Alarm aggregation method and device, equipment and storage medium

Abstract

The invention provides an alarm aggregation method and device, equipment and a storage medium. The method comprises the steps that for each alarm event, an alarm time sequence sub-graph in each alarm accompanying time period where the alarm event is located is intercepted from a formed alarm time sequence picture, and the alarm time sequence picture is formed by distributing all the alarm events according to a time sequence; for each alarm event, determining an alarm association relationship under the alarm event according to an accompanying alarm hotspot after the alarm time sequence sub-graphs are superposed in each alarm accompanying time period where the alarm event is located; and according to the alarm association relationship under each alarm event, carrying out alarm aggregation on each alarm event. The alarm association relationship under each alarm event is determined from the perspective of global accompanying alarm, comprehensive detection of the alarm association relationship is realized, the comprehensiveness of alarm event aggregation is ensured, the alarm frequency in a service system is further reduced, and alarm storm is avoided.

Description

technical field [0001] The embodiments of the present application relate to the technical field of alarm processing, and in particular to an alarm aggregation method, device, device, and storage medium. Background technique [0002] With the rapid development of Internet technology, the scale and complexity of various business systems are also gradually increasing, making the detection requirements for alarm events in business systems are also getting higher and higher. In order to comprehensively detect and detect alarm events in the business system, a variety of alarm detection conditions are usually defined to detect whether there are alarm events from multiple dimensions. However, an abnormal point in the business system may trigger the generation of alarm events in multiple dimensions, and then generate an alarm storm, resulting in the fact that the alarm event becomes invalid. Therefore, in order to avoid an alarm storm in the business system, it is necessary to aggre...

AI Technical Summary

Problems solved by technology

[0004] However, the multivariate correlations that actually exist between multiple alarm events in the business system cannot be constructed from multiple binary correlations. The alarm event E means "the main service is unavailable", and the alarm event C means " Replica service is unavailable" and the alarm event D indicates "business service offline" as examples, E and C can jointly deduce D, indicating that there is a ternary relationship among E, C, and D. However, E or C and D cannot be deduced, indicating that there is no binary relationship between E and D or C and D, then the ternary relationship between E, C, and D cannot be constructed using the existing method

Moreover, it is common that the multivariate associations that actually exist between alarm events in the business system cannot be constructed from the corresponding binary associations. Therefore, the existing aggregation alarms cannot realize the comprehensive aggregation of alarm events in the business system. There is a problem with too many alarms

Images