A Prometheus alarm signal classification method and device based on double fingerprints

Abstract

This application provides a Prometheus alarm signal classification method and apparatus based on dual fingerprints. The method involves: sorting all key-value pairs of alarm tags in a natural order; converting the sorted JSON object into a first string; calculating the MD5 hash of the first string to obtain a second string; using the second string as a tag fingerprint; using the tag fingerprint as the primary fingerprint and the content fingerprint as an auxiliary fingerprint, wherein the auxiliary fingerprint corresponds to the primary fingerprint, and the primary fingerprint serves as an identifier for alarm signal classification. This method overcomes the shortcomings of current single-fingerprint solutions, solves the problem of inaccurate alarm signal classification in self-developed work order systems, which leads to a large number of duplicate work orders, thereby reducing the number of duplicate work orders and lowering maintenance costs.

Description

Technical Field

[0001] This relates to the field of internet technology, and in particular to a method and apparatus for classifying Prometheus alarm signals based on dual fingerprints. Background Technology

[0002] Prometheus is a very popular and complete open-source monitoring solution worldwide, providing a range of functions including data collection, data storage, data querying, and data alerting. Prometheus periodically collects monitoring metric data and then periodically performs rule calculations on these metrics. When a metric meets an alert rule, Prometheus triggers an alert, which is then sent to a designated receiver via Alertmanager. When a metric no longer meets the alert rule, Prometheus removes the alert, and Alertmanager sends a recovery signal to the designated receiver.

[0003] When the self-developed work order system receives an alarm signal for the first time, it creates a work order. When the system receives a recovery signal, it cannot automatically close the work order if it cannot find the corresponding alarm signal. Alarm tag fingerprinting is the solution to this problem. By sorting all the tags of the alarm signal by key and calculating the MD5 hash, the resulting string is used as the alarm tag fingerprint. Since the tags in the alarm signal and the recovery signal of the same alarm object are the same, the calculated alarm tag fingerprint is also the same. This makes it easy to classify alarm signals and recovery signals.

[0004] However, in real-world production environments, there are numerous duplicate alarm signals. These alarm signals have the same alarm content, but some tag values ​​differ, resulting in different calculated alarm tag fingerprints. This can lead to hundreds or even thousands of work orders with identical content. If a single-tag fingerprint scheme is still used, specified tag key-value pairs need to be removed before calculating the fingerprint. However, this requires maintaining a list of tag keys to be removed, and the code needs to incorporate a lot of conditional logic, such as under what circumstances these tag keys should be removed, and under what circumstances should other tag keys be removed. Clearly, the method of removing specified tag key-value pairs is not universal. Summary of the Invention

[0005] This invention provides a method and apparatus for classifying Prometheus alarm signals based on dual fingerprints to improve the above-mentioned problems.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, this application proposes a Prometheus alarm signal classification method based on dual fingerprints. The method includes: sorting all key-value pairs of alarm tags of alarm signals in a natural order; converting the sorted JSON object into a first string; calculating the MD5 hash of the first string to obtain a second string; using the second string as a tag fingerprint; using the tag fingerprint as a primary fingerprint and the content fingerprint as an auxiliary fingerprint, wherein the auxiliary fingerprint corresponds to the primary fingerprint, and the primary fingerprint is an identifier for alarm signal classification.

[0008] In some implementations, the correspondence between the primary fingerprint and the secondary fingerprint is a mapping relationship.

[0009] In some implementations, the method further includes: determining the mapping relationship between the content fingerprint and the master fingerprint; if a mapping relationship exists, then using the corresponding master fingerprint as its own master fingerprint.

[0010] In some implementations, the method further includes: determining the mapping relationship between the content fingerprint and the master fingerprint; if no mapping relationship exists, then using its own tag fingerprint as the master fingerprint.

[0011] In some embodiments, the method further includes:

[0012] Add a time field, and when the time field matches the external time, clear the existing mapping relationship.

[0013] In some implementations, the tag fingerprint serves as the primary fingerprint, and the content fingerprint as the secondary fingerprint. The secondary fingerprint corresponds to the primary fingerprint, which is an identifier for classifying alarm signals and includes:

[0014] The content fingerprint is matched with data in the database. If the content fingerprint has matching data in the database, the master fingerprint is determined. The master fingerprint is the fingerprint that the content fingerprint matches from the database.

[0015] In some implementations, the tag fingerprint is used as the primary fingerprint and the content fingerprint is used as the secondary fingerprint. The secondary fingerprint is used to correspond to the primary fingerprint, and the primary fingerprint is an identifier for classifying alarm signals. The implementation also includes: if the content fingerprint does not have matching data in the database, then the tag fingerprint itself is taken as the primary fingerprint, and the mapping relationship between the primary fingerprint and the content fingerprint is saved to the database.

[0016] In some implementations, the method further includes: determining whether an alarm signal has been processed, and if so, processing the next repeating alarm signal.

[0017] Secondly, this application proposes a Prometheus alarm signal classification device based on dual fingerprints, characterized in that the device includes: a sorting unit, which is used to sort all key-value pairs of alarm tags of alarm signals in a natural order; a first conversion unit, which is used to convert the sorted JSON object into a first string; a calculation unit, which is used to calculate the MD5 hash of the first string to obtain a second string; a determination unit, which is used to use the second string as a tag fingerprint; and a marking unit, which is used to use the tag fingerprint as a primary fingerprint and the content fingerprint as an auxiliary fingerprint, wherein the auxiliary fingerprint is used to correspond to the primary fingerprint, and the primary fingerprint is an identifier for alarm signal classification.

[0018] In some implementations, the tagging unit is further configured to take its own tag fingerprint as the master fingerprint if the content fingerprint does not have matching data in the database, and save the mapping relationship between the master fingerprint and the content fingerprint to the database.

[0019] Thirdly, embodiments of the present invention provide an electronic device. It includes: one or more processors; a memory; and one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more application programs are configured to perform the method as described in the first aspect.

[0020] This application provides a Prometheus alarm signal classification method based on dual fingerprints. The method involves: sorting all key-value pairs of alarm tags in a natural order; converting the sorted JSON object into a first string; calculating the MD5 hash of the first string to obtain a second string; using the second string as a tag fingerprint; using the tag fingerprint as the primary fingerprint and the content fingerprint as an auxiliary fingerprint, wherein the auxiliary fingerprint corresponds to the primary fingerprint, and the primary fingerprint serves as the identifier for alarm signal classification. This method overcomes the shortcomings of current single-fingerprint solutions, solves the problem of inaccurate alarm signal classification in self-developed work order systems, which leads to a large number of duplicate work orders, thereby reducing the number of duplicate work orders and lowering maintenance costs. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of a Prometheus alarm signal classification method based on dual fingerprints, as shown in the embodiment.

[0022] Figure 2 A structural block diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0023] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0024] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0025] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the difference between them, their intended meanings are consistent. Similarly, the terms "of," "corresponding," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the difference between them, their intended meanings are consistent.

[0026] This application proposes a Prometheus alarm signal classification method based on dual fingerprints, such as... Figure 1 As shown, the method includes steps S101 to S104:

[0027] S101: Sort all key values ​​of the alarm tag of the alarm signal into natural order;

[0028] S102: Convert the sorted JSON object into the first string.

[0029] Understandably, given the characteristics of Prometheus alarm signals, each time an alarm signal is received, its content fingerprint needs to be calculated. The alarm content of the alarm signal is in string format, and the content fingerprint is calculated by performing an MD5 hash on the alarm content string. The final string obtained is the content fingerprint.

[0030] S103: Calculate the MD5 hash of the first string to obtain the second string.

[0031] Given that content fingerprints serve as auxiliary fingerprints, a table needs to be created in advance to record the mapping relationship between content fingerprints and the primary fingerprint.

[0032] S104: Use the second string as a tag fingerprint;

[0033] S105: Use the tag fingerprint as the primary fingerprint and the content fingerprint as the secondary fingerprint, wherein the secondary fingerprint is used to correspond to the primary fingerprint, and the primary fingerprint is an identifier for classifying alarm signals.

[0034] Understandably, based on the characteristics of tag fingerprints and content fingerprints, the tag fingerprint is taken as the primary fingerprint, and the content fingerprint as the secondary fingerprint. The role of the secondary fingerprint is to determine its own primary fingerprint, while the primary fingerprint is the identifier for classifying alarm signals. This is done to avoid the problem of inaccurate classification of alarm signals such as memory usage alarms (alarm content such as: 192.168.4.1 machine memory usage exceeds 90%, reaching 94.43%).

[0035] In some implementations, the correspondence between the primary fingerprint and the secondary fingerprint is a mapping relationship.

[0036] In some implementations, the method further includes: determining the mapping relationship between the content fingerprint and the master fingerprint; if a mapping relationship exists, then using the corresponding master fingerprint as its own master fingerprint.

[0037] In some implementations, the method further includes: determining the mapping relationship between the content fingerprint and the master fingerprint; if no mapping relationship exists, then using its own tag fingerprint as the master fingerprint.

[0038] In some embodiments, the method further includes:

[0039] Add a time field, and when the time field matches the external time, clear the existing mapping relationship.

[0040] In some implementations, the tag fingerprint serves as the primary fingerprint, and the content fingerprint as the secondary fingerprint. The secondary fingerprint corresponds to the primary fingerprint, which is an identifier for classifying alarm signals and includes:

[0041] The content fingerprint is matched with data in the database. If the content fingerprint has matching data in the database, the master fingerprint is determined. The master fingerprint is the fingerprint that the content fingerprint matches from the database.

[0042] In some implementations, the tag fingerprint is used as the primary fingerprint and the content fingerprint is used as the secondary fingerprint. The secondary fingerprint is used to correspond to the primary fingerprint, and the primary fingerprint is an identifier for classifying alarm signals. The implementation also includes: if the content fingerprint does not have matching data in the database, then the tag fingerprint itself is taken as the primary fingerprint, and the mapping relationship between the primary fingerprint and the content fingerprint is saved to the database.

[0043] In some implementations, the method further includes: determining whether an alarm signal has been processed, and if so, processing the next repeating alarm signal.

[0044] The specific implementation process can be as follows:

[0045] S1: After receiving the alarm signal, calculate its tag fingerprint and content fingerprint respectively;

[0046] S2: Determine the primary fingerprint of the alarm signal, that is, use the content fingerprint of the alarm signal to compare with the records in the database, and find the primary fingerprint corresponding to the content fingerprint in the database:

[0047] S21: If not found, take its own tag fingerprint as the master fingerprint and save the mapping relationship between the master fingerprint and the content fingerprint to the database;

[0048] S22: If it can be found, then take the main fingerprint of the found record as the main fingerprint of the alarm signal;

[0049] S3: Use the master fingerprint to classify alarm signals and determine whether to generate a new work order or to close an existing work order;

[0050] S4: Process the next alarm signal.

[0051] Please refer to the table below for detailed procedures: Table 1

[0052]

[0053]

[0054] Table 1 shows the classification process for alarm signals with the same label but different content.

[0055]

[0056] Table 2 shows alarm signals with different labels but the same content.

[0057] As can be understood from the above, neither single-tag fingerprinting nor content fingerprinting schemes can accurately classify both Table 1 and Table 2 alarm signals simultaneously. However, the method for accurate Prometheus alarm signal classification based on dual fingerprints provided in this invention calculates both the tag fingerprint and content fingerprint of the alarm signal, using the tag fingerprint as the primary factor and the content fingerprint as a secondary factor. This allows for accurate classification of various alarm signal types, such as Table 1 and Table 2.

[0058] Based on this, please refer to Table 3.

[0059]

[0060]

[0061] S1, upon receiving the first alarm signal, the content fingerprint and tag fingerprint are calculated to be AAA and BBB, respectively. No record with the content fingerprint AAA is found in the database, therefore BBB is selected as the primary fingerprint for classification, and the mapping relationship between the content fingerprint AAA and the primary fingerprint BBB is saved to the database. Since a work order with the primary fingerprint BBB has not yet been created, a work order is created.

[0062] S2, upon receiving an alarm signal, the content fingerprint and tag fingerprint are calculated to be AAB and BBB, respectively. No record with the content fingerprint AAB is found in the database; therefore, BBB is selected as the primary fingerprint for classification, and the mapping relationship between the content fingerprint AAB and the primary fingerprint BBB is saved to the database. A work order with the fingerprint BBB already exists and does not need to be created.

[0063] S3, upon receiving an alarm signal, the content fingerprint and tag fingerprint are calculated to be XXX and YYY respectively. No record with the content fingerprint XXX is found in the database, therefore YYY is selected as the primary fingerprint for classification, and the mapping relationship between the content fingerprint XXX and the primary fingerprint YYY is saved to the database. It is detected that a work order with the primary fingerprint YYY has not yet been created, therefore a work order is created.

[0064] S4, upon receiving the recovery signal, the content fingerprint and tag fingerprint are calculated to be AAB and BBB, respectively. The database is searched, and the primary fingerprint associated with content fingerprint AAB is found to be BBB. Therefore, BBB is used as the primary fingerprint for this signal for classification. A work order with fingerprint BBB is detected to already exist and has not been recovered; therefore, the work order created in S101 is recovered.

[0065] S5, upon receiving an alarm signal, the content fingerprint and tag fingerprint are calculated to be XXX and YZZ respectively. The database is searched, and the primary fingerprint associated with content fingerprint XXX is found to be YYY. Therefore, YYY is used as the primary fingerprint for this signal for classification. A work order with fingerprint YYY already exists and does not need to be created.

[0066] S6, upon receiving the recovery signal, the content fingerprint and tag fingerprint are calculated to be XXX and YZZ respectively. The database is searched, and the primary fingerprint associated with the content fingerprint XXX is YYY. Therefore, YYY is used as the primary fingerprint for this signal for classification. A work order with fingerprint YYY is detected to already exist and has not been recovered; therefore, the work order created in S103 is recovered.

[0067] S7, upon receiving the recovery signal, the content fingerprint and tag fingerprint are calculated to be XXX and YYY respectively. The database is searched, and the primary fingerprint associated with the content fingerprint XXX is YYY. Therefore, YYY is used as the primary fingerprint for this signal for classification. A work order with fingerprint YYY already exists but has been recovered; therefore, this signal is ignored.

[0068] As can be seen from the above, by simultaneously calculating the tag fingerprint and content fingerprint of the alarm signal, with the tag fingerprint as the primary component and the content fingerprint as the secondary component, and finding the corresponding tag fingerprint through the content fingerprint, and using the found primary fingerprint as its own primary fingerprint, this method can accurately classify alarm signals in different scenarios and solve the problem of duplicate work orders.

[0069] Secondly, this application proposes a Prometheus alarm signal classification device based on dual fingerprints, characterized in that the device includes: a sorting unit, which is used to sort all key-value pairs of alarm tags of alarm signals in a natural order; a first conversion unit, which is used to convert the sorted JSON object into a first string; a calculation unit, which is used to calculate the MD5 hash of the first string to obtain a second string; a determination unit, which is used to use the second string as a tag fingerprint; and a marking unit, which is used to use the tag fingerprint as a primary fingerprint and the content fingerprint as an auxiliary fingerprint, wherein the auxiliary fingerprint is used to correspond to the primary fingerprint, and the primary fingerprint is an identifier for alarm signal classification.

[0070] In some implementations, the tagging unit is further configured to take its own tag fingerprint as the master fingerprint if the content fingerprint does not have matching data in the database, and save the mapping relationship between the master fingerprint and the content fingerprint to the database.

[0071] like Figure 2 As shown, electronic device 2000 may include processor 2001.

[0072] Optionally, the electronic device 2000 may also include a memory 2002.

[0073] The processor 2001 is coupled to the memory 2002, which can be connected via a communication bus.

[0074] The following is combined Figure 2 A detailed introduction to each component of the electronic device 2000:

[0075] The processor 2001 is the control center of the electronic device 2000. It can be a single processor or a collective term for multiple processing elements. For example, the processor 2001 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0076] Optionally, the processor 2001 can perform various functions of the electronic device 2000 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0077] In a specific implementation, as one example, the processor 2001 may include one or more CPUs, for example... Figure 2 CPU0 and CPU1 are shown in the diagram.

[0078] The memory 2002 is used to store the software program that executes the present invention, and is controlled by the processor 2001 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0079] Optionally, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code having an instruction or data structure form and accessible by a computer, but not limited thereto. The memory 2002 may be integrated with the processor 2001 or exist independently, and may be accessed through the interface circuit of the electronic device 2000 (…). Figure 2(Not shown in the figure) is coupled to processor 2001, and the embodiments of the present invention do not specifically limit this.

[0080] It should be noted that, Figure 2 The structure of the electronic device 2000 shown does not constitute a limitation on the electronic device. Actual electronic devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0081] Furthermore, the technical effects of the electronic device 2000 can be referred to the technical effects of the methods described in the above method embodiments, and will not be repeated here.

[0082] It should be understood that, in various embodiments of the present invention, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0083] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0084] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0085] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0086] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0087] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0088] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A Prometheus alert signal categorization method based on dual-fingerprint, characterized in that, The method includes: Sort all key values ​​of the alarm tag of the alarm signal into natural order; Obtain the alarm content string and calculate the MD5 hash of the alarm content string to obtain the content fingerprint; Convert the sorted JSON object into the first string; Calculate the MD5 hash of the first string to obtain the second string; Use the second string as the tag fingerprint; The tag fingerprint is used as the primary fingerprint, and the content fingerprint is used as the secondary fingerprint. The secondary fingerprint is used to correspond to the primary fingerprint, and the primary fingerprint is an identifier for classifying alarm signals.

2. The Prometheus alert signal categorization method based on dual fingerprints according to claim 1, characterized in that, The correspondence between the primary fingerprint and the secondary fingerprint is a mapping relationship.

3. The Prometheus alert signal categorization method based on dual fingerprints according to claim 2, characterized in that, The method further includes: Determine the mapping relationship between the content fingerprint and the master fingerprint. If a mapping relationship exists, use the corresponding master fingerprint as its own master fingerprint.

4. The Prometheus alert signal categorization method based on dual fingerprints according to claim 3, characterized in that, The method further includes: Determine the mapping relationship between the content fingerprint and the master fingerprint. If there is no mapping relationship, use the self-label fingerprint as the master fingerprint.

5. The dual-fingerprint-based Prometheus alert signal categorization method of claim 4, wherein, The method further includes: Add a time field, and when the time field matches the external time, clear the existing mapping relationship.

6. The dual-fingerprint-based Prometheus alert signal categorization method of claim 5, wherein, The tag fingerprint serves as the primary fingerprint, and the content fingerprint serves as the secondary fingerprint. The secondary fingerprint corresponds to the primary fingerprint, which is an identifier for classifying alarm signals and includes: The content fingerprint is matched with data in the database. If the content fingerprint has matching data in the database, the master fingerprint is determined. The master fingerprint is the fingerprint that the content fingerprint matches from the database.

7. The Prometheus alarm signal classification method based on dual fingerprints according to claim 6, characterized in that, The tag fingerprint serves as the primary fingerprint, and the content fingerprint serves as the secondary fingerprint. The secondary fingerprint corresponds to the primary fingerprint, which is an identifier for classifying alarm signals. The primary fingerprint also includes: If the content fingerprint does not have matching data in the database, then its own tag fingerprint is taken as the master fingerprint, and the mapping relationship between the master fingerprint and the content fingerprint is saved to the database.

8. The Prometheus alarm signal classification method based on dual fingerprints according to claim 7, characterized in that, The method further includes: Determine whether an alarm signal has been processed. If it has, process the next repeating alarm signal.

9. A Prometheus alarm signal classification device based on dual fingerprints, characterized in that, The device includes: A sorting unit is used to sort all the key values ​​of the alarm tag of the alarm signal into a natural order. The first conversion unit is used to convert the sorted JSON object into a first string; The calculation unit is used to calculate the MD5 hash of the first string to obtain the second string; The determining unit is used to use the second string as a tag fingerprint; A marking unit is used to use the tag fingerprint as the primary fingerprint and the content fingerprint as the secondary fingerprint, wherein the secondary fingerprint is used to correspond to the primary fingerprint, and the primary fingerprint is an identifier for classifying alarm signals.

10. A Prometheus alarm signal classification device based on dual fingerprints according to claim 9, characterized in that, The tagging unit is also used to take its own tag fingerprint as the master fingerprint if the content fingerprint does not have matching data in the database, and save the mapping relationship between the master fingerprint and the content fingerprint to the database.

Images