An alarm processing method, device and equipment

Abstract

Embodiments of the present application disclose an alarm processing method, device and equipment, wherein the method comprises: aggregating alarm messages meeting an association rule into at least one alarm group, wherein each alarm group comprises one main alarm and at least one sub-alarm, and the association rule is updated based on a rule change message; determining the alarm group meeting a trigger condition as a target alarm group, wherein the trigger condition comprises a main-sub trigger condition of the main alarm and the sub-alarm, a sub-sub trigger condition between the sub-alarms and a filtering condition, and the filtering condition is a logical relationship between the main-sub trigger condition and the sub-sub trigger condition; and outputting the target alarm group. In this way, the alarms matching the association rule are further screened according to the trigger condition, the accuracy of the association is improved, the accuracy of alarm positioning is effectively improved, and the number of invalid work orders is reduced.

Description

Technical Field

[0001] This application relates to the field of alarms, and includes, but is not limited to, an alarm processing method, apparatus, and device. Background Technology

[0002] With the application and development of 5G technology, cloud computing has become a trend. Simultaneously, the underlying network management system supporting the stable operation of cloud services is also facing transformation and challenges. The diversification and variability of cloud products, cloud network elements, and underlying systems all pose challenges to the network management system. Alarm correlation is an indispensable function in the network management system. Existing technologies mainly implement alarm correlation using the following two solutions:

[0003] Option 1: Fixed template. Identify a specific type of alarm based on given fields, and perform association processing if the alarm matches the template.

[0004] Option 2: Rule Engine. Import the corresponding alarm fields into the rule engine. The alarm is matched by the rule engine to determine whether it meets the association rules. If it does, the corresponding association relationship is output. The downstream program receives the association relationship and performs the corresponding association processing.

[0005] The two association processing methods mentioned above have the following problems:

[0006] Option 1, using a fixed template configuration, is too rigid, has high maintenance costs, and lacks flexibility.

[0007] (1) Online maintenance personnel need to maintain a large number of customized configuration documents;

[0008] (2) A lot of customized development is also required at the code level, and the pressure of maintenance and upgrade tasks is high;

[0009] (3) The scope of application is small, it only applies to a certain type of special alarm and cannot be applied to ordinary alarms; the accuracy is insufficient.

[0010] Option 2: Use a rule engine to match alarm attributes to achieve association;

[0011] (1) After the alarm matching rules are followed, pairwise comparisons can only achieve two-level associations and cannot achieve three-level associations.

[0012] (2) The matching rules only apply to a single alarm. That is, the main alarm and the sub-alarm are matched separately. If the main alarm and the sub-alarm meet the matching rules, they are considered to be related. The comparison between the main alarm and the sub-alarm is not realized, and the relationship between the main alarm and the sub-alarm cannot be established. Summary of the Invention

[0013] In view of this, the present application provides an alarm processing method, apparatus and device to solve at least one problem existing in the prior art. It at least solves the problems that the alarm processing method of the prior art is too rigid by using a fixed template configuration, has high maintenance costs and is not flexible in configuration, and the accuracy of the correlation between the main alarm and the sub-alarm is not high.

[0014] The technical solution of this application is implemented as follows:

[0015] In a first aspect, this application provides an alarm processing method, comprising: aggregating alarm messages that satisfy association rules into at least one alarm group, wherein each alarm group includes a main alarm and at least one sub-alarm, and the association rules are updated based on rule change messages; determining the alarm group that satisfies triggering conditions as a target alarm group, wherein the triggering conditions include a master-sub-triggering condition between the main alarm and the sub-alarm, a sub-sub-triggering condition between the sub-alarms, and a filtering condition, wherein the filtering condition is the logical relationship between the master-sub-triggering condition and the sub-sub-triggering condition; and outputting the target alarm group.

[0016] Secondly, this application provides an alarm processing apparatus, the apparatus comprising: an aggregation module, configured to aggregate alarm messages that satisfy association rules into at least one alarm group, wherein each alarm group includes a main alarm and at least one sub-alarm, and the association rules are updated based on rule change messages; a determination module, configured to determine the alarm group that satisfies triggering conditions as a target alarm group, wherein the triggering conditions include a master-sub-triggering condition between the main alarm and the sub-alarm, a sub-sub-triggering condition between the sub-alarms, and a filtering condition, wherein the filtering condition is the logical relationship between the master-sub-triggering condition and the sub-sub-triggering condition; and an output module, configured to output the target alarm group.

[0017] Thirdly, this application provides an alarm processing device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the program to implement the alarm processing method described above.

[0018] This application provides an alarm processing method, apparatus, and device. First, upon confirming the receipt of an alarm message, alarm messages satisfying association rules are aggregated into at least one alarm group. Each alarm group includes a main alarm and at least one sub-alarm. The association rules are updated based on rule change messages. Then, alarm groups satisfying triggering conditions are identified as target alarm groups. The triggering conditions include master-sub-triggering conditions between the main alarm and the sub-alarms, sub-sub-triggering conditions between the sub-alarms, and filtering conditions. The filtering conditions define the logical relationship between the master-sub-triggering conditions and the sub-sub-triggering conditions. Finally, the target alarm group is output. This approach differs from existing technologies that assume association as long as the alarms meet the association rules. It further filters triggering conditions after matching the association rules, comparing and determining the field information of the main alarm and the sub-alarms, thus improving the accuracy of the association. Accurate association effectively improves the accuracy of alarm location and reduces the number of invalid work orders. The triggering conditions include those between sub-alarms, achieving a three-layer association of alarms. This solves the problem that pairwise comparisons after alarm matching rules can only achieve two-layer associations, not three-layer ones. The association rules are updated based on rule change messages, allowing them to be updated according to actual conditions. This addresses the issues of rigid, costly, and inflexible configuration using fixed templates in existing technologies. Attached Figure Description

[0019] Figure 1 A schematic diagram of the system architecture of an alarm processing method provided in this application embodiment;

[0020] Figure 2 A rule configuration page provided for an embodiment of this application;

[0021] Figure 3 An association rule configuration page provided in an embodiment of this application;

[0022] Figure 4 This is a schematic diagram illustrating the implementation process of an alarm processing method provided in an embodiment of this application.

[0023] Figure 5 A flowchart illustrating the process of determining a target alarm group is provided in this embodiment of the application.

[0024] Figure 6 This is a schematic diagram of the composition structure of an alarm processing device provided in an embodiment of this application;

[0025] Figure 7 This is a schematic diagram of a hardware entity of the alarm processing device provided in the embodiments of this application. Detailed Implementation

[0026] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0027] It should be understood that the embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit the technical scope of this application.

[0028] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0029] Kafka is a high-throughput distributed publish-subscribe messaging system that can handle all action streams of data from consumers on a website.

[0030] Flink executes arbitrary streaming data programs in a data-parallel and pipelined manner. Flink's pipelined runtime system can execute both batch and stream processing programs.

[0031] Drools (JBoss Rules) is an open-source business rules engine that is easy to access, adjust, and manage for enterprise policies. It conforms to industry standards and is fast and efficient.

[0032] ID (Identity document) is an abbreviation for various proprietary terms such as identity document number, account number, unique code, exclusive number, industrial design, country abbreviation, legal terminology, general account, decoder, software company, etc.

[0033] Redis (Remote Dictionary Server) is an open-source, ANSI C-written, network-enabled, in-memory or persistent, log-structured, key-value database that provides application programming interfaces (APIs) in multiple languages.

[0034] Figure 1 A system architecture diagram of an alarm processing method provided in this application embodiment is shown below. Figure 1 As shown, the system architecture includes at least: a bottom-level device 101, a cloud product 102, a message forwarding module 103, a message receiving module 104, a rule management module 105, a rule matching module 106, an associated window module 107, an anchor point relationship comparison module 108, and an associated message processing module 109.

[0035] The underlying device 101 can be a low-level hardware device that serves the system.

[0036] Cloud product 102 can be a virtual machine in the cloud;

[0037] The message forwarding module 103 can be the entry module for alarm access. It is mainly responsible for forwarding alarm messages from the underlying device 101 and various cloud products 102. It supports both message queue (MQ) and Kafka access. It distinguishes between active and cleared alarm messages and verifies the format of alarm messages. If the format meets the requirements, the alarm message is forwarded to the background Kafka of the alarm processing system for downstream Flink consumption. If the format does not meet the requirements, the alarm message is cleared.

[0038] The message receiving module 104 uses Flink to obtain alarm messages and related messages by accessing Kafka, and determines whether it is an alarm message or a related message based on the message number. If it is an alarm message, it forwards it to the downstream rule matching module 106; if it is a related message, it forwards it to the related message processing module 109.

[0039] The rule management module 105 is used to configure rules through a World Wide Web (web) page. This web page can be understood as a rule configuration page. Through the rule configuration page, you can complete the functions of adding, modifying and deleting rules, and send the corresponding related rule operations to Flink via Kafka.

[0040] Figure 2 A rule configuration page provided for embodiments of this application, such as Figure 2 As shown, the rule configuration page includes: Add Control 21, Enable Control 22, Disable Control 23, and Delete Control 24. Add Control 21 is used to add new association rule IDs, that is, to add matching conditions for new association rule IDs. For example, it can utilize... Figure 3 The association rule configuration page shown is used to configure association rules; the enable control 22 is used to allow the user to determine whether to enable the selected association rule; the disable control 23 is used to allow the user to determine whether to disable the selected association rule; and the delete control 24 is used to allow the user to determine whether to delete the selected association rule.

[0041] Figure 3 An association rule configuration page provided for embodiments of this application, such as Figure 3As shown, this page includes basic information 31, main alarm matching conditions 32, sub-alarm matching conditions 33, and associated triggering conditions 34. Basic information 31 provides information such as rule name, association period, and rule description for users to configure according to actual needs. Main alarm matching conditions 32 provide attribute names, operators, operation values, and filtering methods for users to configure. Users can configure at least one main alarm matching condition to determine the main alarm. When multiple main alarm matching conditions are configured, the logical relationship between them can be determined by configuring the filtering method. Sub-alarm matching conditions 33 allow users to configure sub-alarm matching conditions. Users can add multiple sub-alarm matching condition pages (sub-alarm 1, sub-alarm 2) according to actual needs. Each sub-alarm matching condition can also be configured with a corresponding filtering method. Associated triggering conditions 34 allow users to configure associated triggering conditions between sub-alarms and / or associated triggering conditions between the main alarm and sub-alarms; filtering methods can also be configured for these conditions.

[0042] The rule matching module 106, upon receiving a rule change message, converts the corresponding rule into a Drools statement based on the rule ID and loads it into the rule engine for rule verification upon receiving alarm messages. It employs a Drools-based rule engine. Upon receiving a rule change message, it retrieves the complete rule information from Redis using the rule ID carried in the message, parses and splits the associated rules into a main alarm rule and multiple sub-alarm rules, and finally converts the rules into standard Drools statements and imports them into the rule engine library. The alarm message matches the rules to determine whether it satisfies the main alarm rule or a sub-alarm rule, assigns the corresponding tag, and outputs the result to the association window module 107.

[0043] The association window module 107 is used to group alarm messages according to rule ID and set the time span of the window according to the association period set by the rule. Alarm messages that meet the same rule are assigned to the same window. Each time a new data is added to the window, an aggregation calculation is performed to pair the main and sub alarms in the window and output them. Alarm messages that exceed the association period are deleted.

[0044] The anchor point comparison module 108 is used to further compare the anchor point information of the master and child alarms. For example, by comparing the device ID of the master alarm and the peer device ID of the child alarm, if they are equal, it can be determined that the master alarm and the child alarm are related. The anchor point comparison module 108 can obtain anchor point information based on the paired master and child alarm information, compare the anchor point information of the master alarm with the anchor point information of the child alarm, and if they are equal, it considers that there is a relationship and outputs the relationship to Kafka; otherwise, it returns directly. Here, the anchor point information can be understood as the triggering condition between the master alarm and the child alarm (master-child triggering condition) or the triggering condition between child alarms (child-child triggering condition).

[0045] The associated message processing module 109 is used to determine the main alarm and the corresponding sub-alarm ID based on the received associated message, and update the associated attribute fields according to the corresponding alarm ID.

[0046] based on Figure 1 The system architecture shown implements the alarm handling process as follows:

[0047] Each cloud-based product 102 and underlying device 101 sends the original alarm information to the message forwarding module 103 via Kafka / MQ. The message forwarding module 103 performs preliminary format verification on the original alarm information and then sends it to Kafka. The message receiving module 104 uses Flink to receive the forwarded messages and classifies them by type. The classification process is as follows: determine whether the message is an active message or a related message. If it is an active message, it is sent to the rule matching module 106 for association rule matching. Alarms that match the association rules are classified according to the rule ID and added to the association window module 107. If it is a related message, it is sent to the related message processing module 109. In the association window module 107, each new alarm triggers an association calculation, pairs the master and child alarms, and sends the paired master and child alarms to the anchor comparison module 108 for anchor filtering (trigger condition matching). Finally, the association message is sent to Kafka. The message receiving module 104 uses Flink to receive the association message and sends it to the association message processing module 109. The association message processing module 109 updates the association fields of the alarms according to the association message and pushes them to the front end for association presentation.

[0048] This application provides an alarm processing method, such as... Figure 4 As shown, the method includes:

[0049] Step S401: Aggregate alarm messages that satisfy the association rules into at least one alarm group, wherein each alarm group includes a main alarm and at least one sub-alarm, and the association rules are updated based on the rule change message.

[0050] In some implementations, such as Figure 1 As shown, the message receiving module 104 can obtain different types of messages from the cloud product 102 or the underlying device 101. These messages include alarm messages, rule messages, and association messages. If an alarm message is received, the alarm message is sent to the rule matching module 106, which aggregates alarm messages that meet the association rules into at least one alarm group. The association rules are obtained using the rule management module 107.

[0051] In some implementations, the rule management module 107 can provide a page for users to configure associated rules, for example, Figure 3 As shown, the user-configured main alarm matching condition 32 and sub-alarm matching condition 33 can be obtained from the association rule configuration page.

[0052] In some embodiments, alarm messages that satisfy the same association rule ID are aggregated into at least one alarm group.

[0053] Step S402: Determine the alarm group that meets the triggering conditions as the target alarm group, wherein the triggering conditions include the master-sub-triggering conditions between the master alarm and the sub-alarms, the sub-sub-triggering conditions between the sub-alarms and the filtering conditions, and the filtering conditions are the logical relationship between the master-sub-triggering conditions and the sub-sub-triggering conditions.

[0054] Figure 5 This application provides a flowchart illustrating the process of determining a target alarm group, as shown in the embodiments of this application. Figure 5 As shown in the diagram, the process flow includes:

[0055] Step S51: Filter out the master / sub alarms that meet the association conditions through the rule engine, and send the master / sub alarm to the association window module 107 (the association window module 107 can periodically delete alarms that have exceeded the association time according to the alarm validity period).

[0056] Step S52: When a new alarm message enters the association window module 107 or the timer expires, the association calculation is triggered, i.e., in step 53 below, trigger condition matching is performed in the anchor point relationship comparison module 108. The trigger condition matching can be as follows: Figure 3 The associated trigger condition 34 is shown in the configuration.

[0057] Step S53: The anchor point relationship comparison module 108 uses the anchor point program to retrieve all master / child alarms that meet the association rules from the association window module 107, classifies them according to master / child, and starts to traverse and match the trigger conditions.

[0058] Step S54: The anchor point relationship comparison module 108 outputs the target alarm group (main alarm A, sub-alarm A2) that meets the triggering conditions.

[0059] Step S403: Output the target alarm group.

[0060] In this embodiment, firstly, upon confirming the receipt of an alarm message, alarm messages satisfying the association rules are aggregated into at least one alarm group. Each alarm group includes one main alarm and at least one sub-alarm. The association rules are updated based on rule change messages. Then, alarm groups satisfying the triggering conditions are determined as target alarm groups. The triggering conditions include the master-sub-triggering condition between the main alarm and the sub-alarm, the sub-sub-triggering condition between the sub-alarms, and a filtering condition. The filtering condition is the logical relationship between the master-sub-triggering condition and the sub-sub-triggering condition. Finally, the target alarm group is output. This approach differs from existing technologies that consider an alarm as associated simply because it meets the association rules. It further filters the triggering conditions after matching the association rules, comparing and determining the field information of the main alarm and the sub-alarm, thus improving the accuracy of the association. Accurate association effectively improves the accuracy of alarm location and reduces the number of invalid work orders. The triggering conditions include those between sub-alarms, achieving a three-layer association of alarms. This solves the problem that pairwise comparisons after alarm matching rules can only achieve two-layer associations, not three-layer ones. The association rules are updated based on rule change messages, allowing them to be updated according to actual conditions. This addresses the issues of rigid, costly, and inflexible configuration using fixed templates in existing technologies.

[0061] This application provides an alarm processing method, which includes:

[0062] Step 201: Receive a rule change message, which includes associated rules.

[0063] In some embodiments, such as Figure 1 As shown, the rule matching module (rule engine) 106 receives a rule change message sent by the rule management module 105. The rule change can be in response to user configuration, such as... Figure 3 The association rule configuration page shown.

[0064] Step 202: Parse the association rules to obtain a matching rule for a main alarm and a matching rule for at least one sub-alarm associated with the matching rule for the main alarm.

[0065] In some embodiments, the association rule may include a matching rule for a primary alarm and matching rules for multiple sub-alarms associated with the matching rule for the primary alarm. For example... Figure 3 The association rule configuration page sets the main alarm matching condition 32 and two sub-alarm matching conditions 33 associated with the main alarm matching rule.

[0066] Step 203: After converting the matching rule of the main alarm and the matching rule of at least one sub-alarm associated with the matching rule of the main alarm, import them into the rule engine.

[0067] In some embodiments, the matching rules for a primary alarm and the matching rules for at least one child alarm associated with the primary alarm can be converted into Drools statements and added to the Drools engine library.

[0068] Step 204: Invoke the rule engine, which will assign alarm messages that satisfy the same association rule to the same association window.

[0069] Windowing is a common problem in stream processing applications, often requiring data aggregation across a time window. Flink's windowing operators provide easy-to-use applications that can divide data streams into windows and process the data within each window.

[0070] In some embodiments, such as Figure 1 As shown, the rule engine 106 assigns alarm messages that satisfy the same association rule to an association window module 107.

[0071] Step 205: When a new alarm message is added to each of the aforementioned associated windows, the alarm messages in the corresponding associated windows are aggregated and calculated.

[0072] In some embodiments, when a new alarm message is added to the associated window, an aggregation operation is immediately triggered to perform aggregation calculations on the alarm messages in the corresponding associated window.

[0073] Step 206: Pair the main alarms and sub-alarms in each associated window after aggregation calculation to obtain the alarm group.

[0074] In some embodiments, after aggregation calculation, multiple alarm groups including a main alarm and at least one sub-alarm can be obtained according to the actual situation.

[0075] Step 207: Determine the alarm group that meets the triggering conditions as the target alarm group, wherein the triggering conditions include the master-sub-triggering conditions between the master alarm and the sub-alarms, the sub-sub-triggering conditions between the sub-alarms, and the filtering conditions, wherein the filtering conditions are the logical relationship between the master-sub-triggering conditions and the sub-sub-triggering conditions.

[0076] Step 208: Output the target alarm group.

[0077] In this embodiment, the system performs correlation processing on alarm messages based on correlation windows, adopts real-time stream processing, and splits correlated alarms into windows. Alarms with the same rules are added to the same window, effectively improving the efficiency of correlation aggregation calculation. At the same time, by leveraging the distributed computing capabilities of stream processing, the system fully utilizes computing resources to improve alarm processing capabilities, solving the problem in the prior art where single alarm matching is not very flexible in handling correlation periods and requires writing a lot of business code to implement the validity of correlation windows.

[0078] This application provides an alarm processing method, which includes...

[0079] Step 211: Receive a rule change message, which includes associated rules.

[0080] Step 212: Parse the association rules to obtain a matching rule for a main alarm and a matching rule for at least one sub-alarm associated with the matching rule for the main alarm.

[0081] Step 213: After converting the matching rules of the main alarm and the matching rules of the at least one associated sub-alarm, import them into the rule engine.

[0082] Step 214: The rule engine will assign alarm messages that satisfy the same association rule to the same association window.

[0083] Step 215: Determine the time span of the corresponding association window based on the association period set in the association rule.

[0084] In some embodiments, the system can determine the time span of the corresponding association window based on the association period set in the association rules. Here, the user can configure the association period according to the actual situation when configuring association rules. For example, Figure 3 The association rule configuration page shown allows users to configure the association period for basic information 31, which is the time span of the association window.

[0085] Step 216: When a new alarm message is added to each of the associated windows, delete the alarm messages in each of the associated windows that exceed the corresponding time span.

[0086] Since timeout alarms no longer meet the association rules, alarm messages that exceed the corresponding time span need to be deleted from the association window.

[0087] Step 217: Perform aggregate calculations on the alarm messages in the associated windows after deletion.

[0088] Step 218: Pair the main alarms and sub-alarms in each associated window after aggregation calculation to obtain the alarm group.

[0089] Step 219: Determine the alarm group that meets the triggering conditions as the target alarm group, wherein the triggering conditions include the master-sub-triggering conditions between the master alarm and the sub-alarms, the sub-sub-triggering conditions between the sub-alarms and the filtering conditions, and the filtering conditions are the logical relationship between the master-sub-triggering conditions and the sub-sub-triggering conditions.

[0090] Step 220: Output the target alarm group.

[0091] In this embodiment, when a new alarm message is added to each associated window, alarm messages exceeding the corresponding time span within each associated window are deleted, and then the alarm messages in the deleted associated windows are aggregated. This ensures that the alarm messages used for aggregation calculation all meet the association period requirements, solving the problem that alarm messages exceeding the time span do not meet the association period.

[0092] This application provides an alarm processing method, which includes:

[0093] Step 301: If an alarm message is received, the alarm messages that satisfy the association rules are aggregated into at least one alarm group, wherein each alarm group includes a main alarm and at least one sub-alarm.

[0094] Step 302: When the logical relationship is AND, the alarm group that simultaneously satisfies the master-child triggering condition and the child-child triggering condition is determined as the target alarm group.

[0095] The triggering conditions include master-child triggering conditions, sub-child triggering conditions, and filtering conditions; the master-child triggering conditions are used to characterize the triggering conditions between master alarms and sub-alarms, the sub-child triggering conditions are used to characterize the triggering conditions between sub-alarms, and the filtering conditions are used to characterize the logical relationship between the master-child triggering conditions and the sub-child triggering conditions.

[0096] In some embodiments, the master-child triggering condition can be a constraint on the relationship between the master alarm and the child alarm, and the child-child triggering condition can be a constraint on the relationship between the child alarms. Using the master-child triggering condition and the child-child triggering condition, the complex multi-layered relationships of the triggering conditions of the master alarm and the child alarm, the master alarm and the child alarm 1, and the child alarm 2 can be described intuitively, thereby achieving the establishment of three-layer or even N-layer associations.

[0097] In some embodiments, the filtering conditions can be as follows: Figure 3The filtering method in association trigger condition 34 on the association rule configuration page shows that users can choose AND or OR logic for simple logic, or they can choose a more complex logic configuration to meet their needs. Once the filtering conditions are obtained, the system can determine the logical relationship between the primary and child trigger conditions and the child-child trigger conditions.

[0098] The logical relationship is AND, meaning that the system needs to identify alarm groups that simultaneously meet both the master-child triggering condition and the child-child triggering condition as target alarm groups.

[0099] In some embodiments, a user can configure multiple triggering conditions on a sub-alarm page. In the case of a simple logical AND filtering method, the system needs to identify the alarm group that meets multiple triggering conditions as the target alarm group.

[0100] Step 303: When the logical relationship is OR, the alarm group that satisfies the master-child triggering condition or the child-child triggering condition is determined as the target alarm group.

[0101] The logical relationship is OR, meaning that the system needs to determine the alarm group that meets the master-child triggering condition or the child-child triggering condition as the target alarm group.

[0102] In some embodiments, a user can configure multiple trigger conditions on a sub-alarm page. In the case of a simple logical OR filtering method, the system needs to determine the alarm group that meets any of the trigger conditions as the target alarm group.

[0103] Step 304: Output the target alarm group.

[0104] In this embodiment, the establishment and processing of master-child triggering conditions and child-child triggering conditions provide a technical implementation for multi-layer alarm association. It can intuitively describe the relationship between master alarms and child alarms, as well as complex multi-layer relationships such as master alarms, child alarm 1, and child alarm 2, thereby achieving the establishment of three-layer or even N-layer associations. After establishing the matching relationship between master alarms and child alarms, alarms can be effectively compressed. When dispatching alarms, the child alarms of the master alarm can be placed as additional messages in the same work order for processing, effectively reducing the number of alarm work orders and solving the problem of a large number of invalid work orders affecting user processing efficiency.

[0105] This application provides an alarm processing method, which includes:

[0106] Step 310: If an alarm message is received, the alarm messages that satisfy the association rules are aggregated into at least one alarm group, wherein each alarm group includes a main alarm and at least one sub-alarm.

[0107] Step 311: If the device information corresponding to the main alarm in the alarm group is the same as the device information corresponding to the sub-alarm in the alarm group, the alarm group is determined as the target alarm group.

[0108] In some embodiments, if it is determined that the device information that generates the main alarm in the alarm group is the same as the device information that generates the sub-alarm, it can be determined that the alarms in the alarm group are generated by the same device, and the alarm group can be identified as the target alarm group.

[0109] Step 312: Output the target alarm group.

[0110] In this embodiment, if the device information corresponding to the main alarm in the alarm group is the same as the device information corresponding to the sub-alarm in the alarm group, the alarm group is determined as the target alarm group. In this way, the association between the main alarm and the sub-alarm can be determined based on the device information, and the target alarm group can be accurately identified.

[0111] This application provides an alarm processing method, which includes:

[0112] Step 320: Obtain messages to be processed, wherein the messages to be processed include the alarm messages and related messages.

[0113] In some embodiments, such as Figure 1 As shown, the message forwarding module 103 obtains messages to be processed from the underlying device 101 and / or the cloud product 102. The messages to be processed include alarm messages and related messages.

[0114] Step 321: If the message is determined to be the alarm message, the alarm messages that satisfy the association rules are aggregated into at least one alarm group.

[0115] Step 322: Determine the alarm group that meets the triggering conditions as the target alarm group.

[0116] Step 323: Output the target alarm group.

[0117] Step 324: If the message is determined to be the associated message, update the status of the alarm corresponding to the associated message.

[0118] In this embodiment, when the message to be processed is an alarm message, the processing corresponding to the alarm message is performed; when the message to be processed is a related message, the processing corresponding to the related message is performed. In this way, corresponding processing can be achieved based on different messages to be processed.

[0119] This application provides an alarm processing method, which includes:

[0120] Step 330: Obtain messages to be processed, wherein the messages to be processed include the alarm messages and related messages.

[0121] Step 331: If the message to be processed is determined to be the alarm message, the alarm messages that satisfy the association rules are aggregated into at least one alarm group.

[0122] Step 332: Determine the alarm group that meets the triggering conditions as the target alarm group.

[0123] Step 333: Output the target alarm group.

[0124] Step 334: If it is determined that the message to be processed is the associated message, update the identifier of the main alarm in the target alarm group to the main alarm identifier field of the sub-alarm in the target alarm group, and at the same time update the identifier of the sub-alarm in the target alarm group to the sub-alarm identifier field of the main alarm in the target alarm group.

[0125] In some embodiments, for example, if the device information of the main alarm and the peer device information of the sub-alarm are associated with the same device identifier, the identifier of the main alarm can be updated in the sub-alarm identifier field, and the identifier of the sub-alarm can be updated in the sub-alarm identifier field of the main alarm.

[0126] In this embodiment, when the message is determined to be the associated message, the identifier of the primary alarm is updated in the primary alarm identifier field of the sub-alarm, and the identifier of the sub-alarm is simultaneously updated in the sub-alarm identifier field of the primary alarm. In this way, the system can display the association between the primary alarm and the sub-alarm based on the alarm identifier fields.

[0127] This application provides an alarm processing method, such as... Figure 1 As shown, the alarm handling method requires the use of message receiving module 104, rule management module 105, rule matching module 106, associated window module 10, anchor point comparison module 108, and associated message processing module 109 to complete the processing flow. The following is the processing flow of each type of module:

[0128] 1. Message receiving module 104;

[0129] Step 141: Receive various messages sent by the underlying device 101 or the cloud product 102, and use Flink stream processing to listen for alarm messages, rule messages, and related messages.

[0130] Step 142: After receiving any of the above messages, extract the message type from the message body to determine whether the message is an alarm message or a related message.

[0131] Step 143: If the message is confirmed to be an alarm message, the alarm message is sent to the rule matching module 106.

[0132] Step 144: If the message is confirmed to be a related message, the related message is sent to the related message processing module 109.

[0133] II. Rules Management Module 105;

[0134] Step 151: A web page can be provided to users, allowing them to edit association rules, such as adding, deleting, and modifying them. Association rules include: association period, a main alarm matching condition, multiple sub-alarm matching conditions, and triggering conditions.

[0135] Step 152: Perform the database operation to store the modified association rules, that is, store the association rule information in Redis;

[0136] Step 153: Generate a corresponding notification message to Kafka based on the user's operation type. The notification message carries the rule ID and operation type. Send the change message of the associated rule to the rule matching module 106.

[0137] III. Rule Matching Module 106;

[0138] Step 161: Receive the change message of the associated rule sent by the rule management module 105.

[0139] Step 162: Retrieve all associated rules based on the rule ID, and split them according to the main alarm matching condition and multiple sub-alarm matching conditions. Convert the split main alarm matching conditions and multiple sub-alarm matching conditions into Drools statements and add them to the Drools engine library.

[0140] Step 163: Using the alarm message matching engine library received by the message receiving module 104, add the corresponding field to the attribute field of the alarm message for alarm messages that match the rule ID.

[0141] Step 164: Output the matched alarm message to the associated window module 107.

[0142] IV. Related window module 107;

[0143] Step 171: Receive the alarm message sent by the rule matching module 106 after rule matching.

[0144] Step 172: Group by rule ID, insert alarms with the same rule ID into the same associated window. If the associated window does not exist, create a new window based on the rule ID and associated time window.

[0145] Step 173: After each associated window receives new data (newly generated alarm message), it immediately triggers an aggregation operation, traversing all main alarms and all child alarms in the associated window, and outputting the main alarms and child alarms in pairs.

[0146] Step 174: After the aggregation operation is completed, iterate through all alarms in the associated window again and delete alarms whose time exceeds the associated time window (associated period).

[0147] Step 175: Output the paired main alarm and sub-alarm to the anchor point relationship comparison module 108.

[0148] The features of the associated window module 107 are: alarm messages are grouped and calculated according to rule IDs, and the main alarm and sub-alarms in an associated window can be directly paired, saving the calculation overhead of eliminating redundant alarms.

[0149] V. Anchor Point Comparison Module 108;

[0150] Step 181: Retrieve all associated rules from Redis based on the rule ID.

[0151] Step 182: Obtain the master-sub triggering conditions and / or sub-sub triggering conditions between the master alarm and the sub-alarm based on the sub-alarm number.

[0152] Step 183: Extract the attribute values ​​corresponding to the main alarm and the child alarm respectively according to the master-child triggering conditions and / or the child-child triggering conditions.

[0153] Step 184: Determine whether the attribute values ​​of the main alarm and the child alarm match the main-child trigger conditions and / or the child-child trigger conditions.

[0154] Step 185: In the case of a match, output the corresponding associated message to Kafka. The message receiving module 104 obtains the associated message from Kafka and sends it to the associated message processing module 109.

[0155] Step 186: In the case of a mismatch, determine that there is no actual relationship and return directly without any processing.

[0156] The anchor point comparison module 108 has the following characteristics: Unlike existing technologies that identify a relationship as long as it meets the association rules, the anchor point comparison module 108 performs further anchor point filtering on alarms after matching the association rules, compares and judges the field information of the main alarm and the sub-alarm, improves the accuracy of the association, and realizes direct comparison and association between the main and the sub-alarms.

[0157] VI. Related Message Processing Module 109;

[0158] Step 191: Receive message. The message received by the message receiving module 104 contains the main alarm ID and multiple sub-alarm IDs associated with it.

[0159] Step 192: Update the sub-alarm ID to the sub-alarm ID (sub_alarm_ids) field of the main alarm.

[0160] Step 193: Update the primary alarm ID to the primary alarm ID (primary_alarm_ids) field of each sub-alarm.

[0161] This application provides an alarm association implementation scheme based on Flink streaming processing; an association processing method based on Flink windows; and a method for establishing and processing master-child triggering conditions and child-child triggering conditions. In this way, alarm association is implemented using Flink real-time streaming processing, which splits associated alarms into windows. Alarms with the same rules are added to the same window, effectively improving the efficiency of association aggregation calculation. Simultaneously, Flink's distributed computing capabilities are leveraged to fully utilize computing resources and improve alarm processing capabilities. Unlike existing technologies that implement two-layer association based on master alarm matching conditions and child alarm matching conditions, this application provides a technical implementation for multi-layer alarm association by establishing anchor relationships. Anchors are additional constraints on the relationship between master alarms and child alarms, added on top of association rules. Through anchors, the relationship between master alarms and child alarms, master alarms and child alarm 1, and child alarm 2—complex multi-layer relationships—can be described intuitively, thereby achieving the establishment of three-layer or even N-layer associations.

[0162] Based on the foregoing embodiments, this application provides an alarm processing device, which includes various modules, each module including sub-modules, and each sub-module including units; of course, it can also be implemented through specific logic circuits; in the implementation process, the processor can be a central processing unit (CPU), microprocessor (MPU), digital signal processor (DSP) or field programmable gate array (FPGA), etc.

[0163] Figure 6 This is a schematic diagram of the composition structure of an alarm processing device provided in an embodiment of this application, as shown below. Figure 6 As shown, the device 600 includes:

[0164] The aggregation module 610 is used to aggregate alarm messages that meet the association rules into at least one alarm group, wherein each alarm group includes a main alarm and at least one sub-alarm, and the association rules are updated based on the rule change message;

[0165] The determination module 620 is used to determine the alarm group that meets the triggering conditions as the target alarm group, wherein the triggering conditions include the master-sub-triggering condition between the master alarm and the sub-alarm, the sub-sub-triggering condition between the sub-alarms and the filtering condition, and the filtering condition is the logical relationship between the master-sub-triggering condition and the sub-sub-triggering condition;

[0166] Output module 630 is used to output the target alarm group.

[0167] In some embodiments, the aggregation module 610 includes a calling submodule, an aggregation submodule, and a pairing submodule. The calling submodule is used to call a rule engine, which assigns alarm messages that satisfy the same association rule to the same association window. The aggregation submodule is used to perform aggregation calculations on the alarm messages in the corresponding association window when a new alarm message is added to each association window. The pairing submodule is used to pair the main alarm and sub-alarms in each association window after aggregation calculation to obtain the alarm group.

[0168] In some embodiments, the aggregation module 610 further includes a receiving submodule, a parsing submodule, and an import submodule, wherein the receiving submodule is used to receive rule change messages, the rule change messages including associated rules; the parsing submodule is used to parse the associated rules to obtain a matching rule for a main alarm and a matching rule for at least one sub-alarm associated with the matching rule for the main alarm; and the import submodule is used to convert the matching rule for the main alarm and the matching rule for the at least one sub-alarm associated with the matching rule for the main alarm and then import them into the rule engine.

[0169] In some embodiments, the aggregation submodule includes a determining unit, a deleting unit, and an aggregation unit, wherein the determining unit is used to determine the time span of the corresponding association window based on the association period set in the association rule; the deleting unit is used to delete alarm messages in each association window that exceed the corresponding time span when a new alarm message is added in each association window; and the aggregation unit is used to perform aggregation calculation on the alarm messages in the deleted association windows.

[0170] In some embodiments, the triggering conditions include master-sub-triggering conditions, sub-sub-triggering conditions, and filtering conditions. The master-sub-triggering conditions characterize the triggering conditions between a master alarm and a sub-alarm, the sub-sub-triggering conditions characterize the triggering conditions between sub-alarms, and the filtering conditions characterize the logical relationship between the master-sub-triggering conditions and the sub-sub-triggering conditions. The determining module includes a first determining sub-module and a second determining sub-module. The first determining sub-module is used to determine, when the logical relationship is AND, an alarm group that simultaneously satisfies both the master-sub-triggering conditions and the sub-sub-triggering conditions as the target alarm group. The second determining sub-module is used to determine, when the logical relationship is OR, an alarm group that satisfies either the master-sub-triggering conditions or the sub-sub-triggering conditions as the target alarm group.

[0171] In some embodiments, the master-sub triggering condition includes the device information corresponding to the master alarm being equal to the device information corresponding to the sub alarm. The determining module is further configured to determine the alarm group as the target alarm group when it is determined that the device information corresponding to the master alarm in the alarm group is the same as the device information corresponding to the sub alarm in the alarm group.

[0172] In some embodiments, the apparatus further includes an acquisition module and an update module, wherein the acquisition module is configured to acquire a message to be processed, wherein the message to be processed includes the alarm message and the associated message; the aggregation module is further configured to, when it is determined that the message to be processed is the alarm message, aggregate alarm messages that satisfy the association rules into at least one alarm group; and the update module is configured to, when it is determined that the message to be processed is the associated message, update the status of the alarm corresponding to the associated message.

[0173] In some embodiments, the update module is further configured to, when determining that the message to be processed is the associated message, update the identifier of the main alarm in the target alarm group to the main alarm identifier field of the sub-alarm in the target alarm group, and at the same time update the identifier of the sub-alarm in the target alarm group to the sub-alarm identifier field of the main alarm in the target alarm group.

[0174] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0175] It should be noted that, in the embodiments of this application, if the alarm processing method described above is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause the alarm processing device (which may be a mobile phone, tablet computer, laptop computer, desktop computer, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0176] Correspondingly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in the alarm processing method provided in the above embodiments.

[0177] Correspondingly, embodiments of this application provide an alarm processing device. Figure 7 This is a schematic diagram of a hardware entity of the alarm processing device according to an embodiment of this application, such as... Figure 7 As shown, the hardware entity of the device 700 includes a memory 701 and a processor 702. The memory 701 stores a computer program that can run on the processor 702. When the processor 702 executes the program, it implements the alarm processing steps provided in the above embodiments.

[0178] The memory 701 is configured to store instructions and applications executable by the processor 702, and can also cache data to be processed or already processed (e.g., image data, audio data, voice communication data and video communication data) in the processor 702 and various modules in the alarm processing device 700. It can be implemented by flash memory or random access memory (RAM).

[0179] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0180] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0181] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0182] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0183] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0184] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0185] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0186] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an alarm processing device (which may be a mobile phone, tablet computer, laptop computer, desktop computer, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, magnetic disks, or optical disks.

[0187] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0188] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0189] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0190] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An alarm processing method, characterized in that, The method includes: The rule engine is invoked, and the rule engine assigns alarm messages that satisfy the same association rule to the same association window; When a new alarm message is added to each of the aforementioned associated windows, the alarm messages in the corresponding associated window are aggregated and calculated. The main alarm and sub-alarms in each associated window after aggregation calculation are paired to obtain alarm groups. Each alarm group includes one main alarm and at least one sub-alarm. The association rules are updated based on rule change messages. The alarm group that meets the triggering conditions is determined as the target alarm group. The triggering conditions include the master-sub-triggering condition between the master alarm and the sub-alarm, the sub-sub-triggering condition between the sub-alarms, and the filtering condition. The filtering condition is the logical relationship between the master-sub-triggering condition and the sub-sub-triggering condition. When the logical relationship is AND, the alarm group that simultaneously satisfies the master-child triggering condition and the child-child triggering condition is determined as the target alarm group; When the logical relationship is OR, the alarm group that satisfies the master-child triggering condition or the child-child triggering condition is determined as the target alarm group; Output the target alarm group.

2. The method as described in claim 1, characterized in that, The method further includes: Receive the rule change message, which includes associated rules; Parse the association rules to obtain a matching rule for a main alarm and a matching rule for at least one sub-alarm associated with the matching rule for the main alarm; After converting the matching rule of the main alarm and the matching rule of at least one sub-alarm associated with the matching rule of the main alarm, they are imported into the rule engine.

3. The method as described in claim 1, characterized in that, When a new alarm message is added to each of the associated windows, the alarm messages in the corresponding associated window are aggregated and calculated, including: Based on the association period set in the association rules, the time span of the corresponding association window is determined; When a new alarm message is added to each of the aforementioned associated windows, alarm messages in each of the aforementioned associated windows that exceed the corresponding time span will be deleted; The alarm messages in the associated windows after deletion are then aggregated and calculated.

4. The method as described in claim 1, characterized in that, The master-slave triggering condition includes the fact that the device information corresponding to the master alarm is equal to the device information corresponding to the slave alarm. Correspondingly, determining the alarm group that meets the triggering conditions as the target alarm group includes: If the device information corresponding to the main alarm in the alarm group is the same as the device information corresponding to the sub-alarm in the alarm group, the alarm group is determined as the target alarm group.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Obtain pending messages, wherein the pending messages include the alarm message and related messages; If the message to be processed is determined to be the alarm message, alarm messages that meet the association rules will be aggregated into at least one alarm group; If it is determined that the message to be processed is the associated message, the status of the alarm corresponding to the associated message is updated.

6. The method as described in claim 5, characterized in that, The step of updating the status of the alarm corresponding to the associated message when it is determined that the message to be processed is the associated message includes: If it is determined that the message to be processed is the associated message, the identifier of the main alarm in the target alarm group is updated to the main alarm identifier field of the sub-alarm in the target alarm group, and the identifier of the sub-alarm in the target alarm group is updated to the sub-alarm identifier field of the main alarm in the target alarm group.

7. An alarm processing device, characterized in that, The device includes: The aggregation module is used to call the rule engine, which assigns alarm messages that satisfy the same association rule to the same association window; when an alarm message is added to each association window, the alarm messages in the corresponding association window are aggregated and calculated; the main alarm and sub-alarms in each association window after aggregation and calculation are paired to obtain alarm groups, wherein each alarm group includes one main alarm and at least one sub-alarm. The determination module is used to determine the alarm group that meets the triggering conditions as the target alarm group, wherein the triggering conditions include the master-sub-triggering conditions between the master alarm and the sub-alarms, the sub-sub-triggering conditions between the sub-alarms, and the filtering conditions, wherein the filtering conditions are the logical relationship between the master-sub-triggering conditions and the sub-sub-triggering conditions; The first determining submodule is used to determine the alarm group that simultaneously satisfies the master-child triggering condition and the child-child triggering condition as the target alarm group when the logical relationship is AND; The second determining submodule is used to determine the alarm group that satisfies the master-sub triggering condition or the sub-sub triggering condition as the target alarm group when the logical relationship is OR. The output module is used to output the target alarm group.

8. An alarm processing device, characterized in that, The method includes a memory and a processor, the memory storing a computer program executable on the processor, characterized in that the processor, when executing the program, implements the steps of the method according to any one of claims 1 to 6.

Images