An alarm relationship determination method, device, apparatus and storage medium

Abstract

Embodiments of the present application provide a kind of alarm relationship determination method, equipment, device and storage medium, involve data processing technical field, wherein the above-mentioned method includes: obtaining the alarm quantity of each alarm to be analyzed;According to alarm generation time and alarm generation device, the alarm to be analyzed is divided into alarm group;For each alarm to be analyzed, determine the conditional alarm of alarm quantity greater than or equal to the alarm quantity of the alarm to be analyzed, and obtain the same group times of each conditional alarm and the alarm to be analyzed in the same alarm group, according to the same group times, determine the alarm relationship between each conditional alarm and the alarm to be analyzed.The scheme provided by the embodiments of the present application can determine the alarm relationship between alarms.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to an alarm relationship determination method, device, apparatus and storage medium. BACKGROUND

[0002] Network devices such as base stations may fail during operation, causing abnormal communication network, thereby affecting network communication quality. After failure, the network device generally generates an alarm reflecting the above failure, and the staff can locate the failure according to the alarm to eliminate the failure.

[0003] Since the network device generates a large number of alarms during operation, if the staff analyzes the alarms one by one and then locates the failure, the efficiency is low. Since one failure may cause other failures, it can be considered that there is an alarm relationship between the alarms caused by these failures.

[0004] For example, the network device fails X1, triggering the generation of alarm M, and failure X1 may further cause the network device to fail X2, thereby triggering the network device to generate alarm N. Since failure X2 is caused by failure X1, it can be considered that alarm M is the root cause alarm of alarm N, alarm N is the derivative alarm of alarm M, and there is an alarm relationship between alarm M and alarm N.

[0005] Therefore, when locating the failure, if the alarm relationship between the alarms can be determined, the alarms can be analyzed according to the alarm relationship, the root cause alarm is located, and the alarms generated by the network device are compressed and filtered, thereby improving the efficiency of failure location.

[0006] In view of the above, it is necessary to provide an alarm relationship determination scheme to determine the alarm relationship between the alarms. SUMMARY

[0007] The purpose of the embodiment of the present application is to provide an alarm relationship determination method, device, apparatus and storage medium to determine the alarm relationship between different alarms. The specific technical scheme is as follows:

[0008] In a first aspect, the embodiment of the present application provides an alarm relationship determination method, which comprises:

[0009] Obtain the alarm quantity of each alarm to be analyzed;

[0010] According to the alarm generation time and the alarm generation device, the alarm to be analyzed is divided into an alarm group;

[0011] For each to-be-analyzed alarm, condition alarms whose alarm quantities are greater than or equal to the alarm quantity of the to-be-analyzed alarm are determined, and the same-group times of each condition alarm and the to-be-analyzed alarm being in the same alarm group are obtained, and alarm relationships between each condition alarm and the to-be-analyzed alarm are determined according to the same-group times.

[0012] In a second aspect, an embodiment of the present application provides an alarm relationship determining device, comprising a memory, a transceiver, and a processor.

[0013] The memory is configured to store a computer program; the transceiver is configured to transceive data under control of the processor; and the processor is configured to read the computer program in the memory and perform the following operations:

[0014] obtain alarm quantities of each to-be-analyzed alarm;

[0015] divide the to-be-analyzed alarms into alarm groups according to alarm generation times and alarm generation devices;

[0016] For each to-be-analyzed alarm, condition alarms whose alarm quantities are greater than or equal to the alarm quantity of the to-be-analyzed alarm are determined, and the same-group times of each condition alarm and the to-be-analyzed alarm being in the same alarm group are obtained, and alarm relationships between each condition alarm and the to-be-analyzed alarm are determined according to the same-group times.

[0017] In a third aspect, an embodiment of the present application provides an alarm relationship determining apparatus, comprising:

[0018] a quantity determining module configured to obtain alarm quantities of each to-be-analyzed alarm;

[0019] an alarm group dividing module configured to divide the to-be-analyzed alarms into alarm groups according to alarm generation times and alarm generation devices;

[0020] a relationship determining module configured to, for each to-be-analyzed alarm, determine condition alarms whose alarm quantities are greater than or equal to the alarm quantity of the to-be-analyzed alarm, and obtain the same-group times of each condition alarm and the to-be-analyzed alarm being in the same alarm group, and determine alarm relationships between each condition alarm and the to-be-analyzed alarm according to the same-group times.

[0021] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method steps of any of the first aspect.

[0022] In a fifth aspect, an embodiment of the present application further provides a computer program product containing instructions, which, when executed on a computer, cause the computer to perform the method steps of any of the first aspect.

[0023] The embodiment of the present application has the following beneficial effects:

[0024] The embodiment of the present application provides a method for determining alarm relationship. First, the number of alarms to be analyzed is obtained, and the alarms to be analyzed are divided into alarm groups according to alarm generation time and alarm generation device. For each alarm to be analyzed, conditional alarms whose number of alarms is greater than or equal to the number of alarms of the alarm to be analyzed are determined, and the number of times that each conditional alarm and the alarm to be analyzed are in the same alarm group is obtained. According to the number of times, the alarm relationship between each conditional alarm and the alarm to be analyzed is determined.

[0025] As can be seen from the above, if one fault is the root cause of another fault, then if a device has the root cause fault, the possibility of another derived fault occurring in a short time is high, so the device will generate alarms indicating the above two faults in a short time. Therefore, if the same device generates two different alarms at similar times, it can be considered that the possibility of the alarm relationship between the above two alarms is high. The scheme provided by the embodiment of the present application divides alarms into alarm groups according to alarm generation time and alarm generation device, and the alarms in the same alarm group are generated by the same device and have similar generation times. If the number of times that the conditional alarm and the alarm to be analyzed are in the same alarm group is high, it can be considered that the same device generates the conditional alarm and the alarm to be analyzed at similar times, so it can be considered that the conditional alarm and the alarm to be analyzed have an alarm relationship.

[0026] Moreover, since the derived fault is caused by the root cause fault, in most cases, the number of occurrences of the root cause fault is greater than the number of occurrences of the derived fault, so the number of alarms of the root cause alarm corresponding to the root cause fault is often greater than the number of alarms of the derived alarm corresponding to the derived fault. Since the number of alarms of the conditional alarm is greater than or equal to the number of alarms of the alarm to be analyzed in the embodiment of the present application, it can be roughly determined that the conditional alarm with the alarm relationship is the root cause alarm of the alarm to be analyzed. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and other drawings can also be obtained by those skilled in the art according to these drawings.

[0028] Figure 1 The flowchart of the first alarm relationship determination method provided by the embodiment of the present application is shown in the figure;

[0029] Figure 2 The flowchart of the second alarm relationship determination method provided by the embodiment of the present application is shown in the figure;

[0030] Figure 3 A flowchart of a third alarm relationship determination method provided for an embodiment of the present application is shown in FIG. 6;

[0031] Figure 4 A flowchart of a fourth alarm relationship determination method provided for an embodiment of the present application is shown in FIG. 7;

[0032] Figure 5A A diagram of a first alarm chain table group provided for an embodiment of the present application is shown in FIG. 8;

[0033] Figure 5B A diagram of a second alarm chain table group provided for an embodiment of the present application is shown in FIG. 9;

[0034] Figure 5C A diagram of a third alarm chain table group provided for an embodiment of the present application is shown in FIG. 10;

[0035] Figure 5D A diagram of a fourth alarm chain table group provided for an embodiment of the present application is shown in FIG. 11;

[0036] Figure 5E A diagram of a fifth alarm chain table group provided for an embodiment of the present application is shown in FIG. 12;

[0037] Figure 5F A diagram of a sixth alarm chain table group provided for an embodiment of the present application is shown in FIG. 13;

[0038] Figure 5G A diagram of a seventh alarm chain table group provided for an embodiment of the present application is shown in FIG. 14;

[0039] Figure 5H A diagram of an eighth alarm chain table group provided for an embodiment of the present application is shown in FIG. 15;

[0040] Figure 5I A diagram of a ninth alarm chain table group provided for an embodiment of the present application is shown in FIG. 16;

[0041] Figure 5J A diagram of a tenth alarm chain table group provided for an embodiment of the present application is shown in FIG. 17;

[0042] Figure 6A A diagram of a first condition mode base provided for an embodiment of the present application is shown in FIG. 18;

[0043] Figure 6B A diagram of a second condition mode base provided for an embodiment of the present application is shown in FIG. 19;

[0044] Figure 6C A diagram of a third condition mode base provided for an embodiment of the present application is shown in FIG. 20;

[0045] Figure 6D A diagram of a fourth condition mode base provided for an embodiment of the present application is shown in FIG. 21;

[0046] Figure 6E A fifth conditional pattern base provided for an embodiment of the present application is shown in the diagram;

[0047] Figure 6F A sixth conditional pattern base provided for an embodiment of the present application is shown in the diagram;

[0048] Figure 7 A flowchart of a fifth alarm relationship determination method provided for an embodiment of the present application is shown in the diagram;

[0049] Figure 8 A flowchart of an alarm relationship determination method applied to base station alarm provided for an embodiment of the present application is shown in the diagram;

[0050] Figure 9 A structural diagram of an alarm relationship determination device provided for an embodiment of the present application is shown in the diagram;

[0051] Figure 10 A structural diagram of an alarm relationship determination device provided for an embodiment of the present application is shown in the diagram. DETAILED DESCRIPTION

[0052] In the embodiments of the present application, the term “and / or” describes the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist simultaneously, and B exists alone. The character “ / ” generally represents an “or” relationship between the associated objects before and after it.

[0053] In the embodiments of the present application, the term “multiple” means two or more, and other quantifiers are similar.

[0054] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art based on the embodiments of the present application belong to the scope of protection of the present application.

[0055] In order to determine the alarm relationship between alarms, the embodiments of the present application provide an alarm relationship determination method, device, apparatus and storage medium.

[0056] The embodiments of the present application provide an alarm relationship determination method, and the above method comprises:

[0057] Obtain the alarm quantity of each alarm to be analyzed;

[0058] According to the alarm generation time and the alarm generation device, the alarm to be analyzed is divided into an alarm group;

[0059] For each to-be-analyzed alarm, a conditional alarm whose alarm quantity is greater than or equal to the alarm quantity of the to-be-analyzed alarm is determined, and the same-group times of each conditional alarm and the to-be-analyzed alarm located in the same alarm group are obtained, and the alarm relationship between each conditional alarm and the to-be-analyzed alarm is determined according to the same-group times.

[0060] As can be seen from the above, if one fault is the root cause of another fault, if the device has the root cause fault, then the possibility of another derivative fault occurring in a short time is higher, and therefore the device will generate alarms indicating the above two faults in a short time. Therefore, if the same device generates two different alarms multiple times in a similar time, it can be considered that the possibility of an alarm relationship between the above two alarms is higher. The scheme provided by the embodiment of the present application divides the alarms into alarm groups according to alarm generation time and alarm generation device, the alarms in the same alarm group are generated by the same device, and the generation time is relatively close. If the same-group times of the conditional alarm and the to-be-analyzed alarm located in the same alarm group are higher, it can be considered that the same device generates the conditional alarm and the to-be-analyzed alarm multiple times in a similar time, and therefore it can be considered that the conditional alarm and the to-be-analyzed alarm have an alarm relationship.

[0061] Moreover, since the derivative fault is caused by the root cause fault, in most cases, the occurrence times of the root cause fault are greater than the occurrence times of the derivative fault, and therefore the alarm quantity of the root cause alarm corresponding to the root cause fault is often greater than the alarm quantity of the derivative alarm corresponding to the derivative fault. Since the alarm quantity of the conditional alarm is greater than or equal to the alarm quantity of the to-be-analyzed alarm in the embodiment of the present application, it can be roughly determined that the conditional alarm with an alarm relationship is the root cause alarm of the to-be-analyzed alarm.

[0062] Referring to Figure 1 The flowchart of the first alarm relationship determination method provided by the embodiment of the present application is shown in the figure, and the method includes the following steps S101-S103.

[0063] S101: Obtain the alarm quantity of each to-be-analyzed alarm.

[0064] Specifically, the alarms generated by each network device in a preset time period can be obtained as to-be-analyzed alarms. The network device can be a base station, a switch, etc.

[0065] In an embodiment of the present application, alarm information indicating the to-be-analyzed alarm can be obtained, the alarm information can be recorded in the device log, and the alarm information stores an alarm number. The alarm numbers corresponding to different alarms are different, and different to-be-analyzed alarms can be distinguished according to the alarm numbers, and the alarm quantity of each to-be-analyzed alarm can be counted.

[0066] Referring to Table 1, the first alarm information example table provided by the embodiment of the present application is shown in the figure.

[0067] Table 1

[0068]

[0069]

[0070] In the table 1, the alarms shown in the table 1 are alarms generated by the base station, and it can be seen from the table 1 that the alarm numbers and alarm names of different alarms are different, the gNB field in the example of the table 1 represents the base station corresponding to the alarm, and the other fields respectively represent the devices in the base station corresponding to the alarm, the alarms with the same gNB field correspond to the same base station, and the alarms with the same other field correspond to the same device. Specifically, the above example is an example, and the values of the above fields of each alarm are not limited to the above example. Each field in the above example is a field contained in the prior art alarm information, and the meaning of each field will not be described here.

[0071] S102: According to the alarm generation time and the alarm generation device, the to-be-analyzed alarms are divided into alarm groups.

[0072] In an embodiment of the present application, the to-be-analyzed alarms generated by the same alarm generation device and having alarm generation times in the same time period can be divided into the same alarm group.

[0073] For example, the length of the above-mentioned time period can be 10ms, 50ms, etc.

[0074] Specifically, the alarm generation time of the to-be-analyzed alarm can be determined according to the generation time information carried in the alarm information representing the to-be-analyzed alarm, and the alarm generation device of the to-be-analyzed alarm can be determined according to the generation device information carried in the alarm information.

[0075] S103: For each to-be-analyzed alarm, a condition alarm having an alarm number greater than or equal to the alarm number of the to-be-analyzed alarm is determined, the same group times of each condition alarm and the to-be-analyzed alarm located in the same alarm group are obtained, and the alarm relationship existing between each condition alarm and the to-be-analyzed alarm is determined according to the above-mentioned same group times.

[0076] In an embodiment of the present application, for each to-be-analyzed alarm, the condition alarms having alarm numbers greater than or equal to the alarm number of the to-be-analyzed alarm can be determined in all to-be-analyzed alarms, and then each alarm group is traversed to count the times of each condition alarm and the to-be-analyzed alarm located in the same alarm group.

[0077] In another embodiment of the present application, the alarms in each alarm group can be sorted in descending order of the alarm number, the alarms located before the to-be-analyzed alarm in each alarm group are determined as the condition alarms, and the times of each condition alarm located before the to-be-analyzed alarm in each alarm group are counted.

[0078] Specifically, the more the same-group times between the conditional alarm and the alarm to be analyzed, the more the times that the conditional alarm and the alarm to be analyzed are generated in succession by the same device in a short time, and the higher the probability that the conditional alarm and the alarm to be analyzed have an alarm relationship. Therefore, according to the above same-group times, it is determined that the conditional alarm and the alarm to be analyzed have an alarm relationship if the same-group times are greater than preset same-group times.

[0079] In addition, the alarm relationship between each conditional alarm and the alarm to be analyzed can also be determined through the following steps A-B.

[0080] Step A: According to the same-group times between each conditional alarm and the alarm to be analyzed, the same-group frequency between each conditional alarm and the alarm to be analyzed is calculated.

[0081] Specifically, for each conditional alarm, the above same-group frequency can be the same-group times of the conditional alarm divided by the sum of the same-group times of each conditional alarm. The above same-group frequency can be referred to as the same-group support.

[0082] Step B: If the same-group frequency between the conditional alarm and the alarm to be analyzed is greater than a preset same-group frequency, it is determined that the conditional alarm and the alarm to be analyzed have an alarm relationship.

[0083] Specifically, the higher the same-group frequency of the conditional alarm, the higher the probability that the conditional alarm and the alarm to be analyzed are generated in succession by the same device in a short time among the conditional alarms generated in succession by the same device in a short time with the alarm to be analyzed, and it can be considered that the conditional alarm and the alarm to be analyzed have an alarm relationship.

[0084] In addition, the alarm relationship between each conditional alarm and the alarm to be analyzed can also be determined through the following step C.

[0085] Step C: According to the above same-group times, the alarm relationship between each conditional alarm and the alarm to be analyzed, except for a preset relationship, is determined.

[0086] The above preset relationship is a historical alarm relationship that has been determined and / or an error alarm relationship.

[0087] Specifically, the above determined historical alarm relationship is a known alarm relationship, so it does not need to be determined repeatedly, and the above historical alarm relationship can be recorded in a white list. The above error alarm relationship can be an alarm relationship composed of alarms that are manually set and do not have root cause and derivative relationships, and the above error alarm relationship can be recorded in a black list.

[0088] In one embodiment of the present application, after the alarm relationship between the condition alarm and the alarm to be analyzed is determined according to the same group number, the preset relationship can be removed from the determined alarm relationship.

[0089] In another embodiment of the present application, the alarm relationship between two alarms indicates that one of the two alarms is a root cause alarm and the other is a derived alarm. After the alarm relationship between the two alarms is determined, it can be further determined which one of the two alarms with the alarm relationship is the root cause alarm and which one is the derived alarm.

[0090] Specifically, since the root cause fault indicated by the root cause alarm is the cause of the derived fault indicated by the derived alarm, the alarm quantity of the root cause alarm is usually greater than that of the derived alarm. If the alarm quantities of the two alarms are different, the alarm with the greater alarm quantity can be considered as the root cause alarm and the alarm with the smaller alarm quantity can be considered as the derived alarm. Since the root cause fault indicated by the root cause alarm occurs before the derived fault indicated by the derived alarm, the alarm generation time of the root cause alarm is usually earlier than that of the derived alarm. If the alarm quantities of the two alarms are the same, the alarm with the earlier alarm generation time can be determined as the root cause alarm and the other alarm can be determined as the derived alarm.

[0091] Further, since the alarm relationship is the alarm relationship between two alarms, the alarm relationship can be expressed in the form of a binomial set. The alarm identifiers of the two alarms with the alarm relationship can be recorded in the binomial set. The alarm identifier can be an alarm number. The alarm identifier of the root cause alarm can be located at the front end of the binomial set and the alarm identifier of the derived alarm can be located at the rear end of the binomial set.

[0092] As can be seen from the above, if one fault is the root cause of another fault, if the device has the root cause fault, the possibility of another derived fault occurring in a short time is high. Therefore, the device will generate alarms indicating the two faults in a short time. Therefore, if the same device generates two different alarms at similar times, it can be considered that the possibility of the alarm relationship between the two alarms is high. After the alarms are divided into alarm groups according to the alarm generation time and the alarm generation device in the scheme provided by the embodiments of the present application, the alarms in the same alarm group are generated by the same device and the generation time is relatively close. If the same group number of the condition alarm and the alarm to be analyzed is high, it can be considered that the same device generates the condition alarm and the alarm to be analyzed at similar times. Therefore, it can be considered that the condition alarm and the alarm to be analyzed have an alarm relationship.

[0093] Furthermore, since derivative faults are caused by root cause faults, the number of occurrences of root cause faults is usually greater than the number of occurrences of derivative faults. Therefore, the number of root cause alarms corresponding to root cause faults is often greater than the number of derivative alarms corresponding to derivative faults. In this embodiment of the invention, the number of conditional alarms is greater than or equal to the number of alarms to be analyzed. Therefore, it can be roughly determined that conditional alarms with alarm relationships are the root cause alarms of the alarms to be analyzed.

[0094] In one embodiment of the present invention, before step S102 described above, the following steps D-E may also be included.

[0095] Step D: Determine the frequency of occurrence of each alarm to be analyzed based on the number of alarms detected.

[0096] Specifically, for each alarm to be analyzed, the frequency of occurrence of the alarm can be calculated by dividing the number of alarms for that alarm by the sum of the number of alarms for all alarms to be analyzed. This frequency of occurrence can be referred to as the support level of the alarm to be analyzed.

[0097] Step E: Delete alarms to be analyzed that occur less frequently than the preset frequency.

[0098] Specifically, if the probability of an alarm to be analyzed is low, it means that the alarm to be analyzed may be an alarm that occurs alone and the possibility of an alarm relationship with other alarms is low. Therefore, alarms to be analyzed with a probability of occurrence lower than the preset probability can be deleted. The alarm relationship between the alarm to be analyzed and other alarms is uncertain, which can save the computing resources required to determine the alarm relationship and improve the efficiency of determining the alarm relationship.

[0099] See Figure 2 This is a flowchart illustrating the second alarm relationship determination method provided in this embodiment of the invention, which is consistent with the aforementioned... Figure 1 Compared to the illustrated embodiment, step S102 can be implemented by step S102A.

[0100] S102A: Based on the alarm generation time, alarms generated by the same device among the alarms to be analyzed are divided into alarm groups according to the fault type.

[0101] Specifically, the above-mentioned fault types can be classified according to the fault location indicated by the alarm to be analyzed. For example, if the alarm to be analyzed indicates a base station fault, then the alarm to be analyzed belongs to the base station type; if the alarm to be analyzed indicates a motherboard fault, then the alarm to be analyzed belongs to the motherboard type; if the alarm to be analyzed indicates a chip fault, then the alarm to be analyzed belongs to the chip type, etc.

[0102] The fault type can also be a fault impact level of the fault indicated by the alarm, for example, the fault impact level can be a serious level, a common level, and the like.

[0103] The same alarm to be analyzed can correspond to one or more fault types, for example, if the alarm to be analyzed indicates a chip fault, since the chip is installed on the mainboard, and the mainboard is installed in the base station, the alarm to be analyzed can correspond to the chip type, the mainboard type, and the base station type.

[0104] In an embodiment of the present application, the fault type corresponding to the alarm to be analyzed can be determined according to a field contained in the alarm information indicating the alarm to be generated. For example, if the gNB field indicating the base station corresponding to the alarm is contained in the alarm information, it indicates that the alarm information corresponds to the base station fault, and the alarm to be analyzed corresponds to the base station type. If the board field indicating the mainboard corresponding to the alarm is contained in the alarm information, it indicates that the alarm information corresponds to the mainboard fault, and the alarm to be analyzed corresponds to the mainboard type.

[0105] In addition, the alarms can be divided into different alarm levels according to the fault types, for example, all alarms generated by the base station can correspond to the base station type, the alarms corresponding to the base station type can be divided into a first-level alarm, some of the alarms corresponding to the base station type correspond to the mainboard type, the alarms corresponding to the mainboard type can be divided into a second-level alarm, some of the alarms corresponding to the mainboard type correspond to the chip type, the alarms corresponding to the chip type can be divided into a third-level alarm, and so on. The first-level alarm contains the second-level alarm, and the second-level alarm contains the third-level alarm. As can be seen, the alarms belonging to the same alarm level correspond to the same fault type, and the alarms belonging to different alarm levels correspond to different fault types.

[0106] In an embodiment of the present application, alarms generated by the same alarm generating device, in the same time period, and corresponding to the same fault type can be divided into the same alarm group. If the same alarm corresponds to multiple fault types, the same alarm can be divided into multiple alarm groups for different fault types.

[0107] In addition, the foregoing Figure 1 Compared with the foregoing, the step S103 can be implemented through the following steps S103A-S103B.

[0108] S103A: For each alarm to be analyzed, determine a conditional alarm whose alarm quantity is greater than or equal to the alarm quantity of the alarm to be analyzed, and for each fault type, obtain the same group times of each conditional alarm and the alarm to be analyzed located in the same alarm group corresponding to the fault type, and determine the alarm relationship between each conditional alarm and the alarm to be analyzed for the fault type according to the obtained same group times.

[0109] In one embodiment of the present application, for each fault type, the same-group times of each condition alarm and the alarm to be analyzed in the alarm group for the fault type are counted respectively, so that the alarm relationship between each condition alarm and the alarm to be analyzed for the fault type is determined according to the same-group times.

[0110] Specifically, the same-group times and the manner of determining the alarm relationship for each fault type are similar to the step S103, and the embodiments of the present application will not be described here.

[0111] S103B: Obtain the alarm relationship existing for each fault type.

[0112] Specifically, the alarm relationship obtained for different fault types can be different, so the intersection of the alarm relationships for different fault types can be determined as the obtained alarm relationship.

[0113] As can be seen from the above, for different fault types, the alarm relationship corresponding to the fault type is determined as the final obtained alarm relationship only if the alarm relationship exists for each fault type, so that the final obtained alarm relationship is applicable to each fault type. Since the final obtained alarm relationship is determined and screened for multiple times, the final obtained alarm relationship is more accurate.

[0114] In another embodiment of the present application, if the fault types corresponding to two alarms in the determined alarm relationship are different, the alarm relationship can be directly determined as the final obtained alarm relationship, so that the alarm relationship between alarms across fault types can be confirmed.

[0115] In yet another embodiment of the present application, if the alarm to be analyzed is divided into different alarm levels according to the fault type, the alarm to be analyzed belonging to the first-level alarm can be used as the alarm to be analyzed in the process of executing steps S101-S103 to obtain the alarm relationship for the first-level alarm. The alarm to be analyzed not belonging to the second-level alarm is removed, and steps S101-S103 are repeatedly executed to obtain the alarm relationship for the second-level alarm, and the alarm relationship for each level of alarm is determined in turn. The alarm relationship existing for each level of alarm is obtained as the final determined alarm relationship.

[0116] Referring to Figure 3 The flowchart of the third alarm relationship determination method provided by the embodiments of the present application is similar to the above Figure 1 Compared with the above-mentioned embodiments, the method further includes steps S104-S105 after step S102.

[0117] S104: Sort the alarms in each alarm group according to a first order.

[0118] wherein the first order is an order from large to small of the number of alarms.

[0119] Referring to Table 2, an example of an alarm group provided for an embodiment of the present application is shown.

[0120] Table 2

[0121]

[0122]

[0123] wherein each entry in Table 2 contains each alarm in an alarm group. The order of each alarm from front to back in each entry is the first order.

[0124] S105: generating alarm chain table groups according to each alarm group, and determining the node count of each chain table node in the alarm chain table.

[0125] wherein each chain table node in an alarm chain table corresponds to each alarm in an alarm group in order along the node link order, and the alarm with the same order number in the same alarm group corresponds to the same chain table node.

[0126] Specifically, an alarm chain table in the alarm chain table group is composed of each chain table node from the starting chain table node without a parent node to the ending chain table node without a child node in the link relationship between chain table nodes. Each chain table node can record the alarm identifier of the alarm corresponding to the chain table node, wherein the alarm identifier can be represented in the form of an alarm number.

[0127] One chain table node in the alarm chain table group corresponds to one alarm, and one alarm can correspond to multiple chain table nodes in the alarm chain table group.

[0128] Since each chain table node in an alarm chain table corresponds to each alarm in an alarm group in order along the node link order, the alarm corresponding to the chain table node at the front end of the alarm chain table has an alarm number greater than or equal to the alarm number of the alarm corresponding to the chain table node at the rear end.

[0129] In one embodiment of the present application, alarm chain lists corresponding to each alarm group can be generated respectively, for each two alarm chain lists, alarm nodes corresponding to the same alarms in sequence from the starting chain list node between the two alarm chain lists are determined, and the chain list segment composed of the determined alarm nodes is referred to as a coincident chain list segment. The alarm nodes with the same arrangement number in the coincident chain list segment in the two alarm chain lists correspond to the same alarm, and the two alarm chain lists can be merged according to the coincident chain list segment, so that the alarms with the same arrangement number in the alarms in sequence from the starting alarm between the alarm groups corresponding to the two alarm chain lists correspond to the same alarm node. The above-mentioned process of merging alarm chain lists is repeatedly executed until there is no alarm chain list containing a coincident chain list segment.

[0130] Specifically, the last alarm node of the coincident chain list segment in the first alarm chain list in the two alarm chain lists can be linked to the first alarm node except the coincident chain list segment in the second alarm chain list, and the coincident chain list segment in the second alarm chain list can be removed, so as to realize the merging of the two alarm chain lists.

[0131] In addition, the node count of the starting chain list node in an alarm chain list is the number of times that the alarm corresponding to the chain list node is located at the first position in the alarm group.

[0132] Specifically, after the above-mentioned alarm chain list group is generated, the alarm corresponding to the starting alarm node of each alarm chain list can be counted in the alarm group to obtain the number of times that the alarm is located at the first position in the alarm group, which is taken as the node count of the starting chain list node. The above-mentioned node count can also be stored in the node.

[0133] In addition, the node count of the starting chain list node in an alarm chain list is the number of times that the alarm corresponding to the chain list node is located at the first position in the alarm group.

[0134] Specifically, for each other chain list node, the alarm group can be traversed to count the number of times that the first alarm is located before and adjacent to the second alarm, and the counted number of times is taken as the node count of the other chain list node and stored in the other chain list node.

[0135] Furthermore, the starting nodes of each alarm chain list in the above-mentioned alarm chain list group are linked to the root node of a tree structure. Each alarm node in each alarm chain list is a child node in the above-mentioned tree structure.

[0136] Specifically, the above-mentioned root node does not correspond to an alarm, and is only used to link each alarm chain list, so the above-mentioned root node can be an empty node, and the tree structure formed by the above-mentioned alarm chain list group can be referred to as an alarm tree.

[0137] In addition, compared with the foregoing Figure 1 The step S103 can be implemented by the following steps S103C-S103D compared with the embodiment shown in the foregoing.

[0138] S103C: For each alarm to be analyzed, determine the chain table node located before the chain table node corresponding to the alarm to be analyzed in each chain table of the alarm chain table group, and determine the alarm corresponding to the determined chain table node as a conditional alarm.

[0139] Specifically, in each alarm chain table in the alarm chain table group, each chain table node in an alarm chain table corresponds to each alarm in an alarm group in order along the node link order, and the arrangement order of the alarms in the alarm group is the order of the alarm quantity from large to small. Therefore, the alarm corresponding to the node at the front in the alarm chain table has a larger alarm count. The alarm count of the alarm corresponding to the chain table node located before the chain table node corresponding to the alarm to be analyzed is greater than the alarm to be analyzed, and therefore the alarm corresponding to the determined chain table node is the conditional alarm.

[0140] In an embodiment of the present application, the alarm chain table can be traversed from the starting chain table node of each alarm chain table, and the alarm corresponding to each chain table node can be determined in turn. If the determined chain table node corresponds to the alarm to be analyzed, the alarm corresponding to each chain table node in the alarm chain table except the chain table node corresponding to the alarm to be analyzed is determined as the conditional alarm.

[0141] Each chain table node except the chain table node corresponding to the alarm to be analyzed can be linked in turn to form a conditional chain table, and the conditional chain table can be referred to as a conditional pattern base. The alarm corresponding to each node contained in the conditional pattern base corresponding to the alarm to be analyzed is the conditional alarm of the alarm to be analyzed.

[0142] S103D: According to the node count of the chain table node corresponding to the alarm to be analyzed, the same group number of each conditional alarm and the alarm to be analyzed in the same alarm group is determined, and according to the same group number, the alarm relationship existing between each conditional alarm and the alarm to be analyzed is determined.

[0143] In an embodiment of the present application, the same group number of each conditional alarm and the alarm to be analyzed in the same alarm group can be determined by the following step F.

[0144] Step F: For each conditional alarm, the sum of the node counts of the analysis nodes in the same alarm chain table as the conditional node is determined as the same group number of the conditional alarm and the alarm to be analyzed in the same alarm group.

[0145] The conditional node is the chain table node corresponding to the conditional alarm, and the analysis node is the chain table node corresponding to the alarm to be analyzed.

[0146] Specifically, for each condition alarm, a condition node corresponding to the condition alarm can be determined, and it is determined whether there is a to-be-analyzed node in the alarm chain list in which the condition node is located along the node link direction from the condition node. If there is, the node count of the determined to-be-analyzed node is accumulated on the same group number corresponding to the condition alarm. The initial value of the same group number corresponding to each condition alarm is 0.

[0147] In addition, each to-be-analyzed node can also be determined in the alarm chain list group, and a path from the starting chain list node to the to-be-analyzed node is determined. The node count of the to-be-analyzed node in the path is recorded as a sub-same group number corresponding to the condition alarm corresponding to each chain list node. For each condition alarm, the sum of the sub-same group numbers corresponding to the condition alarm is taken as the same group number corresponding to the condition alarm.

[0148] In another embodiment of the present application, in the process of generating the condition pattern base, the same group number of the condition alarm corresponding to each node in the condition pattern base can be calculated by the above-mentioned manner as the node count of the node in the condition pattern base, and recorded in the node of the condition pattern base. Then, by querying the node count of each node in the condition pattern base corresponding to the to-be-analyzed alarm, the same group number corresponding to the condition alarm corresponding to the node can be determined.

[0149] As can be seen from the above, the embodiment of the present application can construct an alarm chain list group to represent the size relationship between the alarms corresponding to the chain list nodes in the alarm chain list in the order of the chain list nodes, and represent the number of times that the first alarm in each alarm group is located before and adjacent to the second alarm by the node count. Thus, the condition alarm of the to-be-analyzed alarm can be determined by the front-back relationship of the chain list nodes in the alarm chain list group, and the same group number corresponding to the condition alarm can be determined according to the node count. Moreover, the alarm chain list group generated by using the chain list structure has a clear structure and simple storage, and compared with directly storing the alarm information, the alarm information is stored in the form of the alarm chain list group, which can more simply record the relationship between the alarms.

[0150] Referring to Figure 4 The flowchart of the fourth alarm relationship determination method provided by the embodiment of the present application is similar to the above-mentioned embodiment. Figure 3 Compared with the above-mentioned embodiment, the step S105 can be realized by the following steps S105A-S105D.

[0151] S105A: generating an alarm chain list corresponding to the target alarm group, and determining the node count of each chain list node in the generated alarm chain list as 1.

[0152] The starting target alarm group is an arbitrary alarm group.

[0153] Specifically, along the link order of the chain table nodes in the generated alarm chain table, each chain table node in the alarm chain table corresponds to each alarm in the target alarm group in order.

[0154] S105B: determining an alarm group from the alarm groups without generating alarm chain tables as a new target alarm group.

[0155] Specifically, the alarm group without generating alarm chain table is an alarm group that has not been a target alarm group.

[0156] In an embodiment of the present application, an alarm group can be randomly determined from the alarm groups without generating alarm chain tables as a target alarm group, or an alarm group with the most contained alarms can be selected as a target alarm group, etc.

[0157] S105C: determining the chain table node corresponding to the alarm identical to the alarm in the target alarm group from the start chain table node in the generated alarm chain table.

[0158] In an embodiment of the present application, the start chain table node corresponding to the alarm identical to the start alarm in the target alarm group can be determined, if the start chain table node exists, whether the alarm corresponding to the next chain table node linked by the start chain table node is identical to the second alarm in the target alarm group is determined, and the same is true until the alarm corresponding to the chain table node is different from the alarm at the same arrangement serial number in the target alarm group. Thus, the chain table node corresponding to the alarm identical to the alarm from the start alarm in the target alarm group from the start chain table node is determined.

[0159] If the node determination is successful, it means that there is a chain table node corresponding to the alarm identical to the alarm from the start alarm in the target alarm group from the start chain table node in the generated alarm chain table, and step S105D can be executed.

[0160] If the node determination fails, it means that there is no chain table node corresponding to the alarm identical to the alarm from the start alarm in the target alarm group from the start chain table node in the generated alarm chain table, and a separate alarm chain table can be generated for the target alarm group, and step S105A is returned to be executed.

[0161] S105D: respectively adding 1 to the node count of the determined chain table node, generating a sub-alarm chain table, linking the last determined chain table node to the start chain table node of the sub-alarm chain table, and determining the node count of each chain table node in the sub-alarm chain table to be 1.

[0162] The chain table node in the sub-alarm chain table corresponds to the alarm in the target alarm group in sequence along the node link order.

[0163] Specifically, if the determined node is successful, the determined node can be used as the node corresponding to the alarm before the target alarm in the target alarm group, and a sub-alarm chain table is generated for the alarm after the target alarm. The last chain table node is linked to the starting chain table node of the sub-alarm chain table. Therefore, the determined chain table nodes and the chain table nodes in the generated sub-alarm chain table together form an alarm chain table corresponding to the target alarm group. Each chain table node in the alarm chain table corresponds to an alarm in the target alarm group.

[0164] If there is an alarm group for which the alarm chain table has not been generated after the alarm chain table of the target alarm group is generated, the step S105B is executed.

[0165] As can be seen from the above, if there is a chain table node in the generated alarm chain table, which corresponds to the alarm in sequence from the starting chain table node to the alarm in the target alarm group, it is not necessary to generate a chain table node for the alarm before the target alarm in the target alarm group. The node count of the determined chain table node is increased by 1, and the last chain table node is linked to the starting chain table node of the generated sub-alarm chain table. Therefore, it can be ensured that the alarm with the same arrangement number corresponds to the same chain table node in the alarm in sequence from the starting alarm in the alarm groups. If there is no chain table node corresponding to the alarm in sequence from the starting chain table node to the alarm in the target alarm group, a chain table is generated for the target alarm group. The same is true for all alarm groups. Each chain table node in the alarm chain table corresponds to each alarm in the first alarm group in sequence.

[0166] The process of generating the alarm chain table group corresponding to the 10 alarm groups in the above table 2 is described below.

[0167] Referring to Figure 5A The first alarm chain table group provided by the embodiment of the present application is shown in the following figure.

[0168] The first alarm group in the above table 2 is used as the target alarm group, and the alarm chain table corresponding to the first alarm group is generated. Figure 5A The alarm chain table corresponding to the first alarm group is generated. The alarm chain table contains a chain table node corresponding to the alarm a, a chain table node corresponding to the alarm d, a chain table node corresponding to the alarm e, a chain table node corresponding to the alarm f, and a chain table node corresponding to the alarm b. The node count of each chain table node is 1, which is the same as the arrangement order of the alarm a, the alarm d, the alarm e, the alarm f, and the alarm b in the first alarm group.

[0169] Referring to Figure 5B , a diagram of a second alarm chain table group provided for an embodiment of the present application is shown.

[0170] In the diagram, the second alarm group in Table 2 above is taken as a target alarm group, the first alarm in the current target alarm group is alarm a, and the second alarm is alarm d. The path in the alarm chain table generated so far, in which the alarm corresponding to the first chain table node is alarm a, and the alarm corresponding to the second chain table node is alarm d, is shown. The part in the diagram enclosed by the dashed line is the chain table node in the alarm chain table generated so far, in which the alarm corresponding to the starting chain table node is the same as the alarm starting from the starting alarm in the target alarm group, i.e., the chain table node corresponding to alarm a and alarm d. As compared with the alarm chain table group shown in Figure 5A In the diagram, the node count of each chain table node in the part enclosed by the dashed line is incremented by 1. A sub-alarm chain table can be generated, which contains the chain table node corresponding to alarm g, and the last chain table node determined, i.e., the chain table node corresponding to alarm d, is linked to the starting chain table node of the sub-alarm chain table, i.e., the chain table node corresponding to alarm g.

[0171] Referring to Figure 5C , a diagram of a third alarm chain table group provided for an embodiment of the present application is shown.

[0172] In the diagram, the third alarm group in Table 2 above is taken as a target alarm group, which contains alarm e. Since there is no alarm chain table in which the alarm corresponding to the starting chain table node is alarm e in the alarm chain table generated so far except the root node, there is no chain table node in the alarm chain table generated so far, in which the alarm corresponding to the starting chain table node is the same as the alarm starting from the starting alarm in the target alarm group. Therefore, an alarm chain table can be generated for the current target alarm group alone, which contains a chain table node corresponding to alarm e, and the node count of the chain table node is 1.

[0173] Referring to Figure 5D , a diagram of a fourth alarm chain table group provided for an embodiment of the present application is shown.

[0174] In the diagram, the fourth alarm group in Table 2 above is taken as a target alarm group, which contains alarm a, alarm d, and alarm e. The path in the alarm chain table generated so far, in which the alarm corresponding to the first chain table node is alarm a, the alarm corresponding to the second chain table node is alarm d, and the alarm corresponding to the third chain table node is alarm e, is shown. The part in the diagram enclosed by the dashed line is the chain table node in the alarm chain table generated so far, in which the alarm corresponding to the starting chain table node is the same as the alarm starting from the starting alarm in the target alarm group, i.e., the chain table node contained in the path above, and the chain table node corresponding to alarm e. As compared with the alarm chain table group shown in Figure 5CThe node count of each list node in the dashed box is increased by 1 compared with the shown alarm chain list group. A sub-alarm chain list can be generated, which contains the list nodes corresponding to alarms g and c in turn, and the determined last list node, i.e. the list node corresponding to alarm e, is linked to the starting list node of the sub-alarm chain list, i.e. the list node corresponding to alarm g.

[0175] Referring to Figure 5E A seventh alarm chain list group provided by an embodiment of the present application is shown in FIG. 7.

[0176] In the sixth alarm group in Table 2, the first alarm in the current target alarm group is alarm e, and there is a path in the generated alarm chain list in which the alarm corresponding to the first list node is alarm e. The part in the dashed box in the figure is the list nodes in the generated alarm chain list in which the alarm corresponding to the starting list node is the same as the starting alarm in the target alarm group in turn, i.e. the list nodes contained in the path, and the list nodes are the same as the list nodes in the path described above. Figure 5D The node count of each list node in the dashed box is increased by 1 compared with the shown alarm chain list group. If the current target alarm group does not contain other alarms, a sub-alarm chain list does not need to be generated.

[0177] Referring to Figure 5F A seventh alarm chain list group provided by an embodiment of the present application is shown in FIG. 7.

[0178] In the sixth alarm group in Table 2, the first alarm in the current target alarm group is alarm e, and there is a path in the generated alarm chain list in which the alarm corresponding to the first list node is alarm e. The part in the dashed box in the figure is the list nodes in the generated alarm chain list in which the alarm corresponding to the starting list node is the same as the starting alarm in the target alarm group in turn, i.e. the list nodes contained in the path, and the list nodes are the same as the list nodes in the path described above. Figure 5E The node count of each list node in the dashed box is increased by 1 compared with the shown alarm chain list group. If the current target alarm group does not contain other alarms, a sub-alarm chain list does not need to be generated.

[0179] Referring to Figure 5G A seventh alarm chain list group provided by an embodiment of the present application is shown in FIG. 7.

[0180] The eighth alarm group in Table 2 is taken as the target alarm group. The first alarm in the current target alarm group is alarm a, the second alarm is alarm d, and the path in the generated alarm chain list except the root node has the first chain list node corresponding to alarm a and the second chain list node corresponding to alarm d. The part in the dashed box in the figure is the chain list node in the generated alarm chain list, which has the alarm corresponding to the starting chain list node and the alarm in the target alarm group starting from the starting alarm successively identical. The chain list node is included in the path, and the chain list node is the same as the chain list node in the path described above. Figure 5F The node count of each chain list node in the dashed box is increased by 1 compared with the alarm chain list group shown in the figure. Since the current target alarm group does not include other alarms, a sub-alarm chain list does not need to be generated.

[0181] Referring to Figure 5H The eighth alarm chain list group provided by the embodiment of the application is shown in the figure.

[0182] The eighth alarm group in Table 2 is taken as the target alarm group. The first alarm in the current target alarm group is alarm a, the second alarm is alarm d, and the path in the generated alarm chain list except the root node has the first chain list node corresponding to alarm a and the second chain list node corresponding to alarm d. The part in the dashed box in the figure is the chain list node in the generated alarm chain list, which has the alarm corresponding to the starting chain list node and the alarm in the target alarm group starting from the starting alarm successively identical. The chain list node is included in the path, and the chain list node is the same as the chain list node in the path described above. Figure 5G The node count of each chain list node in the dashed box is increased by 1 compared with the alarm chain list group shown in the figure. Since the current target alarm group does not include other alarms, a sub-alarm chain list does not need to be generated.

[0183] Referring to Figure 5I The ninth alarm chain list group provided by the embodiment of the application is shown in the figure.

[0184] The ninth alarm group in Table 2 is taken as a target alarm group. The first alarm in the current target alarm group is alarm a, the second alarm is alarm d, the third alarm is alarm e, and the fourth alarm is alarm g. In the generated alarm chain list, the alarm corresponding to the first chain list node is alarm a, the alarm corresponding to the second chain list node is alarm d, the alarm corresponding to the third chain list node is alarm e, and the alarm corresponding to the fourth chain list node is alarm g. The part in the dashed box in the figure is a chain list node in the generated alarm chain list, which is the same as the alarm corresponding to the starting chain list node and the alarm starting from the starting alarm in the target alarm group in sequence. The chain list nodes included in the path are the same as the path in the alarm chain list group shown in Figure 5H The node count of each chain list node in the dashed box is increased by 1 compared with the alarm chain list group shown in

[0185] Referring to Figure 5J FIG. 6 is a schematic diagram of a tenth alarm chain list group provided by an embodiment of the present application.

[0186] The tenth alarm group in Table 2 is taken as a target alarm group. The first alarm in the current target alarm group is alarm a, the second alarm is alarm d, the third alarm is alarm e, and the fourth alarm is alarm g. In the generated alarm chain list, the alarm corresponding to the first chain list node is alarm a, the alarm corresponding to the second chain list node is alarm d, the alarm corresponding to the third chain list node is alarm e, and the alarm corresponding to the fourth chain list node is alarm g. The part in the dashed box in the figure is a chain list node in the generated alarm chain list, which is the same as the alarm corresponding to the starting chain list node and the alarm starting from the starting alarm in the target alarm group in sequence. The chain list nodes included in the path are the same as the path in the alarm chain list group shown in Figure 5I The node count of each chain list node in the dashed box is increased by 1 compared with the alarm chain list group shown in

[0187] After the alarm chain list group shown in Figure 5J is generated, a condition pattern base for each alarm to be analyzed can be determined.

[0188] Referring to Figure 6A FIG. 7 is a schematic diagram of a first condition pattern base provided by an embodiment of the present application.

[0189] In the condition pattern base shown in Figure 6A the condition pattern base shown in Figure 6A The left part in Figure 5J the alarm chain list group shown in FIG. 5 is a path from the starting chain list node to the chain list node corresponding to alarm b. As can be seen from the path, the chain list nodes corresponding to alarm a, alarm d, alarm e, and alarm f are all located before the chain list node corresponding to alarm b. Figure 6AThe right side is the conditional pattern base for alarm b determined based on the above path. The conditional pattern base contains nodes for alarms a, d, e, and f respectively. The node count of each node is the number of times the corresponding alarm and alarm b are in the same group.

[0190] See Figure 6B This is a schematic diagram of the second conditional mode base provided in an embodiment of the present invention.

[0191] in, Figure 6B The conditional pattern base shown is the conditional pattern base for alarm c. Figure 6B The middle left part is Figure 5J The path from the starting node to the corresponding alarm c in the alarm list group shown above shows that the nodes of alarms a, d, e, and g are all located before the node of alarm c. Figure 6B The right side is the conditional pattern base for alarm c, determined based on the above path. The conditional pattern base contains nodes for alarms a, d, e, and g, respectively. The node count of each node is the number of times the corresponding alarm and alarm c are in the same group.

[0192] See Figure 6C This is a schematic diagram of the third conditional mode base provided in the embodiments of the present invention.

[0193] in, Figure 6C The conditional pattern base shown is the conditional pattern base for alarm f. Figure 6C The middle left part is Figure 5J The path from the starting node to the corresponding alarm f in the alarm list group shown above shows that the nodes of alarms a, d, and e are all located before the node of alarm f. Figure 6C The right side is the conditional pattern base for alarm f determined based on the above path. The conditional pattern base contains nodes for alarms a, d, and e respectively. The node count of each node is the number of times the corresponding alarm and alarm f are in the same group.

[0194] See Figure 6D This is a schematic diagram of the fourth conditional mode base provided in the embodiments of the present invention.

[0195] in, Figure 6D The conditional pattern base shown is the conditional pattern base for alarm g. Figure 6D The middle left part is Figure 5J The path from the starting node to the corresponding alarm g in the alarm list group shown above shows that the nodes of alarms a, d, and e are all located before the node of alarm g. Figure 6DThe right part is a condition pattern base for the alarm g based on the path, and the condition pattern base includes nodes for the alarms a, d and e respectively, and the node count of each node is the same group number between the corresponding alarm and the alarm g.

[0196] Referring to Figure 6E FIG. 5 is a schematic diagram of a fifth condition pattern base provided by an embodiment of the present application.

[0197] In the condition pattern base shown in FIG. 5, the condition pattern base is a condition pattern base for the alarm e. Figure 6E The left part of FIG. 5 is a path from the start list node to the list node corresponding to the alarm e in the alarm list group shown in FIG. 4, and from the path, it can be seen that the list nodes corresponding to the alarms a and d are located before the list node corresponding to the alarm e. Figure 6E The right part is a condition pattern base for the alarm e based on the path, and the condition pattern base includes nodes for the alarms a and d respectively, and the node count of each node is the same group number between the corresponding alarm and the alarm e. Figure 5J Figure 6E Referring to FIG. 6 is a schematic diagram of a sixth condition pattern base provided by an embodiment of the present application.

[0198] Figure 6F In the condition pattern base shown in FIG. 6, the condition pattern base is a condition pattern base for the alarm d.

[0199] In the condition pattern base shown in FIG. 6, the condition pattern base is a condition pattern base for the alarm d. Figure 6F The left part of FIG. 6 is a path from the start list node to the list node corresponding to the alarm d in the alarm list group shown in FIG. 4 except the root node, and from the path, it can be seen that the list node corresponding to the alarm a is located before the list node corresponding to the alarm d. Figure 6F The right part is a condition pattern base for the alarm d based on the path, and the condition pattern base includes a node for the alarm a, and the node count is the same group number between the alarm a and the alarm d. Figure 5J Figure 6F Referring to FIG. 7 is a flowchart of a fifth alarm relationship determination method provided by an embodiment of the present application, and compared with the foregoing

[0200] Compared with the embodiment shown in FIG. 7, the method further includes the following step S106 after step S105A. Figure 7 Figure 4 S106: For each list node in the alarm list, link the entry table node corresponding to the same alarm in the entry table to the list node.

[0201] S106: For each list node in the alarm list, link the entry table node corresponding to the same alarm in the entry table to the list node.

[0202] Each entry table node in the entry table corresponds to one of the to-be-analyzed alarms.

[0203] ​​Specifically, the item header table can also be in the form of a linked list, and each item header table node in the item header table is linked in sequence, and each item header table node in the item header table records the alarm identifier of the corresponding alarm.

[0204] In an embodiment of the present application, the item header table node can be directly linked to the linked list node corresponding to the same alarm. The item header table node can also be linked to the first generated linked list node corresponding to the same alarm in the alarm linked list group, the first generated linked list node is linked to the second generated linked list node corresponding to the same alarm, and so on. The item header table node is directly linked to the first generated linked list node corresponding to the same alarm and indirectly linked to other linked list nodes corresponding to the same alarm.

[0205] In addition, the pointer for linking the item header table node and the linked list node is different from the pointer between the linked list nodes in the alarm linked list group. The pointer for linking the linked list nodes corresponding to the same alarm is different from the pointer between the linked list nodes in the alarm linked list group.

[0206] Compared with the foregoing Figure 4 After the step S105D, the following step S107 is further included.

[0207] S107: For each linked list node in the sub-alarm linked list, link the item header table node corresponding to the same alarm as the linked list node in the item header table to the linked list node.

[0208] In an embodiment of the present application, the manner of linking the item header table and the linked list nodes in the sub-alarm linked list is similar to the foregoing step S106, and will not be described here again.

[0209] Compared with the foregoing Figure 4 The step S103C can also be implemented by the following steps S103C1-S103C2.

[0210] S103C1: For each to-be-analyzed alarm, determine the linked list node linked by the item header table node corresponding to the to-be-analyzed alarm in the item header table as the linked list node corresponding to the to-be-analyzed alarm.

[0211] Specifically, if the item header table node is directly connected to each linked list node, the linked list node directly linked by the item header table can be directly determined as the linked list node corresponding to the to-be-analyzed alarm.

[0212] If the item header table node is indirectly linked to part of the linked list nodes, the first linked list node directly linked to the item header table node can be determined first, then the second linked list node linked to the first linked list node is determined, and so on, to determine each linked list node corresponding to the to-be-analyzed alarm.

[0213] S103C2: determining the alarm corresponding to the chain table node before the chain table node corresponding to the to-be-analyzed alarm as a condition alarm.

[0214] From the above, since each item table node in the item table links the chain table node corresponding to the same alarm, the chain table node corresponding to the to-be-analyzed alarm in the alarm chain table group can be quickly found through the item table node. The alarm chain table group does not need to be traversed, thereby reducing the amount of calculation required when determining a condition alarm.

[0215] In an embodiment of the present application, if the alarm is a base station generated alarm, and the alarm is divided into different alarm levels, and the alarm corresponding to the base station type can be divided into a first level alarm, the alarm relationship between alarms can be determined through the following embodiment.

[0216] Referring to Figure 8 A flowchart of a method for determining an alarm relationship applied to a base station alarm is provided in an embodiment of the present application.

[0217] S801: determining whether it is the first time to determine an alarm relationship.

[0218] If yes, step S802 is executed, otherwise, step S803 is executed.

[0219] S802: setting the black list and the white list as empty.

[0220] Since there is no determined historical alarm relationship and no known false alarm relationship when the alarm relationship is determined for the first time, the black list and the white list can be set as empty. Step S803 is then executed.

[0221] S803: obtaining a to-be-analyzed alarm generated in a preset time period.

[0222] S804: grouping the obtained to-be-analyzed alarm according to alarm generation time to obtain an initial alarm group.

[0223] S805: if the to-be-analyzed alarm is a first level alarm, the alarms in the initial alarm group are divided into alarm groups according to alarm generation equipment.

[0224] Specifically, since the to-be-analyzed alarm is a base station generated alarm, the alarms in the initial alarm group can be further divided according to the base station generating the to-be-analyzed alarm to obtain each alarm group.

[0225] S806: determining the alarm relationship existing between the alarms according to the alarm groups.

[0226] Specifically, the manner of determining the alarm relationship is similar to the embodiment shown in step S103, and the embodiment of the present application will not be described again.

[0227] S807: determining the root cause alarm and the derived alarm in the two alarms according to the alarm quantity and alarm generation time of the two alarms with the alarm relationship.

[0228] S808: judging whether the two alarms in the determined alarm relationship are alarms belonging to different alarm levels.

[0229] If yes, step S809 is executed, otherwise step S814 is executed.

[0230] S809: removing the alarm relationship belonging to the blacklist and / or the whitelist in the determined alarm relationship.

[0231] S810: updating the above-mentioned blacklist and whitelist according to the determined alarm relationship.

[0232] Specifically, the obtained alarm relationship can be shown to the staff, and after the staff filters the alarm relationship, the alarm relationship added to the blacklist and the whitelist is determined.

[0233] S811: if the above-mentioned alarm to be analyzed is not a first-level alarm, the alarms in the primary alarm group are divided into alarm groups according to the target level.

[0234] The initial target level is the second level.

[0235] S812: determining the alarm relationship between the alarms for the target level according to the above-mentioned alarm groups.

[0236] S813: determining the root cause alarm and the derived alarm in the two alarms according to the alarm quantity and alarm generation time of the two alarms with the alarm relationship for the target level.

[0237] S814: obtaining the alarm relationship in the determined alarm relationship for the target level which is the same as the alarm relationship for the first level.

[0238] After obtaining the above-mentioned alarm relationship, step S809 can be executed to remove the alarm relationship belonging to the blacklist and / or the whitelist in the obtained alarm relationship.

[0239] If the above-mentioned target level is the highest level, step S803 is returned to re-obtain new alarm to be analyzed to continue the confirmation of the next round of alarm relationship.

[0240] If the above-mentioned target level is not the highest level, step S815 is executed.

[0241] S815: update the target level to the next level, and return to step S811.

[0242] Specifically, the above Figure 8 The embodiment shown is a specific implementation of the above-mentioned alarm relationship determination method, similar to the above-mentioned embodiment of the alarm relationship determination method, and the embodiment of the application will not be described again.

[0243] Corresponding to the above-mentioned alarm relationship determination method, the embodiment of the application provides an alarm relationship determination device.

[0244] Referring to Figure 9 A structural schematic diagram of an alarm relationship determination device provided by the embodiment of the application comprises a memory 901, a transceiver 902, and a processor 903.

[0245] The memory 901 is used for storing a computer program; the transceiver 902 is used for transceiving data under the control of the processor; and the processor 903 is used for reading the computer program in the memory and performing the following operations:

[0246] obtaining the alarm quantity of each alarm to be analyzed;

[0247] dividing the alarm to be analyzed into an alarm group according to the alarm generation time and the alarm generation device;

[0248] For each alarm to be analyzed, determining a conditional alarm whose alarm quantity is greater than or equal to the alarm quantity of the alarm to be analyzed, and obtaining the same group times of each conditional alarm and the alarm to be analyzed located in the same alarm group, and determining the alarm relationship between each conditional alarm and the alarm to be analyzed according to the same group times.

[0249] Among them, in Figure 9 The bus architecture can comprise any number of interconnected buses and bridges, which are specifically linked together by various circuits of one or more processors represented by the processor 903 and the memory represented by the memory 901. The bus architecture can also link various other circuits such as peripheral devices, voltage stabilizers, and power management circuits, which are well known in the art, and thus will not be further described herein. The bus interface provides an interface. The transceiver 902 can be a plurality of elements, i.e., comprising a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, including wireless channels, wired channels, optical cables, and other transmission media. The processor 903 is responsible for managing the bus architecture and general processing, and the memory 901 can store data used by the processor 903 in performing operations.

[0250] The processor 903 can be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor can also be a multi-core architecture.

[0251] As can be seen from the above, if one fault is the root cause of another fault, if the device has the root cause fault, then the possibility of another derivative fault occurring in a short time is high, and therefore the device will generate alarms indicating the above two faults in a short time. Therefore, if the same device generates two different alarms at similar times, it can be considered that the possibility of an alarm relationship between the above two alarms is high. The scheme provided by the embodiment of the present application divides the alarms into alarm groups according to the alarm generation time and the alarm generation device, the alarms in the same alarm group are generated by the same device, and the generation time is relatively close. If the number of times that the condition alarm and the to-be-analyzed alarm are in the same alarm group is high, it can be considered that the same device generates the condition alarm and the to-be-analyzed alarm at similar times multiple times. Therefore, it can be considered that there is an alarm relationship between the condition alarm and the to-be-analyzed alarm.

[0252] Moreover, since the derivative fault is caused by the root cause fault, in most cases, the number of occurrences of the root cause fault is greater than the number of occurrences of the derivative fault, and therefore the number of root cause alarms corresponding to the root cause fault is often greater than the number of derivative alarms corresponding to the derivative fault. Since the number of alarms of the condition alarm is greater than or equal to the number of alarms of the to-be-analyzed alarm in the embodiment of the present application, it can be roughly determined that the condition alarm that has an alarm relationship is the root cause alarm of the to-be-analyzed alarm.

[0253] In an embodiment of the present application, the to-be-analyzed alarm is divided into alarm groups according to the alarm generation time and the alarm generation device, and specifically includes:

[0254] According to the alarm generation time, the alarms with the same alarm generation device in the to-be-analyzed alarm are divided into alarm groups according to the fault type;

[0255] The number of times that each condition alarm and the to-be-analyzed alarm are in the same alarm group is obtained, and the alarm relationship between each condition alarm and the to-be-analyzed alarm is determined according to the number of times, and specifically includes:

[0256] For each fault type, obtain the same group times of each condition alarm and the to-be-analyzed alarm located in the same alarm group corresponding to the fault type, and determine the alarm relationship between each condition alarm and the to-be-analyzed alarm for the fault type according to the obtained same group times.

[0257] Obtain the alarm relationship existing for each fault type.

[0258] As can be seen from the above, for different fault types, the alarm relationship corresponding to the fault type is determined as the final obtained alarm relationship only if the alarm relationship exists for each fault type, so that the final obtained alarm relationship is applicable to each fault type. Since the final obtained alarm relationship is determined and screened for multiple times, the final obtained alarm relationship is relatively accurate.

[0259] In an embodiment of the application, after the to-be-analyzed alarm is divided into alarm groups according to alarm generation time and alarm generation device, the method further comprises:

[0260] Sort the alarms in each alarm group according to a first order, wherein the first order is an order from large to small in alarm quantity.

[0261] Generate an alarm chain table group according to each alarm group, and determine the node count of each chain table node in the alarm chain table, wherein each chain table node in a chain table corresponds to each alarm in an alarm group arranged in order along the node link order, and the alarm with the same arrangement serial number in each alarm group from the starting alarm in sequence corresponds to the same chain table node; the node count of the starting chain table node in a chain table is the number of times that the alarm corresponding to the chain table node is located at the first position in the alarm group; the node count of each chain table node other than the starting chain table node is the number of times that the first alarm is located before and adjacent to the second alarm in each alarm group, the first alarm is the alarm corresponding to the previous chain table node of the chain table node, and the second alarm is the alarm corresponding to the chain table node;

[0262] The condition alarm with an alarm quantity greater than or equal to the alarm quantity of the to-be-analyzed alarm is determined, and the same group times of each condition alarm and the to-be-analyzed alarm located in the same alarm group are obtained, specifically comprising:

[0263] In each alarm chain table of the alarm chain table group, determine the chain table node located before the chain table node corresponding to the to-be-analyzed alarm, and determine the alarm corresponding to the determined chain table node as a condition alarm.

[0264] According to the node count of the chain table node corresponding to the to-be-analyzed alarm, determine the same group times of each condition alarm and the to-be-analyzed alarm located in the same alarm group.

[0265] As can be seen from the above, the embodiment of the present application can construct an alarm chain list group, express the size relationship of the alarms corresponding to the chain table nodes in the alarm chain list group in the order of the chain table nodes in the alarm chain list group, and express the number of times that the first alarm in each alarm group is located before and adjacent to the second alarm by the node count. Thus, the conditional alarm of the alarm to be analyzed can be determined according to the relationship between the chain table nodes in the alarm chain list group, and the same group number corresponding to the conditional alarm can be determined according to the node count. In addition, the alarm chain list group generated by using the chain table structure has clear structure and simple storage, and compared with the alarm information directly stored in the alarm, the alarm information stored in the form of the alarm chain list group can record the relationship between the alarms more simply.

[0266] In one embodiment of the present application, the alarm chain list group is generated according to each alarm group, and the node count of each chain table node in the alarm chain list is determined, which specifically includes:

[0267] generating an alarm chain list corresponding to the target alarm group, and determining the node count of each chain table node in the generated alarm chain list as 1, wherein the starting target alarm group is an arbitrary alarm group;

[0268] determining an alarm group from the alarm groups without generated alarm chain list as a new target alarm group;

[0269] determining, in the generated alarm chain list, the chain table nodes in which the alarms corresponding to the starting chain table node and the alarms starting from the starting alarm in the target alarm group are sequentially identical;

[0270] if the determination of the node is successful, adding 1 to the node count of the determined chain table node respectively, generating a sub-alarm chain list, linking the last determined chain table node to the starting chain table node of the sub-alarm chain list, and determining the node count of each chain table node in the sub-alarm chain list as 1, wherein each chain table node in the sub-alarm chain list corresponds to the alarm sequentially arranged after the target alarm in the target alarm group along the node linking order, and the target alarm is the alarm corresponding to the last determined chain table node;

[0271] if the determination of the node fails, returning to execute the step of generating the alarm chain list corresponding to the target alarm group;

[0272] if there is an alarm group without generated alarm chain list, returning to execute the step of determining an alarm group from the alarm groups without generated alarm chain list as a new target alarm group.

[0273] As can be seen from the above, if there is a chain table node corresponding to the same alarm as the starting alarm of the target alarm group in the generated alarm chain table, the chain table node is not needed to be generated separately for the alarm before the target alarm in the target alarm group, the node count of the determined chain table node is directly added by 1, and the determined last chain table node is linked to the starting chain table node of the generated sub-alarm chain table. Thus, it can be ensured that the alarms with the same arrangement number in the alarm groups correspond to the same chain table node. If there is no chain table node corresponding to the same alarm as the starting alarm of the target alarm group in the generated alarm chain table, a chain table is generated separately for the target alarm group, and the same is applied to all alarm groups. Each chain table node in the alarm chain table corresponds to each alarm in the first alarm group in sequence.

[0274] In an embodiment of the present application, after the alarm chain table corresponding to the target alarm group is generated, the method further comprises:

[0275] For each chain table node in the alarm chain table, a table header node corresponding to the same alarm as the chain table node in the table header table is linked to the chain table node, wherein each table header node in the table header table corresponds to one of the alarms to be analyzed.

[0276] After the last chain table node is linked to the starting chain table node of the sub-alarm chain table, the method further comprises:

[0277] For each chain table node in the alarm chain table, a table header node corresponding to the same alarm as the chain table node in the table header table is linked to the chain table node.

[0278] The method of determining the chain table node before the chain table node corresponding to the alarm to be analyzed in each alarm chain table in the alarm chain table group and determining the alarm corresponding to the determined chain table node as the conditional alarm comprises:

[0279] The chain table node linked to the table header node corresponding to the alarm to be analyzed in the table header table is determined as the chain table node corresponding to the alarm to be analyzed.

[0280] The alarm corresponding to the chain table node before the chain table node corresponding to the alarm to be analyzed is determined as the conditional alarm.

[0281] As can be seen from the above, since each table header node in the table header table links to the chain table node corresponding to the same alarm, the chain table node corresponding to the alarm to be analyzed in the alarm chain table group can be quickly found through the table header node. Thus, the calculation amount required for determining the conditional alarm can be reduced.

[0282] In one embodiment of the present application, the same-group times of each condition alarm and the alarm to be analyzed in the same alarm group are determined according to the node count of the linked list node corresponding to the alarm to be analyzed, and specifically include:

[0283] For each condition alarm, the sum of the node count of the analyzed node in the same alarm linked list as the condition node is determined as the same-group times of the condition alarm and the alarm to be analyzed in the same alarm group, wherein the condition node is the linked list node corresponding to the condition alarm, and the analyzed node is the linked list node corresponding to the alarm to be analyzed.

[0284] In one embodiment of the present application, the start nodes of each alarm linked list in the alarm linked list group are linked to the root node of the tree structure.

[0285] Each alarm node in each alarm linked list is a child node in the tree structure.

[0286] In one embodiment of the present application, after the alarm quantity of each alarm to be analyzed is obtained, the method further includes:

[0287] According to the alarm times of each alarm to be analyzed, the occurrence frequency of each alarm to be analyzed is determined.

[0288] The alarm to be analyzed with an occurrence frequency lower than a preset occurrence frequency is deleted.

[0289] In one embodiment of the present application, the alarm relationship between each condition alarm and the alarm to be analyzed is determined according to the same-group times, and specifically includes:

[0290] According to the same-group times between each condition alarm and the alarm to be analyzed, the same-group frequency between each condition alarm and the alarm to be analyzed is calculated.

[0291] If the same-group frequency between the condition alarm and the alarm to be analyzed is greater than a preset same-group frequency, it is determined that the alarm relationship exists between the condition alarm and the alarm to be analyzed.

[0292] In one embodiment of the present application, the alarm relationship between each condition alarm and the alarm to be analyzed is determined according to the same-group times, and specifically includes:

[0293] According to the same-group times, the alarm relationship between each condition alarm and the alarm to be analyzed, except for a preset relationship, is determined, wherein the preset relationship is a historical alarm relationship and / or an error alarm relationship that has been determined.

[0294] Corresponding to the foregoing alarm relationship determination method, an embodiment of the present application further provides an alarm relationship determination device.

[0295] Referring toFigure 10 Fig. 1 is a structural schematic diagram of an alarm relationship determination device according to an embodiment of the present application.

[0296] The number determination module 1001 is configured to obtain alarm numbers of each alarm to be analyzed.

[0297] The alarm group division module 1002 is configured to divide the alarms to be analyzed into alarm groups according to alarm generation time and alarm generation device.

[0298] The relationship determination module 1003 is configured to, for each alarm to be analyzed, determine conditional alarms whose alarm numbers are greater than or equal to the alarm number of the alarm to be analyzed, and obtain a same-group number of each conditional alarm and the alarm to be analyzed in the same alarm group, and determine an alarm relationship between each conditional alarm and the alarm to be analyzed according to the same-group number.

[0299] Specifically, the alarm relationship determination device determines the alarm relationship in a manner similar to the embodiments shown in the alarm relationship determination method, and the present application will not be described again.

[0300] As can be seen from the above, if one fault is the root cause of another fault, then if a device has the root cause fault, the possibility of another derivative fault occurring in a short time is high, and therefore the device will generate alarms indicating the two faults in a short time. Therefore, if the same device generates two different alarms at similar times, it can be considered that the possibility of an alarm relationship between the two alarms is high. After the alarm is divided into alarm groups according to alarm generation time and alarm generation device in the scheme provided by the present application, the alarms in the same alarm group are generated by the same device and the generation time is relatively close. If the same-group number of the conditional alarm and the alarm to be analyzed in the same alarm group is high, it can be considered that the same device generates the conditional alarm and the alarm to be analyzed at similar times multiple times, and therefore it can be considered that an alarm relationship exists between the conditional alarm and the alarm to be analyzed.

[0301] Moreover, since the derivative fault is caused by the root cause fault, in most cases, the occurrence number of the root cause fault is greater than the occurrence number of the derivative fault, and therefore the alarm number of the root cause alarm corresponding to the root cause fault is often greater than the alarm number of the derivative alarm corresponding to the derivative fault. Since the alarm number of the conditional alarm is greater than or equal to the alarm number of the alarm to be analyzed in the present application, it can be roughly determined that the conditional alarm with the alarm relationship is the root cause alarm of the alarm to be analyzed.

[0302] In another embodiment of the present application, a computer readable storage medium is also provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps of any of the alarm relationship determination methods.

[0303] When the computer readable storage medium provided by the embodiment of the present application is used to determine the alarm relationship, if one fault is the root cause of another fault, then if the device has the root cause fault, the possibility of another derived fault occurring in a short time is higher, and thus the device will generate alarms indicating the above two faults in a short time. Therefore, if the same device generates two different alarms at similar times for multiple times, it can be considered that the possibility of the alarm relationship between the above two alarms is higher. After the alarm is divided into alarm groups according to the alarm generation time and the alarm generation device, the alarms in the same alarm group are generated by the same device and the generation time is relatively close. If the same group times of the condition alarm and the alarm to be analyzed in the same alarm group are higher, it can be considered that the same device generates the condition alarm and the alarm to be analyzed at similar times for multiple times, and thus it can be considered that the condition alarm and the alarm to be analyzed have the alarm relationship.

[0304] Moreover, since the derived fault is caused by the root cause fault, in most cases, the occurrence times of the root cause fault are greater than the occurrence times of the derived fault, and thus the alarm quantity of the root cause alarm corresponding to the root cause fault is often greater than the alarm quantity of the derived alarm corresponding to the derived fault. Since the alarm quantity of the condition alarm is greater than or equal to the alarm quantity of the alarm to be analyzed in the embodiment of the present application, it can be determined that the condition alarm that has the alarm relationship is the root cause alarm of the alarm to be analyzed.

[0305] In another embodiment provided by the present application, a computer program product containing instructions is also provided, which, when running on a computer, causes the computer to execute the alarm relationship determination method in any of the above embodiments.

[0306] When the computer program product provided by the embodiment of the present application is used to determine the alarm relationship, if one fault is the root cause of another fault, then if the device has the root cause fault, the possibility of another derived fault occurring in a short time is higher, and thus the device will generate alarms indicating the above two faults in a short time. Therefore, if the same device generates two different alarms at similar times for multiple times, it can be considered that the possibility of the alarm relationship between the above two alarms is higher. After the alarm is divided into alarm groups according to the alarm generation time and the alarm generation device, the alarms in the same alarm group are generated by the same device and the generation time is relatively close. If the same group times of the condition alarm and the alarm to be analyzed in the same alarm group are higher, it can be considered that the same device generates the condition alarm and the alarm to be analyzed at similar times for multiple times, and thus it can be considered that the condition alarm and the alarm to be analyzed have the alarm relationship.

[0307] Further, since the derived fault is caused by the root cause fault, in most cases, the number of occurrences of the root cause fault is greater than the number of occurrences of the derived fault, and thus the alarm quantity of the root cause alarm corresponding to the root cause fault is usually greater than the alarm quantity of the derived alarm corresponding to the derived fault. Since in the embodiment of the present application, the alarm quantity of the conditional alarm is greater than or equal to the alarm quantity of the alarm to be analyzed, it can be roughly determined that the conditional alarm with the alarm relationship is the root cause alarm of the alarm to be analyzed.

[0308] In the above embodiments, the implementation can be achieved by software, hardware, firmware or any combination thereof, entirely or partially. When implemented by software, the implementation can be achieved in the form of a computer program product, entirely or partially. The computer program product includes one or more computer instructions. When loaded and executed by a computer, the computer instructions entirely or partially generate the processes or functions described in the embodiments of the present application. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. containing one or more available media. The available medium can be a magnetic medium (for example, floppy disk, hard disk, magnetic tape), optical medium (for example, DVD) or semiconductor medium (for example, solid state disk (SSD)) and the like.

[0309] It should be noted that in this paper, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0310] Each of the embodiments in the present specification is described in a related manner, and the same or similar parts among the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the alarm relationship determination device, the apparatus, the storage medium, and the computer program embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0311] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk memory and optical memory) embodying computer-usable program code.

[0312] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer executable instructions. These computer executable instructions can be provided to a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing apparatus to produce a machine, so that the instructions executed by the computer or other programmable data processing apparatus generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure One one or more flows and / or blocks Figure One means for carrying out the functions specified in the flowchart

[0313] These processor executable instructions can also be stored in a processor readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the processor readable memory produce a manufactured product including instruction means, which implements the functions specified in the flowcharts and / or block diagrams. Figure One one or more flows and / or blocks Figure One means for carrying out the functions specified in the flowchart

[0314] These processor executable instructions can also be loaded into a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable data processing apparatus to produce a computer implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure One one or more flows and / or blocks Figure One means for carrying out the functions specified in the flowchart

[0315] Obviously, various modifications and changes can be made to the present application by those skilled in the art without departing from the spirit and scope of the present application. Accordingly, it is intended that the present application embrace all such modifications and changes as fall within the scope of the embodiments disclosed herein and their equivalents.

Claims

1. An alarm relationship determination method characterized by comprising: The method comprises: obtaining alarm quantity of each alarm to be analyzed; dividing the alarms to be analyzed into alarm groups according to alarm generation time and alarm generation device; sorting alarms in each alarm group according to a first order, wherein the first order is from large to small alarm quantity; generating alarm linked list groups according to each alarm group and determining node count of each linked list node in the alarm linked list, wherein each linked list node in an alarm linked list corresponds to each alarm in an alarm group arranged in order along node link order, and alarms with the same arrangement number in each alarm group in turn correspond to the same linked list node from the starting alarm; the node count of the starting linked list node in an alarm linked list is the number of times the alarm corresponding to the starting linked list node is located at the first position in the alarm group; the node count of other linked list nodes except the starting linked list node is the number of times the first alarm before and adjacent to the second alarm in each alarm group, and the first alarm is the alarm corresponding to the previous linked list node of the other linked list node, and the second alarm is the alarm corresponding to the other linked list node; for each alarm to be analyzed, determining the linked list node before the linked list node corresponding to the alarm to be analyzed in each alarm linked list of the alarm linked list group, and determining the alarm corresponding to the determined linked list node as a conditional alarm; determining the same group number of each conditional alarm and the alarm to be analyzed in the same alarm group according to the node count of the linked list node corresponding to the alarm to be analyzed, and determining the alarm relationship between each conditional alarm and the alarm to be analyzed according to the same group number.

2. The method of claim 1, wherein, The method comprises: dividing alarms with the same alarm generation device in the alarm to be analyzed into alarm groups according to fault type; obtaining the same group number of each conditional alarm and the alarm to be analyzed in the same alarm group corresponding to the fault type for each fault type, and determining the alarm relationship between each conditional alarm and the alarm to be analyzed for the fault type according to the obtained same group number; obtaining the alarm relationship existing for each fault type. The method comprises:

3. The method of claim 1, wherein, generating an alarm linked list corresponding to the target alarm group and determining the node count of each linked list node in the generated alarm linked list as 1, wherein the starting target alarm group is any alarm group; determining an alarm group from the alarm groups without generated alarm linked list as a new target alarm group; determining the linked list node in the generated alarm linked list, which is the same as the alarm corresponding to the starting alarm in the target alarm group in turn from the starting linked list node; ​ if the determined node is successful, adding 1 to the node count of the determined linked list node respectively, generating a sub-alarm linked list, linking the determined last linked list node to the start linked list node of the sub-alarm linked list, and determining the node count of each linked list node in the sub-alarm linked list as 1, wherein each linked list node in the sub-alarm linked list corresponds to an alarm sequentially arranged after the target alarm in the target alarm group along the node linking order, and the target alarm is the alarm corresponding to the determined last linked list node; if the determined node is unsuccessful, returning to the step of generating the alarm linked list corresponding to the target alarm group; if there is an alarm group without a generated alarm linked list, returning to the step of determining one alarm group in the alarm group without a generated alarm linked list as a new target alarm group.

4. The method of claim 3, wherein, After the step of generating the alarm linked list corresponding to the target alarm group, the method further comprises: for each linked list node in the alarm linked list, linking the item header table node corresponding to the same alarm as the linked list node in the item header table to the linked list node, wherein each item header table node in the item header table corresponds to one of the to-be-analyzed alarms respectively; after the step of linking the determined last linked list node to the start linked list node of the sub-alarm linked list, the method further comprises: for each linked list node in the sub-alarm linked list, linking the item header table node corresponding to the same alarm as the linked list node in the item header table to the linked list node; the step of determining the linked list node before the linked list node corresponding to the to-be-analyzed alarm in each alarm linked list in the alarm linked list group and determining the alarm corresponding to the determined linked list node as a conditional alarm comprises: determining the linked list node linked to the item header table node corresponding to the to-be-analyzed alarm in the item header table as the linked list node corresponding to the to-be-analyzed alarm; determining the alarm corresponding to the linked list node before the determined linked list node corresponding to the to-be-analyzed alarm as a conditional alarm.

5. The method of claim 1, wherein, the step of determining the same-group number of each conditional alarm and the to-be-analyzed alarm in the same alarm group according to the node count of the linked list node corresponding to the to-be-analyzed alarm comprises: for each conditional alarm, determining the sum of the node counts of the to-be-analyzed nodes in the same alarm linked list as the conditional node as the same-group number of the conditional alarm and the to-be-analyzed alarm in the same alarm group, wherein the conditional node is the linked list node corresponding to the conditional alarm, and the to-be-analyzed node is the linked list node corresponding to the to-be-analyzed alarm.

6. The method of any one of claims 1-5, wherein: the start node of each alarm linked list in the alarm linked list group is linked to the root node of a tree structure; each alarm node in each alarm linked list is a child node in the tree structure.

7. The method according to claim 1 or 2, characterized in that, After the step of obtaining the alarm number of each to-be-analyzed alarm, the method further comprises: determining the occurrence frequency of each to-be-analyzed alarm according to the alarm number of each to-be-analyzed alarm; deleting the to-be-analyzed alarm with an occurrence frequency lower than a preset occurrence frequency.

8. The method of claim 1 or 2, wherein, the step of determining the alarm relationship between each conditional alarm and the to-be-analyzed alarm according to the same-group number comprises: According to the same-group frequency between each condition alarm and the to-be-analyzed alarm, the same-group frequency between each condition alarm and the to-be-analyzed alarm is calculated; If the same-group frequency between the condition alarm and the to-be-analyzed alarm is greater than a preset same-group frequency, it is determined that there is an alarm relationship between the condition alarm and the to-be-analyzed alarm.

9. The method of claim 1 or 2, wherein, According to the same-group frequency, the alarm relationship existing between each condition alarm and the to-be-analyzed alarm is determined, including: According to the same-group frequency, the alarm relationship existing between each condition alarm and the to-be-analyzed alarm is determined, including:

10. An alarm relation determining apparatus characterized by comprising: The memory, the transceiver, and the processor are included. The memory is used to store a computer program; the transceiver is used to transceive data under the control of the processor; and the processor is used to read the computer program in the memory and perform the following operations: Obtaining the alarm quantity of each to-be-analyzed alarm; According to the alarm generation time and the alarm generation device, the to-be-analyzed alarms are divided into alarm groups; According to a first order, the alarms in each alarm group are sorted, wherein the first order is from large to small according to the alarm quantity; According to each alarm group, an alarm linked list group is generated, and the node count of each linked list node in the alarm linked list is determined, wherein each linked list node in an alarm linked list corresponds to each alarm in an alarm group arranged in order along the node link order, and the alarm with the same arrangement number in each alarm group in turn corresponds to the same linked list node from the starting alarm; the node count of the starting linked list node in an alarm linked list is the number of times that the alarm corresponding to the starting linked list node is located at the first position in the alarm group; the node count of each linked list node other than the starting linked list node is the number of times that the first alarm is located before and adjacent to the second alarm in each alarm group, the first alarm is the alarm corresponding to the previous linked list node of the other linked list node, and the second alarm is the alarm corresponding to the other linked list node; For each to-be-analyzed alarm, in each alarm linked list of the alarm linked list group, the linked list node located before the linked list node corresponding to the to-be-analyzed alarm is determined, and the alarm corresponding to the determined linked list node is determined as a condition alarm; according to the node count of the linked list node corresponding to the to-be-analyzed alarm, the same-group frequency of each condition alarm and the to-be-analyzed alarm located in the same alarm group is determined, and according to the same-group frequency, the alarm relationship existing between each condition alarm and the to-be-analyzed alarm is determined.

11. The alarm correlation determination device according to claim 10, characterized by According to the alarm generation time, the alarms with the same alarm generation device in the to-be-analyzed alarms are divided into alarm groups according to the fault type. According to the same-group frequency, the alarm relationship existing between each condition alarm and the to-be-analyzed alarm is determined, including: According to the same-group frequency, the alarm relationship existing between each condition alarm and the to-be-analyzed alarm is determined, including: obtaining, for each fault type, a same-group number of condition alarms and the to-be-analyzed alarm being in a same alarm group corresponding to the fault type, and determining, according to the obtained same-group number, an alarm relationship between the condition alarms and the to-be-analyzed alarm for the fault type; obtaining alarm relationships existing for each fault type.

12. The alarm correlation determination device according to claim 10, characterized by The generating alarm chain table groups according to the alarm groups and determining node counts of each chain table node in the alarm chain tables comprises: generating an alarm chain table corresponding to a target alarm group, and determining the node count of each chain table node in the generated alarm chain table as 1, wherein the starting target alarm group is an arbitrary alarm group; determining an alarm group from the alarm groups for which no alarm chain table has been generated as a new target alarm group; in the generated alarm chain table, determining a chain table node for which alarms corresponding to a starting chain table node and alarms starting from a starting alarm in the target alarm group are sequentially identical; if the node determination is successful, adding 1 to the node count of the determined chain table node, generating a sub-alarm chain table, linking the determined last chain table node to a starting chain table node of the sub-alarm chain table, and determining the node count of each chain table node in the sub-alarm chain table as 1, wherein each chain table node in the sub-alarm chain table corresponds to an alarm sequentially arranged after a target alarm in the target alarm group in the order of node linking, and the target alarm is an alarm corresponding to the determined last chain table node; if the node determination fails, returning to the step of generating an alarm chain table corresponding to a target alarm group; if there is an alarm group for which no alarm chain table has been generated, returning to the step of determining an alarm group from the alarm groups for which no alarm chain table has been generated as a new target alarm group.

13. The alarm correlation determination device according to claim 12, characterized by After the step of generating an alarm chain table corresponding to a target alarm group, the method further comprises: for each chain table node in the alarm chain table, linking a header table node corresponding to the same alarm as the chain table node in the header table to the chain table node, wherein each header table node in the header table corresponds to a to-be-analyzed alarm one by one; after the step of linking the determined last chain table node to a starting chain table node of the sub-alarm chain table in the step of generating a sub-alarm chain table, the method further comprises: for each chain table node in the sub-alarm chain table, linking a header table node corresponding to the same alarm as the chain table node in the header table to the chain table node; The determining, in each alarm chain table in the alarm chain table group, a chain table node located before a chain table node corresponding to the to-be-analyzed alarm and determining an alarm corresponding to the determined chain table node as a condition alarm comprises: determining, as the chain table node corresponding to the to-be-analyzed alarm, a chain table node linked by a header table node corresponding to the to-be-analyzed alarm in the header table; determining, as the condition alarm, an alarm corresponding to a chain table node located before the chain table node corresponding to the to-be-analyzed alarm.

14. The alarm correlation determination device according to claim 10, characterized by The determining, according to the node count of the chain table node corresponding to the to-be-analyzed alarm, a same-group number of condition alarms and the to-be-analyzed alarm being in a same alarm group comprises: For each condition alarm, the sum of the node counts of the nodes to be analyzed in the same alarm chain table as the condition node is determined as the same group number of the condition alarm and the alarm to be analyzed in the same alarm group, wherein the condition node is the chain table node corresponding to the condition alarm, and the node to be analyzed is the chain table node corresponding to the alarm to be analyzed.

15. The alarm relationship determining device according to any one of claims 10-14, characterized in that, the start nodes of each alarm chain table in the alarm chain table group are linked to the root node of a tree structure; each alarm node in each alarm chain table is a child node in the tree structure.

16. The alarm correlation determining apparatus according to claim 10 or 11, characterized by After the alarm quantity of each alarm to be analyzed is obtained, the method further comprises: determining the occurrence frequency of each alarm to be analyzed according to the alarm number of each alarm to be analyzed; deleting the alarm to be analyzed with an occurrence frequency lower than a preset occurrence frequency.

17. The alarm correlation determining apparatus according to claim 10 or 11, characterized by The determining of the alarm relationship between each condition alarm and the alarm to be analyzed according to the same group number comprises: calculating the same group frequency between each condition alarm and the alarm to be analyzed according to the same group number between each condition alarm and the alarm to be analyzed; if the same group frequency between the condition alarm and the alarm to be analyzed is greater than a preset same group frequency, it is determined that the alarm relationship exists between the condition alarm and the alarm to be analyzed.

18. The alarm correlation determining apparatus according to claim 10 or 11, characterized by The determining of the alarm relationship between each condition alarm and the alarm to be analyzed according to the same group number comprises: determining the alarm relationship between each condition alarm and the alarm to be analyzed, except for a preset relationship, according to the same group number, wherein the preset relationship is a historical alarm relationship and / or an error alarm relationship that has been determined.

19. An alarm relationship determination apparatus characterized by comprising: The device comprises: a quantity determining module configured to obtain the alarm quantity of each alarm to be analyzed; an alarm group dividing module configured to divide the alarm to be analyzed into alarm groups according to alarm generation time and alarm generation device; The relationship determining module is configured to sort the alarms in each alarm group in a first order, wherein the first order is an order from large to small in terms of the number of alarms; generate alarm chain table groups according to the alarm groups, and determine the node count of each chain table node in the alarm chain table, wherein each chain table node in an alarm chain table corresponds to each alarm arranged in order in an alarm group in sequence along the node link order, and the alarm with the same arrangement serial number in each alarm group corresponds to the same chain table node; the node count of the starting chain table node in an alarm chain table is the number of times that the alarm corresponding to the chain table node is located at the first position in the alarm group; the node count of each chain table node other than the starting chain table node is the number of times that the first alarm corresponding to the chain table node is located before and adjacent to the second alarm in each alarm group; the first alarm is the alarm corresponding to the previous chain table node of the chain table node, and the second alarm is the alarm corresponding to the chain table node; for each alarm to be analyzed, determine the chain table nodes located before the chain table node corresponding to the alarm to be analyzed in each alarm chain table in the alarm chain table group, and determine the alarm corresponding to the determined chain table node as a conditional alarm; determine the same group number of each conditional alarm and the alarm to be analyzed in the same alarm group according to the node count of the chain table node corresponding to the alarm to be analyzed, and determine the alarm relationship between each conditional alarm and the alarm to be analyzed according to the same group number.

20. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps of any one of claims 1-9.

Images