發(fā)布時(shí)間：2018-03-11 11:31

  本文選題：集中監(jiān)控　切入點(diǎn)：復(fù)雜事件處理　出處：《東華大學(xué)》2014年碩士論文　論文類型：學(xué)位論文

【摘要】：目前,大部分企業(yè)都將IT基礎(chǔ)設(shè)施進(jìn)行集中監(jiān)控,以便統(tǒng)一管理調(diào)度,提升業(yè)務(wù)應(yīng)用的性能。針對(duì)監(jiān)控到的海量事件,如何有效地將它們?nèi)诤显谝黄鸺右岳?獲取更有價(jià)值的信息,是進(jìn)行監(jiān)控的意義所在。然而在對(duì)大型分布式IT資源系統(tǒng)進(jìn)行集中監(jiān)控時(shí),所返回的監(jiān)控事件數(shù)量龐雜,因查詢效率低,故障分析不明確或處理過程中人為因素等原因造成了事件關(guān)聯(lián)檢測不準(zhǔn)確或者響應(yīng)時(shí)間慢等問題。服務(wù)突然的中斷或異常會(huì)影響大量客戶的使用,導(dǎo)致業(yè)務(wù)出現(xiàn)延遲甚至最終給企業(yè)帶來重大損失。本文研究利用復(fù)雜事件處理技術(shù)來解決事件關(guān)聯(lián)的問題,并結(jié)合應(yīng)用需求進(jìn)行改進(jìn),以期加快響應(yīng)時(shí)間,提高監(jiān)測準(zhǔn)確度。 論文首先介紹了國內(nèi)外復(fù)雜事件處理系統(tǒng)的應(yīng)用現(xiàn)狀,針對(duì)網(wǎng)絡(luò)監(jiān)控項(xiàng)目需求,研究了監(jiān)控系統(tǒng)的架構(gòu)、事件的采集方式、事件的表示形式和展現(xiàn)形式等,歸納整理了監(jiān)控事件中存在的問題。針對(duì)監(jiān)控返回的事件量大,事件處理速度慢,規(guī)則定義不準(zhǔn)確,產(chǎn)生大量冗余事件造成處理困難和響應(yīng)不及時(shí)問題,論文提出從兩方面入手來解決。 一方面,為了提高查詢處理速度,采用關(guān)系引擎和事件引擎相結(jié)合的方式,使用多查詢優(yōu)化規(guī)則：針對(duì)多查詢規(guī)則中如何調(diào)用操作符模式問題,從最小化cpu使用角度考慮,提出基于代價(jià)的多查詢優(yōu)化方法,利用貪心算法對(duì)規(guī)則引擎進(jìn)行優(yōu)化,實(shí)現(xiàn)事件的關(guān)聯(lián),提高事件處理的速度。 另一方面,針對(duì)規(guī)則定義不準(zhǔn)確,事件冗余量大的問題,提出基于Dempster-Shafer(D-S)證據(jù)理論方法對(duì)事件做進(jìn)一步分析的解決方案。對(duì)于未知的事件或者不確定的事件來說,根源無法判斷,而且很多預(yù)定義的規(guī)則是主觀經(jīng)驗(yàn)規(guī)定的,在實(shí)際中不一定準(zhǔn)確,再加上環(huán)境等因素的影響,由此派生出的通用規(guī)則集合很難應(yīng)用到所有故障分析中。而D-S證據(jù)理論可以表示不確定或者缺少條件的概率情況,即使信息不完全或者不精確,也可以進(jìn)行推理,它是一種轉(zhuǎn)換的信念模型。從該角度出發(fā),對(duì)復(fù)雜事件處理系統(tǒng)進(jìn)行擴(kuò)展,提出了一種智能化的解決方案,采用基于D-S證據(jù)理論的信息融合方法,來自動(dòng)定位事件發(fā)生的根源,從而減少告警冗余信息的產(chǎn)生。該方法不僅解決了目前根據(jù)主觀經(jīng)驗(yàn)預(yù)定義規(guī)則所帶來的不精確檢測等局限,而且在獲取潛在信息和不確定故障分析中起到了很好的作用,使得檢測事件的實(shí)時(shí)性和準(zhǔn)確性都有所提高。 最后,論文用實(shí)驗(yàn)驗(yàn)證了提出方法的合理性和有效性。
[Abstract]:At present, most enterprises have centralized monitoring of IT infrastructure in order to unify management scheduling and improve the performance of business applications. Obtaining more valuable information is the meaning of monitoring. However, when centralized monitoring large distributed IT resource systems, the number of monitoring events returned is numerous and complex, because of the low query efficiency, Failure analysis is not clear or human factors in the process of processing cause the problem of inaccurate detection of event association or slow response time. A sudden interruption or exception of service will affect the use of a large number of customers. This paper studies the use of complex event processing technology to solve the problem of event association, and improves it in combination with application requirements in order to speed up the response time and improve the monitoring accuracy. Firstly, the paper introduces the application status of complex event processing system at home and abroad. According to the requirement of network monitoring project, it studies the structure of monitoring system, the way of event collection, the form of representation and presentation of event, and so on. The problems existing in monitoring events are summarized and sorted out. In view of the large number of events returned by monitoring, the slow processing speed of events, the inaccurate definition of rules, the occurrence of a large number of redundant events, the difficulty of handling and the problem of untimely response. The paper proposes to solve the problem from two aspects. On the one hand, in order to improve the speed of query processing, the relationship engine and event engine are combined to optimize the rules of multi-query. Considering the problem of how to call operator mode in multi-query rules, we consider how to minimize the use of cpu. A multi-query optimization method based on cost is proposed. The greedy algorithm is used to optimize the rule engine to realize the association of events and to improve the speed of event processing. On the other hand, in order to solve the problem of inaccurate definition of rules and large amount of event redundancy, a solution based on Dempster-Shafern D-S) evidence theory is proposed to further analyze the event. For unknown events or uncertain events, the root causes can not be determined. Moreover, many predefined rules are prescribed by subjective experience and are not necessarily accurate in practice, plus the influence of factors such as the environment. The derived set of general rules is difficult to apply to all fault analysis, and D-S evidence theory can represent the probability of uncertainty or lack of conditions, even if the information is incomplete or inaccurate, it can be inferred. It is a conversion belief model. From this point of view, the complex event processing system is extended, and an intelligent solution is proposed. The information fusion method based on D-S evidence theory is adopted to automatically locate the origin of the event. This method not only solves the limitation of imprecise detection brought by predefined rules according to subjective experience, but also plays a good role in obtaining potential information and uncertain fault analysis. The real-time and accuracy of detecting events are improved. Finally, the rationality and validity of the proposed method are verified by experiments.
【學(xué)位授予單位】：東華大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2014
【分類號(hào)】：TP393.06

【參考文獻(xiàn)】

相關(guān)期刊論文 前1條

1 孫林超;陳群;康莊莊;;分布式RFID復(fù)雜事件處理關(guān)鍵技術(shù)的研究[J];計(jì)算機(jī)工程與應(yīng)用;2011年22期

，

本文編號(hào)：1597976