarities, screening at least one designated alarm object from all the designated alarm objects according to a second preset rule as a root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster includes:
calculating a first weight value corresponding to the designated Pearson similarity based on historical alarm data;
acquiring a second weight value corresponding to the specified time difference;
according to the first weight value and the second weight value, carrying out weighted calculation on each appointed Pearson similarity and each corresponding appointed time difference to obtain a plurality of weight values;
and taking at least one designated alarm object with the highest weighted value as a root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster.
Optionally, after the step of screening at least one designated alarm object from all the designated alarm objects according to a second preset rule and according to all the designated pearson similarities and designated time differences corresponding to each designated pearson similarity, and outputting the root cause object of the alarm cluster, the method includes:
displaying a root cause object of the alarm cluster;
receiving a designated root cause object selected by operation and maintenance personnel from the root cause objects of the alarm cluster;
and determining the specified root cause object as a final root cause object of the alarm cluster.
The application also provides a positioning device for the alarm root cause, which comprises:
the first acquisition module is used for acquiring a specific alarm object in an alarm slice and generating an alarm cluster according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice;
the generating module is used for acquiring the designated alarm object in the alarm cluster, performing index aggregation processing on the monitoring index in the designated alarm object and generating a corresponding entry index, wherein the designated alarm object is any one of all the alarm objects in the alarm cluster;
the second acquisition module is used for acquiring first index time sequence data corresponding to the specified index of the specified alarm object and acquiring second index time sequence data corresponding to the entry index of the specified alarm object;
the adjusting module is used for adjusting a first time window of the first index time sequence data according to a first preset rule and calculating the appointed Pearson similarity between the appointed index and the entrance index according to a second time window of the second index time sequence data;
a third obtaining module, configured to obtain a designated pearson similarity corresponding to each designated alarm object and a designated time difference corresponding to each designated pearson similarity respectively;
and the first determining module is used for screening at least one designated alarm object from all the designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all the designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity.
The present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.
The present application also provides a computer-readable storage medium having stored thereon a computer program which, when being executed by a processor, carries out the steps of the above-mentioned method.
The method, the device, the computer equipment and the storage medium for positioning the alarm root cause have the following beneficial effects:
according to the method and the device for positioning the alarm root cause, the computer equipment and the storage medium, a specific alarm object in an alarm slice is obtained, and an alarm cluster is generated according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice; acquiring a designated alarm object in the alarm cluster, and performing index aggregation processing on monitoring indexes in the designated alarm object to generate a corresponding entry index, wherein the designated alarm object is any one of all alarm objects in the alarm cluster; acquiring first index time sequence data corresponding to an appointed index of the appointed alarm object and acquiring second index time sequence data corresponding to an entry index of the appointed alarm object; according to a second time window of the second index time sequence data, adjusting a first time window of the first index time sequence data according to a first preset rule, and calculating the appointed Pearson similarity between the appointed index and the entry index; respectively acquiring appointed Pearson similarity corresponding to each appointed alarm object and appointed time difference corresponding to each appointed Pearson similarity; and screening at least one designated alarm object from all designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity. This application is through clustering and root cause analysis to the object of reporting an emergency and asking for help or increased vigilance to can generate the root cause object that the cluster of reporting an emergency and asking for help or increased vigilance that corresponds with the object of reporting an emergency and asking for help or increased vigilance related to the object of reporting an emergency and asking for help or increased vigilance, the effectual condition of avoiding appearing needing to carry out root cause analysis constantly in a large amount of raw data relevant with the fortune dimension system of manual work has alleviateed fortune dimension personnel's work load, has reduced and has reported an emergency and increased fortune dimension work's work efficiency because of the required consuming time of judgement process of reporting an emergency and asking for help or increased vigilance root.
Drawings
Fig. 1 is a flowchart illustrating a method for locating an alarm root cause according to an embodiment of the present application;
FIG. 2 is a schematic structural diagram of a device for locating an alarm root cause according to an embodiment of the present application;
fig. 3 is a schematic structural diagram of a computer device according to an embodiment of the present application.
The implementation, functional features and advantages of the objectives of the present application will be further explained with reference to the accompanying drawings.
Detailed Description
It should be understood that the specific embodiments described herein are merely illustrative of and not restrictive on the broad application.
It should be noted that all directional indicators (such as up, down, left, right, front, back, 8230; \8230;) in the embodiments of the present application are only used to explain the relative positional relationship between the components, the movement, etc. in a specific posture (as shown in the attached drawings), and if the specific posture is changed, the directional indicators are changed accordingly, and the connection may be a direct connection or an indirect connection.
Referring to fig. 1, a method for positioning an alarm root cause according to an embodiment of the present application includes:
s1: acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice;
s2: acquiring a designated alarm object in the alarm cluster, performing finger aggregation processing on monitoring indexes in the designated alarm object, and generating a corresponding entry index, wherein the designated alarm object is any one of all alarm objects in the alarm cluster;
s3: acquiring first index time sequence data corresponding to an appointed index of the appointed alarm object and acquiring second index time sequence data corresponding to an entry index of the appointed alarm object;
s4: according to a second time window of the second index time sequence data, adjusting a first time window of the first index time sequence data according to a first preset rule, and calculating the appointed Pearson similarity between the appointed index and the entry index;
s5: respectively obtaining appointed Pearson similarity corresponding to each appointed alarm object and appointed time difference corresponding to each appointed Pearson similarity;
s6: and screening at least one designated alarm object from all designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity.
As described in the foregoing steps S1 to S6, the main execution subject of the embodiment of the method is a positioning device for an alarm root cause. In practical applications, the positioning device of the alarm root cause may be implemented by a virtual device, such as a software code, or may be implemented by a physical device written with or integrated with a relevant execution code, and may perform human-computer interaction with a user through a keyboard, a mouse, a remote controller, a touch panel, or a voice control device. The positioning device for the alarm root cause provided by the embodiment can rapidly and intelligently generate the root cause object related to the alarm cluster corresponding to the alarm object, and further effectively improve the working efficiency of operation and maintenance work. Specifically, a specific alarm object in an alarm slice is obtained first, and an alarm cluster is generated according to the specific alarm object, wherein when a fault event occurs during the operation of the operation and maintenance system, alarms of multiple objects may be triggered, that is, multiple alarm objects associated with the fault event may be generated. In addition, the alarm slice refers to all alarm objects generated by the operation and maintenance system in a specific time period, and the specific time period can be set to be every 10 minutes; and each alarm in the alarm slice in this exampleThe alarm object only belongs to one alarm problem so as to eliminate the possibility that the same alarm object in the alarm slice belongs to a plurality of alarm problems due to time relation; the specific alarm object is any one of all alarm objects in the alarm slice; the alarm cluster is obtained by clustering a specific alarm object and a target alarm object of which the calling chain distance with the specific alarm object is not more than a preset distance threshold, and any object in the alarm cluster can be the best explanation of the alarm cluster, namely a root cause object corresponding to the alarm cluster. And after the alarm cluster is obtained, acquiring a designated alarm object in the alarm cluster, and performing index aggregation processing on the monitoring index corresponding to the application layer object in the designated alarm object to generate an entry index. The process of performing index aggregation processing on the monitoring index corresponding to the application layer object in the designated alarm object may include: firstly, all monitoring indexes in the application layer object are obtained, and then normalization addition and average calculation are carried out on all the monitoring indexes to obtain the entry index. In addition, after all the monitoring indexes are obtained, the monitoring indexes can be further screened, a certain number of specified monitoring indexes are selected, and then the specified monitoring indexes are subjected to normalization addition and average calculation to obtain the entry indexes. For example, if there is a monitoring index a = [ a ] 1 ,A 2 ,A 3 ,…,A n ]And a monitoring index B = [ B ] 1 ,B 2 ,B 3 ,…,B n ]If the monitoring index a and the monitoring index B are normalized and averaged, the entry index C = [ C ] can be obtained 1 ,C 2 ,C 3 ,…,C n ]And C is n ＝(A n +B n )/2. When the entry index is obtained, acquiring first index time sequence data corresponding to the specified index of the specified alarm object; and acquiring second index time sequence data corresponding to the entry index of the specified alarm object. Wherein, the index corresponding to the specified index isThe sequence data is data values acquired in real time, generally at least can include acquisition values such as visit time consumption, visit amount, occupation amount and the like, and the specified index can be a visit time consumption index. After the first index time sequence data and the second index time sequence data are obtained, the first time window of the first index time sequence data is adjusted according to a first preset rule and a second time window of the second index time sequence data, and the appointed Pearson similarity between the appointed index and the entrance index is calculated. The first preset rule may refer to adjusting a first time window of the first indicator time series data according to a preset time difference threshold, so as to ensure that a time difference between the first time window and a second time window is within a range of the time difference threshold. In addition, the specified pearson similarity between the specified index and the entrance index may be calculated by a calculation formula related to pearson correlation coefficients, and the calculation formula of the pearson correlation coefficients is as follows:
Figure BDA0002474007630000081
x is a prescribed index and X is a variable, X = [ X = 1 ,X 2 ,X 3 ,…,X n ]Y is an entry index and Y is a variable, Y = [ Y = 1 ,Y 2 ,Y 3 ,…,Y n ]Cov (X, Y) is the covariance of X and Y, μ is the mean, and σ is the standard deviation. And then respectively acquiring the appointed Pearson similarity corresponding to each appointed alarm object and the appointed time difference corresponding to each appointed Pearson similarity. After the first time window of the first index time sequence data is subjected to sliding adjustment according to the second time window and a first preset rule, a plurality of groups of specified first time windows subjected to sliding adjustment are generated; and for the appointed alarm object, calculating the Pearson similarity between the plurality of groups of appointed indexes and the entrance index corresponding to the plurality of groups of appointed first time windows for a plurality of times according to the plurality of groups of appointed first time windows, and taking the Pearson similarity with the maximum value as the appointed Pearson similarity. In addition, after the above-specified pearson similarity is obtained,the specified time difference corresponding to the specified pearson similarity can be obtained by calculating the time difference between the specified first time window and the specified second time window corresponding to the specified pearson similarity. And finally, according to all the appointed Pearson similarities and the appointed time difference corresponding to each appointed Pearson similarity, screening out at least one appointed alarm object from all the appointed alarm objects according to a second preset rule to be used as the root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster. The second preset rule is not specifically limited, and for example, the second preset rule may be: other relevant features corresponding to the designated alarm object are obtained, then a preset supervised learning algorithm is called to carry out prediction processing on the other relevant features, the obtained designated Pearson similarity and the designated time difference, further the root cause judgment probability value of each designated alarm object is calculated, and then the alarm object corresponding to the root cause judgment probability value meeting the conditions is used as the root cause object of the alarm cluster and is output. In addition, other rules may be used to find the root cause object of the alarm cluster, for example, a weighting value is obtained by performing weighting calculation on the designated pearson similarity, the designated time difference, and the corresponding weighting value, and then the alarm object corresponding to the weighting value satisfying the condition is output as the root cause object of the alarm cluster. The embodiment clusters and root cause analysis are carried out on the alarm object, so that the root cause object related to the alarm cluster corresponding to the alarm object can be generated quickly and intelligently, the condition that root cause analysis is carried out on a large amount of original data related to an operation and maintenance system at any time by manpower is effectively avoided, the workload of operation and maintenance personnel is reduced, the time consumed by the alarm root cause judgment process is reduced, and the working efficiency of operation and maintenance work is improved.
Further, in an embodiment of the application, the step S1 includes:
s100: acquiring a specific alarm object in an alarm slice;
s101: respectively calculating the calling chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;
s102: circularly executing the step of screening out target alarm objects of which the calling chain distance from the alarm slice to the specific alarm object is not greater than a preset distance threshold value until no target alarm object of which the calling chain distance from the alarm slice to the specific alarm object is not greater than the preset distance threshold value exists in the alarm slice;
s103: and placing all the target alarm objects and the specific alarm objects obtained by screening into a preset alarm set to obtain the alarm cluster.
As described in the foregoing steps S100 to S103, the step of obtaining a specific alarm object in the alarm slice and generating an alarm cluster according to the specific alarm object may specifically include: firstly, a specific alarm object in the alarm slice is obtained. And then respectively calculating the calling chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object. Specifically, in a certain operation and maintenance system, an alarm object a calls an alarm object B, the alarm object B calls an alarm object C, and there is an influence relationship in the call relationship, and for any two alarm objects that are called and associated n times, the call chain distance between the 2 alarm objects is n. For example, if a and B are two alarm objects that are called and associated n times, the calling chain distance between a and B is n; as another example, according to the above mentioned a call B, B call C can yield: a and B are two alarm objects which are called and associated for 1 time, namely the calling chain distance between A and B is 1; similarly, B and C are two alarm objects which are called and associated by 1 time, namely the calling chain distance between B and C is 1; a and C are two alarm objects which are called and associated by 2 times, namely the calling chain distance between A and C is 2. In addition, when the calculated calling chain distance is n, for any one alarm object a in a plurality of alarm objects included in a certain alarm influence problem, the calling chain distance between at least one alarm object B and the alarm object B is smaller than or equal to n. And after the calling chain distance is calculated, screening out a target alarm object of which the calling chain distance from the specific alarm object is not more than a preset distance threshold value from the alarm slice. The value of the preset distance threshold is set according to the alarm propagation distance, that is, may be set according to an actual value of the alarm propagation distance, and may be set to 1, for example. And circularly executing the step of screening out the target alarm objects of which the calling chain distance with the specific alarm object is not more than the preset distance threshold from the alarm slice until no target alarm object of which the calling chain distance with the specific alarm object is not more than the preset distance threshold exists in the alarm slice. And finally, placing all the target alarm objects and the specific alarm objects obtained by screening into a preset alarm set to obtain the alarm cluster. The alarm cluster is generated by placing the specific alarm object and the target alarm object in the alarm set, so that the root cause analysis is carried out on the specified alarm object in the alarm cluster by using the related algorithm rule, and the root cause object of the alarm cluster is obtained intelligently and quickly.
Further, in an embodiment of the application, the step S4 includes:
s400: acquiring a first time window of first index time sequence data and a second time window of second index time sequence data;
s401: according to the second time window and a preset time difference threshold, performing sliding adjustment on the first time window to control the time difference between the first time window and the second time window to be within the range of the time difference threshold, and obtaining a plurality of groups of specified first time windows after sliding adjustment;
s402: calculating the Pearson similarity between the plurality of groups of specified indexes and the entrance index, which respectively correspond to the plurality of groups of specified first time windows according to the plurality of groups of specified first time windows;
s403: screening the pearson similarity with the maximum value from the plurality of groups of pearson similarities;
s404: and determining the Pearson similarity with the maximum value as the specified Pearson similarity.
As described in the foregoing steps S400 to S404, the step of adjusting the first time window of the first index time series data according to the second time window of the second index time series data and according to the first preset rule, and calculating the designated pearson similarity between the designated index and the entry index may specifically include: firstly, a first time window of first index time sequence data and a second time window of second index time sequence data are obtained. The numerical values of the first time window and the second time window are divided into units. And then, according to the second time window and a preset time difference threshold, performing sliding adjustment on the first time window to control the time difference between the first time window and the second time window to be within the range of the time difference threshold, and obtaining a plurality of groups of specified first time windows after the sliding adjustment. Wherein the numerical value of the time difference is an absolute value. And then, calculating the Pearson similarity between the plurality of groups of specified indexes and the entrance index, which respectively correspond to the plurality of groups of specified first time windows according to the plurality of groups of specified first windows. And the first time window and the second time window have the same size. The time difference threshold is a range of values, and the specific numerical range of the time difference threshold is not limited, and may be set to 0-60min, for example. In addition, the first time window can be adjusted in a sliding mode according to the preset times to obtain a plurality of groups of appointed first time windows with the same preset times, index data of appointed indexes corresponding to different appointed first time windows are different, and therefore a plurality of groups of different Pearson similarities between the appointed indexes and the entrance indexes can be calculated. And after the plurality of groups of pearson similarities are obtained, screening the pearson similarity with the largest value from the plurality of groups of pearson similarities, and determining the pearson similarity with the largest value as the designated pearson similarity. In the embodiment, the first time window of the first index time sequence data is correspondingly adjusted in a sliding manner through the preset time difference threshold, so that a plurality of groups of pearson similarities are calculated according to the obtained plurality of groups of appointed first time windows, and the appointed pearson similarity with the largest value is accurately selected from the plurality of groups of pearson similarities, thereby being beneficial to accurately determining the root cause object of the alarm cluster according to the appointed pearson similarity and the preset relevant rule.
Further, in an embodiment of the present application, the step S6 includes:
s600: taking the designated Pearson similarity and the designated time difference corresponding to the designated alarm object as a first characteristic;
s601: acquiring second characteristics corresponding to the designated alarm object, wherein the number of the second characteristics comprises one or more than one;
s602: calling a preset supervised learning algorithm to carry out prediction processing on the first characteristic and the second characteristic which respectively correspond to each appointed alarm object, and calculating root cause judgment probability values which respectively correspond to each appointed alarm object;
s603: and taking at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster.
As described in the foregoing steps S600 to S603, the step of screening out at least one designated alarm object from all the designated alarm objects according to a second preset rule as a root cause object of the alarm cluster and outputting the root cause object of the alarm cluster according to all the designated pearson similarities and the designated time difference corresponding to each designated pearson similarity may specifically include: firstly, the appointed Pearson similarity and the appointed time difference corresponding to the appointed alarm object are used as first characteristics. And then acquiring a second characteristic corresponding to the specified alarm object, wherein the second characteristic refers to other related characteristics corresponding to the specified alarm object, and the number of the second characteristics comprises one or more. And the second characteristic may specifically include one or more of the number of times the object is called, the number of times the object is alarmed, and the object hierarchy. And then, calling a preset supervised learning algorithm to carry out prediction processing on the first characteristic and the second characteristic which respectively correspond to each appointed alarm object, and calculating root cause judgment probability values which respectively correspond to each appointed alarm object. The supervised learning algorithm can be specifically a random forest algorithm, the random forest algorithm belongs to an integrated learning algorithm, a plurality of weak learners (tree models) are constructed, random learners are trained through randomly extracting features and samples, and finally, comprehensive judgment results of the weak learners are obtained. The prediction output form of the random forest is a probability value (the general probability is more than 0.5 and is 1, otherwise, the probability value is 0), the characteristic of an object is taken as input, and the output is the judgment probability of the object as a root factor. And for a warning cluster, a plurality of warning objects exist, and when the first characteristic and other related characteristics are input into a weak learner constructed by a random forest algorithm, the random forest algorithm calculates a corresponding root cause judgment probability value for each warning object. And finally, when the root cause judgment probability value is obtained, at least one designated alarm object with the highest root cause judgment probability value is used as the root cause object of the alarm cluster, and the root cause object of the alarm cluster is output. In addition, in addition to outputting the root cause object of the alarm cluster, a first feature and a second feature corresponding to the root cause object of the alarm cluster may be output. In the embodiment, the supervised learning algorithm is called, the root cause prediction is performed on the obtained multiple features, namely the first feature and the second feature, and the at least one designated alarm object with the highest judgment probability value can be accurately output, so that the root cause object of the alarm cluster corresponding to the alarm object can be rapidly and intelligently generated, the workload of operation and maintenance personnel is effectively reduced, and the work efficiency of operation and maintenance work is improved.
Further, in an embodiment of the present application, the step S603 includes:
s6030: sequencing all the root cause judgment probability values in a sequence from high to low to obtain a sequencing result;
s6031: starting from the root cause judgment probability values ranked at the top in the sequencing result, sequentially acquiring the appointed root cause judgment probability values of a preset number;
s6032: and taking the alarm object corresponding to the acquired specified root cause judgment probability value as the root cause object of the alarm cluster.
As described in the foregoing steps S6030 to S6032, the step of taking at least one designated alarm object with the highest root cause determination probability value as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster may specifically include: firstly, all the root cause judgment probability values are sequenced from high to low to obtain a sequencing result. And after the sorting result is obtained, sequentially acquiring a preset number of appointed root cause judgment probability values from the root cause judgment probability value ranked at the head in the sorting result. The preset number is not particularly limited, and may be set according to actual requirements, for example, 5. And finally, the alarm object corresponding to the obtained specified root cause judgment probability value is used as the root cause object of the alarm cluster, so that the obtained root cause object of the alarm cluster can be subsequently used as the root cause corresponding to the alarm cluster to be output to operation and maintenance personnel, and the operation and maintenance personnel can conveniently carry out alarm root cause positioning on the alarm cluster according to the output root cause of the alarm cluster. For example, when the preset number is 5, it is assumed that the ranking result obtained by ranking all the root cause determination probability values is: and (3) respectively corresponding alarm objects of the root cause judgment probability value 1, the root cause judgment probability value 2, the root cause judgment probability value 3, the root cause judgment probability value 4, the root cause judgment probability value 5, \8230and \8230, wherein the root cause judgment probability value 1, the root cause judgment probability value 2, the root cause judgment probability value 3, the root cause judgment probability value 4 and the root cause judgment probability value 5 are used as root cause objects of the alarm clusters.
In an embodiment of the application, the step S6 includes:
s610: calculating a first weight value corresponding to the designated Pearson similarity based on historical alarm data;
s611: acquiring a second weighted value corresponding to the specified time difference;
s612: according to the first weight value and the second weight value, carrying out weighted calculation on each appointed Pearson similarity and each corresponding appointed time difference to obtain a plurality of weight values;
s613: and taking at least one designated alarm object with the highest weighted value as a root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster.
As described in the foregoing steps S610 to S613, the step of screening out at least one designated alarm object from all the designated alarm objects according to a second preset rule as a root cause object of the alarm cluster and outputting the root cause object of the alarm cluster according to all the designated pearson similarities and the designated time difference corresponding to each designated pearson similarity may specifically include: first, a first weight value corresponding to the designated Pearson similarity is calculated based on historical alarm data. Wherein, a first weight value corresponding to the designated Pearson similarity can be calculated according to the occurrence frequency of the designated alarm object in the historical alarm data. And acquiring a second weight value corresponding to the specified time difference after the first weight value is obtained. The value of the second weight value is not particularly limited, and may be set according to actual requirements, for example, may be set to 0.5. After the first weight value and the second weight value are obtained, weighting calculation is carried out on each appointed Pearson similarity and each corresponding appointed time difference according to the first weight value and the second weight value, and a plurality of weighted values are obtained. And finally, taking at least one designated alarm object with the highest weighted value as the root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster. The determination process of using the at least one designated alarm object with the highest weighted value as the root cause object of the alarm cluster may refer to the at least one designated alarm object with the highest root cause determination probability value as the root cause object of the alarm cluster, which is not described herein again. According to the embodiment, the obtained first weight value corresponding to the appointed Pearson similarity and the obtained second weight value corresponding to the appointed time difference are subjected to weighting calculation to obtain the corresponding weighted values, and then at least one appointed alarm object with the highest weighted value is accurately output to serve as the root cause object of the alarm cluster.
Further, in an embodiment of the application, the step S610 includes:
s6100: acquiring the historical alarm data and a first quantity of the historical alarm data;
s6101: respectively screening out a second quantity of the appointed historical alarm data containing each appointed alarm object from the historical alarm data;
s6102: respectively calculating a quotient value of a second quantity and the first quantity of each appointed historical alarm data to obtain a plurality of ratio values corresponding to each appointed alarm object;
s6103: and determining each obtained ratio as a first weight value corresponding to each designated alarm object.
As described in the foregoing steps S6100 to S6103, the step of calculating the first weight value corresponding to the designated pearson similarity based on the historical alarm data may specifically include: historical alarm data and a first quantity of the historical alarm data are obtained first. The method can adopt a timing task mechanism, and reads historical alarm data in a preset time period according to a set time period so as to perform subsequent data processing analysis. Other task data such as the time period of the execution of the timing task, the sampling time of the alarm data and the like can be stored in a fixed configuration file in advance. When the positioning device of the alarm root cause in this embodiment is initially started, the fixed configuration file is read to obtain the time period for executing the timing task, and the time period is registered in the timing task executor. And after the timing task is triggered, reading the alarm data sampling duration configured in the configuration file, and acquiring corresponding historical alarm data from a historical alarm data record table. And then, respectively screening out a second quantity of the appointed historical alarm data containing the appointed alarm objects from the historical alarm data. After the second quantity is obtained, the quotient value of the second quantity and the first quantity of each appointed historical alarm data is calculated respectively, and a plurality of proportion values corresponding to each appointed alarm object are obtained. And finally, when the plurality of ratio values are obtained, determining each obtained ratio value as a first weight value corresponding to each designated alarm object, so as to calculate the weighted value according to the first weight value, and further determine the root cause object of the alarm cluster according to the weighted value.
Further, in an embodiment of the present application, after the step S6, the method includes:
s620: displaying a root cause object of the alarm cluster;
s621: receiving a designated root cause object selected by operation and maintenance personnel from the root cause objects of the alarm cluster;
s622: and determining the specified root cause object as a final root cause object of the alarm cluster.
As described in steps S620 to S622, after the root cause object of the alarm cluster is generated, the operation and maintenance personnel may further determine the final root cause object of the alarm cluster from all the root cause objects. Specifically, the root cause object of the alarm cluster is firstly shown to the operation and maintenance personnel. In addition to outputting the root cause object of the alarm cluster, a first feature and a second feature corresponding to the root cause object of the alarm cluster or a weight value corresponding to the root cause object of the alarm cluster may be output. And then receiving a designated root cause object selected by the operation and maintenance personnel from the root cause objects of the alarm cluster. The number of the designated root cause objects is preferably one. In addition, the operation and maintenance personnel can manually judge according to the root cause object, the first characteristic, the second characteristic or the weight value of the alarm cluster, filter partial wrong root cause objects in the root cause objects of all the alarm clusters, and further obtain the specified root cause object. And finally, determining the designated root cause object as a final root cause object of the alarm cluster, so as to obtain the final root cause object of the alarm cluster after the screening and removing treatment is performed on part of wrong root cause objects in the root cause objects of all the alarm clusters according to the operation and maintenance personnel, and enable the operation and maintenance personnel to more quickly and accurately perform alarm root cause positioning on the alarm cluster at this time according to the final root cause object of the alarm cluster. For example, if the root cause object of the alarm cluster output and presented is: and the root cause object 1, the root cause object 2, the root cause object 3, the root cause object 4 and the root cause object 5, and the specified root cause object selected by the operation and maintenance personnel is the root cause object 4, the root cause object 4 is used as the final root cause object of the alarm cluster.
Referring to fig. 2, an embodiment of the present application further provides a device for locating an alarm root cause, including:
the first obtaining module 1 is configured to obtain a specific alarm object in an alarm slice, and generate an alarm cluster according to the specific alarm object, where the specific alarm object is any one of all alarm objects in the alarm slice;
a generating module 2, configured to obtain a designated alarm object in the alarm cluster, perform aggregation on monitoring indexes in the designated alarm object, and generate a corresponding entry index, where the designated alarm object is any one of the alarm objects in all the alarm clusters;
the second obtaining module 3 is configured to obtain first index time sequence data corresponding to an assigned index of the assigned alarm object, and obtain second index time sequence data corresponding to an entry index of the assigned alarm object;
the adjusting module 4 is configured to adjust a first time window of the first index time sequence data according to a first preset rule and a second time window of the second index time sequence data, and calculate a specified pearson similarity between the specified index and the entry index;
a third obtaining module 5, configured to obtain a designated pearson similarity corresponding to each designated alarm object and a designated time difference corresponding to each designated pearson similarity respectively;
and the first determining module 6 is configured to, according to all the designated pearson similarities and designated time differences corresponding to each of the designated pearson similarities, screen out at least one designated alarm object from all the designated alarm objects according to a second preset rule, where the at least one designated alarm object is used as a root cause object of the alarm cluster, and output the root cause object of the alarm cluster.
In this embodiment, the implementation processes of the functions and actions of the first obtaining module, the generating module, the second obtaining module, the adjusting module, the third obtaining module, and the first determining module in the positioning device for the alarm root cause are specifically described in the implementation processes corresponding to steps S1 to S6 in the positioning method for the alarm root cause, and are not described herein again.
Further, in an embodiment of the present application, the first obtaining module includes:
the first acquisition unit is used for acquiring a specific alarm object in the alarm slice;
the first calculation unit is used for calculating the calling chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object respectively;
a first screening unit, configured to cyclically perform the step of screening, from the alarm slice, a target alarm object whose calling chain distance from the specific alarm object is not greater than a preset distance threshold until there is no target alarm object whose calling chain distance from the specific alarm object is not greater than the preset distance threshold in the alarm slice;
and the placing unit is used for placing all the target alarm objects and the specific alarm objects obtained by screening into a preset alarm set to obtain the alarm cluster.
In this embodiment, the implementation processes of the functions and functions of the first obtaining unit, the first calculating unit, the first screening unit and the placing unit in the positioning device for the alarm root cause are specifically described in the implementation processes corresponding to steps S100 to S103 in the positioning method for the alarm root cause, and are not described herein again.
Further, in an embodiment of the present application, the adjusting module includes:
the second acquisition unit is used for acquiring a first time window of the first index time sequence data and a second time window of the second index time sequence data;
the adjusting unit is used for performing sliding adjustment on the first time window according to the second time window and a preset time difference threshold value so as to control the time difference between the first time window and the second time window to be within the range of the time difference threshold value and obtain a plurality of groups of specified first time windows after the sliding adjustment;
the second calculation unit is used for calculating the Pearson similarity between the plurality of groups of specified indexes and the entrance index, which respectively correspond to the plurality of groups of specified first time windows according to the plurality of groups of specified first time windows;
the second screening unit is used for screening the pearson similarity with the largest value from the plurality of groups of pearson similarities;
a first determining unit configured to determine the pearson similarity with the largest value as the designated pearson similarity.
In this embodiment, the implementation processes of the functions and actions of the second obtaining unit, the adjusting unit, the second calculating unit, the second screening unit and the first determining unit in the positioning device for the alarm root cause are specifically described in the implementation processes corresponding to steps S400 to S404 in the positioning method for the alarm root cause, and are not described herein again.
Further, in an embodiment of the application, the first determining module includes:
the second determination unit is used for taking the designated Pearson similarity and the designated time difference corresponding to the designated alarm object as a first characteristic;
a third obtaining unit, configured to obtain a second feature corresponding to the specified alarm object, where the number of the second feature includes one or more features;
the calling unit is used for calling a preset supervised learning algorithm to carry out prediction processing on the first characteristic and the second characteristic which respectively correspond to each appointed alarm object, and calculating root judgment probability values which respectively correspond to each appointed alarm object;
and the third determining unit is used for taking at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster.
In this embodiment, the implementation processes of the functions and functions of the second determining unit, the third obtaining unit, the calling unit and the third determining unit in the positioning apparatus for the alarm root cause are specifically described in the implementation processes corresponding to steps S600 to S603 in the positioning method for the alarm root cause, and are not described herein again.
Further, in an embodiment of the application, the third determining unit includes:
the sorting subunit is used for sorting all the root cause judgment probability values in a sequence from high to low to obtain a sorting result;
the first obtaining subunit is configured to sequentially obtain a preset number of specified root cause judgment probability values from the root cause judgment probability values ranked at the top in the ranking result;
and the first determining subunit is used for taking the alarm object corresponding to the acquired specified root cause judgment probability value as the root cause object of the alarm cluster.
In this embodiment, the implementation processes of the functions and functions of the sorting subunit, the first obtaining subunit, and the first determining subunit in the positioning apparatus for an alarm root cause are specifically described in the implementation processes corresponding to steps S6030 to S6032 in the positioning method for an alarm root cause, and are not described again here.
Further, in an embodiment of the application, the first determining module includes:
a third calculation unit configured to calculate a first weight value corresponding to the specified pearson similarity based on historical alarm data;
a fourth acquiring unit configured to acquire a second weight value corresponding to the specified time difference;
the fourth calculation unit is used for performing weighted calculation on each appointed pearson similarity and each corresponding appointed time difference according to the first weighted value and the second weighted value to obtain a plurality of weighted values;
and the fourth determining unit is used for taking at least one designated alarm object with the highest weighted value as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster.
In this embodiment, the implementation processes of the functions and actions of the third calculating unit, the fourth obtaining unit, the fourth calculating unit and the fourth determining unit in the positioning device for the alarm root cause are specifically described in the implementation processes corresponding to steps S610 to S613 in the positioning method for the alarm root cause, and are not described herein again.
Further, in an embodiment of the application, the third calculating unit includes:
the second obtaining subunit is used for obtaining the historical alarm data and the first quantity of the historical alarm data;
the screening subunit is used for screening out a second quantity of the appointed historical alarm data containing the appointed alarm objects from the historical alarm data respectively;
the calculating subunit is configured to calculate a quotient of the second quantity and the first quantity of each of the designated historical alarm data, respectively, to obtain a plurality of ratio values corresponding to each of the designated alarm objects;
and the second determining subunit is configured to determine each obtained ratio as a first weight value corresponding to each specified alarm object.
The implementation processes of the functions and actions of the second obtaining subunit, the screening subunit, the calculating subunit, and the second determining subunit in the positioning apparatus for the alarm root cause are specifically described in the implementation processes corresponding to steps S6100 to S6103 in the positioning method for the alarm root cause, and are not described herein again.
Further, in an embodiment of the present application, the apparatus for locating an alarm root cause includes:
the display module is used for displaying the root cause object of the alarm cluster;
the receiving module is used for receiving a specified root cause object selected by operation and maintenance personnel from the root cause objects of the alarm cluster;
and the second determining module is used for determining the specified root cause object as the final root cause object of the alarm cluster.
In this embodiment, the implementation processes of the functions and functions of the display module, the receiving module and the second determining module in the positioning device for the alarm root cause are specifically described in the implementation processes corresponding to steps S620 to S622 in the positioning method for the alarm root cause, and are not described herein again.
Referring to fig. 3, a computer device, which may be a server and whose internal structure may be as shown in fig. 3, is also provided in the embodiment of the present application. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is designed to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer equipment is used for storing data such as specified alarm objects, monitoring indexes, entry indexes, index time sequence data, specified Pearson similarity, specified time difference and the like. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method for locating an alarm root cause.
The processor executes the steps of the method for positioning the alarm root cause:
acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice;
acquiring a designated alarm object in the alarm cluster, and performing index aggregation processing on monitoring indexes in the designated alarm object to generate a corresponding entry index, wherein the designated alarm object is any one of all alarm objects in the alarm cluster;
acquiring first index time sequence data corresponding to an appointed index of the appointed alarm object and acquiring second index time sequence data corresponding to an entry index of the appointed alarm object;
according to a second time window of the second index time sequence data, adjusting a first time window of the first index time sequence data according to a first preset rule, and calculating the appointed Pearson similarity between the appointed index and the entry index;
respectively obtaining appointed Pearson similarity corresponding to each appointed alarm object and appointed time difference corresponding to each appointed Pearson similarity;
and screening at least one designated alarm object from all designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all the designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity.
Those skilled in the art will appreciate that the structure shown in fig. 3 is only a block diagram of a part of the structure related to the present application, and does not constitute a limitation to the apparatus and the computer device to which the present application is applied.
An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, where when the computer program is executed by a processor, the method for locating an alarm root cause is implemented, and the method specifically includes:
acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice;
acquiring a designated alarm object in the alarm cluster, and performing index aggregation processing on monitoring indexes in the designated alarm object to generate a corresponding entry index, wherein the designated alarm object is any one of all alarm objects in the alarm cluster;
acquiring first index time sequence data corresponding to an appointed index of the appointed alarm object and acquiring second index time sequence data corresponding to an entry index of the appointed alarm object;
according to a second time window of the second index time sequence data, adjusting a first time window of the first index time sequence data according to a first preset rule, and calculating the appointed Pearson similarity between the appointed index and the entrance index;
respectively obtaining appointed Pearson similarity corresponding to each appointed alarm object and appointed time difference corresponding to each appointed Pearson similarity;
and screening at least one designated alarm object from all designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity.
To sum up, according to the method, the apparatus, the computer device, and the storage medium for positioning an alarm root cause provided in the embodiment of the present application, a specific alarm object in an alarm slice is obtained, and an alarm cluster is generated according to the specific alarm object, where the specific alarm object is any one of all alarm objects in the alarm slice; acquiring a designated alarm object in the alarm cluster, and performing index aggregation processing on monitoring indexes in the designated alarm object to generate a corresponding entry index, wherein the designated alarm object is any one of all alarm objects in the alarm cluster; acquiring first index time sequence data corresponding to an appointed index of the appointed alarm object and acquiring second index time sequence data corresponding to an entry index of the appointed alarm object; according to a second time window of the second index time sequence data, adjusting a first time window of the first index time sequence data according to a first preset rule, and calculating the appointed Pearson similarity between the appointed index and the entrance index; respectively acquiring appointed Pearson similarity corresponding to each appointed alarm object and appointed time difference corresponding to each appointed Pearson similarity; and screening at least one designated alarm object from all designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity. This application is through clustering and root cause analysis to the object of reporting an emergency and asking for help or increased vigilance to can generate the root cause object that the cluster of reporting an emergency and asking for help or increased vigilance that corresponds with the object of reporting an emergency and asking for help or increased vigilance related to the object of reporting an emergency and asking for help or increased vigilance, the effectual condition of avoiding appearing needing to carry out root cause analysis constantly in a large amount of raw data relevant with the fortune dimension system of manual work has alleviateed fortune dimension personnel's work load, has reduced and has reported an emergency and increased fortune dimension work's work efficiency because of the required consuming time of judgement process of reporting an emergency and asking for help or increased vigilance root.
It will be understood by those skilled in the art that all or part of the processes of the methods of the above embodiments may be implemented by hardware associated with instructions of a computer program, which may be stored on a non-volatile computer-readable storage medium, and when executed, may include processes of the above embodiments of the methods. Any reference to memory, storage, database, or other medium provided herein and used in the examples may include non-volatile and/or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically Programmable ROM (EPROM), electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRDRAM), enhanced SDRAM (ESDRAM), synchronous Link (Synchlink) DRAM (SLDRAM), rambus (Rambus) direct RAM (RDRAM), direct bused dynamic RAM (DRDRAM), and bused dynamic RAM (RDRAM).
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, apparatus, article, or method. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of another identical element in a process, apparatus, article, or method comprising the element.
The above description is only a preferred embodiment of the present application, and not intended to limit the scope of the present application, and all modifications of equivalent structures and equivalent processes, which are made by the contents of the specification and the drawings of the present application, or which are directly or indirectly applied to other related technical fields, are also included in the scope of the present application.

Claims (9)

1. A method for positioning an alarm root cause is characterized by comprising the following steps:
acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice;
acquiring a designated alarm object in the alarm cluster, and performing index aggregation processing on monitoring indexes in the designated alarm object to generate a corresponding entry index, wherein the designated alarm object is any one of all alarm objects in the alarm cluster;
acquiring first index time sequence data corresponding to an appointed index of the appointed alarm object and acquiring second index time sequence data corresponding to an entry index of the appointed alarm object;
according to a second time window of the second index time sequence data, adjusting a first time window of the first index time sequence data according to a first preset rule, and calculating the appointed Pearson similarity between the appointed index and the entry index;
respectively obtaining appointed Pearson similarity corresponding to each appointed alarm object and appointed time difference corresponding to each appointed Pearson similarity;
according to all the appointed Pearson similarities and the appointed time difference corresponding to each appointed Pearson similarity, screening out at least one appointed alarm object from all the appointed alarm objects according to a second preset rule to serve as the root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster;
the process of performing index aggregation on the monitoring index corresponding to the application layer object in the designated alarm object may include: firstly, acquiring all monitoring indexes in the application layer object, and then carrying out normalization addition and average calculation on all the monitoring indexes to obtain the entry index;
the step of adjusting the first time window of the first index time sequence data according to a first preset rule and calculating the designated pearson similarity between the designated index and the entry index according to the second time window of the second index time sequence data includes:
acquiring a first time window of first index time sequence data and a second time window of second index time sequence data;
according to the second time window and a preset time difference threshold, performing sliding adjustment on the first time window to control the time difference between the first time window and the second time window to be within the range of the time difference threshold, and obtaining a plurality of groups of specified first time windows after sliding adjustment;
calculating the Pearson similarity between the plurality of groups of specified indexes and the entrance index, which respectively correspond to the plurality of groups of specified first time windows according to the plurality of groups of specified first time windows;
screening the pearson similarity with the maximum value from the pearson similarities;
and determining the pearson similarity with the maximum value as the specified pearson similarity.
2. The method for positioning alarm root cause according to claim 1, wherein the step of obtaining a specific alarm object in the alarm slice and generating an alarm cluster according to the specific alarm object comprises:
acquiring a specific alarm object in an alarm slice;
respectively calculating the calling chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;
circularly executing the step of screening out the target alarm objects of which the calling chain distance with the specific alarm object is not more than a preset distance threshold from the alarm slice until no target alarm object of which the calling chain distance with the specific alarm object is not more than the preset distance threshold exists in the alarm slice;
and placing all the target alarm objects and the specific alarm objects obtained by screening into a preset alarm set to obtain the alarm cluster.
3. The method for positioning alarm root cause according to claim 1, wherein the step of screening out at least one specified alarm object from all the specified alarm objects as the root cause object of the alarm cluster according to a second preset rule according to all the specified pearson similarities and the specified time differences corresponding to each of the specified pearson similarities, and outputting the root cause object of the alarm cluster comprises:
taking the designated Pearson similarity and the designated time difference corresponding to the designated alarm object as a first characteristic;
acquiring second characteristics corresponding to the designated alarm object, wherein the number of the second characteristics comprises one or more than one;
calling a preset supervised learning algorithm to carry out prediction processing on the first characteristic and the second characteristic which respectively correspond to each appointed alarm object, and calculating root cause judgment probability values which respectively correspond to each appointed alarm object;
and taking at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster.
4. The method for positioning an alarm root cause according to claim 3, wherein the step of using at least one designated alarm object with the highest probability value of judging the root cause as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster comprises:
sequencing all the root cause judgment probability values in a sequence from high to low to obtain a sequencing result;
starting from the root cause judgment probability values ranked at the top in the sequencing result, sequentially acquiring the appointed root cause judgment probability values of a preset number;
and taking the alarm object corresponding to the acquired specified root cause judgment probability value as the root cause object of the alarm cluster.
5. The method for positioning alarm root cause according to claim 1, wherein the step of screening at least one designated alarm object from all the designated alarm objects according to a second preset rule as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster according to all the designated pearson similarities and the designated time difference corresponding to each designated pearson similarity respectively comprises:
calculating a first weight value corresponding to the designated Pearson similarity based on historical alarm data;
acquiring a second weight value corresponding to the specified time difference;
according to the first weight value and the second weight value, carrying out weighted calculation on each appointed Pearson similarity and each corresponding appointed time difference to obtain a plurality of weight values;
and taking at least one designated alarm object with the highest weighted value as a root cause object of the alarm cluster, and outputting the root cause object of the alarm cluster.
6. The method for positioning alarm root cause according to claim 1, wherein after the step of screening out at least one specified alarm object from all the specified alarm objects as the root cause object of the alarm cluster according to a second preset rule according to all the specified pearson similarities and the specified time differences corresponding to each of the specified pearson similarities, and outputting the root cause object of the alarm cluster, the method comprises:
displaying a root cause object of the alarm cluster;
receiving a designated root cause object selected by operation and maintenance personnel from the root cause objects of the alarm cluster;
and determining the specified root cause object as a final root cause object of the alarm cluster.
7. An alarm root cause positioning device, configured to perform the alarm root cause positioning method according to any one of claims 1 to 6, comprising:
the first acquisition module is used for acquiring a specific alarm object in an alarm slice and generating an alarm cluster according to the specific alarm object, wherein the specific alarm object is any one of all alarm objects in the alarm slice;
the generating module is used for acquiring the designated alarm object in the alarm cluster, performing index aggregation processing on the monitoring index in the designated alarm object and generating a corresponding entry index, wherein the designated alarm object is any one of all the alarm objects in the alarm cluster;
the second acquisition module is used for acquiring first index time sequence data corresponding to the specified index of the specified alarm object and acquiring second index time sequence data corresponding to the entry index of the specified alarm object;
the adjusting module is used for adjusting a first time window of the first index time sequence data according to a first preset rule and calculating the appointed Pearson similarity between the appointed index and the entrance index according to a second time window of the second index time sequence data;
a third obtaining module, configured to obtain a designated pearson similarity corresponding to each designated alarm object and a designated time difference corresponding to each designated pearson similarity respectively;
and the first determining module is used for screening at least one designated alarm object from all the designated alarm objects according to a second preset rule and outputting the root cause object of the alarm cluster according to all the designated Pearson similarities and designated time differences corresponding to each designated Pearson similarity.
8. A computer device comprising a memory and a processor, the memory having stored therein a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method according to any of claims 1 to 6.
9. A storage medium having a computer program stored thereon, the computer program, when being executed by a processor, realizing the steps of the method of any one of claims 1 to 6.
CN202010357568.4A 2020-04-29 2020-04-29 Method and device for positioning alarm root cause, computer equipment and storage medium Active CN111555921B (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202010357568.4A CN111555921B (en) 2020-04-29 2020-04-29 Method and device for positioning alarm root cause, computer equipment and storage medium
PCT/CN2020/099434 WO2021217865A1 (en) 2020-04-29 2020-06-30 Method and apparatus for locating root cause of alarm, computer device, and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010357568.4A CN111555921B (en) 2020-04-29 2020-04-29 Method and device for positioning alarm root cause, computer equipment and storage medium

Publications (2)

Publication Number Publication Date
CN111555921A CN111555921A (en) 2020-08-18
CN111555921B true CN111555921B (en) 2023-04-07

Family

ID=72007828

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010357568.4A Active CN111555921B (en) 2020-04-29 2020-04-29 Method and device for positioning alarm root cause, computer equipment and storage medium

Country Status (2)

Country Link
CN (1) CN111555921B (en)
WO (1) WO2021217865A1 (en)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114285730A (en) * 2020-09-18 2022-04-05 华为技术有限公司 Method and device for determining fault root cause and related equipment
CN113821413A (en) * 2021-09-27 2021-12-21 中国建设银行股份有限公司 Alarm analysis method and device
CN114325232B (en) * 2021-12-28 2023-07-25 微梦创科网络科技（中国）有限公司 Fault positioning method and device
CN114389960B (en) * 2022-01-04 2023-11-28 烽火通信科技股份有限公司 Method and system for collecting and reporting network service performance
CN114024837B (en) * 2022-01-06 2022-04-05 杭州乘云数字技术有限公司 Fault root cause positioning method of micro-service system
CN115529219B (en) * 2022-09-16 2024-07-09 中国工商银行股份有限公司 Alarm analysis method and device, computer readable storage medium and electronic equipment
CN115473789B (en) * 2022-09-16 2024-02-27 深信服科技股份有限公司 Alarm processing method and related equipment
CN115756919B (en) * 2022-11-10 2023-10-31 上海鼎茂信息技术有限公司 Root cause positioning method and system for multidimensional data
CN117093407B (en) * 2023-10-19 2024-03-19 北京凡得科技有限公司 Improved S-learner-based flow anomaly cascade root cause analysis method and system

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109981326A (en) * 2017-12-28 2019-07-05 ***通信集团山东有限公司 The method and device of home broadband perception fault location
CN110300011A (en) * 2018-03-23 2019-10-01 ***通信集团有限公司 A kind of alarm root is because of localization method, device and computer readable storage medium
CN110351118A (en) * 2019-05-28 2019-10-18 华为技术有限公司 Root is because of alarm decision networks construction method, device and storage medium
CN110399347A (en) * 2018-04-23 2019-11-01 华为技术有限公司 Alarm log compression method, apparatus and system, storage medium

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8245079B2 (en) * 2010-09-21 2012-08-14 Verizon Patent And Licensing, Inc. Correlation of network alarm messages based on alarm time
US9246747B2 (en) * 2012-11-15 2016-01-26 Hong Kong Applied Science and Technology Research Co., Ltd. Adaptive unified performance management (AUPM) with root cause and/or severity analysis for broadband wireless access networks

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109981326A (en) * 2017-12-28 2019-07-05 ***通信集团山东有限公司 The method and device of home broadband perception fault location
CN110300011A (en) * 2018-03-23 2019-10-01 ***通信集团有限公司 A kind of alarm root is because of localization method, device and computer readable storage medium
CN110399347A (en) * 2018-04-23 2019-11-01 华为技术有限公司 Alarm log compression method, apparatus and system, storage medium
CN110351118A (en) * 2019-05-28 2019-10-18 华为技术有限公司 Root is because of alarm decision networks construction method, device and storage medium

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
Root-cause analysis of occurring alarms in thermal power plants based on Bayesian networks;Jiandong Wang;《International Journal of Electrical Power and Energy Systems》;20181205;全文 *

Also Published As

Publication number Publication date
WO2021217865A1 (en) 2021-11-04
CN111555921A (en) 2020-08-18

Similar Documents

Publication Publication Date Title
CN111555921B (en) Method and device for positioning alarm root cause, computer equipment and storage medium
US20150120263A1 (en) Computer-Implemented Systems and Methods for Testing Large Scale Automatic Forecast Combinations
EP2353108A1 (en) Method and system for analyzing text
CN111625516A (en) Method and device for detecting data state, computer equipment and storage medium
JP4318221B2 (en) Medical information analysis apparatus, method and program
Abreu et al. Ordinal logistic regression in epidemiological studies
CN111310139A (en) Behavior data identification method and device and storage medium
CN116416884B (en) Testing device and testing method for display module
CN114388135A (en) Pregnant woman index data analysis method, device, equipment and readable storage medium
CN114201328A (en) Fault processing method and device based on artificial intelligence, electronic equipment and medium
WO2021252815A1 (en) Activity level measurement using deep learning and machine learning
CN113807728A (en) Performance assessment method, device, equipment and storage medium based on neural network
CN115034315A (en) Business processing method and device based on artificial intelligence, computer equipment and medium
CN113377564B (en) Fault diagnosis method and device, computer equipment and storage medium
Williams et al. Package ‘caret’
CN106844152B (en) Bank's background task runs the correlation analysis and device of batch time
CN116703455A (en) Medicine data sales prediction method and system based on time series hybrid model
CN116523622A (en) Object risk prediction method and device, electronic equipment and storage medium
Pascual et al. Monitoring a bivariate INAR (1) process with application to Hepatitis A
EP3283932A1 (en) Requirements determination
CN113570070B (en) Streaming data sampling and model updating method, device, system and storage medium
CN113468477B (en) Sensitive data investigation analysis method, storage medium and equipment
CN115146890A (en) Enterprise operation risk warning method and device, computer equipment and storage medium
CN111221704B (en) Method and system for determining running state of office management application system
Tan et al. A literature review on control chart development in healthcare monitoring

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 40033521

Country of ref document: HK

SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant