CN108306749B

Movatterモバイル変換

Info

Publication number: CN108306749B
Application number: CN201710022721.6A
Authority: CN
Inventors: 张一淳
Original assignee: Alibaba Group Holding Ltd
Current assignee: Alibaba Group Holding Ltd
Priority date: 2017-01-12
Filing date: 2017-01-12
Publication date: 2021-11-05
Anticipated expiration: 2037-01-12
Also published as: CN108306749A

Abstract

Provided are a monitoring system alarm method, a monitoring system and a monitoring device. The monitoring system detects that a first monitoring index of a first monitored object meets an alarm condition in a first alarm rule; the monitoring system gives an alarm and displays alarm information to a user, wherein the alarm information comprises information of the first monitoring index and information of a first correlation index different from the first monitoring index. The monitoring device includes a memory storing program code and a processor reading the program code to perform alarm processing. According to the method and the device, when the alarm is given, besides the monitoring index which leads to the alarm is displayed for the user, other related indexes are displayed for the user, the alarm site can be better displayed, and the user can be helped to quickly locate the problem and solve the problem.

Description

Monitoring system alarming method, monitoring system and monitoring device

Technical Field

The present invention relates to monitoring technologies, and in particular, to an alarm method for a monitoring system, and a monitoring apparatus.

Background

The monitoring system can collect and store data of a monitored object (such as a cluster, a host, a network card, a database and the like), obtain corresponding indexes (such as CPU utilization rate, network flow, a value of a certain field in the database, keywords in a log and the like) through analysis, statistics and the like, verify whether the indexes meet expectations or not in real time, and give an alarm if the indexes do not meet the expectations (namely the indexes meet the alarm condition in the alarm rule), for example, the alarm is given when the CPU utilization rate of the host is over 95% as specified by the alarm rule, and if the CPU utilization rate of the host reaches 98%, the indexes do not meet the expectations or the indexes meet the alarm condition in the alarm rule, so that the alarm is triggered. The index used for alarm determination is referred to as a monitoring index (may also be referred to as a monitoring item). The monitoring system sends notice to the user and displays alarm information when alarming.

In the monitoring scenario, the alarm information received in the industry at present includes alarm time and a monitoring index causing the alarm. In a related monitoring operation and maintenance scene aiming at a cluster or a service, after an alarm rule is set on the cluster or the service, each index of each machine of the cluster is analyzed and checked during actual monitoring, if the index does not meet an expected monitoring index, an alarm is sent, and the alarm caused by which monitoring index or the monitoring index of which monitoring object is displayed to a user in alarm information. The monitoring dimension is positioning information for determining a monitoring object causing an alarm, and if the monitoring dimension is configured as a cluster-host-disk, the monitoring index causing the alarm is displayed in the alarm information as to which disk of which host in which cluster the monitoring index causing the alarm belongs.

However, the alarm information of the above monitoring system is not sufficient for locating and solving the problem. Particularly, in a large-scale system formed by fusing a plurality of cloud products in the field of cloud computing, which depends on complex scenes and has a plurality of monitoring indexes, alarm information of the monitoring system has no great effect. Since there are many possibilities that may arise if one monitoring indicator is not in agreement with expectations, the user cannot determine the actual problem causing the alarm by the alarm message.

For example, a user builds a site for an external service, and behind the site, a plurality of servers and load balancing equipment are provided. The user adds monitoring to the state of the home page of the website, the request amount of the website and the access response time, and the traditional monitoring system only informs the user that the website is hung when alarming, or the request amount of which machine falls down, or the access response time of which machine is overlong. However, there may be various reasons that the website is hung or the request amount falls or the access response time is too long, for example, one or more servers are down, the related processes are killed, the network card traffic reaches a quota, a forwarding error of the load balancing product occurs, a storage product dependent on the user fails, and the like. After receiving the alarm, the user needs to log in the server or the cloud product console to troubleshoot the problem step by step, so that much time is inevitably wasted, the user in the alarm or fault is very inconvenient, data of corresponding indexes may be changed when the user is troublesomed, and the current scene of the alarm is difficult to reproduce so as to determine the problem.

As described above, the monitoring system alarm method of the related art has the following main problems:

the alarm information is only displayed by a single index, and cannot be analyzed by combining a plurality of indexes. For example, a user sets an alarm of the CPU usage rate, and only an alarm message that the CPU usage rate of which machine of which cluster exceeds a threshold value generates an alarm can be generated, and other relevant indexes of system load, memory, process, network, and the like, which cooperate to troubleshoot problems, cannot be displayed. The user can not self-define the interested display indexes.

The alarm information is only displayed by a single monitoring object and cannot be analyzed in combination with other related objects. For example, when the website request amount of a certain machine falls suddenly, only relevant indexes of the machine can be given, and a user cannot know the states of other objects, such as the situations of other machines and load balancing equipment, but the website request amount of the machine falls suddenly, which may be caused by the faults of other machines or load balancing equipment.

In addition, the alarm method of the related art monitoring system has other problems, such as:

the display format of the alarm information is fixed, and if the alarm information can only be displayed in a text mode, a user can not conveniently and intuitively find problems.

The application scene is monotonous, only monitoring alarm scenes such as clusters/service-host-indexes can be processed, and corresponding to complex scenes on the cloud, the user-defined scenes cannot be met.

Disclosure of Invention

In view of this, an embodiment of the present invention provides a monitoring system alarm method, including:

the monitoring system detects that a first monitoring index of a first monitored object meets an alarm condition in a first alarm rule;

the monitoring system gives an alarm and displays alarm information to a user, wherein the alarm information comprises information of the first monitoring index and information of a first correlation index different from the first monitoring index.

The embodiment of the invention also provides a monitoring system, which comprises a data processing module, an alarm analysis module and an alarm module, wherein:

the alarm analysis module is configured to: sending an alarm notification to the alarm module when detecting that a first monitoring index of a first monitoring object meets an alarm condition in a first alarm rule, and sending alarm information acquired from the data processing module to the alarm module;

the alarm module is set as follows: alarming after receiving the alarm notification, and displaying the alarm information to a user; wherein the alarm information includes information of the first monitoring index and information of a first correlation index different from the first monitoring index.

The embodiment of the present invention further provides a monitoring device, including a memory and a processor, wherein:

the memory is configured to: saving the program code;

the processor is configured to: reading the program code to perform the following processes:

and when detecting that a first monitoring index of a first monitoring object meets an alarm condition in a first alarm rule, alarming and displaying alarm information to a user, wherein the alarm information comprises information of the first monitoring index and information of a first associated index different from the first monitoring index.

According to the scheme, the monitoring indexes which cause alarm are displayed to the user, and other related indexes are displayed to the user during alarm, so that an alarm site can be better displayed, the user can be helped to quickly locate the problem and solve the problem.

Drawings

FIG. 1 is a flow chart of a monitoring alarm method according to an embodiment of the present invention;

FIG. 2 is a block diagram of a monitoring system according to an embodiment of the present invention;

FIG. 3 is a flowchart of the overall process of a monitoring alarm method according to a second embodiment of the present invention;

FIG. 4 is a flowchart of an exemplary monitoring alarm method according to a second embodiment of the present invention;

fig. 5 is a flowchart of a third monitoring alarm method according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that the embodiments and features of the embodiments in the present application may be arbitrarily combined with each other without conflict.

Example one

In a monitoring scene, how to show all interested indexes of a user during alarming is convenient for the user to know all relevant information of the system at the first time when the user receives the alarming information, and the user can clearly know which link of the system has a problem and how to repair the system, so that the cost of solving the problem by the user is reduced to the minimum. The embodiment provides an alarm method of a monitoring system, the monitoring system and a monitoring device to solve the problems.

It should be noted that, the flow of this embodiment describes a primary alarm process, where "the first monitoring object", "the first monitoring index", the first alarm rule ", and" the first association index "are the monitoring object, the monitoring index, the alarm rule, and the association index related to the alarm determination, and do not mean that this embodiment is limited to some special monitoring objects, monitoring indexes, alarm rules, and association indexes. Other terms such as "first monitoring index associated object", "first associated index associated object", and the like are also similar.

As shown in fig. 1, the alarm method of the monitoring system of the embodiment includes:

step 110, the monitoring system detects that a first monitoring index of a first monitored object meets an alarm condition in a first alarm rule;

the monitoring system of the embodiment takes a monitoring system of a large-scale system formed by fusing a plurality of cloud products as an example, but the invention can also be used for a monitoring system of a simple system, for example, a service system formed by a few machines or even a stand-alone system.

In this application, a monitoring object may be any object in a monitored system, and may be a physical entity such as a cluster, a system, a rack, a device (such as a server, a load balancing device, and the like), a device (such as a network card, a power supply, a memory, and the like), or may be a software entity such as a computer operating system, an application, a data table, a process, and the like, or may form a logical entity together with software and hardware, such as a virtual machine, a database, a functional module, a functional component, and the like. The same is true of the presentation object, the associated object.

And 120, the monitoring system gives an alarm and displays alarm information to a user, wherein the alarm information comprises information of the first monitoring index and information of a first associated index different from the first monitoring index.

When alarming is carried out, the alarming information can be directly sent to a user, the user can display the alarming information to the user when receiving the alarming notice, the address information of the alarming information can also be sent to the user as a link, and the user can enter a display page of the alarming information by clicking the address information.

The information of the first monitoring index and the first associated index is displayed to a user in the alarm information simultaneously, so that an alarm site is better displayed, and after the user receives the alarm, the first monitoring index and the first associated index can be combined to perform combined analysis of multiple indexes, so that the problem is quickly positioned and solved. It should be noted that, although the first correlation index shown in a certain alarm is different from the first monitoring index, a certain index does not have a fixed identity, and the alarm may be the first correlation index at this time, and become the first monitoring index at other alarms. For example, in a certain alarm, the CPU utilization rate is a first monitoring index, and the memory utilization rate is a first correlation index; in the subsequent alarm, the memory utilization rate becomes the first monitoring index, and the CPU utilization rate becomes the first related index.

In this embodiment, the monitoring system provides an interface for customizing the association index to the user. The user can define the associated index which needs to be displayed together with the monitoring index in the alarm information by himself through the interface, and the first associated index is the associated index corresponding to the alarm. The user can add, delete, modify and check the associated indexes through the interface according to personal experience, so that the user can meet the needs of the user. In another embodiment, considering that the user-defined association index requires the user to have a certain professional skill, and some users may not have such a skill, the association index required to be displayed together with the monitoring index in the alarm information is configured by default by the system (referring to the monitoring system). Configuration modes other than user-defined are considered as system defaults, such as configuration of background maintenance personnel of the monitoring system, associated indexes configured by a producer of the monitoring system and the like. In another embodiment, the two modes are combined, and the association index can be customized by the user even if the default association index of the system exists in the monitoring system.

For a simple system, because the indexes are limited, no matter what alarm is, a group of same indexes can be defined as the association indexes, in this case, the association indexes corresponding to different alarms are the same, and do not need to be configured respectively, and do not need to be searched according to the corresponding relation to obtain the first association index. The embodiment is applied to a complex system, so that the indexes are very many, and the associated indexes needing to be known by different alarms can be different. Therefore, the correlation indexes need to be configured and established respectively and corresponding to the alarm. The corresponding relation between the correlation index and the alarm is embodied by the corresponding relation between the correlation index and the alarm characteristic information, and includes but is not limited to the following two modes:

the association index corresponds to the alarm rule. Taking the user-defined association index as an example, the user may define a set of indexes (including one or more indexes) for one or more alarm rules as the association index corresponding to the one or more alarm rules. In this case, the association index corresponding to the alarm in this embodiment includes the association index corresponding to the first alarm rule.

The correlation index corresponds to the monitoring index. Also taking a user-defined association index as an example, the user may define a set of indexes (including one or more indexes) for one or more monitoring indexes as the association index corresponding to the one or more monitoring indexes. In this case, the relevant index corresponding to the alarm in this embodiment includes the relevant index corresponding to the first monitoring index.

The two corresponding modes can also exist in the monitoring system at the same time, namely, the associated indexes corresponding to the alarm rules and the associated indexes corresponding to the monitoring indexes are configured. In this case, the relevant index corresponding to the alarm in this embodiment includes the relevant index corresponding to the first alarm rule and the relevant index corresponding to the first monitoring index.

In this embodiment, the information of the first monitoring index includes data (such as a value of CPU utilization, a value of access response time, and the like) of the first monitoring index on the first monitoring index display object. In the present application, the display object is used to indicate an index of which objects are to be displayed in the alarm information. The monitoring index display object is an object of which the monitoring index is to be displayed in the alarm information, and is used for displaying the monitoring index of which object is to be displayed in the alarm information. For example, if the CPU utilization of the host a of the cluster a and the CPU utilization of the host B of the cluster a are displayed in the alarm information, the monitoring index is the CPU utilization, and the monitoring index display objects are the host a of the cluster a and the host B of the cluster a.

When an alarm is given, the monitoring indexes of which objects need to be displayed in alarm information are determined according to the display dimensionality of the monitoring indexes corresponding to the alarm. The monitoring index display dimension is information for positioning a monitoring index display object. For example, there are multiple hosts in a cluster, each host has multiple disks, the monitoring index includes disk usage, and in an alarm caused by disk usage, the monitoring index display dimension is configured as cluster-host-disk. If the disk utilization rate (first monitoring index) of the disk a (namely, the first monitoring object) of the host a in the cluster a meets the alarm condition, displaying the dimension according to the monitoring index corresponding to the alarm, and displaying the disk utilization rate on the disk a of the host a in the cluster a. In this case, the monitoring index display dimension is the same as the monitoring dimension corresponding to the alarm in the related art, and the monitoring index display object in the alarm information is the first monitoring object.

However, in this embodiment, the monitoring index presentation dimension may cover and be larger than the monitoring dimension, and the first monitoring index presentation object includes, in addition to the first monitoring object, a first monitoring index associated object different from the first monitoring object, so as to present monitoring indexes of more objects to the user. For example, in the above example, the monitoring index showing dimension corresponding to the alarm is configured as a cluster-host, and the monitoring index showing dimension includes a variable defined based on the monitoring dimension corresponding to the alarm, that is, a value of the variable refers to a value of a corresponding parameter in the monitoring dimension. Thus, when the disk usage rate (first monitoring index) of the disk a (first monitoring object) of the host a in the cluster a meets the alarm condition, the disk usage rates on all the disks of the host a in the cluster a can be displayed in the alarm information. That is, the first monitoring index display object includes, in addition to the first monitoring object, other disks of the host a in the cluster a except the disk a, and the other disks are the first monitoring index related objects.

In this example, the monitoring index presentation dimension corresponding to the alarm may also be configured to include two dimensions, one being a monitoring dimension; the other is cluster-host B-disk B, where the cluster is used as a variable whose value refers to the value of the cluster in the monitoring dimension. In this case, when the same alarm occurs, the alarm information shows the disk usage rate on the disk B of the host B in the cluster a in addition to the disk usage rate on the first monitored object. And the disk B of the host B in the cluster A is the first monitoring index correlation object. The disk B may be a disk used by a user to temporarily store data when the storage space is insufficient. Therefore, by displaying the first monitoring index associated object, the user can know the disk usage rate of other interested disks at the first time when receiving the alarm, and find a solution for the alarm, such as transferring data to other disks.

The display dimension of the monitoring index corresponding to the alarm can be customized by a user and/or defaulted by a system, and for a simple system, all alarms can correspond to the same display dimension of the monitoring index without being searched according to alarm characteristic information and corresponding relation during alarming. For a complex system, monitoring index display dimensions need to be configured and established respectively and correspond to an alarm, the corresponding relationship between the monitoring index display dimensions and the alarm can be embodied through the corresponding relationship between the monitoring index display dimensions and alarm characteristic information (such as a monitoring index and an alarm rule), when the alarm is given at a certain time, the corresponding relationship is searched according to the alarm characteristic information (such as a first monitoring index and a first alarm rule) of the alarm to obtain the corresponding monitoring index display dimensions, and then a first monitoring index display object is determined and data of the first monitoring index on the first monitoring index display object is obtained so as to be displayed in the alarm information.

In this embodiment, the information of the first relevant index includes data of the first relevant index on the first relevant index display object. In the application, the association index display object is an object for displaying the association index in the alarm information, and indicates which objects are to be displayed in the alarm information. In this embodiment, the first associated index presentation object may include the first monitoring object, or include a first associated index associated object different from the first monitoring object, or include the first monitoring object and the first associated index associated object. For example, in the alarm information, the first monitoring index is access response time, the first monitoring object is a host a in the cluster a, and the first correlation index includes a CPU usage rate and a memory usage rate. Then, the object to be displayed in the alarm information about the CPU usage rate and the memory usage rate is the first correlation index display object, and may be, for example, a host a in the cluster a, that is, a first monitoring object, or a host B in the cluster a, that is, a different monitoring object, or may include the host a in the cluster a and the host B in the cluster a. The object which is different from the first monitoring object in the first relevance index display object is called a first relevance index relevance object. The first associated metric related object and the first monitoring metric related object may be the same or different.

In this embodiment, when an alarm is given, which object association indicators are to be displayed in the alarm information is determined according to the association indicator display dimension corresponding to the alarm. The relevance index presentation dimension is information for locating relevance index presentation objects. For example, in a cluster having multiple servers and a load balancing device, the monitoring criteria includes access response duration, in the alarm caused by the overlong access response time (the first monitoring index), because the overlong access response time may be caused by the fact that the processing speed is slowed down due to the overhigh utilization rate of the CPU and the memory of the server itself, or may be caused by the fact that the forwarding speed of the access request is slowed down due to the overhigh utilization rate of the CPU and the memory of the load balancing device, therefore, the first related index is set (which can be configured according to the user-defined instruction or the default configuration of the system) as the CPU usage rate and the memory usage rate, and the correlation index display dimension comprises two dimensions, wherein one dimension is a cluster-server, and the cluster and the server are variables defined based on the monitoring dimension corresponding to the alarm, and the values refer to the values of the cluster and the server in the monitoring dimension. The other dimension is a cluster-load balancing device, wherein the cluster is a variable defined based on the monitoring dimension corresponding to the alarm, and the value of the cluster in the monitoring dimension is referred to by the value. When an alarm is caused by the fact that the access response time of a server A (a first monitoring object) in the cluster A is too long, a first correlation index display object in the alarm information comprises the server A in the cluster A and load balancing equipment in the cluster A, and information of the first correlation index displayed by the alarm information comprises the CPU utilization rate and the memory utilization rate on the server A in the cluster A and the CPU utilization rate and the memory utilization rate on the load balancing equipment in the cluster A. The information is displayed in the alarm information, the alarm scene is restored, the user is helped to locate the problem as soon as possible, so that the problem is solved as soon as possible, and the user does not need to log in a corresponding control platform to troubleshoot the problem step by step any more.

For the present invention, the monitoring index display dimension and the monitoring index display dimension do not necessarily include variables, and may be located to a fixed object in the monitored system.

In this embodiment, the information of the first monitoring index may include current data and historical data of the first monitoring index; the information of the first correlation index may also include current data and historical data of the first correlation index. The historical data can be historical data in a tracing time range, the tracing time range can be customized by a user or configured by default by a system, and the tracing time ranges of the historical data of the first monitoring index and the first related index can be the same or different.

In this embodiment, the alarm information is displayed to the user in a user-defined display format, for example, the alarm information may be displayed in various forms such as text and graphics.

In this embodiment, the alarm information further includes information of troubleshooting and processing suggestions provided by the monitoring system to the user.

The method can meet the requirement of mining alarm site information, allows a user to define interested associated indexes, and can also define the display dimensionality of the monitoring indexes and the associated indexes, when an alarm occurs, the data of the monitoring indexes and the associated indexes of corresponding objects are dynamically found according to the display dimensionality corresponding to the current alarm and are displayed for the user, so that the user can know all relevant information at the first time when the alarm information is received, the problems are quickly positioned and solved, and online loss is reduced.

The present embodiment further provides a monitoring system, as shown in fig. 2, including an information management module 10, a data processing module 20, an alarm analysis module 30, and an alarm module 40, where:

the alarm analysis module is configured to: when detecting that a first monitoring index of a first monitoring object meets an alarm condition in a first alarm rule, sending an alarm notification to an alarm module, and sending alarm information acquired from a data processing module to the alarm module;

In the present embodiment, the first and second electrodes are,

the information management module may be configured to: storing and maintaining meta-information of the alarm, wherein the meta-information comprises user-defined and/or system-default associated indexes which need to be displayed together with monitoring indexes in the alarm information, and the associated indexes comprise the first associated indexes, namely the associated indexes corresponding to the alarm;

the alarm analysis module obtains alarm information from the data processing module, and may include: and the alarm analysis module acquires the information of the first correlation index from the data processing module according to the first correlation index stored by the information management module.

The association index corresponding to the alarm may include an association index corresponding to the first alarm rule and/or an association index corresponding to the first monitoring index.

In the present embodiment, the first and second electrodes are,

the information of the first monitoring index displayed by the alarm module comprises data of the first monitoring index on a first monitoring index display object, and the first monitoring index display object comprises the first monitoring object or comprises the first monitoring object and a first monitoring index associated object different from the first monitoring object;

the information of the first relevance index displayed by the alarm module comprises data of the first relevance index on a first relevance index display object, and the first relevance index display object comprises the first monitoring object and/or a first relevance index association object different from the first monitoring object.

In the present embodiment, the first and second electrodes are,

the information management module is set as follows: storing and maintaining meta-information of an alarm, wherein the meta-information comprises a monitoring index display dimension and a related index display dimension corresponding to the alarm, which are customized by a user and/or are defaulted by a system; the monitoring index display dimension and/or the associated index display dimension corresponding to the alarm comprise variables defined based on the monitoring dimension corresponding to the alarm;

the alarm analysis module obtains alarm information from the data processing module, and the alarm analysis module comprises: the alarm analysis module determines the first monitoring index display object according to the monitoring index display dimension corresponding to the alarm stored in the information management module, and acquires the data of the first monitoring index on the first monitoring index display object from the data processing module; and determining the first associated index display object according to the associated index display dimension corresponding to the alarm stored in the information management module, and acquiring the data of the first associated index on the first associated index display object from the data processing module.

In the present embodiment, the first and second electrodes are,

the information of the first monitoring index acquired by the alarm analysis module from the data processing module may include current data and historical data of the first monitoring index;

the information of the first correlation index acquired by the alarm analysis module from the data processing module may include current data and historical data of the first correlation index.

In the present embodiment, the first and second electrodes are,

the alarm information displayed by the alarm module can adopt a user-defined display format;

the alarm information displayed by the alarm module can also comprise information of troubleshooting and processing suggestions provided by the monitoring system to a user.

The functions of the modules correspond to the processing in the method of the present embodiment, and in addition to the functions described above, other functions and examples are described in the method of the present embodiment, and a description thereof is not repeated. In addition, although the modules of the present embodiment are divided as described above, other division methods of the modules that accomplish these functions are equivalent to the above-described division methods.

The present embodiment also provides a monitoring apparatus, including a memory and a processor, wherein:

the memory is configured to: saving the program code;

In the present embodiment, the first and second electrodes are,

the first correlation index is a correlation index corresponding to the alarm, and the correlation index is an index which is customized by a user and/or is defaulted by a system and needs to be displayed together with a monitoring index in the alarm information.

In the present embodiment, the first and second electrodes are,

the correlation index corresponding to the alarm comprises a correlation index corresponding to the first alarm rule and/or a correlation index corresponding to the first monitoring index.

In the present embodiment, the first and second electrodes are,

the information of the first monitoring index comprises data of the first monitoring index on a first monitoring index display object, and the first monitoring index display object comprises the first monitoring object or comprises the first monitoring object and a first monitoring index association object different from the first monitoring object;

the information of the first associated index comprises data of the first associated index on a first associated index display object, and the first associated index display object comprises the first monitoring object and/or a first associated index associated object different from the first monitoring object.

In the present embodiment, the first and second electrodes are,

the first monitoring index display object is determined according to a monitoring index display dimension corresponding to the alarm defined by a user and/or a system;

the first associated index display object is determined according to the associated index display dimension corresponding to the alarm defined by a user and/or a system;

the monitoring index display dimension and/or the associated index display dimension corresponding to the alarm comprise variables defined based on the monitoring dimension corresponding to the alarm.

In the present embodiment, the first and second electrodes are,

the information of the first monitoring index comprises current data and historical data of the first monitoring index; and/or

The information of the first correlation index comprises current data and historical data of the first correlation index.

In the present embodiment, the first and second electrodes are,

the alarm information is displayed to a user by adopting a user-defined display format; and/or

The alarm information also comprises information of troubleshooting and processing suggestions provided by the monitoring system to a user.

The processing executed by the processor described above corresponds to the processing in the method of the present embodiment, and other processing and examples are described in the corresponding description of the method of the present embodiment in addition to the above description, and the description is not repeated.

According to the embodiment, the cloud monitoring system is built according to the method. Depending on the environment on the cloud, each cloud product reports own monitoring data to the cloud monitoring system, and a user can achieve the following multiple functions by applying the function of deep mining.

Alarming a certain index of a certain object, and displaying the index of the object;

alarming a certain index of a certain object, and displaying other indexes of the object;

alarming a certain index of a certain object, and displaying the index of other objects;

alarming is carried out on a certain index of a certain object, and other indexes of other objects are displayed;

and displaying the current data and the historical data of the indexes.

Of course, this is only a partial example, and the effect achieved according to the design idea of the present embodiment is: the user sets all interested indexes, and the system can acquire the interested indexes related to the system according to the current alarm dimension information. And the data are displayed according to the user-defined file and chart rendering mode, and a processing suggestion is given, so that the technical dilemma that the user cannot know the system problem at the first time at present is solved.

Example two

The embodiment provides a monitoring system alarm method and a corresponding monitoring system aiming at a monitoring scene monitored on the cloud, which can allow a user to define interested associated indexes, and deeply mine data of the associated indexes according to current alarm characteristic information when an alarm occurs, so as to better show an alarm site, help the user to quickly locate and solve problems.

Referring to fig. 2, the monitoring system of the present embodiment includes the following modules: information management module 10, data processing module 20, alarm analysis module 30 and alarm module 40, wherein:

the information management module is set as follows: managing alarm meta-information, wherein the meta-information includes, but is not limited to, topology of a monitored system (including objects and connection relations contained therein), an alarm data source, an alarm rule, an alarm target (various contact ways such as a mailbox, a mobile phone, an APP and the like can be adopted), an alarm information display format, and user-defined deep mining information such as an association index, a monitoring index display dimension, an association index display dimension, an alarm information format and the like corresponding to an alarm. It also provides interfaces for adding, deleting, modifying and searching alarm meta-information.

The data processing module is arranged as follows: and counting and analyzing the collected or reported original monitoring data to obtain index data required by alarm analysis and display and storing the index data so as to conveniently inquire historical data. The data processing module can also provide interfaces for creating monitoring items, reporting monitoring data, inquiring monitoring data and the like.

The alarm analysis module links up other modules together to realize complete alarm function, and is set as: and judging an alarm rule, sending an alarm notification to the alarm module when detecting that a first monitoring index of a first monitoring object meets an alarm condition in the first alarm rule, and sending the alarm information acquired from the data processing module to the alarm module. Part of the alarm information such as the information of the related indexes acquired from the data processing module can be acquired after the alarm is judged, and part of the alarm information such as the information of the monitoring indexes can be acquired before the alarm is judged. In this embodiment, when acquiring alarm information, according to the characteristic information (such as a first monitoring index, a first alarm rule, a monitoring dimension, and the like) of the alarm and the depth mining information in the information management module, the first associated index of the alarm, the monitoring index display dimension and the associated index display dimension corresponding to the alarm are found, the associated index display object and the monitoring index display object of the alarm are further determined, data of the first associated index on the associated index display object and data of the first monitoring index on the monitoring index display object are acquired, and then the data are sent to the alarm module as the alarm information.

The alarm module is set as follows: and alarming after receiving the alarm notification, and displaying the alarm information to a user. The alarm information can be directly sent to the user or a link of the alarm information can be sent to the user. The alarm module can perform user-oriented completion on standard alarm information, for example, perform language conversion on overseas users, and obtain descriptions of the users on corresponding products from the applied cloud products (for example, the products are identified by using user-defined identifiers), so that the users can conveniently and intuitively position the products. The alarm module can be connected with a plurality of notification channels, such as a mail server, a short message gateway and the like, to realize the sending of a plurality of notification modes, such as mobile phone, mail, APP and the like. The alarm information can be displayed to the user in a user-defined format such as a text, a figure or a table, so that the user can conveniently and visually locate the problem.

As shown in fig. 3, the overall process of the alarm method of the monitoring system of the present embodiment includes:

step 210, loading meta information in an information management module, wherein the meta information comprises alarm rules, information of monitoring dimensions and user-defined deep mining information;

step 220, waiting for new monitoring data, and comparing the monitoring index of the monitored object with the alarm condition in the alarm rule after receiving the new monitoring data;

step 230, judging whether an alarm condition is met, if so, executing step 240, otherwise, returning to step 220;

step 240, deeply mining information of user interest in an alarm site as alarm information, wherein the information comprises data of a first monitoring index on a first monitoring index display object and data of a first correlation index on a first correlation index display object;

the first monitoring index display object, the first related index display object, the first monitoring index and the first related index have the same meanings as described above. The presented data may include current data and historical data. How to obtain the information can be seen from the related description in the first embodiment.

And step 250, sending the alarm information to a user.

In addition to the above data, the alarm information may also include processing advice given for this alarm.

By the method, the user can see the indexes and suggestions of the interested objects when receiving the alarm notification, and the problems can be processed more quickly.

An example of the alarm method of the monitoring system of the present embodiment is given below, and as shown in fig. 4, the method includes:

step 310, the user customizes the alarm rule and the corresponding monitoring dimension through the interface provided by the monitoring system, including the first alarm rule: and alarming when the disk utilization rate of the host in the cluster exceeds 95%, wherein the corresponding monitoring dimension is defined as { A: a, B: b, C: c, wherein A is a cluster, B is a host, C is a disk, and a, B, C represent the specific cluster, host and disk involved in an alarm.

In step 320, the user defines the deep mining information of the monitoring index through the interface provided by the monitoring system, including the display dimension of the monitoring index corresponding to the first alarm rule, which is defined as { a: $ A, B: $ B }, where $ A, $ B are variables that represent the reference monitoring dimension { A: a, B: b, C: c } the values of a, b; assume host b1 in cluster a1 has 3 disks c1, c2, c 3;

step 330, the user defines the deep mining information of the associated index through the interface provided by the monitoring system, including: and the correlation index display dimension corresponding to the first alarm rule, wherein the correlation index is 'disk read-write speed', and the correlation index display dimension is defined as { A: $ A, B: and $ B, C: $ C }, $ a, $ B, $ C represent the reference monitoring dimension { a: a, B: b, C: c } the values of a, b, c;

after the correlation indexes are defined, a user can check the disk read-write speed of the monitored object after the disk usage rate of the monitored object alarms, and observe whether the disk read-write is influenced.

The user-defined information of the three steps is stored in an information management module of the monitoring system. The description is divided into three steps for convenience of expression, and the completion can be completed in a configuration process defined by a user once without fixed precedence relationship. Of course, multiple configurations are possible.

Step 340, the monitoring system detects in real time whether the monitoring index of the monitored object meets the alarm condition in the alarm rule, and if it is detected that the disk utilization rate (first monitoring index) of the disk c1 (first monitored object) of the host b1 in the cluster a1 is 99% and exceeds the threshold value of 95% specified by the alarm condition in the first alarm rule, an alarm is triggered, and the monitoring dimension corresponding to the alarm is { a: a1, B: b1, C: c1 };

the data of the monitoring index is acquired by the data processing module or analyzed and processed after being received and reported, and real-time alarm judgment is realized by the monitoring data acquired by the alarm analysis module from the data processing module and the alarm rule acquired by the information management module.

Step 350, the monitoring system searches the depth mining information of the user-defined monitoring index, and finds out the monitoring index display dimension corresponding to the first alarm rule as { A: $ A, B: and $ B }, combining the monitoring dimensionality corresponding to the alarm to obtain a monitoring index display dimensionality of the alarm, wherein the monitoring index display dimensionality is { A: a1, B: b1, and further determining that the first monitoring index display object is a disk c1, c2 or c3 of a host b1 in the cluster a 1;

step 360, the monitoring system searches for the depth mining information of the user-defined associated index, finds out that the first associated index corresponding to the first alarm rule is the disk read-write rate, and the associated index display dimension is defined as { A: $ A, B: and $ B, C: and $ C, combining the monitoring dimensionality corresponding to the alarm to obtain the relevance index display dimensionality of the alarm, wherein the relevance index display dimensionality is { A: a1, B: b1, C: c1, and further determining that the first associated indicator shows that the object is the disk c1 of the host b1 in the cluster a 1;

the two steps can be completed by the interaction of the alarm analysis module and the information management module.

Step 370, the monitoring system obtains the disk usage rates of the disks c1, c2 and c3 of the host b1 in the cluster a1 and the disk read-write rate of the disk c1 of the host b1 in the cluster a1 as alarm information, alarms and sends the alarm information to the user, and meanwhile gives a troubleshooting and processing suggestion.

In the module, the alarm analysis module can acquire the data and inform the alarm module to alarm. The action of alarm execution can remind the user of attention in other modes such as sound, light and the like besides sending alarm information.

The user is allowed to define the interested indexes, the association relation is defined by the user, the requirement of the user for mining the alarm site information can be met to the maximum extent, some default interested indexes can be defined for the user according to the characteristics of the monitoring items, therefore, the effect of deep mining of the alarm site is achieved, and richer alarm information is displayed for the user.

EXAMPLE III

The first difference between the present embodiment and the embodiment is that the alarm information displayed to the user does not include information of the associated index, but includes a monitoring index of the associated object.

As shown in fig. 5, the alarm method of the monitoring system of the embodiment includes:

step 410, the monitoring system detects that a first monitoring index of a first monitored object meets an alarm condition in a first alarm rule;

this step may be the same as in the first embodiment.

Step 420, the monitoring system gives an alarm and displays an alarm message to a user, where the alarm message includes data of the first monitoring index on a first monitoring index display object, and the first monitoring index display object includes the first monitoring object and a first monitoring index associated object different from the first monitoring object.

In the present application, the display object is used to indicate an index of which objects are to be displayed in the alarm information. The monitoring index display object is an object of which the monitoring index is to be displayed in the alarm information, and is used for displaying the monitoring index of which object is to be displayed in the alarm information. For example, if the CPU utilization of the host a of the cluster a and the CPU utilization of the host B of the cluster a are displayed in the alarm information, the monitoring index is the CPU utilization, and the monitoring index display objects are the host a of the cluster a and the host B of the cluster a.

When an alarm is given, monitoring indexes of which objects need to be displayed in alarm information are determined according to the displaying dimension of the monitoring indexes corresponding to the alarm. The monitoring index display dimension is information for positioning a monitoring index display object. For example, there are multiple hosts in a cluster, each host has multiple disks, the monitoring index includes disk usage, and in an alarm caused by disk usage, the monitoring index display dimension is configured as cluster-host-disk. If the disk utilization rate (first monitoring index) of the disk a (namely, the first monitoring object) of the host a in the cluster a meets the alarm condition, displaying the dimension according to the monitoring index corresponding to the alarm, and displaying the disk utilization rate on the disk a of the host a in the cluster a. In this case, the monitoring index display dimension is the same as the monitoring dimension corresponding to the alarm in the related art, and the monitoring index display object in the alarm information is the first monitoring object.

However, in this embodiment, the monitoring index display dimension covers and is greater than the monitoring dimension, and the first monitoring index display object includes a first monitoring object and also includes a first monitoring index associated object different from the first monitoring object, so as to display the monitoring indexes of more objects to the user. For example, in the above example, the monitoring index showing dimension corresponding to the alarm is configured as a cluster-host, and the monitoring index showing dimension may include a variable defined based on the monitoring dimension corresponding to the alarm, that is, a value of the variable refers to a value of a corresponding parameter in the monitoring dimension, in this example, the variable includes a cluster and a host, that is, values of the cluster and the host in the monitoring index showing dimension refer to values of the cluster and the host in the monitoring dimension, respectively. Thus, when the disk usage rate (first monitoring index) of the disk a (first monitoring object) of the host a in the cluster a meets the alarm condition, the disk usage rates on all the disks of the host a in the cluster a can be displayed in the alarm information. That is, the first monitoring index display object includes, in addition to the first monitoring object, other disks of the host a in the cluster a except the disk a, and the other disks are the first monitoring index related objects.

The method can meet the requirement of mining alarm site information, allows a user to define the display dimension of the monitoring index, dynamically finds the data of the monitoring index of the corresponding object according to the display dimension corresponding to the current alarm to display the data for the user when the alarm occurs, and enables the user to know all relevant information at the first time when the alarm information is received, thereby quickly positioning and solving the problems and reducing online loss.

The embodiment also provides a monitoring system, which includes an information management module, a data processing module, an alarm analysis module and an alarm module, and can refer to fig. 2, where:

the alarm module is set as follows: alarming after receiving the alarm notification, and displaying the alarm information to a user; the alarm information comprises data of a first monitoring index on a first monitoring index display object, and the first monitoring index display object comprises the first monitoring object and a first monitoring index association object different from the first monitoring object.

In the present embodiment, the first and second electrodes are,

the information management module is set as follows: storing and maintaining meta-information of an alarm, wherein the meta-information comprises a monitoring index display dimension corresponding to the alarm, which is customized by a user and/or is defaulted by a system; the monitoring index display dimension corresponding to the alarm comprises a variable defined based on the monitoring dimension corresponding to the alarm;

the alarm analysis module obtains alarm information from the data processing module, and the alarm analysis module comprises: the alarm analysis module determines the first monitoring index display object according to the monitoring index display dimension corresponding to the alarm stored in the information management module, and acquires the data of the first monitoring index on the first monitoring index display object from the data processing module.

In the present embodiment, the first and second electrodes are,

the information of the first monitoring index acquired by the alarm analysis module from the data processing module may include current data and historical data of the first monitoring index.

In the present embodiment, the first and second electrodes are,

Although the modules of the present embodiment are divided as described above, other division methods of the modules for performing these functions are equivalent to the above-described division methods.

the memory is configured to: saving the program code;

if the first monitoring index of the first monitoring object is detected to meet the alarm condition in the first alarm rule, alarming and displaying alarm information to a user; the alarm information comprises data of a first monitoring index on a first monitoring index display object, and the first monitoring index display object comprises the first monitoring object and a first monitoring index association object different from the first monitoring object.

In the present embodiment, the first and second electrodes are,

the first monitoring index display object is determined according to a monitoring index display dimension corresponding to the alarm defined by a user and/or a system; the monitoring index display dimension corresponding to the alarm comprises a variable defined based on the monitoring dimension corresponding to the alarm.

In the present embodiment, the first and second electrodes are,

the information of the first monitoring index comprises current data and historical data of the first monitoring index.

In the present embodiment, the first and second electrodes are,

and the alarm information is displayed to the user by adopting a user-defined display format.

In the present embodiment, the first and second electrodes are,

It should be noted that, besides the above-mentioned cluster-host architecture system, the present invention can also be used for monitoring and alarming of systems of other architectures. For example, a user has an external service system, which includes a module a, a module B, and a module C, where the module a is a module providing external services, and when an alarm is generated due to sudden change of a request amount per unit time of the module a, the user wants to check whether inter-call between the modules is affected. The user may define the call response time as the associated index corresponding to the alarm, and define the monitoring index display dimension and the associated index display dimension corresponding to the alarm as fixed values, that is, all 3 modules, so that when the unit time request quantity of the module a suddenly changes to cause the alarm, the unit time request quantities of the module B and the module C and the call response times of the module a, the module B and the module C are also displayed in the alarm information, in addition to the unit time request quantity of the module a, so that the user can track the behavior of each module and find out which link has a problem.

The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments. Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solutions of the embodiments of the present invention may be embodied in the form of a software product, which is stored in a storage medium (e.g., ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal device (e.g., a mobile phone, a computer, a server, or a network device) to execute the method according to the embodiments of the present invention.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A monitoring system alarm method comprises the following steps:

the monitoring system gives an alarm and sends alarm information to a user, and the user displays the alarm information to the user when receiving the alarm notification; or the monitoring system gives an alarm and sends the address information of the alarm information to a user;

the alarm information comprises information of the first monitoring index and information of a first associated index different from the first monitoring index, the first associated index is an associated index corresponding to the alarm, and the associated index is an index which is customized by a user and/or is defaulted by a system and needs to be displayed together with the monitoring index in the alarm information.

2. The method of claim 1, wherein:

3. The method of claim 1 or 2, wherein:

4. The method of claim 3, wherein:

the monitoring index display dimension and/or the associated index display dimension corresponding to the alarm comprise variables defined based on the monitoring dimension corresponding to the alarm or are fixed values.

5. The method of any of claims 1-2, 4, wherein:

6. The method of any of claims 1-2, 4, wherein:

7. The utility model provides a monitoring system, includes information management module, data processing module, alarm analysis module and alarm module, its characterized in that:

the alarm module is set as follows: alarming after receiving the alarm notification, and sending the alarm information to a user, wherein the user can display the alarm information to the user when receiving the alarm notification; or, after receiving the alarm notification, alarming and sending the address information of the alarm information to a user; wherein the alarm information includes information of the first monitoring index and information of a first correlation index different from the first monitoring index;

the information management module is set as follows: storing and maintaining meta-information of the alarm, wherein the meta-information comprises user-defined and/or system-default associated indexes which need to be displayed together with monitoring indexes in the alarm information, and the associated indexes comprise the first associated indexes, namely the associated indexes corresponding to the alarm;

the alarm analysis module obtains alarm information from the data processing module, and the alarm analysis module comprises: and the alarm analysis module acquires the information of the first correlation index from the data processing module according to the first correlation index stored by the information management module.

8. The system of claim 7, wherein:

9. The system of claim 7 or 8, wherein:

10. The system of claim 9, wherein:

the information management module is set as follows: storing and maintaining meta-information of an alarm, wherein the meta-information comprises a monitoring index display dimension and a related index display dimension corresponding to the alarm, which are customized by a user and/or are defaulted by a system; the monitoring index display dimension and/or the associated index display dimension corresponding to the alarm comprise variables defined based on the monitoring dimension corresponding to the alarm or are fixed values;

11. The system of any of claims 7-8, 10, wherein:

the information of the first monitoring index acquired by the alarm analysis module from the data processing module comprises current data and historical data of the first monitoring index; and/or

The information of the first correlation index acquired by the alarm analysis module from the data processing module comprises current data and historical data of the first correlation index.

12. The system of any of claims 7-8, 10, wherein:

the alarm information displayed by the alarm module adopts a user-defined display format; and/or

The alarm information displayed by the alarm module also comprises information of troubleshooting and processing suggestions provided by the monitoring system to a user.

13. A monitoring device comprising a memory and a processor, wherein:

the memory is configured to: saving the program code;

when detecting that a first monitoring index of a first monitoring object meets an alarm condition in a first alarm rule, alarming and sending alarm information to a user, wherein the user displays the alarm information to the user when receiving an alarm notification; or, when detecting that the first monitoring index of the first monitoring object meets the alarm condition in the first alarm rule, alarming and sending the address information of the alarm information to the user;