Dynamic alarm knowledge base creating method and system based on alarm management

Abstract

The invention discloses a dynamic alarm knowledge base creation method based on alarm management, which comprises the following steps: S1, carrying out alarm-to-knowledge point data conversion on the basis of experience of an engineer in processing alarm items to form an engineer knowledge base which is used for forming think tank management under unified management and control; s2, based on alarm data acquisition and processing of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, information corresponding to alarm data is created into an alarm fault knowledge base; and S3, the engineer knowledge base and the alarm fault knowledge base are subjected to association and information integration, so that a dynamic alarm knowledge base is formed, and the dynamic alarm knowledge base is used for providing guidance and support for fault processing. And an engineer is assisted to quickly position and solve one or more problems in various heterogeneous monitoring systems, heterogeneous monitoring equipment and heterogeneous monitoring servers. The invention also discloses a corresponding system, electronic equipment and a readable storage medium.

Description

Technical Field

[0001] The present invention relates to the technical field of IT system, network system and industrial control system alarms and alarm monitoring, management and response, and in particular to a method and system for creating a dynamic alarm knowledge base based on alarm management. Background Art

[0002] Due to the continuous improvement of informatization and automation, especially in the fields of IT systems, network systems and industrial control systems, as the complexity and scale of these systems increase, how to effectively monitor, manage and respond to various alarms in the system has become an urgent problem that needs to be solved.

[0003] Secondly, with the development of emerging technologies such as cloud computing, big data, and the Internet of Things, system architectures have become increasingly complex, and cross-platform, cross-network, and cross-device alarms are becoming increasingly frequent. These alarms are not only massive in number, but also come from a wide range of sources and types, requiring alarm management systems to possess powerful processing capabilities to uniformly collect, analyze, and process this information. As system complexity and scale continue to grow, relying solely on individual engineers' experience and knowledge is no longer sufficient to meet alarm processing needs. Summary of the Invention

[0004] In order to solve the problems existing in the prior art, the present invention provides a method and system for creating a dynamic alarm knowledge base based on alarm management, which is used to realize alarm conversion into knowledge points for alarm management based on alarm management. On the one hand, based on the alarm management system, each processing method, processing means and related knowledge used by engineers in handling alarm matters are directly converted into knowledge points to form an engineer knowledge base, forming a think tank management under unified management and control; on the other hand, based on the collection and integration of alarm data, the alarm content is converted into text, and new think tank knowledge points are stored or generated to establish an alarm fault knowledge base, and the fault handling experience and recovery solutions accumulated in daily operation and maintenance work are sorted and summarized. Thus, guidance and support for fault handling are provided in two aspects at the same time, helping engineers to quickly locate and solve problems.

[0005] In one aspect, the present invention provides a method for creating a dynamic alarm knowledge base based on alarm management, comprising:

[0006] S1, based on the experience of engineers in handling alarms, convert alarms into knowledge points to form an engineer knowledge base, which is used to form a think tank management under unified management;

[0007] S2, based on the alarm data collection and processing of multiple heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, the information corresponding to the alarm data is created into an alarm fault knowledge base;

[0008] S3, associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base, which is used to provide guidance and support for fault handling and assist engineers in quickly locating and solving one or more problems in multiple heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0009] Preferably, the S1 includes:

[0010] S11, collecting process data of multiple engineers handling alarm matters, wherein the process data includes each handling method, handling means, and relevant knowledge of the application;

[0011] S12, converting the process data into different alarm knowledge point data according to the data type;

[0012] S13, integrating the different alarm knowledge point data to form an engineer knowledge base that can be upgraded and updated.

[0013] Preferably, the S2 includes:

[0014] S21, collecting multi-source alarm information data from one or more of a plurality of heterogeneous monitoring systems, heterogeneous monitoring devices, and heterogeneous monitoring servers, and performing data processing on the alarm information;

[0015] S22, receiving, recording and storing the currently processed alarm information, and being able to store and record historical alarm information;

[0016] S23, modularize, convert and uniformly review the received alarm information, store or generate new think tank knowledge points, and establish an alarm fault knowledge base based on the new think tank knowledge points.

[0017] Preferably, the S21 includes:

[0018] (1) Collect multi-source alarm information from various heterogeneous monitoring systems, devices, and servers; wherein, the collection includes: using agent or agentless methods to perform single alarm information collection or multi-dimensional collection.

[0019] (2) Data integration and data standardization processing of the alarm information are performed among the various heterogeneous monitoring systems, devices and servers based on a unified interface or protocol.

[0020] Preferably, modular division of the received alarm information is implemented by adopting a modular design concept, and the alarm management system is divided into different functional modules according to the method and case of processing alarms, so as to facilitate the management and expansion of new think tank knowledge points.

[0021] Preferably, the S23 includes:

[0022] (1) performing alarm filtering on the received alarm information based on filtering rules, thereby removing useless information and retaining only meaningful alarm information, and formulating the filtering rules according to the business scenario in the case of the alarm filtering;

[0023] (2) The alarms filtered by the alarms are uniformly managed in a list format, and the filtered alarm information is analyzed based on unified analysis and causal analysis technology.

[0024] Preferably, the process of storing or generating new think tank knowledge points after text conversion and unified review includes:

[0025] (1) View and extract knowledge points that have not been converted into text through the primary think tank;

[0026] (2) generating knowledge points from knowledge points that have not been converted into text using the text generation method and then conducting knowledge point review;

[0027] (3) Determine the alarm trigger source based on the reviewed knowledge points and perform alarm detection, process the detected alarm data, and build an alarm rule engine;

[0028] (4) Performing alarm processing based on the alarm rule engine and the alarm data that has been processed.

[0029] A second aspect of the present invention provides a dynamic alarm knowledge base creation system based on alarm management, which is used to implement the method of the first aspect, including:

[0030] An engineer knowledge base establishment module (101) is used to convert alarms into knowledge point data based on the experience of engineers in handling alarms to form an engineer knowledge base, and the engineer knowledge base is used to form a think tank management under unified management and control;

[0031] An alarm fault knowledge base establishment module (102) is used to collect and process alarm data from a variety of heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers to create information corresponding to the alarm data into an alarm fault knowledge base;

[0032] A dynamic alarm knowledge base establishment module (103) is used to associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and assist engineers in quickly locating and solving one or more problems in a variety of heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0033] A third aspect of the present invention provides an electronic device, comprising a processor and a memory, wherein the memory stores a plurality of instructions, and the processor is configured to read the instructions and execute the method described in the first aspect.

[0034] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a plurality of instructions, and the plurality of instructions can be read by a processor to execute the method described in the first aspect.

[0035] The method, system, and electronic device provided by the present invention have the following beneficial effects:

[0036] (1) Through the unified management platform, the alarm information scattered in different monitoring systems can be effectively gathered together to avoid the problem of scattered and non-standard alarm information.

[0037] (2) The unified management and development of alarm processing knowledge points can reduce the complexity and pressure of the work of operation and maintenance personnel, and reduce the occurrence of false alarms, missed alarms and repeated alarms.

[0038] (3) The unified management platform can provide more comprehensive alarm information, including alarm source, level, time, content, etc., so that operation and maintenance personnel can have a more comprehensive understanding of the system status.

[0039] (4) View the alarm details to obtain detailed information about the relevant alarm devices, obtain the alarm level and content from the corresponding monitoring items and triggers, and synchronize them to the think tank by submitting the processing method when processing the alarm.

[0040] (5) By integrating the alarm data from different monitoring systems, a more complete alarm view can be formed, which helps operation and maintenance personnel to quickly locate problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flow chart of a method for creating a dynamic alarm knowledge base based on alarm management according to an embodiment of the present invention;

[0042] Figure 2 A flowchart of a method for collecting and processing alarm data based on multiple heterogeneous monitoring systems, heterogeneous monitoring devices, and heterogeneous monitoring servers to create an alarm fault knowledge base based on information corresponding to the alarm data according to an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of an interface divided into different functional modules according to an embodiment of the present invention;

[0044] Figure 4 Schematic diagram of an alarm filtering interface according to an embodiment of the present invention;

[0045] Figure 5Schematic diagram of an interface for analyzing filtered alarm information based on unified analysis, causal analysis, and other technologies according to an embodiment of the present invention;

[0046] Figure 6 A flowchart showing the principle of a method for converting text and storing or generating new think tank knowledge points after unified review according to an embodiment of the present invention;

[0047] Figure 7 Creating a system architecture diagram for a dynamic alarm knowledge base based on alarm management according to an embodiment of the present invention;

[0048] Figure 8 FIG. 2 is a schematic structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to better understand the above technical solution, the above technical solution will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0050] Example 1

[0051] like Figure 1 As shown, this embodiment provides a method for creating a dynamic alarm knowledge base based on alarm management, including:

[0052] S1, based on the experience of engineers in handling alarms, convert alarms into knowledge points to form an engineer knowledge base, which is used to form a think tank management under unified management;

[0053] As a preferred embodiment, the S1 includes:

[0054] S11, collecting process data of multiple engineers handling alarm matters, wherein the process data includes each handling method, handling means, and relevant knowledge of the application;

[0055] S12, converting the process data into different alarm knowledge point data according to the data type;

[0056] S13, integrating the different alarm knowledge point data to form an upgradeable engineer knowledge base

[0057] like Figure 2 As shown, S2, based on the alarm data collection and processing of multiple heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, the information corresponding to the alarm data is created into an alarm fault knowledge base.

[0058] As a preferred embodiment, the S2 includes:

[0059] S21, collecting multi-source alarm information data from one or more of a plurality of heterogeneous monitoring systems, heterogeneous monitoring devices, and heterogeneous monitoring servers, and performing data processing on the alarm information;

[0060] In this embodiment, the S21 includes:

[0061] (1) Collect multi-source alarm information from various heterogeneous monitoring systems, devices, and servers (such as Prometheus, Grafana, Zabbix, etc.); wherein, the collection includes: using agent or agentless methods to perform single alarm information collection or multi-dimensional collection.

[0062] (2) Based on a unified interface or protocol (such as REST API, Webhooks, etc.), data integration and data standardization processing of the alarm information are performed between the various heterogeneous monitoring systems, devices and servers.

[0063] S22, receiving, recording and storing the currently processed alarm information, and being able to store and record the historical alarm information.

[0064] In this embodiment, the method supports the storage and query of historical alarm information. Administrators can view historical alarm records and apply for alarm trend analysis charts through the query interface.

[0065] S23, modularize, convert text and uniformly review the received alarm information, store or generate new think tank knowledge points, and establish an alarm fault knowledge base based on the new think tank knowledge points. The alarm fault knowledge base is used to organize and summarize the fault handling experience and recovery solutions accumulated in daily operation and maintenance work.

[0066] like Figure 3 As shown, as a preferred implementation method, modular division of the received alarm information is essentially realized by adopting a modular design concept, dividing the alarm management system into different functional modules according to the method and case of processing alarms, so as to facilitate the management and expansion of new think tank knowledge points.

[0067] As a preferred embodiment, the S23 includes:

[0068] (1) Figure 4 As shown, the received alarm information is filtered based on filtering rules, thereby removing useless information and retaining only meaningful alarm information. In the case of alarm filtering, the filtering rules are formulated according to the business scenario to ensure that the filtered information will not affect the business.

[0069] (2) Figure 5As shown, the alarms after the alarm filtering are uniformly managed in a list form, and the filtered alarm information is analyzed based on unified analysis, cause-effect analysis and other technologies.

[0070] like Figure 6 As shown, as a preferred embodiment, the process of storing or generating new think tank knowledge points after text conversion and unified review includes:

[0071] (1) View and extract knowledge points that have not been converted into text through the primary think tank;

[0072] (2) generating knowledge points from knowledge points that have not been converted into text using the text generation method and then conducting knowledge point review;

[0073] (3) Determine the alarm trigger source based on the reviewed knowledge points and perform alarm detection, process the detected alarm data, and build an alarm rule engine;

[0074] (4) Performing alarm processing based on the alarm rule engine and the alarm data that has been processed.

[0075] S3, associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base, which is used to provide guidance and support for fault handling and assist engineers in quickly locating and solving one or more problems in multiple heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0076] Example 2

[0077] like Figure 7 As shown, this embodiment provides a dynamic alarm knowledge base creation system based on alarm management, which is used to implement the method of embodiment 1, including:

[0078] The engineer knowledge base establishment module 101 is used to convert alarms into knowledge points based on the experience of engineers in handling alarms to form an engineer knowledge base. The engineer knowledge base is used to form a think tank management under unified management and control;

[0079] An alarm fault knowledge base building module 102 is configured to collect and process alarm data from a variety of heterogeneous monitoring systems, heterogeneous monitoring devices, and heterogeneous monitoring servers to create an alarm fault knowledge base based on the information corresponding to the alarm data;

[0080] The dynamic alarm knowledge base establishment module 103 is used to associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and assist engineers in quickly locating and solving one or more problems in multiple heterogeneous monitoring systems, heterogeneous monitoring equipment and heterogeneous monitoring servers.

[0081] The present invention also provides a memory storing a plurality of instructions, wherein the instructions are used to implement the method as in the first embodiment.

[0082] like Figure 8 As shown, the present invention also provides an electronic device, including a processor 301 and a memory 302 connected to the processor 301, the memory 302 stores multiple instructions, and the instructions can be loaded and executed by the processor to enable the processor to execute the method as in embodiment 1.

[0083] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the invention. Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the invention. Thus, the present invention is intended to include such changes and modifications as fall within the scope of the claims and their equivalents.

Claims

1. A method for creating a dynamic alarm knowledge base based on alarm management, characterized in that: include: S1, based on the experience of engineers in handling alarms, convert alarms into knowledge points to form an engineer knowledge base, which is used to form a think tank management under unified management; S2, based on the alarm data collection and processing of multiple heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, the information corresponding to the alarm data is created into an alarm fault knowledge base; S3, associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base, which is used to provide guidance and support for fault handling and assist engineers in quickly locating and solving one or more problems in multiple heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

2. A method for creating a dynamic alarm knowledge base based on alarm management according to claim 1, characterized in that: Said S1 comprises: S11, collecting process data of multiple engineers handling alarm matters, wherein the process data includes each handling method, handling means, and relevant knowledge of the application; S12, converting the process data into different alarm knowledge point data according to the data type; S13, integrating the different alarm knowledge point data to form an engineer knowledge base that can be upgraded and updated.

3. A method for creating a dynamic alarm knowledge base based on alarm management according to claim 2, characterized in that: The S2 includes: S21, collecting multi-source alarm information data from one or more of a plurality of heterogeneous monitoring systems, heterogeneous monitoring devices, and heterogeneous monitoring servers, and performing data processing on the alarm information; S22, receiving, recording and storing the currently processed alarm information, and being able to store and record historical alarm information; S23, modularize, convert and uniformly review the received alarm information, store or generate new think tank knowledge points, and establish an alarm fault knowledge base based on the new think tank knowledge points.

4. A method for creating a dynamic alarm knowledge base based on alarm management according to claim 3, characterized in that: The S21 includes: (1) Collect multi-source alarm information from various heterogeneous monitoring systems, devices, and servers; wherein, the collection includes: using agent or agentless methods to perform single alarm information collection or multi-dimensional collection. (2) Data integration and data standardization processing of the alarm information are performed among the various heterogeneous monitoring systems, devices and servers based on a unified interface or protocol.

5. A method for creating a dynamic alarm knowledge base based on alarm management according to claim 4, characterized in that: The modular division of the received alarm information is implemented by adopting a modular design concept, and the alarm management system is divided into multiple functional modules according to the alarm processing method and case, so as to facilitate the management and expansion of new think tank knowledge points.

6. A method for creating a dynamic alarm knowledge base based on alarm management according to claim 5, characterized in that: The S23 includes: (1) performing alarm filtering on the received alarm information based on filtering rules, thereby removing useless information and retaining only meaningful alarm information, and formulating the filtering rules according to the business scenario in the case of the alarm filtering; (2) The alarms filtered by the alarms are uniformly managed in a list format, and the filtered alarm information is analyzed based on unified analysis and causal analysis technology.

7. A method for creating a dynamic alarm knowledge base based on alarm management according to claim 6, characterized in that: The process of converting the text and storing or generating new think tank knowledge points after unified review includes: (1) View and extract knowledge points that have not been converted into text through the primary think tank; (2) generating knowledge points from knowledge points that have not been converted into text using the text generation method and then conducting knowledge point review; (3) Determine the alarm trigger source based on the reviewed knowledge points and perform alarm detection, process the detected alarm data, and build an alarm rule engine; (4) Performing alarm processing based on the alarm rule engine and the alarm data that has been processed.

8. A dynamic alarm knowledge base creation system based on alarm management, used to implement the method according to any one of claims 1 to 7, characterized in that: include: An engineer knowledge base establishment module (101) is used to convert alarms into knowledge point data based on the experience of engineers in handling alarms to form an engineer knowledge base, and the engineer knowledge base is used to form a think tank management under unified management and control; An alarm fault knowledge base establishment module (102) is used to collect and process alarm data from a variety of heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers to create information corresponding to the alarm data into an alarm fault knowledge base; A dynamic alarm knowledge base establishment module (103) is used to associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and assist engineers in quickly locating and solving one or more problems in a variety of heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a plurality of instructions, and the processor is configured to read the instructions and execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the plurality of instructions can be read by a processor to execute the method according to any one of claims 1 to 7.

Images