1. A fault trigger matching method based on knowledge base expert rules is characterized by comprising the following steps:

constructing a knowledge base, wherein the knowledge base comprises expert rules and a plurality of trigger conditions corresponding to the expert rules;

acquiring expert rules in a knowledge base as target expert rules and indexes corresponding to the target expert rules;

acquiring a plurality of trigger conditions of the target rule as a target trigger condition set;

acquiring actual data of the index;

judging whether the actual data meet the preset requirements of the target trigger condition set or not;

and determining that the actual data meets the preset requirements of the target trigger condition set, and triggering the fault response of the target expert rule.

2. The method of claim 1, wherein each of the plurality of trigger conditions in the knowledge base comprises an indicator, comparison logic, an indicator threshold, a trigger number, a trigger condition weight, and trigger continuity.

3. The method of claim 2, wherein the obtaining actual data of the index comprises:

acquiring an index;

and acquiring actual data corresponding to the index.

4. The method of claim 2, wherein the determining whether the actual data meets the preset requirements of the target trigger condition set comprises:

judging whether the actual data reaches a threshold value by adopting comparison logic in the target trigger condition set;

and determining that the actual data reaches a threshold value, and calculating the number of times that the actual data triggers a single target triggering condition in the target triggering condition set.

5. The method of claim 4, wherein the determining whether the actual data meets the preset requirements of the target trigger condition set further comprises:

and judging the continuity of the actual data triggering single target triggering condition.

6. The method of claim 4, wherein the determining whether the actual data meets the preset requirements of the target trigger condition set further comprises:

determining that the actual data and all target triggering conditions in the target triggering condition set complete a judgment process, and calculating the weight of each target triggering condition;

and determining whether the actual data meets the preset requirements of the target trigger condition set or not according to the weight of each target trigger condition.

7. The method of claim 1, wherein the determining that the actual data meets the preset requirements of the target trigger condition set and triggers the fault response of the target expert rule comprises:

acquiring the actual data and judgment results of all target trigger conditions in the target trigger condition set;

acquiring a correction coefficient;

calculating the matching degree of the event with faults according to the judgment result and the correction coefficient;

and determining that the matching degree meets a threshold value of the matching degree, and triggering the fault response of the target expert rule.

8. A fault trigger matching system based on expert rules of a knowledge base is characterized by comprising

The system comprises a construction module, a storage module and a processing module, wherein the construction module is used for constructing a knowledge base, and the knowledge base comprises expert rules and a plurality of trigger conditions corresponding to the expert rules;

the first acquisition module is used for acquiring expert rules in a knowledge base as target expert rules and indexes corresponding to the target expert rules;

a second obtaining module, configured to obtain multiple trigger conditions of the target rule as a target trigger condition set;

the third acquisition module is used for acquiring actual data of the index;

the judging module is used for judging whether the actual data meets the preset requirements of the target triggering condition set;

and the determining module is used for determining that the actual data meets the preset requirements of the target triggering condition set and triggering the fault response of the target expert rule.

9. A knowledge base expert rule based fault trigger matching system, comprising:

at least one memory for storing a program;

at least one processor configured to load the program to perform the method for matching against a fault trigger based on expert rules of the knowledge base according to any of claims 1 to 7.

10. A computer-readable storage medium storing a computer-executable program which, when executed by a computer, is configured to perform the method for matching against a fail trigger based on expert rules of knowledge base according to any one of claims 1 to 7.

Background

A knowledge base is a collection of facts, rules, and concepts, and from the perspective of storing knowledge, an organization that stores and manages knowledge in a descriptive way is called a knowledge base. In the related art, when fault matching is performed according to the knowledge base, corresponding fault responses are usually triggered according to data of a single monitoring point. The response mode is easy to generate the phenomenon of false touch, so that the workload of workers is increased invisibly.

Disclosure of Invention

The present invention is directed to solving at least one of the problems of the prior art. Therefore, the invention provides a fault trigger matching method, system and medium based on expert rules of a knowledge base, which can effectively reduce the occurrence of false touch.

In a first aspect, an embodiment of the present invention provides a fault trigger matching method based on expert rules in a knowledge base, including the following steps:

constructing a knowledge base, wherein the knowledge base comprises expert rules and a plurality of trigger conditions corresponding to the expert rules;

acquiring expert rules in a knowledge base as target expert rules and indexes corresponding to the target expert rules;

acquiring a plurality of trigger conditions of the target rule as a target trigger condition set;

acquiring actual data of the index;

judging whether the actual data meet the preset requirements of the target trigger condition set or not;

and determining that the actual data meets the preset requirements of the target trigger condition set, and triggering the fault response of the target expert rule.

The fault triggering matching method based on the knowledge base expert rules provided by the embodiment of the invention has the following beneficial effects:

in the embodiment, a plurality of trigger conditions corresponding to expert rules are set in a knowledge base, then the expert rules in the knowledge base are obtained as target expert rules, indexes corresponding to the target expert rules and a plurality of trigger conditions of the target rules are obtained as target trigger condition sets, then whether actual data of the obtained indexes meet preset requirements of the target trigger condition sets is judged, and after the fact that the actual data meet the preset requirements of the target trigger condition sets, fault responses of the target expert rules are triggered.

In some embodiments, each trigger condition of the plurality of trigger conditions in the knowledge base comprises an indicator, comparison logic, an indicator threshold, a number of triggers, a weight of a trigger condition, and a trigger continuity.

In some embodiments, the obtaining actual data of the indicator includes:

acquiring an index;

and acquiring actual data corresponding to the index.

In some embodiments, the determining whether the actual data meets the preset requirement of the target trigger condition set includes:

judging whether the actual data reaches a threshold value by adopting comparison logic in the target trigger condition set;

and determining that the actual data reaches a threshold value, and calculating the number of times that the actual data triggers a single target triggering condition in the target triggering condition set.

In some embodiments, the determining whether the actual data meets the preset requirement of the target trigger condition set further includes:

and judging the continuity of the actual data triggering single target triggering condition.

In some embodiments, the determining whether the actual data meets the preset requirement of the target trigger condition set further includes:

determining that the actual data and all target triggering conditions in the target triggering condition set complete a judgment process, and calculating the weight of each target triggering condition;

and determining whether the actual data meets the preset requirements of the target trigger condition set or not according to the weight of each target trigger condition.

In some embodiments, the determining that the actual data meets the preset requirements of the target trigger condition set, triggering a fault response of the target expert rule, includes:

acquiring the actual data and judgment results of all target trigger conditions in the target trigger condition set;

acquiring a correction coefficient;

calculating the matching degree of the event with faults according to the judgment result and the correction coefficient;

and determining that the matching degree meets a threshold value of the matching degree, and triggering the fault response of the target expert rule.

In a second aspect, an embodiment of the present invention provides a fault trigger matching system based on expert rules in a knowledge base, including

The system comprises a construction module, a storage module and a processing module, wherein the construction module is used for constructing a knowledge base, and the knowledge base comprises expert rules and a plurality of trigger conditions corresponding to the expert rules;

the first acquisition module is used for acquiring expert rules in a knowledge base as target expert rules and indexes corresponding to the target expert rules;

a second obtaining module, configured to obtain multiple trigger conditions of the target rule as a target trigger condition set;

the third acquisition module is used for acquiring actual data of the index;

the judging module is used for judging whether the actual data meets the preset requirements of the target triggering condition set;

and the determining module is used for determining that the actual data meets the preset requirements of the target triggering condition set and triggering the fault response of the target expert rule.

In a third aspect, an embodiment of the present invention provides a fault trigger matching system based on expert rules in a knowledge base, including:

at least one memory for storing a program;

at least one processor, configured to load the program to perform the method for matching fault trigger based on expert rules in a knowledge base provided in the embodiment of the first aspect.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, where the storage medium stores a computer-executable program, and the computer-executable program is used to execute the method for matching fault triggers based on expert rules in a knowledge base provided in the first aspect.

Additional aspects and advantages of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.

Drawings

The invention is further described with reference to the following figures and examples, in which:

FIG. 1 is a method for matching fault triggers based on expert rules of a knowledge base, according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of the structure of a knowledge base according to an embodiment of the present invention;

fig. 3 is a flowchart of an application process according to an embodiment of the present invention.

Detailed Description

Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the accompanying drawings are illustrative only for the purpose of explaining the present invention, and are not to be construed as limiting the present invention.

In the description of the present invention, it should be understood that the orientation or positional relationship referred to in the description of the orientation, such as the upper, lower, front, rear, left, right, etc., is based on the orientation or positional relationship shown in the drawings, and is only for convenience of description and simplification of description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus, should not be construed as limiting the present invention.

In the description of the present invention, the meaning of a plurality is one or more, the meaning of a plurality is two or more, and the above, below, exceeding, etc. are understood as excluding the present numbers, and the above, below, within, etc. are understood as including the present numbers. If the first and second are described for the purpose of distinguishing technical features, they are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated or implicitly indicating the precedence of the technical features indicated.

In the description of the present invention, unless otherwise explicitly limited, terms such as arrangement, installation, connection and the like should be understood in a broad sense, and those skilled in the art can reasonably determine the specific meanings of the above terms in the present invention in combination with the specific contents of the technical solutions.

In the description of the present invention, reference to the description of the terms "one embodiment," "some embodiments," "an illustrative embodiment," "an example," "a specific example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

A monitoring system for fault judgment or inference by using a knowledge base is mostly based on a knowledge base technical framework, and a fault intelligent diagnosis system is constructed by daily judgment of maintenance personnel, clarification and regularization of operation experience and arrangement of the operation experience as an expert rule. The monitoring system carries out index and alarm automatic association, equipment information is automatically matched, the service influence range is intelligently obtained, and rapid discovery and positioning of faults are realized.

In a monitoring system, a matching method for matching expert rules is critical if the desired effect is to be achieved. The matching method in the related technology has many problems, such as the matching method based on the semantics, the matching method based on the keyword fuzzy matching, the matching method based on the rule full matching, etc., and has the problems of many interference factors, single algorithm noise reduction means, and unsatisfactory matching accuracy.

Based on this, the embodiment of the present invention provides a fault trigger matching method based on expert rules of a knowledge base, where a plurality of trigger conditions corresponding to expert rules are first set in the knowledge base, then the expert rules in the knowledge base are obtained as target expert rules, indexes corresponding to the target expert rules, and a plurality of trigger conditions of the target rules as target trigger condition sets, then it is determined whether actual data of the obtained indexes meet preset requirements of the target trigger condition sets, and after it is determined that the actual data meet preset requirements of the target trigger condition sets, fault responses of the target expert rules are triggered.

Specifically, referring to fig. 1, an embodiment of the present invention provides a fault trigger matching method based on expert rules in a knowledge base, and the embodiment may be applied to a user fault alarm server or a background processor corresponding to a fault monitoring platform. In the response process, the server or the background processor can interact with the terminal equipment and the monitoring equipment of the monitoring personnel.

Wherein, this embodiment includes the following steps:

and S11, constructing a knowledge base, wherein the knowledge base comprises expert rules and a plurality of trigger conditions corresponding to the expert rules.

In the embodiment of the present application, as shown in fig. 2, the knowledge base includes concepts, entities, connections, rules, and events, such as:

the organization structure of the monitored system is the basis of the knowledge base. In particular to a TOPO structure of a monitored system, wherein the TOPO structure describes the hierarchical relationship of the monitored system and the calling relationship among the systems. Generally, distributed systems have a hierarchical, calling relationship.

Adapting rules of the docking machine data bear expert rules of expert experience. Specifically, the manual includes an equipment manual, a failure case, a failure recovery manual, and the like. The part of rules are made by developers, operation and maintenance personnel, experts and the like of the monitored system.

Static knowledge and semantic knowledge of the fault are described, and machine data such as indexes, alarms, relations among the indexes, various logs and the like on the fault site are reflected.

In addition, the knowledge base further comprises a plurality of trigger conditions, specifically, one expert rule comprises a plurality of trigger conditions, and one trigger condition comprises only one index, so that the weight of the index is also the weight of the trigger condition (hereinafter referred to as the weight of the trigger condition). Since the specific meanings of the indexes are different, the attention points and the importance degrees of the indexes are different, so that the weights of the indexes are different when the knowledge base is matched, and the higher the weight of the trigger condition is, the higher the degree of the trigger condition influencing the whole expert rule is. In one expert rule, the sum of the weights of all trigger conditions is 100. If one trigger condition has a plurality of interference items, the interference items need to be split, all factors causing the interference are used as indexes, the trigger condition is built around the indexes, and the generated trigger condition is used as a part of expert rules. Wherein the indicator is an indicator of a fault. The plurality of trigger conditions includes an indicator, comparison logic, an indicator threshold, a number of triggers, a weight of the trigger condition, and a trigger continuity of the plurality of trigger conditions.

The sources of the knowledge base include: alarms, indicators, connections between indicators, etc. in a structured system; carrying monitored system documents, configurations, tables, lists, logs and the like in the structured system; fault cases in unstructured systems, equipment manuals, and multimodal knowledge corpora.

S12, acquiring the expert rules in the knowledge base as target expert rules, indexes corresponding to the target expert rules and a plurality of trigger conditions of the target rules as target trigger condition sets.

And S13, acquiring actual data of the index.

In the embodiment of the application, the index is obtained first, and then the actual data corresponding to the index is extracted. The index refers to a monitoring point where an event may occur. The actual data is the working data of the index in the working process, and can reflect the current state of the monitoring point.

And S14, judging whether the actual data meet the preset requirements of the target trigger condition set.

In the embodiment of the present application, this step may be implemented by:

and judging whether the actual data reaches the threshold value by adopting comparison logic in the target trigger condition set.

After determining that the actual data reaches the threshold, calculating the number of times the actual data triggers a single target trigger condition within the set of target trigger conditions. The number of triggers may be determined as the number of times of occurrence within a time slice. For example, the triggering condition is 5 minutes triggering 3 times, that is, the time slice is 5 minutes, which means that 3 or more actual values reaching the threshold value in the index actual value set within 5 minutes. It is determined whether the number of triggers is 3 or more than 3 within 5 minutes. In this embodiment, the threshold of the triggering times needs to be adjusted according to different events. This is because the sampling frequency is different due to different meanings of the index, and if a uniform time slice is used for each trigger condition, the accuracy of the matching method is greatly reduced. For example, the connectivity index of the server is sampled once in 10 seconds to judge whether the server is connected or not; and the CPU utilization index of the server performs sampling once in 1 minute. If the two trigger conditions uniformly set the time slice to be 5 minutes for triggering 3 times, then in the 5 minutes, the index sampling point of the server connectivity has 30; the CPU utilization rate sampling points are only 5, so that the judgment of the triggering times is unreasonable.

And judging the continuity of the trigger condition of the single target triggered by the actual data. Wherein, the triggering condition is satisfied when the triggering condition is hit. When a certain fault occurs, the same index is often abnormal for multiple times, and sometimes the index needs to continuously reach the threshold value of the trigger condition in multiple judgment cycles, so that the trigger condition can be considered to be met. The present embodiment masks jitter by using the factor of whether hits are continuously hit as a noise reduction means. For example, network jitter may occasionally cause an abnormal index of the related connection class, and if the index is only abnormal, the abnormality cannot really indicate that the index is related to a problem. For example, in a plurality of continuous detection periods, when a certain server is detected to be failed to connect, the connection failure of the server can be judged, so that the phenomenon of fault misjudgment caused by network jitter and other factors is shielded.

Determining that the actual data and all target triggering conditions in the target triggering condition set complete the judgment process, and calculating the weight of each target triggering condition;

and determining whether the actual data meets the preset requirements of the target trigger condition set or not according to the weight of each target trigger condition.

In the embodiment, the relationship between the actual data of the event and the target trigger condition is judged through a plurality of conditions together, so that the accuracy of the judgment result is improved.

And S15, determining that the actual data meet the preset requirements of the target trigger condition set, and triggering the fault response of the target expert rule.

In the embodiment of the application, the judgment results of actual data and all target trigger conditions in a target trigger condition set are obtained, and meanwhile, a correction coefficient is obtained; and then calculating the matching degree of the event with faults according to the judgment result and the correction coefficient, determining that the matching degree meets the matching degree threshold, and triggering the fault response of the target expert rule so as to improve the accuracy of the response result.

When the above embodiment is applied to an actual operation process, as shown in fig. 3, the following steps are included:

step one, constructing a knowledge base. The composition of the knowledge base is shown in fig. 2. The trigger condition part of the knowledge base expert rules includes, but is not limited to, the following parts:

indexes are as follows: the indicators are points of interest for the monitoring system, including but not limited to: CPU utilization rate, memory utilization rate, hard disk utilization rate, TPS, RTT, success rate and the like.

Comparison logic: comparison logic includes, but is not limited to: equal, unequal, greater than, less than, equal to, including, not including, between.

Index threshold value: after calculating the actual value of the index, the comparison logic is needed to judge the relation between the actual value and the threshold value of the index.

Triggering times are as follows: and in the time segment, in the index actual value set, the number of the index actual values reaching the index threshold value is regarded as the triggering times.

And (3) weighting: the trigger condition weight is used to indicate the magnitude of the degree to which the trigger condition affects the expert rules.

Whether to trigger continuously: in some cases, a plurality of continuous index actual values in the index actual value set need to reach the threshold, and the trigger condition can be determined to be satisfied.

And step two, calculating the actual data value of the index related in the expert rule.

Specifically, from the monitoring data, the actual values of the calculation indexes form an actual value set, the association relationship is organized, and the set of association data is placed in the cache. For example, the CPU utilization index of a certain server is 20% in actual value, and the group of contacts are stored in a cache

Step three, reading the expert rules. The method comprises the steps of reading an expert rule from a knowledge base, and extracting a trigger condition part in the expert rule, wherein the trigger condition part is composed of at least one trigger condition.

And step four, processing the indexes.

The third step is based on the third step, the indexes are analyzed from the triggering conditions, then the index processor is searched according to the indexes, and the index processor searches the actual value set of the relevant indexes in the time segment in the cache.

And step five, judging the triggering condition.

In the step, based on the index actual value set found in the step four, the comparison logic is used for comparing with the threshold value of the index, and whether the actual value of the index reaches the threshold value is judged. For example, the index is the CPU utilization, the judgment logic is > and the threshold is 80%, then the judgment expression of the trigger condition is: the actual usage of the CPU is > 80%. And judging whether the triggering condition is met according to the expression.

And step six, calculating the hit times of the trigger conditions.

In the step, the hit times of the trigger condition is calculated based on the condition that the trigger condition is met in the step five. And judging whether the time slice triggers several times and meets the requirement of hit times. For example, CPU > 80% was triggered 3 times in 5 minutes.

And step seven, judging whether the trigger condition has a continuous hit option.

In the step, on the basis that the hit times are reached in the step six, if the trigger condition in the expert rule has a continuous hit option, whether the trigger condition meets continuous hit needs to be judged. Taking the triggering condition that the index CPU utilization rate is more than 80% and needs to be triggered 3 times and continuous hit needs to be met as an example, assuming that in a 5-minute time segment, the CPU utilization rate is calculated once in 1-minute sampling, and the conditions that the CPU utilization rate is more than 80% in the 1 st minute, the 3 rd minute and the 4 th minute are all met, the triggering times reach 3 times, but because the CPU utilization rates in the second minute and the fifth minute are less than 80%, the triggering condition that the CPU utilization rate is more than 80% is not met, that is, the continuous triggering option is not met, the triggering condition is still judged to be not met.

And step eight, circularly processing the trigger condition in the expert rule.

Since the expert rule includes one or more trigger conditions, steps two through seven need to be repeated to process each trigger condition in the expert rule.

And step nine, calculating the weight of the trigger condition.

And after all the trigger conditions of a certain expert rule are processed, calculating the weight occupied by all the trigger conditions.

Step ten, fault triggering judgment.

Based on the calculation results of all the trigger conditions accumulated in the step nine, and by matching with a correction constant, the fault trigger matching degree can be calculated, and the calculation expression is as follows:

wherein MG (F)_i) Matching degree of a specialist rule i in a knowledge base; m is_iThe number of trigger conditions of the expert rule i is set; j is an integer, j belongs to [1, m ]_i]，Q_jTaking the matching degree of the trigger condition j as 0 or 1, wherein 1 represents that the trigger condition matching is successful, and 0 represents that the trigger condition matching is failed; w_jThe weight of the trigger condition j is taken up; α is a constant and used for the correction of the result, and a value of 1 means no correction.

Step eleven, comparing MG (F)_i) And if the matching degree threshold of the expert rules is reached, triggering is carried out, otherwise, the fault is not triggered. And after the fault is triggered, receiving feedback information processed by the expert rules.

In summary, the embodiment makes the matching degree of the knowledge base more accurate by noise reduction means such as multiple trigger conditions, time slices, trigger condition weights, hit times, whether to hit trigger continuously, and the like.

The embodiment of the invention provides a fault trigger matching system based on expert rules of a knowledge base, which comprises

The system comprises a construction module, a storage module and a processing module, wherein the construction module is used for constructing a knowledge base, and the knowledge base comprises expert rules and a plurality of trigger conditions corresponding to the expert rules;

the first acquisition module is used for acquiring expert rules in a knowledge base as target expert rules and indexes corresponding to the target expert rules;

a second obtaining module, configured to obtain multiple trigger conditions of the target rule as a target trigger condition set;

the third acquisition module is used for acquiring actual data of the index;

the judging module is used for judging whether the actual data meets the preset requirements of the target triggering condition set;

and the determining module is used for determining that the actual data meets the preset requirements of the target triggering condition set and triggering the fault response of the target expert rule.

The content of the embodiment of the method of the invention is all applicable to the embodiment of the system, the function of the embodiment of the system is the same as the embodiment of the method, and the beneficial effect achieved by the embodiment of the system is the same as the beneficial effect achieved by the method.

The embodiment of the invention provides a fault trigger matching system based on expert rules of a knowledge base, which comprises the following steps:

at least one memory for storing a program;

at least one processor configured to load the program to perform the method for matching against a fault trigger based on expert rules of the knowledge base as shown in FIG. 1.

The content of the embodiment of the method of the invention is all applicable to the embodiment of the system, the function of the embodiment of the system is the same as the embodiment of the method, and the beneficial effect achieved by the embodiment of the system is the same as the beneficial effect achieved by the method.

An embodiment of the present invention provides a computer-readable storage medium storing a computer-executable program, which is used to execute the method for matching fault triggers based on expert rules of a knowledge base shown in fig. 1 when the computer-executable program is executed by a computer.

The embodiment of the invention also discloses a computer program product or a computer program, which comprises computer instructions, and the computer instructions are stored in a computer readable storage medium. The computer instructions may be read by a processor of a computer device from a computer-readable storage medium, and executed by the processor to cause the computer device to perform the method illustrated in fig. 1.

The embodiments of the present invention have been described in detail with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge of those skilled in the art without departing from the gist of the present invention. Furthermore, the embodiments of the present invention and the features of the embodiments may be combined with each other without conflict.