Alarm Log Processing Method and Device

Abstract

The present invention provides an alarm log processing method and apparatus, which relate to the field of information security technology and can be applied to the field of financial technology or other technical fields. The method includes: extracting the current alarm source log according to the alarm source location information and alarm time in the current alarm log; inputting the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into a recovery judgment model to obtain the current recovery type; determining the current alarm duration feature value according to the alarm time, and inputting the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into an operation and maintenance instruction model according to the current recovery type to obtain an operation and maintenance operation instruction; and executing an operation and maintenance operation script generated based on the operation and maintenance operation instruction. The present invention can improve the timeliness and effectiveness of alarm processing.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more particularly, to an alarm log processing method and apparatus. Background Art

[0002] In the scenarios of cloud computing and distributed applications, the number of monitoring alarms is large, and the timeliness and effectiveness of alarm handling are important factors affecting the stable operation of application systems. Due to the complex causes of faults, the corresponding emergency handling operation means for the same type of alarm are not consistent; for alarms with complex causes, a large number of operation steps and judgments are often required to completely solve the problem. Summary of the Invention

[0003] The main purpose of the embodiments of the present invention is to provide an alarm log processing method and apparatus to improve the timeliness and effectiveness of alarm handling.

[0004] To achieve the above object, an embodiment of the present invention provides an alarm log processing method, including:

[0005] Extracting a current alarm source log according to the alarm source location information and alarm time in the current alarm log;

[0006] Inputting a current alarm keyword feature value generated based on the current alarm log and a current alarm source feature value generated based on the current alarm source log into a recovery judgment model created based on historical alarm keyword feature values and historical alarm source feature values to obtain a current recovery type;

[0007] Determining a current alarm duration feature value according to the alarm time, and inputting the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into an operation and maintenance instruction model created based on historical alarm duration feature values, historical alarm keyword feature values, and historical alarm source feature values according to the current recovery type to obtain an operation and maintenance operation instruction;

[0008] Executing an operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0009] In one of the embodiments, extracting a current alarm source log according to the alarm source location information and alarm time in the current alarm log includes:

[0010] Determining an alarm source according to the alarm source location information in the current alarm log;

[0011] Determining an alarm delay time according to the alarm source;

[0012] Determining an alarm source log interval according to the alarm delay time and the alarm occurrence time in the alarm time;

[0013] Extracting the current alarm source log according to the alarm source and the alarm source log interval.

[0014] In one embodiment, creating a recovery judgment model based on historical alarm keyword feature values and historical alarm source feature values includes:

[0015] Extracting first historical operation and maintenance instruction logs according to the alarm source location information and alarm time in the historical alarm logs;

[0016] Determining the historical alarm duration according to the alarm time in the historical alarm logs;

[0017] Determining historical recovery type feature values according to the first historical operation and maintenance instruction logs and the comparison result between the recovery time corresponding to the historical alarm source feature values and the historical alarm duration;

[0018] Training a first initial model according to the historical alarm keyword feature values, historical alarm source feature values and historical recovery type feature values, and creating a recovery judgment model according to the training results.

[0019] In one embodiment, extracting first historical operation and maintenance instruction logs according to the alarm source location information and alarm time in the historical alarm logs includes:

[0020] Determining the first historical operation and maintenance instruction log interval according to the alarm time in the historical alarm logs;

[0021] Extracting first historical operation and maintenance instruction logs according to the alarm source location information in the historical alarm logs and the first historical operation and maintenance instruction log interval.

[0022] In one embodiment, inputting the current alarm duration feature value, current alarm keyword feature value and current alarm source feature value into an operation and maintenance instruction model created based on historical alarm duration feature values, historical alarm keyword feature values and historical alarm source feature values according to the current recovery type to obtain operation and maintenance operation instructions includes:

[0023] When the current recovery type is non-automatic recovery, inputting the current alarm duration feature value, current alarm keyword feature value and current alarm source feature value into an operation and maintenance instruction model created based on historical alarm duration feature values, historical alarm keyword feature values and historical alarm source feature values to obtain operation and maintenance operation instructions.

[0024] In one embodiment, creating an operation and maintenance instruction model based on historical alarm duration feature values, historical alarm keyword feature values and historical alarm source feature values includes:

[0025] Extracting historical alarm source logs according to the alarm source location information and alarm time in the historical alarm logs;

[0026] Extracting second historical operation and maintenance instruction logs according to the alarm time in the historical alarm logs and the historical alarm source logs;

[0027] Obtain the historical operation and maintenance instruction eigenvalue according to the instruction operation time and the second historical operation and maintenance instruction log;

[0028] Train the second initial model according to the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, the historical alarm source eigenvalue and the historical operation and maintenance instruction eigenvalue, and create an operation and maintenance instruction model according to the training result.

[0029] In one embodiment, extracting the second historical operation and maintenance instruction log according to the alarm time in the historical alarm log and the historical alarm source log includes:

[0030] Determine the operation and maintenance end time according to the historical alarm source log;

[0031] Determine the historical alarm occurrence time according to the alarm time in the historical alarm log;

[0032] Determine the second historical operation and maintenance instruction log interval according to the operation and maintenance end time and the historical alarm occurrence time;

[0033] Extract the second historical operation and maintenance instruction log according to the alarm source location information in the historical alarm log and the second historical operation and maintenance instruction log interval.

[0034] An embodiment of the present invention further provides an alarm log processing device, including:

[0035] A current alarm source log extraction module, configured to extract a current alarm source log according to the alarm source location information and the alarm time in the current alarm log;

[0036] A current recovery type module, configured to input the current alarm keyword eigenvalue generated based on the current alarm log and the current alarm source eigenvalue generated based on the current alarm source log into a recovery judgment model created based on the historical alarm keyword eigenvalue and the historical alarm source eigenvalue to obtain the current recovery type;

[0037] An operation and maintenance operation instruction module, configured to determine the current alarm duration eigenvalue according to the alarm time, and input the current alarm duration eigenvalue, the current alarm keyword eigenvalue and the current alarm source eigenvalue into an operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue and the historical alarm source eigenvalue according to the current recovery type to obtain an operation and maintenance operation instruction;

[0038] A script execution module, configured to execute an operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0039] In one embodiment, the current alarm source log extraction module includes:

[0040] An alarm source determination unit, configured to determine an alarm source according to the alarm source location information in the current alarm log;

[0041] An alarm delay time unit for determining an alarm delay time according to an alarm source;

[0042] An alarm source log interval unit for determining an alarm source log interval according to the alarm occurrence time in the alarm delay time and the alarm time;

[0043] A current alarm source log extraction unit for extracting a current alarm source log according to the alarm source and the alarm source log interval.

[0044] In one embodiment, it further includes: a recovery judgment model creation module;

[0045] The recovery judgment model creation module includes:

[0046] A first historical operation and maintenance instruction log unit for extracting a first historical operation and maintenance instruction log according to the alarm source location information and the alarm time in the historical alarm log;

[0047] A historical alarm duration unit for determining a historical alarm duration according to the alarm time in the historical alarm log;

[0048] A historical recovery type eigenvalue unit for determining a historical recovery type eigenvalue according to the first historical operation and maintenance instruction log and the comparison result between the recovery time corresponding to the historical alarm source eigenvalue and the historical alarm duration;

[0049] A recovery judgment model creation unit for training a first initial model according to the historical alarm keyword eigenvalue, the historical alarm source eigenvalue and the historical recovery type eigenvalue, and creating the recovery judgment model according to the training result.

[0050] In one embodiment, the first historical operation and maintenance instruction log unit includes:

[0051] A first historical operation and maintenance instruction log interval subunit for determining a first historical operation and maintenance instruction log interval according to the alarm time in the historical alarm log;

[0052] A first historical operation and maintenance instruction log subunit for extracting a first historical operation and maintenance instruction log according to the alarm source location information in the historical alarm log and the first historical operation and maintenance instruction log interval.

[0053] In one embodiment, the operation and maintenance operation instruction module is specifically used for:

[0054] When the current recovery type is non-automatic recovery, input the current alarm duration eigenvalue, the current alarm keyword eigenvalue and the current alarm source eigenvalue into an operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue and the historical alarm source eigenvalue to obtain an operation and maintenance operation instruction.

[0055] In one embodiment, it further includes: an operation and maintenance instruction model creation module;

[0056] The operation and maintenance instruction model creation module includes:

[0057] A historical alarm source log unit, configured to extract historical alarm source logs according to the alarm source location information and alarm time in the historical alarm logs;

[0058] A second historical operation and maintenance instruction log unit, configured to extract a second historical operation and maintenance instruction log according to the alarm time in the historical alarm logs and the historical alarm source logs;

[0059] A historical operation and maintenance instruction eigenvalue unit, configured to obtain historical operation and maintenance instruction eigenvalues according to the instruction operation time and the second historical operation and maintenance instruction log;

[0060] An operation and maintenance instruction model creation unit, configured to train a second initial model according to the historical alarm duration eigenvalue, historical alarm keyword eigenvalue, historical alarm source eigenvalue, and historical operation and maintenance instruction eigenvalue, and create an operation and maintenance instruction model according to the training result.

[0061] In one embodiment, the second historical operation and maintenance instruction log unit includes:

[0062] An operation and maintenance end time subunit, configured to determine the operation and maintenance end time according to the historical alarm source log;

[0063] A historical alarm occurrence time subunit, configured to determine the historical alarm occurrence time according to the alarm time in the historical alarm logs;

[0064] A second historical operation and maintenance instruction log interval subunit, configured to determine a second historical operation and maintenance instruction log interval according to the operation and maintenance end time and the historical alarm occurrence time;

[0065] A second historical operation and maintenance instruction log subunit, configured to extract a second historical operation and maintenance instruction log according to the alarm source location information in the historical alarm logs and the second historical operation and maintenance instruction log interval.

[0066] An embodiment of the present invention further provides a computer device, including a memory, a processor, and a computer program stored on the memory and running on the processor. When the processor executes the computer program, the steps of the alarm log processing method are implemented.

[0067] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the alarm log processing method are implemented.

[0068] An embodiment of the present invention further provides a computer program product, including a computer program / instructions. When the computer program / instructions are executed by a processor, the steps of the alarm log processing method are implemented.

[0069] In the alarm log processing method and device according to the embodiments of the present invention, first, the current alarm source log is extracted according to the alarm source location information and alarm time in the current alarm log, then the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log are input into the recovery judgment model to obtain the current recovery type, and then the current alarm duration feature value is determined according to the alarm time, so as to input the current alarm duration feature value, the current alarm keyword feature value and the current alarm source feature value into the operation and maintenance instruction model according to the current recovery type to obtain the operation and maintenance operation instruction, and finally, the operation and maintenance operation script generated based on the operation and maintenance operation instruction is executed, which can improve the timeliness and effectiveness of alarm processing. Brief Description of the Drawings

[0070] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts.

[0071] Figure 1 is the flowchart of the alarm log processing method in the embodiments of the present invention;

[0072] Figure 2 is the flowchart of the alarm log processing method in another embodiment of the present invention;

[0073] Figure 3 is the flowchart of S101 in the embodiments of the present invention;

[0074] Figure 4 is the flowchart of creating the recovery judgment model in the embodiments of the present invention;

[0075] Figure 5 is the flowchart of S301 in the embodiments of the present invention;

[0076] Figure 6 is the flowchart of creating the operation and maintenance instruction model in the embodiments of the present invention;

[0077] Figure 7 is the flowchart of S502 in the embodiments of the present invention;

[0078] Figure 8 is the structural block diagram of the alarm log processing device in the embodiments of the present invention;

[0079] Figure 9 is the structural block diagram of the alarm log processing device in another embodiment of the present invention;

[0080] Figure 10It is a schematic structural diagram of the data acquisition module in an embodiment of the present invention;

[0081] Figure 11 It is a schematic structural diagram of the data analysis module in an embodiment of the present invention;

[0082] Figure 12 It is a schematic structural diagram of the alarm handling module in an embodiment of the present invention;

[0083] Figure 13 It is a structural block diagram of a computer device in an embodiment of the present invention. Specific embodiments

[0084] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0085] Those skilled in the art know that the implementation mode of the present invention can be realized as a system, device, equipment, method or computer program product. Therefore, the present disclosure can be specifically realized in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0086] In view of the fact that the prior art requires a large number of operation steps and judgments to completely solve alarms with complex causes, embodiments of the present invention provide an alarm log processing method, which defines alarm characteristics that cannot be quickly solved, and combines historical alarms, historical alarm source logs, and historical operation and maintenance instruction logs to be trained through a neural network algorithm to obtain alarm types that cannot be quickly solved; then, the alarm information, alarm source log, operation and maintenance operation instructions, and alarm duration are used to be trained through a neural network algorithm to obtain an alarm effective handling characteristic function; finally, it is implemented through an automated method, quickly judges whether manual intervention is required for alarm-related information, and provides a handling solution and an automated handling script to the operation and maintenance personnel, improving the timeliness and effectiveness of alarm handling. The present invention will be described in detail below in conjunction with the accompanying drawings.

[0087] Figure 1 It is a flowchart of the alarm log processing method in an embodiment of the present invention. Figure 2 It is a flowchart of the alarm log processing method in another embodiment of the present invention. As Figure 1 - Figure 2 shown, the alarm log processing method includes:

[0088] S101: Extract the current alarm source log according to the alarm source location information and alarm time in the current alarm log.

[0089] Figure 3 This is the flowchart of S101 in the embodiments of the present invention. As Figure 3 shown, S101 includes:

[0090] S201: Determine the alarm source according to the alarm source location information in the current alarm log.

[0091] S202: Determine the alarm delay time according to the alarm source.

[0092] For example, when the alarm source is a server, the alarm delay time t bef is 300 seconds; when the alarm source is a database, the alarm delay time t bef is 600 seconds; when the alarm source is a container, the alarm delay time t bef is 120 seconds.

[0093] S203: Determine the alarm source log interval according to the alarm delay time and the alarm occurrence time in the alarm time.

[0094] Specifically, when implemented, the alarm source log is Log(C), and the alarm occurrence time in the current alarm log is t b ′, then the alarm source log interval is T Con_Log(C) ′(t b ′ - t bef , tb′).

[0095] S204: Extract the current alarm source log according to the alarm source and the alarm source log interval.

[0096] Specifically, when implemented, the current alarm source log includes server logs, database logs, container logs, etc. Extract the log key fields from the JSON data, including: id / ip (alarm source location information, including server ip, container id, device number, etc.), ts (timestamp), lev (log level), and msg (log details). Filter the logs with log levels of severe error (FATAL), error message (ERROR), and warning message (WARN), and extract the alarm source logs within the time period of T Con_Log(C) ′(t b ′ - t bef , tb′) before the alarm occurs, and match them with the error code definitions of the corresponding type of alarm source to obtain the current alarm source log msg set M′: {msg1′, msg2′,... msg n ′}.

[0097] S102: Input the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model created based on the historical alarm keyword feature value and the historical alarm source feature value to obtain the current recovery type.

[0098] Among them, when all bits (One-Hot encoding) of the current alarm keyword feature value and the current alarm source feature value are zero, it indicates that this type of alarm has not occurred before. At this time, it is prompted that the operation and maintenance personnel need to perform manual handling.

[0099] Figure 4 is the flowchart for creating a recovery judgment model in an embodiment of the present invention. As Figure 4 shown, creating a recovery judgment model based on historical alarm keyword feature values and historical alarm source feature values includes:

[0100] S301: Extract the first historical operation and maintenance instruction log according to the alarm source location information and alarm time in the historical alarm log.

[0101] Specifically in implementation, the historical alarm source log can also be extracted according to the alarm source location information and alarm time in the historical alarm log. The technical means used to extract the historical alarm source log is the same as that used to extract the current alarm source log.

[0102] Figure 5 is the flowchart of S301 in an embodiment of the present invention. As Figure 5 shown, S301 includes:

[0103] S401: Determine the first historical operation and maintenance instruction log interval according to the alarm time in the historical alarm log.

[0104] Among them, the first historical operation and maintenance instruction log interval is the same as the alarm time in the historical alarm log. When the alarm occurrence time in the historical alarm log is t b , and the alarm recovery time is t e , the first historical operation and maintenance instruction log interval is (t b , t e ).

[0105] S402: Extract the first historical operation and maintenance instruction log according to the alarm source location information in the historical alarm log and the first historical operation and maintenance instruction log interval.

[0106] Among them, the first historical operation and maintenance instruction log is the manual operation and maintenance instruction log of the corresponding alarm source during the time period from t b to t e .

[0107] S302: Determine the historical alarm duration according to the alarm time in the historical alarm log.

[0108] Among them, the historical alarm duration is the difference between the alarm recovery time and the alarm occurrence time, that is, t e - t b .

[0109] S303: Determine the historical recovery type eigenvalue based on the first historical operation and maintenance instruction log and the comparison result between the recovery time corresponding to the historical alarm source eigenvalue and the historical alarm duration.

[0110] For example, when the alarm source is a server, the recovery time t bh is 180 seconds; when the alarm source is a database, the recovery time t bh is 300 seconds; when the alarm source is a container, the recovery time t bh is 60 seconds.

[0111] When there is an artificial operation and maintenance instruction log for the corresponding alarm source within the time period from t b to t e , or the recovery time t bh is less than the historical alarm duration t e -t b , the historical recovery type is non-automatic recovery, and the corresponding eigenvalue y is 1; otherwise, the historical recovery type is automatic recovery, and the corresponding eigenvalue y is 0.

[0112] S304: Train the first initial model based on the historical alarm keyword eigenvalue, the historical alarm source eigenvalue, and the historical recovery type eigenvalue, and create a recovery judgment model according to the training result.

[0113] Among them, the historical alarm keyword eigenvalue is generated based on the historical alarm log, the historical alarm source eigenvalue is generated based on the historical alarm source log, and the technical means used are the same as those for generating the current alarm keyword eigenvalue and the current alarm source eigenvalue respectively.

[0114] Table 1

[0115]

[0116] Table 2

[0117]

[0118]

[0119] Table 3

[0120]

[0121]

[0122] Table 1 is a specific content schematic table of the historical alarm keywords of the server and the historical alarm source log msg. Table 2 is a specific content schematic table of the historical alarm keywords of the database and the historical alarm source log msg. Table 3 is a specific content schematic table of the historical alarm keywords of the container and the historical alarm source log msg. As shown in Tables 1 - 3, the historical alarm keyword is set as x1, and x1 includes abnormal CPU usage rate, abnormal power module, etc. Set T Con_Log(C) (t b -t bef , tb) The set M of historical alarm source log msgs during the time period: {msg1, msg2, … msg n} is set as x2, and x2 includes "CPUP_Crit", "cpu_load", etc. Through One - Hot encoding, 0 / 1 eigenvalue matching is performed bit - by - bit on x1 and x2 respectively (the corresponding eigenvalue is 1 when matching, and the corresponding eigenvalue is zero when not matching), and the historical recovery type eigenvalue is set as y (the non - automatic recovery eigenvalue is 1, and the automatic recovery eigenvalue is zero). For example, when the historical alarm keyword includes abnormal CPU usage rate, abnormal power module, and normal fan module, the corresponding eigenvalues are 1, 1, 0.

[0123] Table 4

[0124]

[0125]

[0126] Table 4 is a classification interval schematic table. As shown in Table 4, for the threshold - type alarms involved in the alarm source log, they can be classified into different eigenvalues of this type of alarm content x2 according to the data in the alarm source log and Table 4. For example, according to the classification interval, the alarm source log is "Error: cpu overload: current load is 92%". Before processing, x2 is "cpu overload", and the corresponding eigenvalue is 1; after processing, x2 is "cup overload_2", and the digit where 2 is located is the second digit. Therefore, the eigenvalue corresponding to "cpuoverload" is "010000".

[0127] S103: Determine the current alarm duration eigenvalue according to the alarm time, and input the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue into the operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, and the historical alarm source eigenvalue to obtain the operation and maintenance operation instruction.

[0128] In one embodiment, inputting the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue according to the current recovery type into the operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, and the historical alarm source eigenvalue to obtain the operation and maintenance operation instruction includes:

[0129] When the current recovery type is non-automatic recovery, input the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue into the operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, and the historical alarm source eigenvalue to obtain the operation and maintenance operation instruction.

[0130] When the current recovery type is non-automatic recovery and the corresponding alarm source is a container, a request can be sent to the registration center to remove the corresponding container from the registration center to achieve container isolation.

[0131] Figure 6 It is the flowchart of creating the operation and maintenance instruction model in the embodiment of the present invention. As Figure 6 shown, creating the operation and maintenance instruction model based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, and the historical alarm source eigenvalue includes:

[0132] S501: Extract the historical alarm source log according to the alarm source location information and alarm time in the historical alarm log.

[0133] Among them, the technical means used to extract the historical alarm source log is the same as the technical means used to extract the current alarm source log. The alarm occurrence time in the historical alarm log is t b , and the historical alarm source log interval is T Con_Log(C) (t b -t bef , tb). The historical alarm source log includes server logs, database logs, container logs, etc. Extract the log keyword fields from the JSON data, including: id / ip (alarm source location information, including server ip, container id, device number, etc.), ts (timestamp), lev (log level), and msg (log details). Filter the logs with log levels of severe error (FATAL), error message (ERROR), and warning message (WARN), and extract the alarm source logs within the time period of T Con_Log(C) (t b -t bef , tb) before the alarm occurs, and match them with the error code definitions of the corresponding type of alarm source to obtain the historical alarm source log msg set M: {msg1, msg2,... msg n}.

[0134] S502: Extract the second historical operation and maintenance instruction log according to the alarm time in the historical alarm log and the historical alarm source log.

[0135] Figure 7 It is the flowchart of S502 in the embodiments of the present invention. As Figure 7 shown, S502 includes:

[0136] S601: Determine the operation and maintenance end time according to the historical alarm source log.

[0137] S602: Determine the historical alarm occurrence time according to the alarm time in the historical alarm log.

[0138] S603: Determine the second historical operation and maintenance instruction log interval according to the operation and maintenance end time and the historical alarm occurrence time.

[0139] For example, the alarm occurrence time of the alarm time in the historical alarm log is t b , and the time corresponding to the last historical alarm source log before the alarm recovery is t Log(C)last , then the time interval corresponding to the second historical operation and maintenance instruction log is T Ope_Log (t b , t Log(C)last ).

[0140] S604: Extract the second historical operation and maintenance instruction log according to the alarm source location information in the historical alarm log and the second historical operation and maintenance instruction log interval.

[0141] The second historical operation and maintenance instruction log is the historical operation and maintenance instruction log corresponding to the alarm source location information in T Ope_Log (t e , t Log(C)last ).

[0142] S503: Obtain the historical operation and maintenance instruction eigenvalue according to the instruction operation time and the second historical operation and maintenance instruction log.

[0143] The operation and maintenance operation instruction log is the record of the operation instructions of each system user on the centralized operation and maintenance platform. Extract all the operation and maintenance operation instructions O1 - O Ope_Log (t e , t Log(C)last ) during the time period when the operation and maintenance resource object is the alarm source, and sort them according to the instruction operation time to form an instruction set {O1, O p O3, …, O 2,} arranged in the order of alarm handling operation and maintenance. p}

[0144] Table 5

[0145]

[0146] Table 5 is an alarm handling record table, which records the historical alarm keywords, historical alarm source logs, and second historical operation and maintenance instruction logs used to generate historical alarm keyword feature values.

[0147] S504: Train a second initial model based on the historical alarm duration feature value, historical alarm keyword feature value, historical alarm source feature value, and historical operation and maintenance instruction feature value, and create an operation and maintenance instruction model according to the training results.

[0148] Among them, the historical alarm duration feature value is generated based on the historical alarm duration, and the historical alarm duration Δ t = t e - t b , and a corresponding historical alarm duration feature value x3 can be obtained by setting a feature value every 10s. Process x1, x2, and x3 into the One-Hot encoding format to obtain the corresponding feature values.

[0149] S104: Execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0150] Figure 1 The execution subject of the alarm log processing method shown can be a computer. From Figure 1 the process shown, it can be seen that the alarm log processing method in the embodiment of the present invention first extracts the current alarm source log according to the alarm source location information and alarm time in the current alarm log, then inputs the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model to obtain the current recovery type, and then determines the current alarm duration feature value according to the alarm time. According to the current recovery type, input the current alarm duration feature value, current alarm keyword feature value, and current alarm source feature value into the operation and maintenance instruction model to obtain the operation and maintenance operation instruction, and finally execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction, which can improve the timeliness and effectiveness of alarm processing.

[0151] The specific process of the embodiment of the present invention is as follows:

[0152] 1. Determine the first historical operation and maintenance instruction log interval according to the alarm time in the historical alarm log.

[0153] 2. Extract the first historical operation and maintenance instruction log according to the alarm source location information and the first historical operation and maintenance instruction log interval in the historical alarm log.

[0154] 3. Extract the historical alarm source log according to the alarm source location information and alarm time in the historical alarm log.

[0155] 4. Determine the historical alarm duration according to the alarm time in the historical alarm log.

[0156] 5. Determine the historical recovery type eigenvalue based on the first historical operation and maintenance instruction log and the comparison result between the recovery time corresponding to the historical alarm source eigenvalue and the historical alarm duration.

[0157] 6. Train the first initial model based on the historical alarm keyword eigenvalue, the historical alarm source eigenvalue, and the historical recovery type eigenvalue, and create a recovery judgment model according to the training result.

[0158] 7. Determine the operation and maintenance end time according to the historical alarm source log, and determine the historical alarm occurrence time according to the alarm time in the historical alarm log.

[0159] 8. Determine the second historical operation and maintenance instruction log interval according to the operation and maintenance end time and the historical alarm occurrence time, and extract the second historical operation and maintenance instruction log according to the alarm source location information and the second historical operation and maintenance instruction log interval in the historical alarm log.

[0160] 9. Obtain the historical operation and maintenance instruction eigenvalue according to the instruction operation time and the second historical operation and maintenance instruction log.

[0161] 10. Train the second initial model based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, the historical alarm source eigenvalue, and the historical operation and maintenance instruction eigenvalue, and create an operation and maintenance instruction model according to the training result.

[0162] 11. Determine the alarm source according to the alarm source location information in the current alarm log, and determine the alarm delay time according to the alarm source.

[0163] 12. Determine the alarm source log interval according to the alarm delay time and the alarm occurrence time in the alarm time, and extract the current alarm source log according to the alarm source and the alarm source log interval.

[0164] 13. Input the current alarm keyword eigenvalue generated based on the current alarm log and the current alarm source eigenvalue generated based on the current alarm source log into the recovery judgment model to obtain the current recovery type.

[0165] 14. Determine the current alarm duration eigenvalue according to the alarm time. When the current recovery type is non-automatic recovery, input the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue into the operation and maintenance instruction model to obtain the operation and maintenance operation instruction.

[0166] 15. Execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0167] In summary, the alarm log processing method provided by the embodiment of the present invention has the following beneficial effects:

[0168] (1) Wide application range. The present invention is applicable to all systems and can be dynamically adjusted according to the definition of alarm rules and the definition of log error codes, with no special requirements for system types and versions;

[0169] (2) It can effectively improve the timeliness and effectiveness of alarm resolution and reduce the processing pressure on operation and maintenance personnel. An effective alarm handling knowledge base is formed through training and learning based on historical alarm logs, historical alarm source logs, and historical operation and maintenance logs, providing effective handling suggestions to operation and maintenance personnel and performing automated processing, thereby improving the timeliness and automation level of alarm handling.

[0170] Based on the same inventive concept, an embodiment of the present invention also provides an alarm log processing device. Since the principle of problem-solving of this device is similar to that of the alarm log processing method, the implementation of this device can refer to the implementation of the method, and repeated parts will not be elaborated.

[0171] Figure 8 It is the structural block diagram of the alarm log processing device in the embodiment of the present invention. Figure 9 It is the structural block diagram of the alarm log processing device in another embodiment of the present invention. As Figure 8 - Figure 9 shown, the alarm log processing device includes:

[0172] The current alarm source log extraction module is used to extract the current alarm source log according to the alarm source location information and alarm time in the current alarm log;

[0173] The current recovery type module is used to input the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model created based on the historical alarm keyword feature value and historical alarm source feature value to obtain the current recovery type;

[0174] The operation and maintenance operation instruction module is used to determine the current alarm duration feature value according to the alarm time, and input the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into the operation and maintenance instruction model created based on the historical alarm duration feature value, historical alarm keyword feature value, and historical alarm source feature value according to the current recovery type to obtain the operation and maintenance operation instruction;

[0175] The script execution module is used to execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0176] In one embodiment, the current alarm source log extraction module includes:

[0177] The alarm source determination unit is used to determine the alarm source according to the alarm source location information in the current alarm log;

[0178] The alarm delay time unit is used to determine the alarm delay time according to the alarm source;

[0179] An alarm source log interval unit, configured to determine an alarm source log interval according to the alarm occurrence time in the alarm delay time and the alarm time;

[0180] A current alarm source log extraction unit, configured to extract a current alarm source log according to the alarm source and the alarm source log interval.

[0181] In one embodiment, it further includes: a recovery judgment model creation module;

[0182] The recovery judgment model creation module includes:

[0183] A first historical operation and maintenance instruction log unit, configured to extract a first historical operation and maintenance instruction log according to the alarm source location information and the alarm time in the historical alarm log;

[0184] A historical alarm duration unit, configured to determine the historical alarm duration according to the alarm time in the historical alarm log;

[0185] A historical recovery type eigenvalue unit, configured to determine a historical recovery type eigenvalue according to the first historical operation and maintenance instruction log and the comparison result between the recovery time corresponding to the historical alarm source eigenvalue and the historical alarm duration;

[0186] A recovery judgment model creation unit, configured to train a first initial model according to the historical alarm keyword eigenvalue, the historical alarm source eigenvalue, and the historical recovery type eigenvalue, and create the recovery judgment model according to the training result.

[0187] In one embodiment, the first historical operation and maintenance instruction log unit includes:

[0188] A first historical operation and maintenance instruction log interval subunit, configured to determine a first historical operation and maintenance instruction log interval according to the alarm time in the historical alarm log;

[0189] A first historical operation and maintenance instruction log subunit, configured to extract a first historical operation and maintenance instruction log according to the alarm source location information in the historical alarm log and the first historical operation and maintenance instruction log interval.

[0190] In one embodiment, the operation and maintenance operation instruction module is specifically configured to:

[0191] When the current recovery type is non-automatic recovery, input the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue into an operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, and the historical alarm source eigenvalue to obtain an operation and maintenance operation instruction.

[0192] In one embodiment, it further includes: an operation and maintenance instruction model creation module;

[0193] The operation and maintenance instruction model creation module includes:

[0194] A historical alarm source log unit, configured to extract historical alarm source logs according to the alarm source location information and alarm time in the historical alarm logs;

[0195] A second historical operation and maintenance instruction log unit, configured to extract second historical operation and maintenance instruction logs according to the alarm time in the historical alarm logs and the historical alarm source logs;

[0196] A historical operation and maintenance instruction eigenvalue unit, configured to obtain historical operation and maintenance instruction eigenvalues according to the instruction operation time and the second historical operation and maintenance instruction logs;

[0197] An operation and maintenance instruction model creation unit, configured to train a second initial model according to the historical alarm duration eigenvalue, historical alarm keyword eigenvalue, historical alarm source eigenvalue, and historical operation and maintenance instruction eigenvalue, and create an operation and maintenance instruction model according to the training result.

[0198] In one embodiment, the second historical operation and maintenance instruction log unit includes:

[0199] An operation and maintenance end time subunit, configured to determine the operation and maintenance end time according to the historical alarm source logs;

[0200] A historical alarm occurrence time subunit, configured to determine the historical alarm occurrence time according to the alarm time in the historical alarm logs;

[0201] A second historical operation and maintenance instruction log interval subunit, configured to determine a second historical operation and maintenance instruction log interval according to the operation and maintenance end time and the historical alarm occurrence time;

[0202] A second historical operation and maintenance instruction log subunit, configured to extract second historical operation and maintenance instruction logs according to the alarm source location information in the historical alarm logs and the second historical operation and maintenance instruction log interval.

[0203] As Figure 9 shown, in practical applications, the alarm log processing device includes: a data acquisition module, a data analysis module, and an alarm handling module.

[0204] The main function of the data acquisition module is to collect various logs and data from each system management platform and operation and maintenance platform, and perform data preprocessing at the same time.

[0205] Figure 10 is a schematic structural diagram of the data acquisition module in an embodiment of the present invention. As Figure 10 shown, the data acquisition module includes:

[0206] A data acquisition unit, configured to acquire alarm logs, alarm source logs, and operation and maintenance operation instruction logs.

[0207] An alarm range extraction unit, which is used to extract historical alarms and alarms occurring during faults, and simultaneously extract alarm keywords of various types of alarm sources.

[0208] A log range extraction unit, which is used to extract corresponding alarm source logs and operation and maintenance operation instruction logs according to the alarm source location information in the alarm logs. The alarm source log is denoted as Log(C), and the operation and maintenance operation instruction log is denoted as Log(O).

[0209] An effective disposal data preprocessing unit, which is used to concatenate the actions of alarm occurrence - disposal - alarm closing to form an alarm disposal record form.

[0210] The main function of the data analysis module is to learn and train the preprocessed data to form a knowledge base of alarm classifications that cannot be quickly resolved and the corresponding relationship between alarms and effective operation and maintenance operations.

[0211] Figure 11 It is a schematic structural diagram of the data analysis module in an embodiment of the present invention. As Figure 11 shown, the data analysis module includes:

[0212] An alarm feature analysis unit, which includes a recovery judgment model creation module, and is used to learn and classify the features of alarms that cannot be quickly and automatically recovered through a neural network algorithm.

[0213] An alarm effective disposal data preprocessing unit, which is used to process data to obtain historical alarm duration feature values, historical alarm keyword feature values, historical alarm source feature values, and historical operation and maintenance instruction feature values.

[0214] An alarm effective disposal operation learning unit, which includes an operation and maintenance instruction model creation module, and is used to train an operation and maintenance instruction model using a neural network algorithm.

[0215] The main function of the alarm disposal module is to perform automated disposal on the alarm source.

[0216] Figure 12 It is a schematic structural diagram of the alarm disposal module in an embodiment of the present invention. As Figure 12 shown, the alarm disposal module includes:

[0217] An alarm type judgment unit, which includes a current alarm source log extraction module and a current recovery type module, and is used to calculate and analyze whether the current alarm can be quickly recovered according to the result P1 trained by the data analysis module. If all bits of the One - Hot encoding after processing the current alarm features are 0, that is, this type of alarm has not occurred historically, it is prompted that the operation and maintenance personnel need to perform manual disposal.

[0218] The container automatic isolation unit is used for an alarm with the container as the alarm source. If it cannot be quickly restored, a request is sent to the registration center to remove the corresponding container from the registration center to achieve container isolation.

[0219] The disposal command judgment unit includes an operation and maintenance operation instruction module, which is used to calculate and analyze the operation and maintenance operation instructions to be taken according to the alarm, the alarm source log, the current alarm duration, and the result P2 obtained by the data analysis module training, automatically package them into a recommended operation and maintenance operation script, and push the operation instruction set to the operation and maintenance personnel. After the operation and maintenance personnel click "confirm", the relevant commands are automatically executed.

[0220] In summary, the alarm log processing device according to the embodiment of the present invention first extracts the current alarm source log according to the alarm source location information and alarm time in the current alarm log, then inputs the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model to obtain the current recovery type, and then determines the current alarm duration feature value according to the alarm time. According to the current recovery type, the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value are input into the operation and maintenance instruction model to obtain the operation and maintenance operation instructions. Finally, the operation and maintenance operation script generated based on the operation and maintenance operation instructions is executed, which can improve the timeliness and effectiveness of alarm processing.

[0221] The embodiment of the present invention also provides a specific implementation manner of a computer device that can implement all the steps in the alarm log processing method in the above embodiment. Figure 13 It is a structural block diagram of the computer device in the embodiment of the present invention. See Figure 13 The computer device specifically includes the following contents:

[0222] A processor 1301 and a memory 1302.

[0223] The processor 1301 is used to call the computer program in the memory 1302. When the processor executes the computer program, all the steps in the alarm log processing method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0224] Extract the current alarm source log according to the alarm source location information and alarm time in the current alarm log;

[0225] Input the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model created based on the historical alarm keyword feature value and the historical alarm source feature value to obtain the current recovery type;

[0226] Determine the current alarm duration eigenvalue according to the alarm time, and input the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue into the operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, and the historical alarm source eigenvalue according to the current recovery type to obtain the operation and maintenance operation instruction;

[0227] Execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0228] In summary, the computer device in the embodiment of the present invention first extracts the current alarm source log according to the alarm source location information and the alarm time in the current alarm log, then inputs the current alarm keyword eigenvalue generated based on the current alarm log and the current alarm source eigenvalue generated based on the current alarm source log into the recovery judgment model to obtain the current recovery type, and then determines the current alarm duration eigenvalue according to the alarm time, and inputs the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue into the operation and maintenance instruction model according to the current recovery type to obtain the operation and maintenance operation instruction, and finally executes the operation and maintenance operation script generated based on the operation and maintenance operation instruction, which can improve the timeliness and effectiveness of alarm processing.

[0229] The embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the alarm log processing method in the above embodiment. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the alarm log processing method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0230] Extract the current alarm source log according to the alarm source location information and the alarm time in the current alarm log;

[0231] Input the current alarm keyword eigenvalue generated based on the current alarm log and the current alarm source eigenvalue generated based on the current alarm source log into the recovery judgment model created based on the historical alarm keyword eigenvalue and the historical alarm source eigenvalue to obtain the current recovery type;

[0232] Determine the current alarm duration eigenvalue according to the alarm time, and input the current alarm duration eigenvalue, the current alarm keyword eigenvalue, and the current alarm source eigenvalue into the operation and maintenance instruction model created based on the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, and the historical alarm source eigenvalue according to the current recovery type to obtain the operation and maintenance operation instruction;

[0233] Execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0234] In summary, the computer-readable storage medium according to the embodiment of the present invention first extracts the current alarm source log based on the alarm source location information and alarm time in the current alarm log, then inputs the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model to obtain the current recovery type, and then determines the current alarm duration feature value according to the alarm time, and inputs the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into the operation and maintenance instruction model according to the current recovery type to obtain the operation and maintenance operation instruction. Finally, execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction, which can improve the timeliness and effectiveness of alarm processing.

[0235] The embodiment of the present invention also provides a computer program product capable of implementing all the steps in the alarm log processing method in the above embodiment. The computer program product includes computer programs / instructions, and when the computer programs / instructions are executed by a processor, all the steps in the alarm log processing method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0236] Extract the current alarm source log according to the alarm source location information and alarm time in the current alarm log;

[0237] Input the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model created based on the historical alarm keyword feature value and historical alarm source feature value to obtain the current recovery type;

[0238] Determine the current alarm duration feature value according to the alarm time, and input the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into the operation and maintenance instruction model created based on the historical alarm duration feature value, historical alarm keyword feature value, and historical alarm source feature value according to the current recovery type to obtain the operation and maintenance operation instruction;

[0239] Execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction.

[0240] In summary, the computer program product according to the embodiment of the present invention first extracts the current alarm source log based on the alarm source location information and alarm time in the current alarm log, then inputs the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into the recovery judgment model to obtain the current recovery type, and then determines the current alarm duration feature value according to the alarm time, and inputs the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into the operation and maintenance instruction model according to the current recovery type to obtain the operation and maintenance operation instruction. Finally, execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction, which can improve the timeliness and effectiveness of alarm processing.

[0241] In the specific embodiments described above, the objectives, technical solutions and beneficial effects of the present invention have been further described in detail. It should be understood that the above are only specific embodiments of the present invention and are not used to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0242] Those skilled in the art can also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention can be implemented by electronic hardware, computer software, or a combination of both. To clearly show the interchangeability of hardware and software, the above various illustrative components, units, and steps have generally described their functions. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art can use various methods to implement the described functions for each specific application, but such implementation should not be construed as exceeding the protection scope of the embodiments of the present invention.

[0243] The various illustrative logical blocks, or units, or devices described in the embodiments of the present invention can be implemented or operated to perform the described functions by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination of the above designs. The general-purpose processor can be a microprocessor. Optionally, the general-purpose processor can also be any conventional processor, controller, microcontroller, or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0244] The steps of the methods or algorithms described in the embodiments of the present invention may be directly embedded in hardware, software modules executed by a processor, or a combination of both. The software modules may be stored in a RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium in the art. Exemplarily, the storage medium may be connected to the processor so that the processor can read information from the storage medium and write information to the storage medium. Optionally, the storage medium may also be integrated into the processor. The processor and the storage medium may be disposed in an ASIC, and the ASIC may be disposed in a user terminal. Optionally, the processor and the storage medium may also be disposed in different components of the user terminal.

[0245] In one or more exemplary designs, the above-described functions described in the embodiments of the present invention may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, these functions may be stored on a computer-readable medium or transmitted in the form of one or more instructions or codes on a computer-readable medium. A computer-readable medium includes a computer storage medium and a communication medium that facilitates transfer of a computer program from one place to another. The storage medium may be any available medium accessible by a general or special purpose computer. For example, such a computer-readable medium may include, but is not limited to, RAM, ROM, EEPROM, CD-ROM, or other optical disk storage, magnetic disk storage, or other magnetic storage devices, or any other medium that can be used to carry or store program code in the form of instructions or data structures and other forms readable by a general or special purpose computer, or a general or special purpose processor. In addition, any connection may be properly defined as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source via a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wirelessly, such as infrared, wireless, and microwave, it is also included in the defined computer-readable medium. The disks and discs include compact disks, laser disks, optical disks, DVDs, floppy disks, and Blu-ray disks. Disks typically reproduce data magnetically, while discs typically reproduce data optically with a laser. The above combinations may also be included in a computer-readable medium.

Claims

1. An alarm log processing method, characterized in that, Including: Extracting the current alarm source log according to the alarm source location information and alarm time in the current alarm log; Inputting the current alarm keyword feature value generated based on the current alarm log and the current alarm source feature value generated based on the current alarm source log into a recovery judgment model created based on historical alarm keyword feature values and historical alarm source feature values to obtain the current recovery type; Determining the current alarm duration feature value according to the alarm time, and inputting the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into an operation and maintenance instruction model created based on historical alarm duration feature values, historical alarm keyword feature values, and historical alarm source feature values according to the current recovery type to obtain an operation and maintenance operation instruction; Executing an operation and maintenance operation script generated based on the operation and maintenance operation instruction.

2. The alarm log processing method according to claim 1, wherein Extracting the current alarm source log according to the alarm source location information and alarm time in the current alarm log includes: Determining the alarm source according to the alarm source location information in the current alarm log; Determining the alarm delay time according to the alarm source; Determining the alarm source log interval according to the alarm delay time and the alarm occurrence time in the alarm time; Extracting the current alarm source log according to the alarm source and the alarm source log interval.

3. The alarm log processing method according to claim 1, wherein Creating a recovery judgment model based on historical alarm keyword feature values and historical alarm source feature values includes: Extracting the first historical operation and maintenance instruction log according to the alarm source location information and alarm time in the historical alarm log; Determining the historical alarm duration according to the alarm time in the historical alarm log; Determining the historical recovery type feature value according to the first historical operation and maintenance instruction log and the comparison result between the recovery time corresponding to the historical alarm source feature value and the historical alarm duration; Training a first initial model according to the historical alarm keyword feature value, the historical alarm source feature value, and the historical recovery type feature value, and creating the recovery judgment model according to the training result.

4. The alarm log processing method according to claim 3, wherein, Extracting the first historical operation and maintenance instruction log according to the alarm source location information and alarm time in the historical alarm log includes: Determining the first historical operation and maintenance instruction log interval according to the alarm time in the historical alarm log; Extracting the first historical operation and maintenance instruction log according to the alarm source location information in the historical alarm log and the first historical operation and maintenance instruction log interval.

5. The alarm log processing method according to claim 1, wherein Inputting the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into an operation and maintenance instruction model created based on historical alarm duration feature values, historical alarm keyword feature values, and historical alarm source feature values according to the current recovery type to obtain an operation and maintenance operation instruction includes: When the current recovery type is non-automatic recovery, inputting the current alarm duration feature value, the current alarm keyword feature value, and the current alarm source feature value into an operation and maintenance instruction model created based on historical alarm duration feature values, historical alarm keyword feature values, and historical alarm source feature values to obtain an operation and maintenance operation instruction.

6. The alarm log processing method according to claim 1, wherein Creating an operation and maintenance instruction model based on historical alarm duration feature values, historical alarm keyword feature values, and historical alarm source feature values includes: Extract the historical alarm source logs according to the alarm source location information and alarm time in the historical alarm logs; Extract the second historical operation and maintenance instruction logs according to the alarm time in the historical alarm logs and the historical alarm source logs; Obtain the historical operation and maintenance instruction eigenvalue according to the instruction operation time and the second historical operation and maintenance instruction logs; Train the second initial model according to the historical alarm duration eigenvalue, the historical alarm keyword eigenvalue, the historical alarm source eigenvalue and the historical operation and maintenance instruction eigenvalue, and create the operation and maintenance instruction model according to the training result.

7. The alarm log processing method according to claim 6, wherein Extracting the second historical operation and maintenance instruction logs according to the alarm time in the historical alarm logs and the historical alarm source logs includes: Determine the operation and maintenance end time according to the historical alarm source logs; Determine the historical alarm occurrence time according to the alarm time in the historical alarm logs; Determine the second historical operation and maintenance instruction log interval according to the operation and maintenance end time and the historical alarm occurrence time; Extract the second historical operation and maintenance instruction logs according to the alarm source location information in the historical alarm logs and the second historical operation and maintenance instruction log interval.

8. An alarm log processing device, characterized in that, Includes: The current alarm source log extraction module is used to extract the current alarm source log according to the alarm source location information and alarm time in the current alarm log; The current recovery type module is used to input the current alarm keyword eigenvalue generated based on the current alarm log and the current alarm source eigenvalue generated based on the current alarm source log into the recovery judgment model created based on the historical alarm keyword eigenvalue and historical alarm source eigenvalue to obtain the current recovery type; The operation and maintenance operation instruction module is used to determine the current alarm duration eigenvalue according to the alarm time, and input the current alarm duration eigenvalue, the current alarm keyword eigenvalue and the current alarm source eigenvalue into the operation and maintenance instruction model created based on the historical alarm duration eigenvalue, historical alarm keyword eigenvalue and historical alarm source eigenvalue according to the current recovery type to obtain the operation and maintenance operation instruction; The script execution module is used to execute the operation and maintenance operation script generated based on the operation and maintenance operation instruction.

9. A computer device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, When the processor executes the computer program, the steps of the alarm log processing method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of the alarm log processing method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising computer programs / instructions, characterized in that, When the computer program / instruction is executed by the processor, the steps of the alarm log processing method according to any one of claims 1 to 7 are implemented.

Images