An alarm message processing method, device and electronic device

Abstract

The present application provides an alarm message processing method, apparatus and electronic device. The method includes: obtaining an alarm message, where the alarm message includes an importance level and a timestamp; adding the alarm message to a message processing queue according to the importance level and the timestamp. After adding the alarm message to the message processing queue, the processing of the alarm message can be achieved by processing each alarm message in the message processing queue, thereby solving the problems in the prior art.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular, to an alarm message processing method, apparatus, and electronic device. Background Art

[0002] With the continuous improvement of security awareness, alarm systems have been widely used in fields such as communication and medical care. An alarm system can generally be used to monitor monitored objects. For example, a preset range can be set for one or more operating parameters of the monitored object, and then the actual values of these operating parameters are monitored. When it is monitored that the actual value exceeds the preset range, an alarm message is generated and sent to a preset alarm message receiving object. Therefore, for an alarm system, how to process alarm messages is crucial. Summary of the Invention

[0003] The purpose of the embodiments of this application is to provide an alarm message processing method, apparatus, and electronic device to solve the problems in the prior art.

[0004] A first aspect of the embodiments of this application provides an alarm message processing method, including:

[0005] Obtain an alarm message, where the alarm message includes an importance level and a timestamp;

[0006] According to the importance level and the timestamp, add the alarm message to a message processing queue for processing the alarm message.

[0007] In one embodiment, the alarm message further includes an alarm message receiving object; then,

[0008] The method further includes: obtaining the alarm message from the message processing queue according to the order of the alarm messages in the message processing queue, and sending the alarm message to the alarm message receiving object.

[0009] In one embodiment, the method further includes: if a message receipt notice returned by the alarm message receiving object is not received within a first preset time period, send the alarm message to the alarm message receiving object again.

[0010] In one embodiment, after sending the alarm message to the alarm message receiving object again, the method further includes:

[0011] If a message receipt notice of the alarm message receiving object is not received within a second preset time period, determine whether the alarm message is an alarm message maintained by the server, where the server maintenance specifically includes: disk cleaning and / or data synchronization;

[0012] In the case where the alarm message is an alarm message maintained by the server, send a script tool running instruction to indicate running the corresponding script tool for disk cleaning and / or data synchronization of the server.

[0013] In one embodiment, in the message processing queue, alarm messages with different importance levels are arranged in descending order of importance level; and, in the message processing queue, alarm messages with the same importance level are arranged in the order of timestamps; then,

[0014] Adding the alarm message to the message processing queue according to the importance level and the timestamp specifically includes:

[0015] Determine the insertion area in the message processing queue according to the importance level of the obtained alarm message, where the importance levels of the alarm messages in the insertion area are the same as the importance level of the obtained alarm message;

[0016] Determine the insertion position according to the timestamp of the obtained alarm message and the timestamps of the alarm messages in the insertion area;

[0017] Insert the obtained alarm message into the insertion position.

[0018] In one embodiment, adding the alarm message to the message processing queue according to the importance level and the timestamp specifically includes:

[0019] In the case where TPS is greater than QPS, add the alarm message to the message processing queue according to the importance level and the timestamp.

[0020] In one embodiment, the method further includes: determining the QPS through a stress test in advance.

[0021] A second aspect of the embodiments of the present application provides an alarm message processing device, including:

[0022] An acquisition unit, configured to acquire an alarm message, where the alarm message includes an importance level and a timestamp;

[0023] An adding unit, configured to add the alarm message to a message processing queue according to the importance level and the timestamp for processing the alarm message.

[0024] In one embodiment, the alarm message further includes an alarm message receiving object; then,

[0025] The device further includes a sending unit, configured to obtain the alarm messages from the message processing queue according to the sequence of the alarm messages in the message processing queue, and send the alarm messages to the alarm message receiving object.

[0026] A third aspect of the embodiments of the present application provides an electronic device, including:

[0027] A memory, configured to store a computer program;

[0028] A processor, configured to execute the method provided in any embodiment of the present application.

[0029] By using the alarm message processing method provided in the embodiments of the present application, after obtaining the alarm messages, the alarm messages are added to the message processing queue according to the importance level and timestamp of the obtained alarm messages. After adding the alarm messages to the message processing queue, the processing of the alarm messages can be realized by processing each alarm message in the message processing queue, thereby solving the problems in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, other related drawings can be obtained based on these drawings without creative efforts.

[0031] Figure 1 It is a specific flowchart of the alarm message processing method provided in an embodiment of the present application;

[0032] Figure 2 It is a schematic structural diagram of an electronic device provided in an embodiment of the present application;

[0033] Figure 3 It is a schematic diagram of the interaction between an electronic device and a monitored object provided in an embodiment of the present application;

[0034] Figure 4 It is a specific structural diagram of the alarm message processing device provided in an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0035] The following will describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. In the description of the present application, terms such as "first" and "second" are only used for distinguishing descriptions, and cannot be understood as indicating or implying relative importance or sequence.

[0036] As described above, the alarm system can set a preset range for one or more operating parameters of the monitored object, and then monitor the actual values of these operating parameters. When it is monitored that the actual value exceeds the preset range, an alarm message is generated and sent to a pre-set alarm message receiving object. Therefore, for the alarm system, how to process the alarm message is crucial. For example, when the alarm system receives multiple alarm messages, it is easy to miss the processing of alarm messages.

[0037] Based on this, an embodiment of the present application provides an alarm message processing method, which can be used to solve the problems in the prior art. As Figure 1 shown in the specific flowchart of this method, it includes the following steps:

[0038] Step S11: Obtain an alarm message, which includes an importance level and a timestamp.

[0039] The alarm message can be an alarm message generated by the alarm system when it monitors that the actual value of the operating parameter of the monitored object exceeds the preset range. The monitored object can be a virtual monitored object such as an application program or a public account, or a hardware monitored object, such as hardware devices like mobile phones, tablets, large servers, etc.

[0040] The operating parameter can be some key indicators of the monitored object. For example, when it is a large server, in order to ensure the normal operation of the large server, it is necessary to pay attention to key indicators such as memory occupancy, CPU occupancy, CPU temperature, and disk occupancy. These key indicators can be used as operating parameters and monitored through the alarm system. For example, if the operating parameter is CPU occupancy, a preset range (for example, less than 50%) can be set for the CPU occupancy. When it is monitored that the CPU occupancy exceeds the preset range, an alarm message is generated.

[0041] It should be noted that the alarm system usually includes an object monitoring module, which can be used to monitor the actual value of the operating parameter of the monitored object and generate an alarm message when it monitors that the actual value exceeds the preset range.

[0042] The alarm message includes an importance level and a timestamp. Among them, the timestamp can be the timestamp when the alarm message is generated or the timestamp when the alarm message is obtained. The importance level can reflect the importance of the monitored object or the monitored operating parameter. For example, different importance levels can be set for different monitored objects, or different importance levels can be set for different operating parameters in the same monitored object. For example, according to actual needs, five importance levels can be divided, and in descending order, they are level 1, level 2, level 3, level 4, and level 5.

[0043] In practical applications, a graphical user interface can be provided, enabling a user to operate on the graphical user interface, thereby setting different importance levels for different monitored objects, or setting different importance levels for different operating parameters of the same monitored object.

[0044] Step S12: Add the obtained alarm message to the message processing queue according to the importance level and timestamp of the obtained alarm message for processing the alarm message.

[0045] It should be noted that the message processing queue may include multiple alarm messages, and these alarm messages respectively include corresponding importance levels and timestamps. And in this message processing queue, for alarm messages with different importance levels, they are arranged in descending order of importance level, and for alarm messages with the same importance level, they are arranged in the order of timestamps.

[0046] Thus, in step S12, the specific manner of adding the obtained alarm message to the message processing queue according to the importance level and timestamp of the obtained alarm message may be as follows: first, determine the insertion area in the message processing queue according to the importance level of the obtained alarm message, and the importance levels of the alarm messages in the insertion area are the same as the importance level of the obtained alarm message; then, determine the insertion position according to the timestamp of the obtained alarm message and the timestamps of the alarm messages in the insertion area, and then insert the obtained alarm message into this insertion position.

[0047] That is to say, when adding the obtained alarm message to the message processing queue, first consider the importance level, and the alarm message with a higher importance level is placed more forward. In the case of the same importance level, then consider the timestamp, and the alarm message with an earlier timestamp is placed more forward.

[0048] By adopting the alarm message processing method provided by the embodiments of the present application, after obtaining the alarm message, the alarm message is added to the message processing queue according to the importance level and timestamp of the obtained alarm message. After adding the alarm message to the message processing queue in this way, the processing of the alarm message can be realized by processing each alarm message in the message processing queue, thereby solving the problems in the prior art.

[0049] In particular, in practical applications, when the number of obtained alarm messages is large, during the process of processing these alarm messages, it is usually easy to cause some alarm messages to be missed. At this time, by using the method provided in the embodiments of the present application, even when multiple alarm messages are obtained, these alarm messages can be added to the message processing queue, and then these alarm messages can be processed by processing each alarm message in the message processing queue, so the possibility of alarm messages being missed is also reduced.

[0050] For the processing method of each alarm message in the message processing queue, usually according to the order of each alarm message in the message processing queue, they can be obtained and sent in sequence, so as to realize the processing of alarm messages.

[0051] In addition, in order to send the alarm message, usually the alarm message can also include the recipient of the alarm message, and the recipient of the alarm message can be a mobile phone number, an email address or other types of message recipients.

[0052] Therefore, the alarm message in step S11 can also include the recipient of the alarm message, and the alarm message processing method provided by the embodiments of the present application can further include obtaining the alarm message from the message processing queue according to the order of each alarm message in the message processing queue, and sending the alarm message to the recipient of the alarm message.

[0053] In addition, after sending the alarm message to the recipient of the alarm message, the method can further include that if a message received notice is not received from the recipient of the alarm message within the first preset time period, the alarm message is sent to the recipient of the alarm message again.

[0054] Usually, after the recipient of the alarm message has successfully received the alarm message, the message received notice can be returned. Therefore, if the message received notice is received within the first preset time period, it means that the recipient of the alarm message has successfully received the alarm message, and no other processing is required at this time; if the message received notice is not received within the first preset time period, it means that the recipient of the alarm message may not have received the alarm message, and at this time, the alarm message needs to be sent to the recipient of the alarm message again.

[0055] In particular, the first preset time period can be set according to actual needs. For example, the first preset time period can be set according to the importance level of the alarm message. For alarm messages with a higher importance level, their time urgency is usually higher, and at this time, the first preset time period can be set shorter; on the contrary, for alarm messages with a lower importance level, their time urgency is relatively lower, and at this time, the first preset time period can be set longer.

[0056] For example, it is mentioned above that five importance levels can be divided, and in descending order, they are level 1, level 2, level 3, level 4, and level 5. For an alarm message with an importance level of level 1, the first preset time period can be 5 minutes (of course, it can also be 10 minutes, 30 minutes, etc.), while for an alarm message with an importance level of level 5, the first preset time period can be 3 hours or other durations.

[0057] It should be further noted that in practical applications, the server is usually used as the monitored object to monitor the maintenance of the server, including disk cleaning and / or data synchronization of the server. For example, the disk occupancy rate is used as an operating parameter to monitor the disk occupancy rate of the server. When the disk occupancy rate exceeds the preset range, an alarm message for server maintenance is generated.

[0058] At this time, if the received notice of message receipt has not been received from the alarm message recipient within the first preset time period, and after sending the alarm message to the alarm message recipient again, if the received notice of message receipt from the alarm message recipient is still not received within the second preset time period, it can be further determined whether the alarm message is an alarm message for server maintenance. And when the alarm message is an alarm message for server maintenance, a script tool running instruction is sent to indicate the running of the corresponding script tool, so as to clean the disk and / or synchronize data of the server by running the corresponding script tool.

[0059] Among them, the second preset time period can be the same as or different from the first preset time period. For example, the second preset time period can be 10 minutes, 30 minutes, etc.

[0060] In practical applications, the alarm system usually has a certain processing capacity. If the number of alarm messages obtained is within the processing capacity range, the processing efficiency of the alarm messages is relatively high, and it is not easy to have the situation that alarm messages are missed or severely delayed. Therefore, for the alarm system, an alarm priority policy mode and a non-alarm priority policy mode can be further set. When the number of alarm messages obtained is within the processing capacity range, it is processed in the non-alarm priority policy mode; or, when the number of alarm messages obtained exceeds the processing capacity, it is processed in the alarm priority policy mode.

[0061] Among them, processing in the non-alarm priority policy mode can be directly processing after receiving the alarm message, or only adding it to the message processing queue according to the timestamp of the alarm message, etc., for processing the alarm message.

[0062] Process in the alarm - priority policy mode, that is, adopt the alarm - message processing method provided by this application to process the alarm message. That is to say, after obtaining the alarm message, according to the importance level and timestamp of the alarm message, add the alarm message to the message processing queue for processing the alarm message.

[0063] In practical applications, the processing capacity of the alarm system for alarm messages can usually be determined through stress testing. For example, boundary conditions can be set first. The boundary conditions can be that the alarm - information delay rate < 1% (or 3%, 5% or other values), and the alarm - information loss rate < 1% (or 3%, 5% or other values). Then, gradually increase the number of alarm messages received and processed by the alarm system per second, and finally determine the maximum amount of alarm - information processing capacity (Query Per Second, QPS) that the alarm system can bear within this boundary condition. This QPS can be used to measure the processing capacity of the alarm system. For example, when the number of alarm messages processed by the alarm system per second (Transactions Per Second, TPS) is less than or equal to this QPS, it means that the processing capacity of the alarm system is not exceeded, and at this time, process in the non - alarm - priority policy mode; or, when TPS is greater than this QPS, it means that the processing capacity of the alarm system is exceeded, and at this time, process in the alarm - priority policy mode.

[0064] In practical applications, for the alarm system, it can include an object monitoring module, an anomaly monitoring module, and a message processing module. The object monitoring module can be used to monitor the actual values of the operating parameters of the monitored object, and generate an alarm message when it monitors that the actual value exceeds the preset range. The anomaly monitoring module is used to monitor whether TPS is greater than QPS. The message processing module is used to process in the alarm - priority policy mode when TPS is greater than QPS, or process in the non - alarm - priority policy mode when TPS is less than or equal to QPS.

[0065] Relatively speaking, when processing alarm messages in the non - alarm - priority policy mode, compared with processing alarm messages in the alarm - priority policy mode, since the importance level of the alarm message is not considered in the non - alarm - priority policy mode, it may easily cause some alarm messages with a higher importance level to be delayed in processing. Especially when the number of alarm messages is large, the possibility of being delayed in processing is also relatively high. And for alarm messages with a higher importance level, their time urgency is relatively higher. If they are delayed in processing, it may have a greater impact on the normal operation of the monitored object. Therefore, when TPS is greater than QPS, the alarm messages can be processed in the alarm - priority policy mode.

[0066] Such as Figure 2As shown in the figure, this embodiment provides an electronic device 2, including: at least one processor 21 and a memory 22. The processor 21 and the memory 22 are connected through a bus 20. The memory 22 stores instructions executable by the processor 21. When the instructions are executed by the processor 21, the electronic device 2 can execute all or part of the processes of the methods in the above embodiments.

[0067] In practical applications, the electronic device 2 can be a mobile phone, a laptop computer, a desktop computer, or a large server or server cluster composed thereof, etc. All or part of the modules of the alarm system can be set in the electronic device 2.

[0068] As Figure 3 shown in the figure, the electronic device 2 can be docked with one or more monitored objects 3, and the electronic device 2 can communicate with each monitored object 3 separately for data. An object monitoring module in the alarm system can be set in the monitored object 3.

[0069] For example, the object monitoring module in the alarm system can be set in the monitored object 3, and the anomaly monitoring module and the message processing module in the alarm system can be set in the electronic device 2.

[0070] Based on the same inventive concept as the alarm message processing method provided in the embodiments of the present application, the embodiments of the present application also provide an alarm message processing device. For the embodiments of this device, if there are unclear points, the corresponding content of the method embodiments can be referred to. As Figure 4 shown in the figure is a schematic structural diagram of the specific structure of the device 40. The device 40 includes: an acquisition unit 401 and an addition unit 402, where:

[0071] The acquisition unit 401 is used to acquire an alarm message, where the alarm message includes an importance level and a timestamp;

[0072] The addition unit 402 is used to add the alarm message to the message processing queue according to the importance level and the timestamp for processing the alarm message.

[0073] By using the device 40 provided in the embodiments of the present application, since the device 40 adopts the same inventive concept as the alarm message processing method provided in the embodiments of the present application, on the premise that the alarm message processing method can solve technical problems, the device 40 can also solve technical problems, which will not be elaborated here.

[0074] In addition, in practical applications, the technical effects obtained by combining the device 40 with specific hardware devices, cloud technologies, etc. are also within the protection scope of the present application. For example, different units in the device 40 are arranged in different nodes of a distributed cluster in a distributed cluster manner to improve efficiency, etc.

[0075] The alarm message usually may also include the recipient of the alarm message; then, the device 40 may further include a sending unit, configured to obtain the alarm message from the message processing queue according to the sequence of each alarm message in the message processing queue, and send the alarm message to the recipient of the alarm message.

[0076] Certainly, the sending unit may further include a sending subunit, configured to, if a message receipt notice returned by the recipient of the alarm message has not been received within a first preset time period, send the alarm message to the recipient of the alarm message again.

[0077] In practical applications, the device 40 may further include a judging unit and an instruction sending unit, where:

[0078] The judging unit is configured to, after sending the alarm message to the recipient of the alarm message again, if a message receipt notice returned by the recipient of the alarm message has not been received within a second preset time period, judge whether the alarm message is an alarm message maintained by the server, where the server maintenance specifically includes: disk cleaning and / or data synchronization;

[0079] The instruction sending unit is configured to, in the case that the alarm message is an alarm message maintained by the server, send a script tool running instruction to indicate running a corresponding script tool for disk cleaning and / or data synchronization of the server.

[0080] The adding unit 402 may specifically be configured to, when the TPS is greater than the QPS, add the alarm message to the message processing queue according to the importance level and the timestamp.

[0081] Certainly, the device 40 may further include a QPS determining unit, configured to determine the QPS in advance through a stress test.

[0082] In the message processing queue, alarm messages with different importance levels are arranged in descending order of importance level; and, in the message processing queue, alarm messages with the same importance level are arranged in the order of the timestamp.

[0083] In practical applications, the adding unit 402 may include a to-be-inserted area determining subunit, a to-be-inserted position determining subunit, and an inserting subunit, where:

[0084] The to-be-inserted area determining subunit is configured to determine the to-be-inserted area in the message processing queue according to the importance level of the obtained alarm message, where the importance levels of the alarm messages in the to-be-inserted area are the same as the importance level of the obtained alarm message;

[0085] A to-be-inserted position determination subunit, configured to determine a to-be-inserted position according to the time stamp of the acquired alarm message and the time stamps of the alarm messages in the to-be-inserted area;

[0086] An insertion subunit, configured to insert the acquired alarm message into the to-be-inserted position.

[0087] An embodiment of the present invention further provides a computer-readable storage medium for an electronic device, including: a program, which, when running on the electronic device, enables the electronic device to execute all or part of the processes of the method in the above embodiment. The storage medium may be a disk, an optical disc, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD), etc. The storage medium may also include a combination of the above types of memories.

[0088] Although the embodiments of the present invention are described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations fall within the scope defined by the appended claims.

Claims

1. An alarm message processing method, characterized in that, Including: Obtain an alarm message, where the alarm message includes an importance level and a timestamp; When TPS is greater than QPS, based on the alarm priority policy mode, according to the importance level and the timestamp, add the alarm message to the message processing queue for processing the alarm message; where, in the message processing queue, for alarm messages with different importance levels, they are arranged in descending order of importance level, and for alarm messages with the same importance level, they are arranged in the order of the timestamp; where, the TPS is the number of alarm messages processed by the alarm system per second, and the QPS is the maximum alarm message processing capacity that the alarm system can bear per second; When TPS is less than or equal to QPS, based on the non-alarm priority policy mode, add the alarm message to the message processing queue according to the timestamp of the alarm message for processing the alarm message, or directly process the alarm message; The alarm message further includes an alarm message recipient; then, the method further includes: obtaining the alarm message from the message processing queue according to the order of each alarm message in the message processing queue, and sending the alarm message to the alarm message recipient.

2. The method according to claim 1, wherein The method further includes: If a message received notice is not received from the alarm message recipient within the first preset time period, send the alarm message to the alarm message recipient again.

3. The method according to claim 2, wherein After sending the alarm message to the alarm message recipient again, the method further includes: If a message received notice is not received from the alarm message recipient within the second preset time period, determine whether the alarm message is an alarm message maintained by the server, where the server maintenance specifically includes: disk cleaning and / or data synchronization; When the alarm message is an alarm message maintained by the server, send a script tool running instruction to instruct to run the corresponding script tool for disk cleaning and / or data synchronization of the server.

4. The method according to claim 1, wherein Adding the alarm message to the message processing queue according to the importance level and the timestamp specifically includes: Determine the insertion area in the message processing queue according to the importance level of the obtained alarm message, where the importance levels of the alarm messages in the insertion area are the same as the importance level of the obtained alarm message; Determine the insertion position according to the timestamp of the obtained alarm message and the timestamps of the alarm messages in the insertion area; Insert the obtained alarm message into the insertion position.

5. The method according to claim 1, characterized in that The method further includes: determining the QPS in advance through a stress test.

6. An alarm message processing device, characterized in that, Including: An obtaining unit for obtaining an alarm message, where the alarm message includes an importance level and a timestamp; An adding unit, configured to, when the TPS is greater than the QPS, based on the alarm priority policy mode, add the alarm message to a message processing queue according to the importance level and the timestamp for processing the alarm message; wherein, in the message processing queue, alarm messages with different importance levels are arranged in descending order of importance level, and for alarm messages with the same importance level, they are arranged in the order of the timestamps; wherein, the TPS is the number of alarm messages processed by the alarm system per second, and the QPS is the maximum alarm message processing capacity that the alarm system can bear per second; The adding unit is further configured to, when the TPS is less than or equal to the QPS, based on the non-alarm priority policy mode, add the alarm message to the message processing queue according to the timestamp of the alarm message for processing the alarm message, or directly process the alarm message; The alarm message further includes an alarm message receiving object; then, the apparatus further includes a sending unit, configured to obtain the alarm message from the message processing queue according to the sequence of each alarm message in the message processing queue, and send the alarm message to the alarm message receiving object.

7. An electronic device, characterized in that, Comprising: A memory for storing a computer program; A processor for executing the method according to any one of claims 1 to 5.

Images