Alarm information aggregation method and device, monitoring system and storage medium

Abstract

Embodiments of the present application are suitable for base frame operation and maintenance technical field, and provide an alarm information aggregation method and device, a monitoring system and a storage medium, wherein the alarm information aggregation method is applied to the monitoring system, and the method comprises the following steps: acquiring alarm information generated when a system abnormity occurs; the alarm information comprises attribute values corresponding to a plurality of alarm attributes respectively; the alarm information is decomposed step by step according to the plurality of alarm attributes to update an aggregation tree; the aggregation tree comprises a plurality of sub-nodes, and each sub-node corresponds to an attribute value; for any current end sub-node, if the current end sub-node and other end sub-nodes are sibling nodes, then the alarm information corresponding to the current end sub-node and the other end sub-nodes is aggregated to obtain aggregation information; and the aggregation information is sent to a user terminal of a staff. By using the above method, the sending cost of the monitoring system for sending alarm information can be reduced.

Description

Technical Field

[0001] This application belongs to the field of infrastructure maintenance technology, and in particular relates to an alarm information aggregation method, device, monitoring system and storage medium. Background Technology

[0002] A cluster system is a system that connects multiple machines to simultaneously handle complex computational problems, providing uninterrupted service for many applications. For complex cluster systems, such as virtual machine clusters used in cloud computing, a corresponding monitoring system is typically required to monitor the operation of each virtual machine in real time. Typically, when the monitoring system detects an anomaly in a virtual machine, it will generate an alarm message and send it to the operations and maintenance personnel.

[0003] However, in existing technologies, generated alarm information often contains a large amount of redundancy, especially when a virtual machine cluster system generates a large number of alarms in a short period of time. The monitoring system then sends each alarm to the operations and maintenance personnel. This not only causes operations and maintenance personnel to spend a significant amount of time reading through a large volume of alarm information, but also increases the cost of sending alarms to the monitoring system. Summary of the Invention

[0004] This application provides an alarm information aggregation method, apparatus, monitoring system, and storage medium, which can solve the problem of high transmission costs when the monitoring system sends alarm information.

[0005] In a first aspect, embodiments of this application provide an alarm information aggregation method applied to a monitoring system, the method comprising:

[0006] Retrieve alarm information generated when system anomalies occur; the alarm information includes the attribute values ​​corresponding to multiple alarm attributes;

[0007] The alarm information is decomposed level by level according to multiple alarm attributes in order to update the aggregation tree; the aggregation tree includes multiple child nodes, each child node corresponds to the attribute value of an alarm attribute.

[0008] For any current end child node, if the current end child node is a sibling node with other end child nodes, then the alarm information corresponding to the current end child node and other end child nodes is aggregated to obtain aggregated information;

[0009] Send aggregated information to staff user terminals.

[0010] Secondly, embodiments of this application provide an alarm information aggregation device applied to a monitoring system, the device comprising:

[0011] The acquisition module is used to acquire alarm information generated when system anomalies occur; the alarm information includes the attribute values ​​corresponding to multiple alarm attributes;

[0012] The update module is used to decompose alarm information step by step according to multiple alarm attributes in order to update the aggregation tree; the aggregation tree includes multiple child nodes, each child node corresponds to the attribute value of an alarm attribute.

[0013] The aggregation module is used to aggregate the alarm information corresponding to any current end child node and other end child nodes if the current end child node is a sibling node, to obtain aggregated information.

[0014] The sending module is used to send aggregated information to the user terminals of staff.

[0015] Thirdly, embodiments of this application provide a monitoring system, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect above.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the method described in the first aspect above.

[0017] Fifthly, embodiments of this application provide a computer program product that, when run on a monitoring system, causes the monitoring system to execute the method described in the first aspect.

[0018] The beneficial effects of this application's embodiments compared to existing technologies are as follows: For alarm information generated when a system anomaly occurs, the monitoring system can decompose the alarm information level by level according to the alarm attributes to generate an aggregation tree. Then, the monitoring system can aggregate the alarm information corresponding to each terminal child node belonging to the same parent node in the aggregation tree to obtain a single aggregated message. Therefore, the monitoring system does not need to store and send each alarm message separately; it only needs to send one aggregated message. Furthermore, the monitoring system can achieve significant information compression while retaining all alarm information and avoiding information loss, thus reducing the cost of sending a large number of alarm messages. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the implementation of an alarm information aggregation method according to an embodiment of this application;

[0021] Figure 2 This is a flowchart illustrating the implementation of an alarm information aggregation method according to another embodiment of this application;

[0022] Figure 3 This is a schematic diagram of the aggregation tree structure in an alarm information aggregation method provided in an embodiment of this application;

[0023] Figure 4 This is a schematic diagram illustrating an implementation of S103 of an alarm information aggregation method provided in an embodiment of this application;

[0024] Figure 5 This is a schematic diagram illustrating an implementation of S102 of an alarm information aggregation method provided in an embodiment of this application;

[0025] Figure 6 This is a schematic diagram illustrating an implementation of S2 of an alarm information aggregation method provided in an embodiment of this application;

[0026] Figure 7 This is a schematic diagram illustrating an implementation of S104 of an alarm information aggregation method provided in an embodiment of this application;

[0027] Figure 8 This is a schematic diagram of the structure of an alarm information aggregation device provided in one embodiment of this application;

[0028] Figure 9 This is a schematic diagram of the structure of a monitoring system provided in one embodiment of this application. Detailed Implementation

[0029] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0030] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0031] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0032] Please see Figure 1 , Figure 1 The following is a flowchart illustrating the implementation of an alarm information aggregation method provided in an embodiment of this application. The method includes the following steps:

[0033] S101. The monitoring system acquires alarm information generated when an anomaly occurs in the system; the alarm information includes the attribute values ​​corresponding to multiple alarm attributes.

[0034] In one embodiment, the aforementioned system includes, but is not limited to, centralized cluster systems, unbalanced load systems, and virtualized cluster systems. For example, the system may be a virtualized cluster system utilizing cloud computing capabilities, comprising multiple virtual machine devices for operation. The execution entity performing the steps in S101-S104 may be a monitoring system for real-time monitoring of the entire virtualized cluster system's operation. This monitoring system primarily generates alarm information and sends it to the terminals used by staff when system anomalies are detected.

[0035] In one embodiment, the aforementioned multiple alarm attributes include, but are not limited to, alarm source, alarm type, alarm level, application name, IP address, text description information, alarm time, and event identifier. The alarm source is the monitoring platform that detected the anomaly. Specifically, the monitoring system typically includes two monitoring platforms. For example, it includes a monitoring platform for monitoring the resource usage of each virtual machine device in the virtualization cluster system, and a platform for monitoring the access volume of each virtual machine device in the virtualization cluster system, and / or whether access requests have timed out.

[0036] In one embodiment, the alarm level is used to identify the urgency of the alarm information, and it can be divided according to the level rules preset by the staff. The alarm level can be divided into three categories: A, B, and C. The urgency level is A>B>C.

[0037] In one embodiment, the application name is the name of the application that experienced the anomaly. The IP address is the IP address of the virtual machine device where the application experienced the anomaly resides. The text description information describes the anomaly and can be generated by the virtualization cluster system based on a pre-configured alarm template. The alarm time is the time when the anomaly occurred. The event identifier can be the event identifier corresponding to the alarm information, which has unique identification and can be identified by the virtualization cluster system.

[0038] In one embodiment, when the aforementioned alarm information is obtained, the alarm information generated due to system anomalies typically contains a large amount of redundant information. That is, it includes not only the aforementioned multiple alarm attributes, but also many other unnecessary alarm attributes. In this case, the monitoring system can further parse and standardize the obtained alarm information. That is, the alarm source, alarm type, alarm level, application name, IP address, and text description information are treated as multiple alarm attributes, while the attribute values ​​corresponding to other unnecessary alarm attributes in the alarm information are deleted.

[0039] In one embodiment, the aforementioned attribute values ​​are information values ​​that specifically describe the alarm information. For example, the alarm source attribute of the alarm information can have the attribute value of alarm source 1; and for the application name attribute, its attribute value can be the application name corresponding to the application where the anomaly occurred, etc.

[0040] In one embodiment, each alarm message has a unique event identifier; alarm attributes also include new alarm and alarm recovery; refer to Figure 2 After obtaining the alarm information generated when a system anomaly occurs in step S101, the following steps S11-S12 are also included to process the generated alarm information:

[0041] S11. If the alarm information is a newly added alarm, and the alarm information with the same event identifier has not been received within the preset time period, and the alarm information is an alarm recovery, then the monitoring system will decompose the alarm information that is a newly added alarm step by step.

[0042] S12. If the alarm information is a newly added alarm, and other alarm information with the same event identifier received within a preset time period and which is an alarm recovery, the monitoring system will delete the alarm information and the other alarm information.

[0043] In one embodiment, the event identifier has already been explained in S101 and will not be repeated here. It should be noted that alarm information is generally divided into new alarms and alarm recovery. It is understood that some anomalies exist in the virtualization cluster system, which can be quickly recovered within a certain time. Therefore, the virtualization cluster system will generate two types of alarm information within a certain time, and both types of alarm information are for the same anomaly. Therefore, the event identifiers of these two types of alarm information are the same, and they are respectively "new alarm" and "alarm recovery," with a small difference in alarm time.

[0044] In this scenario, if the interval between the two alarm messages is short enough and has no actual impact on the operation of the virtualized cluster system, the two alarm messages can be considered to cancel each other out. That is, both the alarm message and the new alarm message can be deleted.

[0045] Understandably, if no alarm information with the same event identifier and which is an alarm recovery is received within a preset time period, the alarm information of the newly generated alarm can be inserted into the aggregation tree, or the alarm information can be decomposed level by level with multiple existing alarm information in the aggregation tree to generate a new aggregation tree.

[0046] The aforementioned preset time period can be set by staff according to the actual situation.

[0047] It should be added that for each new alarm message generated, it needs to be compared with multiple existing alarm messages in the aggregation tree. If any of the existing alarm messages contain the same attribute values ​​as the new alarm message, then the new alarm message can be deleted. This reduces the number of alarm messages that the monitoring system needs to process.

[0048] S102. The monitoring system decomposes alarm information step by step according to multiple alarm attributes in order to update the aggregation tree; the aggregation tree includes multiple child nodes, and each child node corresponds to the attribute value of an alarm attribute.

[0049] In one embodiment, the aforementioned aggregation tree is a tree diagram built based on multiple alarm attributes. Each child node in the aggregation tree corresponds to an attribute value of an alarm attribute. In the tree path from the root node to any terminal child node in the aggregation tree, each child node in the path corresponds to the attribute value of each alarm attribute contained in the alarm information.

[0050] For example, with Figure 3 For example, Figure 3 This is a schematic diagram of a composite tree structure. Figure 3 The root node is not shown. The attribute for the alarm source can be the next child node of the root node. That is, multiple alarm messages are first segmented by the alarm attribute of the alarm source, which can be divided into child nodes of alarm source 1, child nodes of alarm source 2, ..., child nodes of alarm source N. Then, for alarm messages belonging to alarm source 1, they are again segmented by the application name as the alarm attribute; similarly, they can be divided into child nodes of application name 1, up to child nodes of application name N. This segmentation is repeated for the alarm messages contained under each child node using other alarm attributes. Finally, for alarm messages segmented by IP address as the alarm attribute, they are specifically divided into alarm messages corresponding to IP address 1, IP address 2, IP address 3, IP address 4, IP address 5, etc.

[0051] Based on this, it is understandable that the above Figure 3The attribute values ​​of alarm attributes such as alarm source 1 and application name 1 can all be child nodes in the aggregation tree. The IP address 1, IP address 2, IP address 3, IP address 4, and IP address 5 mentioned above can be considered as the terminal child nodes in the aggregation tree. At this time, the attribute values ​​corresponding to the child nodes from the root node to IP address 1 are the attribute values ​​of all alarm attributes included in a certain alarm information.

[0052] Updating the aggregation tree can be achieved by inserting alarm information into the aggregation tree based on each child node in the aggregation tree, thereby generating new terminal child nodes.

[0053] S103. For any current end child node, if the current end child node is a sibling node to other end child nodes, the monitoring system will aggregate the alarm information corresponding to the current end child node and other end child nodes to obtain aggregated information.

[0054] In one embodiment, if the previous child node contains the current terminal child node and other terminal child nodes, then the other terminal child nodes can be considered sibling nodes of the current terminal child node. That is, the current terminal child node and other terminal child nodes share the same parent node, as shown below. Figure 3 It can be seen that if the current end child node is IP address 1, then IP address 2, IP address 3, IP address 4, and IP address 5 should all be sibling nodes of IP address 1.

[0055] Additionally, it's understandable that the alarm information corresponding to IP address 1 should differ from the alarm information corresponding to other sibling nodes only in the attribute value corresponding to the IP address. That is, the attribute values ​​corresponding to all other alarm attributes must be identical. For example, they should all belong to alarm source 1, and they should all be alarm information generated by application name 1, etc.

[0056] At this point, for the alarm information corresponding to the current end child node and its sibling nodes, the monitoring system does not need to send each alarm information to the user terminal individually. Instead, it can aggregate the multiple alarm information into a single aggregated message before sending it. This reduces the number of times the monitoring system sends messages and achieves significant information compression while retaining all information and avoiding data loss.

[0057] Specifically, the aggregation tree includes the root node; see reference. Figure 4 The monitoring system can aggregate alarm information through the following steps S1031-S1033 to obtain aggregated information:

[0058] S1031, The monitoring system determines the attribute values ​​of the alarm attributes corresponding to each child node between the root node and the previous child node; the previous child node is the parent node of the current end child node.

[0059] S1032. The monitoring system generates a set of attribute values ​​for the alarm attributes corresponding to the current end child node and other end child nodes respectively.

[0060] In one embodiment, the process of the monitoring system aggregating the attribute values ​​of the alarm attributes corresponding to the current end child node and other end child nodes can be as follows: storing the attribute values ​​corresponding to each end child node in the form of a set or list to generate a set of attribute values ​​for the corresponding alarm attributes.

[0061] For example, with Figure 3 For example, the alarm attribute corresponding to the end child node is a list of IP addresses. Based on this, its corresponding attribute value set can be: IP address list = [IP1, IP2, IP3, IP4, IP5]. That is, the monitoring system can simultaneously record 5 attribute values ​​of the alarm attribute in the form of an IP address list.

[0062] S1033. The monitoring system maintains the attribute values ​​of the alarm attributes corresponding to each child node in the alarm information unchanged according to any alarm information; and replaces the attribute value set of the alarm attributes corresponding to the end child node in the alarm information to obtain aggregate information.

[0063] In one embodiment, as explained in S103 above, the current terminal child node and other terminal child nodes are sibling nodes, sharing a parent node. Based on this, it can be assumed that the attribute values ​​of each alarm attribute corresponding to the root node and its parent node are the same in each terminal child node. Therefore, the monitoring system can determine and store the attribute values ​​of each alarm attribute corresponding to the root node and its parent node as the same unique attribute value. That is, the monitoring system can use the attribute values ​​of the alarm attributes corresponding to the root node and its parent node in any alarm information.

[0064] For example, with Figure 3 For example, there are 5 alarm messages in the aggregation tree. Except for the alarm attribute of IP address, the attribute values ​​of all other alarm attributes (alarm source, application name, ...) are the same. Therefore, these 5 alarm messages can be aggregated into the following aggregate information: Alarm source = source1, application name = application1, ..., IP address list = [IP1, IP2, IP3, IP4, IP5].

[0065] S104. The monitoring system sends aggregated information to the staff's user terminals.

[0066] In one embodiment, as explained in S1033, when aggregating the alarm information corresponding to the current end child node and other end child nodes, only the attribute values ​​of the alarm attributes corresponding to the root node to the parent node in one alarm message need to be used. Then, the attribute values ​​corresponding to each end child node are stored in the form of a set or list to generate the corresponding alarm attribute attribute value set.

[0067] In one embodiment, because the unique attribute values ​​are recorded in a list when multiple alarm messages are aggregated, the pressure and time cost of reading a large number of alarm messages for staff are reduced, and the cost of sending a large number of alarm messages is also reduced.

[0068] At this point, for alarm information generated when a system anomaly occurs, the monitoring system can decompose the alarm information level by level according to the alarm attributes to generate an aggregation tree. Then, the monitoring system can aggregate the alarm information corresponding to each terminal child node belonging to the same parent node in the aggregation tree, resulting in a single aggregated message. In this way, the monitoring system does not need to store and send each alarm message separately; it only needs to send a single aggregated message. Furthermore, the monitoring system can achieve significant information compression while retaining all alarm information and avoiding information loss, thus reducing the cost of sending a large number of alarm messages.

[0069] In one embodiment, each alarm message has a unique event identifier; alarm attributes also include new alarm and alarm recovery; refer to Figure 5 In S102, alarm information is decomposed level by level according to multiple alarm attributes to update the aggregation tree. This can be achieved through the following sub-steps S1-S5:

[0070] S1. The monitoring system initializes the root node. The root node includes a set of alarm information consisting of multiple alarm messages and a set of alarm attributes consisting of multiple alarm attributes.

[0071] S2. The monitoring system determines the best attribute from the alarm attribute set based on the attribute values ​​corresponding to multiple alarm attributes.

[0072] In one embodiment, the aforementioned initialization of the root node involves: initializing all alarm information existing in the monitoring system at this time, generating an alarm information set consisting of multiple alarm information items, and an alarm attribute set consisting of multiple alarm attributes contained in each of the multiple alarm information items. Afterwards, the monitoring system can determine the optimal attribute from the multiple alarm attributes, that is, determine the next child node after the initialized root node.

[0073] It should be added that if alarms are randomly grouped based on their attributes, the resulting aggregated tree structure may be too complex, hindering subsequent lossless compression of the alarm information within the aggregated tree. In other words, it cannot achieve...

[0074] Therefore, refer to Figure 6 The monitoring system also needs to determine the optimal attribute from the alarm attribute set through the following steps S21-S24:

[0075] S21. For any current alarm attribute, the monitoring system determines the multiple attribute values ​​included in the current alarm attribute.

[0076] S22. The monitoring system counts the number of alarm messages corresponding to each attribute value.

[0077] In one embodiment, taking the alarm attributes described in S101 above, such as alarm source, alarm type, alarm level, application name, IP address, and text description information, as an example, the aforementioned current alarm information is the alarm information currently being processed among the six alarm information. Multiple attribute values ​​are the attribute values ​​included in the current alarm attribute when grouped by the current alarm attribute. That is, if the current alarm attribute is an information source, its attribute values ​​can be multiple, such as alarm source 1, ..., alarm source N. Then, for each set of alarm information corresponding to each attribute value, the monitoring system can count the number of alarm information belonging to that set.

[0078] S23. The monitoring system calculates the information entropy of the current alarm attribute based on the quantity and the total number of alarm messages. The information entropy is used to measure the degree of aggregation when grouping multiple alarm messages by the current alarm attribute.

[0079] S24. The monitoring system determines the current alarm attribute corresponding to the minimum value in the information entropy as the best attribute.

[0080] In one embodiment, the monitoring system can calculate the information entropy of the current alarm attribute through the following steps: for any current attribute value in the current alarm attribute, calculate the ratio of the number of alarm messages corresponding to the current attribute value to the total number, and obtain the probability that the attribute value in any alarm message is the current attribute value; calculate the initial information entropy of the current attribute value based on the probability; sum the initial information entropy corresponding to each current attribute value in the current alarm attribute to obtain the information entropy of the current alarm attribute.

[0081] The initial information entropy for calculating the current attribute value based on probability can be achieved by multiplying the probability by its logarithm and using the negative of this product as the initial information entropy for the current alarm attribute value. Specifically, the monitoring system can use the minimum information entropy calculation formula to calculate the information entropy representing the current alarm attribute by considering both the quantity and the total number of alarm messages. The specific formula for calculating the minimum information entropy is as follows:

[0082]

[0083]

[0084] in, H(S) is the j-th child node at level i in the aggregation tree; ij a) is the information entropy of alarm attribute a in the alarm information set S; P(a=a) k ) represents the probability that the alarm information belongs to the k-th attribute value in alarm attribute a.

[0085] Specifically, the monitoring system recursively decomposes the alarm information set layer by layer, defining the root node as level 0. The child node aij is the j-th child node of level i, where i represents the child node level (i = 0, 1, 2, ..., 6), indicating the child node's position in the entire aggregation tree. The node index j>=0 indicates the node's position within the nodes of level i, which is the j-th group after grouping the alarm information set of that level based on the alarm attribute corresponding to child node i. Taking level 0 as an example, the alarm information set formed can be S. 0,0 The corresponding alarm attribute set can be p 0,0 And initialize the attribute values ​​contained in the alarm attribute set to the root node.

[0086] Here, H(S,a) represents the information entropy of the alarm information set S with respect to the alarm attribute a. The alarm attribute a has V attribute values ​​in the alarm information set S, denoted as the set {a...} 1 ,a 2 ,…,a V}; where P(a=a k The expression ∈ (0,1] indicates that the alarm information in set S belongs to alarm attribute a = a k The probability of.

[0087] The above formula is specifically expressed as follows: For node p i,j It has an alarm information set S i,j and alarm attribute set A i,j From alarm attribute set A i,j Select the best alarm attribute As a grouping criterion, the alarm information set S is grouped according to the different attribute values ​​of the optimal alarm attribute. i,j Grouping is performed, and alarm messages with the same attribute value are grouped together, denoted as subset S. i+1,j′ and assigned to the same child node p i+1,j′ At the same time from A i,j Remove attributes As a subset of attributes, attribute A i+1,j′, where j′>=0.

[0088] Based on this, according to the above formula: for the initialized root node, both i and j in its hierarchy are 0 at this time, that is, there is only one root node p. 0,0 This means there is only one set of alarm information and one set of alarm attributes. In this case, the root node corresponds to the alarm information set P. 0,0 For any current alarm attribute 'a', if it has V attribute values ​​(i.e., taking the alarm source as the current alarm attribute 'a', it has V alarm sources), then there are a total of V alarm sources, each serving as a child node, to affect the alarm information set P. 0,0 Grouping the data yields the alarm information set S. 0,0 {a 1 ,a 2 ,…,a v}. Then, based on the alarm information set S 0,0 Grouping in the data, calculate P(a=a) k [ ], that is, to calculate the alarm information set S 0,0 Each alarm message belongs to attribute value a. k The probability of the corresponding group. Then, according to Formula 2 above, the probabilities corresponding to each attribute value contained in the current alarm attribute a are summed to obtain the information entropy of grouping the current alarm attribute a.

[0089] Additionally, due to the initial alarm attribute set A i,0 The system has six alarm attributes, resulting in six information entropies. The monitoring system can then select the current alarm attribute corresponding to the minimum value among the six information entropies as the optimal attribute.

[0090] It is understandable that when there exists an alarm attribute 'a', all alarm messages in the corresponding alarm message set S have the same attribute value for alarm attribute 'a', i.e., V = 1. In this case, it can be inferred that: In other words, when grouping alarm information by the attribute values ​​contained in alarm attribute a, if it has only one attribute value, the information entropy corresponding to grouping by alarm attribute a will reach the minimum value of 0. This means that the alarm information set S has the minimum amount of information on alarm attribute a, and the aggregation is better and easier when grouping all alarm information in the alarm information set S by the current alarm attribute a.

[0091] S3. Based on the attribute values ​​corresponding to the best attribute, group the alarm information set to obtain a new alarm information set and an alarm attribute set; wherein, the attribute values ​​corresponding to the best attribute in each new alarm information set are the same, and each attribute value corresponding to the best attribute is a child node.

[0092] S4. For any new set of alarm information and alarm attribute, repeat steps S2-S3 to group the new set of alarm information and alarm attribute until the end child nodes are obtained.

[0093] It is understandable that after the calculations in steps S21-S24 above are completed, node p in the aggregation tree is realized. 0,0 The result of the split is that node p is obtained. 0,0 A series of child nodes p 1,j′ The set of alarm information S corresponding to the child nodes 1,j′ and alarm attribute set A 1,j′ .

[0094] Since the monitoring system has already determined the optimal attribute from the six alarm attributes, each alarm attribute set now contains only five alarm attributes. That is, the new alarm attribute set now contains only the attribute values ​​corresponding to the five alarm attributes. Subsequently, the above method is repeated to group the alarm information sets and alarm attribute sets corresponding to the j child nodes until alarm attribute set A is reached. i+1,j′ Empty. (Refer to...) Figure 3 Finally, alarms are grouped by IP address as the alarm attribute. At this point, for the alarm information set belonging to IP address 1, since the corresponding alarm attribute set is empty and there is no 7th alarm attribute, there is no need to regroup the alarm information set belonging to IP address 1.

[0095] Finally, for each determined optimal attribute, its corresponding attribute value can be used as a child node at each level of the aggregation tree. That is, refer to... Figure 3 When the optimal attribute determined in the first layer is the alarm source, its child nodes can be alarm source 1, ..., alarm source N, respectively. Then, the monitoring system can re-determine the optimal attribute for the alarm information sets under the child nodes of alarm source 1, ..., alarm source N, until the final child nodes are obtained. This results in the final child nodes grouped by alarm attribute as IP address.

[0096] S5. The monitoring system generates a cluster tree based on the root node, child nodes, and terminal child nodes.

[0097] In one embodiment, after grouping the nodes sequentially to obtain the root node, child nodes, and terminal child nodes, the nodes can be connected sequentially according to the path taken during grouping to generate a cluster tree.

[0098] It should be noted that the aggregation tree can be updated at preset time intervals. For example, it can be updated every 0.5 seconds or 1 second. The update methods include, but are not limited to, inserting new alarm information into the aggregation tree based on the attribute values ​​of each child node if new alarm information is obtained, or re-initializing and updating all existing alarm information in the current aggregation tree. That is, re-executing steps S1-S5 to make the generated aggregation tree more conducive to subsequent lossless compression of all existing alarm information.

[0099] In one embodiment, each alarm message includes a lifecycle; refer to Figure 7 In step S104, the aggregated information is sent to the user terminal of the staff, including the following steps S1041-S1043, which are detailed below:

[0100] S1041, The monitoring system determines the update time used when updating alarm information to the aggregation tree.

[0101] S1042. The monitoring system determines the remaining time of alarm information based on the update time and lifecycle.

[0102] S1043. When the remaining time expires, the monitoring system will send aggregated information containing alarm information to the user terminal of the staff.

[0103] In one embodiment, the aforementioned lifecycle refers to the time period from the generation of the alarm information to its transmission to the user terminal. The monitoring system requires time to parse, standardize, and update the aggregation tree of the alarm information. Therefore, the monitoring system can calculate the remaining time for each alarm information based on the update time and the lifecycle. Then, alarm information whose remaining time has expired is sent to the user terminal.

[0104] It is important to note that when sending an alarm message indicating that the remaining time has expired to the user terminal, if the alarm message has other sibling nodes, it should be aggregated with the alarm messages corresponding to those sibling nodes before being sent. This allows staff to promptly process alarm messages indicating that the remaining time has expired, as well as other similar alarm messages.

[0105] Please see Figure 8 , Figure 8 This is a structural block diagram of an alarm information aggregation device provided in an embodiment of this application. The modules included in this embodiment of the alarm information aggregation device are used to perform… Figure 1 , Figures 3 to 7 The steps in the corresponding embodiments. Please refer to the details. Figure 1 , Figures 3 to 7 as well as Figure 1 , Figures 3 to 7 The relevant descriptions in the corresponding embodiments are shown below. For ease of explanation, only the parts relevant to this embodiment are shown. See also... Figure 8 The alarm information aggregation device 800 may include: an acquisition module 810, an update module 820, an aggregation module 830, and a sending module 840, wherein:

[0106] The acquisition module 810 is used to acquire alarm information generated when the system encounters an anomaly; the alarm information includes the attribute values ​​corresponding to multiple alarm attributes.

[0107] The update module 820 is used to decompose alarm information step by step according to multiple alarm attributes in order to update the aggregation tree; the aggregation tree includes multiple child nodes, each child node corresponding to the attribute value of an alarm attribute.

[0108] The aggregation module 830 is used to aggregate the alarm information corresponding to any current end child node and other end child nodes if the current end child node is a sibling node, so as to obtain aggregated information.

[0109] The sending module 840 is used to send aggregated information to the user terminals of staff.

[0110] In one embodiment, each alarm message has a unique event identifier; the alarm attributes also include new alarm and alarm recovery; the alarm information aggregation device 800 further includes:

[0111] The decomposition module is used to decompose alarm information that is a newly added alarm, and alarm information that has not received the same event identifier within a preset time period and is an alarm recovery alarm, in order to decompose the alarm information that is a newly added alarm step by step.

[0112] The deletion module is used to delete the alarm information and other alarm information if the alarm information is a newly added alarm, and if other alarm information with the same event identifier received within a preset time period is alarm recovery information.

[0113] In one embodiment, the update module 820 is further configured to:

[0114] S1. Initialize the root node, which includes an alarm information set consisting of multiple alarm messages and an alarm attribute set consisting of multiple alarm attributes; S2. Determine the best attribute from the alarm attribute set based on the attribute values ​​corresponding to the multiple alarm attributes; S3. Group the alarm information set based on the attribute values ​​corresponding to the best attribute to obtain new alarm information sets and alarm attribute sets; wherein the attribute value corresponding to the best attribute is the same in each new alarm information set, and each attribute value corresponding to the best attribute is a child node; S4. For any new alarm information set and alarm attribute set, repeat steps S2-S3 to group the new alarm information set and alarm attribute set until the terminal child node is obtained; S5. Generate an aggregate tree based on the root node, child nodes, and terminal child nodes.

[0115] In one embodiment, the update module 820 is further configured to:

[0116] For any given alarm attribute, determine the multiple attribute values ​​included in the current alarm attribute; count the number of alarm messages corresponding to each attribute value; calculate the information entropy of the current alarm attribute based on the number and the total number of alarm messages; information entropy is used to measure the degree of aggregation when grouping multiple alarm messages by the current alarm attribute; determine the current alarm attribute corresponding to the minimum value of information entropy as the optimal attribute.

[0117] In one embodiment, the update module 820 is further configured to:

[0118] For any current attribute value in the current alarm attribute, calculate the ratio of the number of alarm messages corresponding to the current attribute value to the total number of alarm messages, and obtain the probability that the attribute value in any alarm message is the current attribute value; calculate the initial information entropy of the current attribute value based on the probability; sum the initial information entropy corresponding to each current attribute value in the current alarm attribute to obtain the information entropy of the current alarm attribute.

[0119] In one embodiment, the aggregation tree includes a root node; the aggregation module 830 is further configured to:

[0120] Determine the attribute values ​​of the alarm attributes corresponding to each child node from the root node to the previous child node; the previous child node is the parent node of the current end child node; generate a set of attribute values ​​of the alarm attributes corresponding to the current end child node and other end child nodes; based on any alarm information, keep the attribute values ​​of the alarm attributes corresponding to each child node in the alarm information unchanged; and replace the attribute value set with the attribute value of the alarm attribute corresponding to the end child node in the alarm information to obtain aggregate information.

[0121] In one embodiment, each alarm message includes a lifecycle; the sending module 840 is further configured to:

[0122] Determine the update time used when the alarm information is updated to the aggregation tree; determine the remaining time of the alarm information based on the update time and lifecycle; when the remaining time is exhausted, send the aggregated information containing the alarm information to the user terminal of the staff.

[0123] When it is understood that, Figure 8 In the structural block diagram of the alarm information aggregation device shown, each module is used to perform... Figure 1 , Figures 3 to 7 The steps in the corresponding embodiments, and for Figure 1 , Figures 3 to 7 The steps in the corresponding embodiments have been explained in detail in the above embodiments. Please refer to the figures for details. Figure 1 , Figures 3 to 7 as well as Figure 1 , Figures 3 to 7 The relevant descriptions in the corresponding embodiments will not be repeated here.

[0124] Figure 9 This is a structural block diagram of a monitoring system provided in one embodiment of this application. Figure 9 As shown, the monitoring system 900 of this embodiment includes: a processor 910, a memory 920, and a computer program 930 stored in the memory 920 and executable on the processor 910, such as a program for an alarm information aggregation method. When the processor 910 executes the computer program 930, it implements the steps in the various embodiments of the alarm information aggregation methods described above, for example... Figure 1 S101 to S104 are shown. Alternatively, the processor 910 implements the above when executing the computer program 930. Figure 8 The functions of each module in the corresponding embodiments, for example, Figure 8 For details on the functions of modules 810 to 840 shown, please refer to [link / reference]. Figure 8 The relevant descriptions in the corresponding embodiments.

[0125] For example, the computer program 930 can be divided into one or more modules, one or more of which are stored in the memory 920 and executed by the processor 910 to implement the alarm information aggregation method provided in this embodiment. One or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 930 in the monitoring system 900. For example, the computer program 930 can implement the alarm information aggregation method provided in this embodiment.

[0126] The monitoring system 900 may include, but is not limited to, a processor 910 and a memory 920. Those skilled in the art will understand that... Figure 9This is merely an example of a monitoring system 900 and does not constitute a limitation on the monitoring system 900. It may include more or fewer components than shown, or combine certain components, or different components. For example, the monitoring system may also include input / output devices, network access devices, buses, etc.

[0127] The processor 910 may be a central processing unit, or it may be other general-purpose processors, digital signal processors, application-specific integrated circuits, off-the-shelf programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0128] The memory 920 can be an internal storage unit of the monitoring system 900, such as the hard disk or memory of the monitoring system 900. The memory 920 can also be an external storage device of the monitoring system 900, such as a plug-in hard disk, smart memory card, flash memory card, etc., equipped on the monitoring system 900. Furthermore, the memory 920 can include both internal storage units and external storage devices of the monitoring system 900.

[0129] This application provides a monitoring system, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the alarm information aggregation method as described in the above embodiments.

[0130] This application provides a computer-readable storage medium, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the alarm information aggregation method as described in the above embodiments.

[0131] This application provides a computer program product that, when run on a monitoring system, causes the monitoring system to execute the alarm information aggregation method in the above embodiments.

[0132] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for aggregating alarm information, characterized in that, Applied to a monitoring system, the method includes: Acquire alarm information generated when a system anomaly occurs; the alarm information includes attribute values ​​corresponding to multiple alarm attributes; The alarm information is decomposed level by level according to the multiple alarm attributes to update the aggregation tree; the aggregation tree includes multiple child nodes, and each child node corresponds to the attribute value of an alarm attribute. For any current end child node, if the current end child node is a sibling node of other end child nodes, then the alarm information corresponding to the current end child node and the other end child nodes are aggregated to obtain aggregated information; The aggregated information is sent to the staff's user terminals; The step of decomposing the alarm information level by level according to the multiple alarm attributes to update the aggregation tree includes: S1. Initialize the root node, wherein the root node includes an alarm information set consisting of multiple alarm information and an alarm attribute set consisting of multiple alarm attributes; S2. Determine the optimal attribute from the alarm attribute set based on the attribute values ​​corresponding to the multiple alarm attributes respectively; S3. Based on the attribute values ​​corresponding to the best attributes, the alarm information set is grouped to obtain a new alarm information set and an alarm attribute set; wherein, the attribute values ​​corresponding to the best attributes in each new alarm information set are the same, and each attribute value corresponding to the best attribute is a child node. S4. For any new set of alarm information and set of alarm attributes, repeat steps S2-S3 to group the new set of alarm information and set of alarm attributes until the end child nodes are obtained. S5. Generate the aggregate tree based on the root node, the child nodes, and the terminal child nodes; The step of determining the optimal attribute from the set of alarm attributes based on the attribute values ​​corresponding to the multiple alarm attributes includes: For any given alarm attribute, determine multiple attribute values ​​included in the current alarm attribute; Count the number of alarm messages corresponding to each attribute value; Based on the quantity and the total number of alarm messages, the information entropy of the current alarm attribute is calculated; the information entropy is used to measure the degree of aggregation when multiple alarm messages are grouped by the current alarm attribute; The current alarm attribute corresponding to the minimum value in the information entropy is determined as the optimal attribute; The step of calculating the information entropy of the current alarm attribute based on the quantity and the total number of alarm messages includes: For any current attribute value in the current alarm attributes, calculate the ratio of the number of alarm messages corresponding to the current attribute value to the total number, and obtain the probability that any of the alarm messages has an attribute value of the current attribute value; Calculate the initial information entropy of the current attribute value based on the probability; The initial information entropy corresponding to each current attribute value in the current alarm attribute is summed to obtain the information entropy of the current alarm attribute.

2. The alarm information aggregation method according to claim 1, characterized in that, Each alarm message has a unique event identifier; the alarm attributes also include new alarms and alarm recovery; after acquiring the alarm information generated when a system anomaly occurs, the following is also included: If the alarm information is the newly added alarm, and the alarm information for which the same event identifier has not been received within a preset time period, and the alarm information is the alarm recovery information, then the alarm information for the newly added alarm is decomposed level by level. If the alarm information is the newly added alarm, and other alarm information with the same event identifier received within the preset time period that is the alarm recovery, then the alarm information and the other alarm information are deleted.

3. The alarm information aggregation method according to claim 1, characterized in that, The aggregation tree includes a root node; The alarm information corresponding to the current end child node and the other end child nodes is aggregated to obtain aggregated information, including: Determine the attribute value of the alarm attribute corresponding to each of the child nodes between the root node and the previous child node; the previous child node is the parent node of the current end child node; Generate a set of attribute values ​​for the alarm attributes corresponding to the current end child node and the other end child nodes respectively; Based on any of the alarm information, the attribute values ​​of the alarm attributes corresponding to each of the child nodes in the alarm information are kept unchanged; and the attribute values ​​of the alarm attributes corresponding to the end child nodes in the alarm information are used to replace the set of attribute values ​​to obtain the aggregate information.

4. The alarm information aggregation method according to any one of claims 1-3, characterized in that, Each alarm message includes a lifecycle; Sending the aggregated information to the staff's user terminal includes: Determine the update time used when the alarm information is updated to the aggregation tree; The remaining time of the alarm information is determined based on the update time and lifecycle. When the remaining time expires, the aggregated information containing the alarm information will be sent to the user terminal of the staff member.

5. An alarm information aggregation device, characterized in that, The device, used in a monitoring system, includes: The acquisition module is used to acquire alarm information generated when a system anomaly occurs; the alarm information includes attribute values ​​corresponding to multiple alarm attributes. The update module is used to decompose the alarm information step by step according to the multiple alarm attributes in order to update the aggregation tree; the aggregation tree includes multiple child nodes, and each child node corresponds to the attribute value of an alarm attribute; The aggregation module is used to aggregate the alarm information corresponding to any current end child node and other end child nodes if the current end child node is a sibling node, to obtain aggregated information. The sending module is used to send the aggregated information to the user terminal of the staff. The update module is also used for: S1. Initialize the root node, wherein the root node includes an alarm information set consisting of multiple alarm information and an alarm attribute set consisting of multiple alarm attributes; S2. Determine the optimal attribute from the alarm attribute set based on the attribute values ​​corresponding to the multiple alarm attributes respectively; S3. Based on the attribute values ​​corresponding to the best attributes, the alarm information set is grouped to obtain a new alarm information set and an alarm attribute set; wherein, the attribute values ​​corresponding to the best attributes in each new alarm information set are the same, and each attribute value corresponding to the best attribute is a child node. S4. For any new set of alarm information and set of alarm attributes, repeat steps S2-S3 to group the new set of alarm information and set of alarm attributes until the end child nodes are obtained. S5. Generate the aggregate tree based on the root node, the child nodes, and the terminal child nodes; The update module is also used for: For any given alarm attribute, determine multiple attribute values ​​included in the current alarm attribute; Count the number of alarm messages corresponding to each attribute value; Based on the quantity and the total number of alarm messages, the information entropy of the current alarm attribute is calculated; the information entropy is used to measure the degree of aggregation when multiple alarm messages are grouped by the current alarm attribute; The current alarm attribute corresponding to the minimum value in the information entropy is determined as the optimal attribute; The update module is also used for: For any current attribute value in the current alarm attributes, calculate the ratio of the number of alarm messages corresponding to the current attribute value to the total number, and obtain the probability that any of the alarm messages has an attribute value of the current attribute value; Calculate the initial information entropy of the current attribute value based on the probability; The initial information entropy corresponding to each current attribute value in the current alarm attribute is summed to obtain the information entropy of the current alarm attribute.

6. A monitoring system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.

Images