An alarm method, device, electronic device and storage medium

Abstract

The present application provides an alarm method, device, electronic device and storage medium. The method is applied to an operation and maintenance management platform, and includes: when at least one fault alarm is received for the first time within the current set time window and the duration of the set time window has not been reached, it is determined whether there is a key alarm matching at least one fault alarm in the preset associated knowledge base; if so, if there is an aggregation analysis duration less than the duration in the aggregation analysis duration corresponding to the matched key alarm, the duration is adjusted to the minimum aggregation analysis duration, and when the adjusted duration is reached, the relevant fault alarms are aggregated and analyzed to obtain an aggregated alarm and output; if there is no aggregation analysis duration less than the duration in the aggregation analysis duration, but there is an aggregation analysis duration greater than the duration, the duration is adjusted to the maximum aggregation analysis duration, and the step of performing aggregation analysis on the relevant fault alarms when the adjusted duration is reached is executed. The present application can output aggregated alarms in a timely manner.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an alarm method, device, electronic device and storage medium. Background Art

[0002] With the advancement of technology, enterprise digital transformation and business expansion, enterprise operation and maintenance data is growing exponentially, becoming more and more diverse and more and more difficult to manage and analyze. Faced with a large number of fault alarms generated by faulty equipment in the operation and maintenance management system, the operation and maintenance management platform aggregates and analyzes them to obtain aggregated alarms and outputs the obtained aggregated alarms to significantly reduce the number of fault alarms, allowing administrators to only perform relevant operation and maintenance management based on aggregated alarms.

[0003] However, different fault scenarios generate different numbers of corresponding fault alarms, and the time distribution between related fault alarms may also vary. If the operation and maintenance management platform determines whether to perform aggregate analysis every time it receives a fault alarm, it will consume a lot of processing power. If the operation and maintenance management platform performs aggregate analysis every time it sets a time window, it cannot guarantee the timely output of aggregated alarms, resulting in poor real-time performance of aggregated alarms, affecting the operation and maintenance efficiency of the entire system. Therefore, how to reduce processing power consumption and how to improve the real-time performance of aggregated alarms are among the technical issues that need to be solved. Summary of the Invention

[0004] To overcome the problems existing in the related art, the present application provides an alarm method, device, electronic device and storage medium.

[0005] According to a first aspect of an embodiment of the present application, there is provided an alarm method, which is applied to an operation and maintenance management platform, and includes:

[0006] When at least one fault alarm is received for the first time within the current set time window and the duration of the current set time window has not yet arrived, determining whether there is a critical alarm in the preset associated knowledge base that matches at least one fault alarm among all the fault alarms;

[0007] When the judgment result is no, if the time length is reached, all fault alarms received within the current set time window are aggregated and analyzed to obtain an aggregated alarm and output it;

[0008] When the judgment result is yes, if there is an aggregation analysis duration shorter than the duration among the aggregation analysis durations corresponding to the key alarms matching at least one fault alarm among all the fault alarms in the preset associated knowledge base, the duration is adjusted to the minimum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, all fault alarms received within the adjusted duration are aggregated and analyzed to obtain and output an aggregate alarm;

[0009] If there is no aggregation analysis duration less than the said duration in the said aggregation analysis duration, but there is an aggregation analysis duration greater than the said duration, then the said duration is adjusted to the maximum aggregation analysis duration in the said aggregation analysis duration, and when the adjusted duration is reached, all fault alarms received within the adjusted duration are aggregated and analyzed to obtain an aggregate alarm and output it.

[0010] According to a second aspect of an embodiment of the present application, an alarm device is provided, which is applied to an operation and maintenance management platform, and includes:

[0011] a judgment module, configured to, when at least one fault alarm is received for the first time within a current set time window and the duration of the current set time window has not yet been reached, judge whether there is a critical alarm in a preset associated knowledge base that matches at least one fault alarm among all the fault alarms;

[0012] a first aggregation analysis module, configured to, when the judgment result of the judgment module is negative and the time period has been reached, perform aggregation analysis on all fault alarms received within the current set time window, obtain an aggregated alarm, and output the aggregated alarm;

[0013] The second aggregation analysis module is used to, when the judgment result of the judgment module is yes, if there is an aggregation analysis duration shorter than the said duration in the aggregation analysis duration corresponding to the key alarm in the preset associated knowledge base that matches at least one fault alarm among all the fault alarms, then adjust the duration to the minimum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, perform aggregation analysis on all the fault alarms received within the adjusted duration to obtain and output an aggregate alarm; if there is no aggregation analysis duration shorter than the said duration in the aggregation analysis duration but there is an aggregation analysis duration longer than the said duration, then adjust the duration to the maximum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, perform aggregation analysis on all the fault alarms received within the adjusted duration to obtain and output an aggregate alarm.

[0014] According to the third aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps of the above-mentioned alarm method.

[0015] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps of the above-mentioned alarm method are implemented.

[0016] The technical solutions provided by the embodiments of the present application may have the following beneficial effects:

[0017] In an embodiment of the present application, for the operation and maintenance management platform, when a fault alarm is received for the first time within the current set time window and the duration of the current set time window has not been reached, a decision can be made based on the key alarms in the preset associated knowledge base and their corresponding aggregation analysis durations to determine whether the duration of the current set time window needs to be adjusted; if adjustment is required, the duration of the current set time window can be adjusted (extended or shortened) based on the aggregation analysis duration corresponding to the key alarms in the preset associated knowledge base that match the received fault alarm. In this way, the operation and maintenance management platform can not only reduce the consumption of processing performance, but also output aggregated alarms in a timely manner, thereby improving the poor real-time performance of aggregated alarms, thereby improving the operation and maintenance efficiency of the entire system.

[0018] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0020] Figure 1 A flowchart of an alarm method provided in an embodiment of the present application;

[0021] Figure 2 Figure 2 shows the process of adjusting the duration of a fixed time window and outputting an aggregated alarm on the operation and maintenance platform provided in an embodiment of the present application;

[0022] Figure 3 Figure 2 shows the process of adjusting the duration of a fixed time window and outputting an aggregated alarm on the operation and maintenance platform provided in an embodiment of the present application;

[0023] Figure 4 A schematic diagram of the structure of an alarm device provided in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0026] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0027] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "when" or "when".

[0028] Next, the embodiments of the present application are described in detail.

[0029] The embodiment of the present application provides an alarm method, which is applied to an operation and maintenance management platform, such as Figure 1 As shown, the method may include the following steps:

[0030] S11. When at least one fault alarm is received for the first time within the current set time window and the duration of the current set time window has not been reached, determine whether there is a critical alarm in the preset associated knowledge base that matches at least one fault alarm among all the fault alarms; when the judgment result is no, execute step S12; when the judgment result is yes, execute step S13.

[0031] In this step, the set time window may be a fixed time window or a rolling time window.

[0032] S12: If the duration of the current set time window is reached, perform aggregation analysis on all fault alarms received within the current set time window, obtain an aggregated alarm, and output it.

[0033] S13. If there is an aggregation analysis duration shorter than the current set time window in the aggregation analysis duration corresponding to the key alarm matching at least one fault alarm in the preset associated knowledge base, the duration of the current set time window is adjusted to the minimum aggregation analysis duration in the aggregation analysis duration, and when the adjusted duration is reached, all fault alarms received within the adjusted duration are aggregated and analyzed to obtain an aggregate alarm and output it; if there is no aggregation analysis duration shorter than the current set time window in the aggregation analysis duration, but there is an aggregation analysis duration longer than the current set time window, the duration of the current set time window is adjusted to the maximum aggregation analysis duration in the aggregation analysis duration, and when the adjusted duration is reached, all fault alarms received within the adjusted duration are aggregated and analyzed to obtain an aggregate alarm and output it.

[0034] Specifically, in the above step S11, when the operation and maintenance management platform determines whether there is a critical alarm in the preset associated knowledge base that matches at least one fault alarm among all the fault alarms, it can determine whether there is an OID in the preset associated knowledge base that is the same as the object identifier (OID) of at least one fault alarm among all the fault alarms.

[0035] In other words, in the preset associated knowledge base, critical alarms are represented by OIDs, and different OIDs represent different critical alarms. Here, critical alarms generally refer to alarms that follow a certain pattern of failure occurrence, which are summarized by the administrator based on system management experience.

[0036] In addition, the preset associated knowledge base also includes the aggregation analysis duration corresponding to each critical alarm. This preset associated knowledge base can be presented in a list format, as shown in Table 1 below. Furthermore, the aggregation analysis duration corresponding to each critical alarm can be understood as the optimal aggregation analysis duration, which can be set by the administrator based on system operation and maintenance experience.

[0037]

[0038] Table 1

[0039] Furthermore, in the embodiment of the present application, the operation and maintenance management platform may also perform the following operations:

[0040] When the judgment result is yes and the aggregation analysis duration is the same as the duration of the current set time window, if the duration of the current set time window is reached, all fault alarms received within the current set time window will be aggregated and analyzed to obtain the aggregated alarm and output it.

[0041] It should be noted that in an embodiment of the present application, for the operation and maintenance management platform, after executing the above step S11, regardless of whether the judgment result is no, or there is an aggregation analysis time that is less than the current set time window in the aggregation analysis time corresponding to the key alarm matching at least one fault alarm in the preset associated knowledge base, or there is no aggregation analysis time that is less than the current set time window in the aggregation analysis time corresponding to the key alarm matching at least one fault alarm in the preset associated knowledge base, but there is an aggregation analysis time that is greater than the current set time window, or the judgment result is yes, and the aggregation analysis time is the same as the current set time window, the corresponding aggregation analysis process is the existing technology and will not be described in detail here.

[0042] Moreover, after outputting the corresponding aggregate alarm, the next set time window will be entered. If a fault alarm is also received in the next set time window, the above step S11 will continue to be executed. If no fault alarm is received in the next set time window, no related operations will be performed when the duration of the next set time window is reached. This cycle will continue until the operation and maintenance management platform stops working.

[0043] The above alarm method is described in detail below with reference to specific embodiments.

[0044] Example 1

[0045] Take the operation and maintenance management platform in a certain operation and maintenance management system as an example. Assume that the operation and maintenance management platform receives the fault alerts sent by three faulty devices for the first time at a certain moment within a fixed time window. For example, this fixed time window is Figure 2 The time window shown from 8:15 to 8:20 has a corresponding duration of 5 minutes.

[0046] In this case, the operation and maintenance management platform will determine whether there is a critical alarm matching at least one of the three fault alarms in the preset associated knowledge base.

[0047] Assume that it is determined that there is a critical alarm that matches 2 of the 3 fault alarms, that is, there is an OID that is the same as the OID of 2 of the 3 fault alarms, so the judgment result is yes. At this time, assume that the operation and maintenance management platform also finds that the aggregation analysis time corresponding to the matching critical alarms is less than 5 minutes, which means that the fault propagation range of these fault alarms is small, or the real-time requirements for the fault are high. In this case, the operation and maintenance management platform will adjust the duration of this fixed time window to the minimum aggregation analysis time (for example, 1 minute).

[0048] When the adjusted time (i.e., 8:16) is reached, the operation and maintenance management platform performs aggregate analysis on all fault alarms received within the adjusted time (i.e., from 8:15 to 8:16) to obtain aggregate alarms (e.g., Figure 2 The specific aggregation analysis process is an existing technology and will not be described in detail here.

[0049] Example 2

[0050] Still taking the operation and maintenance management platform in Example 1 as an example, assuming that the operation and maintenance management platform is Figure 3 As shown, at a certain moment within the time window of 8:20 to 8:25 (corresponding to a duration of 5 minutes), the fault alarms sent by the five faulty devices are received for the first time.

[0051] In this case, the operation and maintenance management platform will determine whether there is a critical alarm in the preset associated knowledge base that matches at least one of the five fault alarms.

[0052] Assume that it is determined that there is a critical alarm that matches these 5 fault alarms, that is, there is an OID that is the same as the OID of these 5 fault alarms, so the judgment result is yes. At this time, assume that the operation and maintenance management platform also finds that there is no aggregation analysis time less than 5 minutes in the aggregation analysis time corresponding to the matching critical alarms, but there is an aggregation analysis time greater than 5 minutes, which means that the fault propagation range of these fault alarms is larger, and more fault alarms can be aggregated. In this case, the operation and maintenance management platform will adjust the duration of this fixed time window to the maximum aggregation analysis time (for example, 7 minutes).

[0053] When the adjusted time (i.e., 8:27) is reached, the operation and maintenance management platform performs aggregate analysis on all fault alarms received within the adjusted time (i.e., from 8:15 to 8:27), and obtains the aggregate alarm (e.g. Figure 3 The specific aggregation analysis process is an existing technology and will not be described in detail here.

[0054] It can be seen from the above technical solutions that in the embodiment of the present application, for the operation and maintenance management platform, when a fault alarm is received for the first time within the current set time window and the duration of the current set time window has not been reached, it can be decided whether the duration of the current set time window needs to be adjusted based on the key alarms in the preset associated knowledge base and their corresponding aggregation analysis durations; if adjustment is required, the duration of the current set time window can be adjusted (extended or shortened) based on the aggregation analysis duration corresponding to the key alarms in the preset associated knowledge base that match the received fault alarms. In this way, the operation and maintenance management platform can not only reduce the consumption of processing performance, but also output aggregated alarms in a timely manner, thereby improving the poor real-time performance of aggregated alarms, thereby improving the operation and maintenance efficiency of the entire system.

[0055] Based on the same inventive concept, the present application also provides an alarm device, which is applied to the operation and maintenance management platform, and its structural diagram is shown as follows: Figure 4 As shown, specifically including:

[0056] The judgment module 41 is configured to, when at least one fault alarm is received for the first time within a current set time window and the duration of the current set time window has not yet expired, determine whether there is a critical alarm in a preset associated knowledge base that matches at least one fault alarm among all the fault alarms;

[0057] A first aggregation analysis module 42 is configured to, when the judgment result of the judgment module 41 is negative and the time period has been reached, perform aggregation analysis on all fault alarms received within the current set time window, obtain an aggregated alarm, and output the aggregated alarm;

[0058] The second aggregation analysis module 43 is used to, when the judgment result of the judgment module 41 is yes, if there is an aggregation analysis duration shorter than the said duration in the aggregation analysis duration corresponding to the key alarm in the preset associated knowledge base that matches at least one fault alarm among all the fault alarms, then adjust the duration to the minimum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, perform aggregation analysis on all the fault alarms received within the adjusted duration to obtain and output an aggregate alarm; if there is no aggregation analysis duration shorter than the said duration in the aggregation analysis duration but there is an aggregation analysis duration longer than the said duration, then adjust the duration to the maximum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, perform aggregation analysis on all the fault alarms received within the adjusted duration to obtain and output an aggregate alarm.

[0059] Preferably, the judgment module 41 is specifically configured to:

[0060] It is determined whether there is an OID in the preset association knowledge base that is the same as the object identifier OID of at least one fault alarm.

[0061] Preferably, the second aggregation analysis module 43 is further configured to:

[0062] When the judgment result of the judgment module 41 is yes and the aggregation analysis time is the same as the time, if the time is reached, all fault alarms received within the current set time window are aggregated and analyzed to obtain an aggregated alarm and output it.

[0063] Preferably, the set time window is a fixed time window or a rolling time window.

[0064] It can be seen from the above technical solutions that in the embodiment of the present application, for the operation and maintenance management platform, when a fault alarm is received for the first time within the current set time window and the duration of the current set time window has not been reached, it can be decided whether the duration of the current set time window needs to be adjusted based on the key alarms in the preset associated knowledge base and their corresponding aggregation analysis durations; if adjustment is required, the duration of the current set time window can be adjusted (extended or shortened) based on the aggregation analysis duration corresponding to the key alarms in the preset associated knowledge base that match the received fault alarms. In this way, the operation and maintenance management platform can not only reduce the consumption of processing performance, but also output aggregated alarms in a timely manner, thereby improving the poor real-time performance of aggregated alarms, thereby improving the operation and maintenance efficiency of the entire system.

[0065] The present application also provides an electronic device, such as Figure 5 As shown, it includes a processor 51 and a machine-readable storage medium 52, wherein the machine-readable storage medium 52 stores machine-executable instructions that can be executed by the processor 51, and the processor 51 is prompted by the machine-executable instructions to implement the steps of the above-mentioned alarm method.

[0066] The machine-readable storage medium may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the machine-readable storage medium may be at least one storage device located remote from the processor.

[0067] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0068] In another embodiment provided by the present application, a computer-readable storage medium is further provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned alarm method are implemented.

[0069] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. An alarm method, characterized in that: The method is applied to an operation and maintenance management platform, and includes: When at least one fault alarm is received for the first time within the current set time window and the duration of the current set time window has not yet arrived, determining whether there is a critical alarm in the preset associated knowledge base that matches at least one fault alarm among all the fault alarms; When the judgment result is no, if the time length is reached, all fault alarms received within the current set time window are aggregated and analyzed to obtain an aggregated alarm and output it; When the judgment result is yes, if there is an aggregation analysis duration shorter than the duration among the aggregation analysis durations corresponding to the key alarms matching at least one fault alarm among all the fault alarms in the preset associated knowledge base, the duration is adjusted to the minimum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, all fault alarms received within the adjusted duration are aggregated and analyzed to obtain and output an aggregate alarm; If there is no aggregation analysis duration shorter than the aggregation analysis duration in the aggregation analysis duration, but there is an aggregation analysis duration longer than the aggregation analysis duration, then the duration is adjusted to the maximum aggregation analysis duration in the aggregation analysis duration, and when the adjusted duration is reached, all fault alarms received within the adjusted duration are aggregated and analyzed to obtain and output aggregated alarms.

2. The method according to claim 1, characterized in that Determining whether there is a key alarm in a preset associated knowledge base that matches at least one fault alarm among all the fault alarms includes: It is determined whether there is an OID in the preset association knowledge base that is the same as the object identifier OID of at least one fault alarm.

3. The method according to claim 1, characterized in that The method further comprises: When the judgment result is yes and the aggregate analysis duration is the same as the duration, if the duration is reached, all fault alarms received within the current set time window are aggregated and analyzed to obtain and output an aggregate alarm.

4. The method according to claim 1, wherein The set time window is a fixed time window or a rolling time window.

5. An alarm device, characterized in that: The device is applied to an operation and maintenance management platform, and includes: a judgment module, configured to, when at least one fault alarm is received for the first time within a current set time window and the duration of the current set time window has not yet been reached, judge whether there is a critical alarm in a preset associated knowledge base that matches at least one fault alarm among all the fault alarms; a first aggregation analysis module, configured to, when the judgment result of the judgment module is negative and the time period has been reached, perform aggregation analysis on all fault alarms received within the current set time window, obtain an aggregated alarm, and output the aggregated alarm; The second aggregation analysis module is used to, when the judgment result of the judgment module is yes, if there is an aggregation analysis duration shorter than the said duration in the aggregation analysis duration corresponding to the key alarm in the preset associated knowledge base that matches at least one fault alarm among all the fault alarms, then adjust the duration to the minimum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, perform aggregation analysis on all the fault alarms received within the adjusted duration to obtain and output an aggregate alarm; if there is no aggregation analysis duration shorter than the said duration in the aggregation analysis duration but there is an aggregation analysis duration longer than the said duration, then adjust the duration to the maximum aggregation analysis duration among the aggregation analysis durations, and when the adjusted duration is reached, perform aggregation analysis on all the fault alarms received within the adjusted duration to obtain and output an aggregate alarm.

6. The device according to claim 5, characterized in that The judgment module is specifically used to: It is determined whether there is an OID in the preset association knowledge base that is the same as the object identifier OID of at least one fault alarm.

7. The device according to claim 5, characterized in that The second aggregation analysis module is further configured to: When the judgment result of the judgment module is yes and the aggregation analysis time is the same as the time, if the time is reached, all fault alarms received within the current set time window are aggregated and analyzed to obtain and output an aggregated alarm.

8. The device according to claim 5, characterized in that The set time window is a fixed time window or a rolling time window.

9. An electronic device, characterized in that: The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps according to any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps according to any one of claims 1 to 4 are implemented.

Images