复杂事件处理在分布式系统集中监控下的应用与研究

发布时间：2018-03-11 11:31

本文选题：集中监控　切入点：复杂事件处理　出处：《东华大学》2014年硕士论文　论文类型：学位论文

【摘要】：目前,大部分企业都将IT基础设施进行集中监控,以便统一管理调度,提升业务应用的性能。针对监控到的海量事件,如何有效地将它们融合在一起加以利用,获取更有价值的信息,是进行监控的意义所在。然而在对大型分布式IT资源系统进行集中监控时,所返回的监控事件数量庞杂,因查询效率低,故障分析不明确或处理过程中人为因素等原因造成了事件关联检测不准确或者响应时间慢等问题。服务突然的中断或异常会影响大量客户的使用,导致业务出现延迟甚至最终给企业带来重大损失。本文研究利用复杂事件处理技术来解决事件关联的问题,并结合应用需求进行改进,以期加快响应时间,提高监测准确度。论文首先介绍了国内外复杂事件处理系统的应用现状,针对网络监控项目需求,研究了监控系统的架构、事件的采集方式、事件的表示形式和展现形式等,归纳整理了监控事件中存在的问题。针对监控返回的事件量大,事件处理速度慢,规则定义不准确,产生大量冗余事件造成处理困难和响应不及时问题,论文提出从两方面入手来解决。一方面,为了提高查询处理速度,采用关系引擎和事件引擎相结合的方式,使用多查询优化规则：针对多查询规则中如何调用操作符模式问题,从最小化cpu使用角度考虑,提出基于代价的多查询优化方法,利用贪心算法对规则引擎进行优化,实现事件的关联,提高事件处理的速度。另一方面,针对规则定义不准确,事件冗余量大的问题,提出基于Dempster-Shafer(D-S)证据理论方法对事件做进一步分析的解决方案。对于未知的事件或者不确定的事件来说,根源无法判断,而且很多预定义的规则是主观经验规定的,在实际中不一定准确,再加上环境等因素的影响,由此派生出的通用规则集合很难应用到所有故障分析中。而D-S证据理论可以表示不确定或者缺少条件的概率情况,即使信息不完全或者不精确,也可以进行推理,它是一种转换的信念模型。从该角度出发,对复杂事件处理系统进行扩展,提出了一种智能化的解决方案,采用基于D-S证据理论的信息融合方法,来自动定位事件发生的根源,从而减少告警冗余信息的产生。该方法不仅解决了目前根据主观经验预定义规则所带来的不精确检测等局限,而且在获取潜在信息和不确定故障分析中起到了很好的作用,使得检测事件的实时性和准确性都有所提高。最后,论文用实验验证了提出方法的合理性和有效性。
[Abstract]:At present, most enterprises have centralized monitoring of IT infrastructure in order to unify management scheduling and improve the performance of business applications. Obtaining more valuable information is the meaning of monitoring. However, when centralized monitoring large distributed IT resource systems, the number of monitoring events returned is numerous and complex, because of the low query efficiency, Failure analysis is not clear or human factors in the process of processing cause the problem of inaccurate detection of event association or slow response time. A sudden interruption or exception of service will affect the use of a large number of customers. This paper studies the use of complex event processing technology to solve the problem of event association, and improves it in combination with application requirements in order to speed up the response time and improve the monitoring accuracy. Firstly, the paper introduces the application status of complex event processing system at home and abroad. According to the requirement of network monitoring project, it studies the structure of monitoring system, the way of event collection, the form of representation and presentation of event, and so on. The problems existing in monitoring events are summarized and sorted out. In view of the large number of events returned by monitoring, the slow processing speed of events, the inaccurate definition of rules, the occurrence of a large number of redundant events, the difficulty of handling and the problem of untimely response. The paper proposes to solve the problem from two aspects. On the one hand, in order to improve the speed of query processing, the relationship engine and event engine are combined to optimize the rules of multi-query. Considering the problem of how to call operator mode in multi-query rules, we consider how to minimize the use of cpu. A multi-query optimization method based on cost is proposed. The greedy algorithm is used to optimize the rule engine to realize the association of events and to improve the speed of event processing. On the other hand, in order to solve the problem of inaccurate definition of rules and large amount of event redundancy, a solution based on Dempster-Shafern D-S) evidence theory is proposed to further analyze the event. For unknown events or uncertain events, the root causes can not be determined. Moreover, many predefined rules are prescribed by subjective experience and are not necessarily accurate in practice, plus the influence of factors such as the environment. The derived set of general rules is difficult to apply to all fault analysis, and D-S evidence theory can represent the probability of uncertainty or lack of conditions, even if the information is incomplete or inaccurate, it can be inferred. It is a conversion belief model. From this point of view, the complex event processing system is extended, and an intelligent solution is proposed. The information fusion method based on D-S evidence theory is adopted to automatically locate the origin of the event. This method not only solves the limitation of imprecise detection brought by predefined rules according to subjective experience, but also plays a good role in obtaining potential information and uncertain fault analysis. The real-time and accuracy of detecting events are improved. Finally, the rationality and validity of the proposed method are verified by experiments.
【学位授予单位】：东华大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【参考文献】