Network alarm information processing method and device and computer device

Abstract

The application relates to a network alarm information processing method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining original alarm information, determining a compression condition group matched with the original alarm information as a target compression condition group; the original alarm information contains field information of a first field corresponding to the target compression condition group; determining a second field representing a homologous attribute corresponding to alarm type configuration information in the target compression condition group, and determining field feature information corresponding to the original alarm information based on the second field; under the target compression condition group, the original alarm information is compressed based on the field feature information to obtain an alarm information compression result; the alarm information compression result carries homologous alarm statistical information homologous to the original alarm information. The method realizes alarm information compression processing optimization, can avoid repeated judgment processing, improves alarm processing efficiency, and is helpful for alarm compression processing in a complex scene.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, computer equipment, storage medium, and computer program product for processing network alarm information. Background Technology

[0002] For business IT systems, alarm messages serve as a source of system information and are an important way for operations and maintenance personnel to understand the system's operational status. For example, by analyzing alarm messages, problems can be accurately and promptly investigated. Alarm monitoring and handling have become an indispensable part of business IT systems.

[0003] Since each network element and service in a 5GC network can detect its own faults, a large number of identical alarms will be generated when reused public facilities, network links, or underlying components on which services depend fail. As network topologies and systems become increasingly complex, simple static compression rules based on traditional methods have limited coverage and cannot support adjustments to compression rules in complex scenarios, resulting in low efficiency in alarm compression processing. Summary of the Invention

[0004] Therefore, it is necessary to provide a network alarm information processing method, apparatus, computer equipment, storage medium, and computer program product that can support alarm compression processing in complex scenarios to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for processing network alarm information, the method comprising:

[0006] Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group;

[0007] Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0008] Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0009] In one embodiment, before the steps of acquiring the original alarm information and determining the compression condition group that matches the original alarm information as the target compression condition group, the method further includes:

[0010] Obtain alarm processing configuration information; the alarm processing configuration information includes grouping configuration information and compression processing information;

[0011] Based on the grouping configuration information and the compression processing information, groups with different compression conditions are obtained;

[0012] The grouping configuration information is used to indicate at least one of the first fields; the compression processing information includes the alarm type configuration information and the processing method for the field information of the second field, wherein the processing method is used to obtain the field feature information.

[0013] In one embodiment, determining the second field representing the same-origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determining the field feature information corresponding to the original alarm information based on the second field, includes:

[0014] From the alarm type configuration information of the target compression condition group, determine the alarm type corresponding to the original alarm information, and the second field corresponding to the alarm type;

[0015] Extract the field information corresponding to the second field from the original alarm information;

[0016] According to the processing method, based on the field information of the second field, the field feature information corresponding to the original alarm information is obtained.

[0017] In one embodiment, the second field includes multiple fields, and the step of obtaining field feature information corresponding to the original alarm information based on the field information of the second field according to the processing method includes:

[0018] The field information of each of the second fields is concatenated to obtain the field concatenation information corresponding to the original alarm information;

[0019] The feature values ​​of the field concatenation information are obtained according to a preset calculation method and used as the field feature information.

[0020] In one embodiment, after determining the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determining the field feature information corresponding to the original alarm information based on the second field, the method further includes:

[0021] If it is detected that no key-value pair matching the field feature information exists in the preset storage system, the original alarm information will be used as the first alarm information under the corresponding alarm type and the key-value pair.

[0022] In one embodiment, the step of compressing the original alarm information based on the field feature information under the target compression condition grouping includes:

[0023] If a key-value pair matching the field feature information is detected in the preset storage system, under the target compression condition grouping, the alarm type corresponding to the original alarm information and the historical alarm information under the key-value pair are merged with the original alarm information.

[0024] In one embodiment, after the step of compressing the original alarm information based on the field feature information, the method further includes:

[0025] Based on the message queue method, perform alarm post-processing operations on the compressed alarm information.

[0026] In one embodiment, the compression condition grouping includes multiple groups, and the method further includes:

[0027] The alarm display page shows the alarm information compression results corresponding to each of the compression condition groups.

[0028] In response to any operation on the compression result of alarm information, the corresponding source alarm statistics are displayed under the compression result of any alarm information.

[0029] Secondly, this application also provides a network alarm information processing device, the device comprising:

[0030] The compression group determination module is used to acquire the original alarm information and determine the compression condition group that matches the original alarm information as the target compression condition group; the original alarm information includes the field information of the first field corresponding to the target compression condition group;

[0031] The field feature information obtaining module is used to determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and to determine the field feature information corresponding to the original alarm information based on the second field;

[0032] The compression processing module is used to compress the original alarm information based on the field feature information under the target compression condition grouping to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0033] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0034] Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group;

[0035] Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0036] Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0037] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0038] Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group;

[0039] Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0040] Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0041] Fifthly, this application also provides a computer program product. The computer program product includes a computer program, which, when executed by a processor, performs the following steps:

[0042] Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group;

[0043] Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0044] Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0045] The aforementioned network alarm information processing method, apparatus, computer equipment, storage medium, and computer program product acquires original alarm information, determines a compression condition group matching the original alarm information as a target compression condition group, the original alarm information contains field information of a first field corresponding to the target compression condition group, then determines a second field representing the same-origin attribute corresponding to the alarm type configuration information in the target compression condition group, determines the field feature information corresponding to the original alarm information based on the second field, and then compresses the original alarm information based on the field feature information under the target compression condition group to obtain an alarm information compression result. The alarm information compression result carries same-origin alarm statistics information that is the same as the original alarm information, thus optimizing the alarm information compression processing. By matching compression condition groups, redundant judgment processing can be avoided, and alarm compression processing based on the same-origin attribute under the target compression condition group improves alarm processing efficiency, can flexibly cope with complex alarm situations in production environments, and meet various compression needs. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating a network alarm information processing method in one embodiment;

[0047] Figure 2 This is a schematic diagram of an alarm compression processing system module in one embodiment;

[0048] Figure 3 This is a schematic diagram of the alarm compression processing system flow in one embodiment;

[0049] Figure 4 This is a flowchart illustrating a network alarm information processing method in another embodiment;

[0050] Figure 5 This is a structural block diagram of a network alarm information processing device in one embodiment;

[0051] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0053] In one embodiment, such as Figure 1 As shown, a method for processing network alarm information is provided. This embodiment illustrates the method applied to a terminal, but it is understood that the method can also be applied to a server, or to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0054] Step 101: Obtain the original alarm information and determine the compression condition group that matches the original alarm information as the target compression condition group;

[0055] The original alarm information may include field information of the first field corresponding to the target compression condition group. The first field may be one or more preset attributes, and the original alarm information may be grouped based on the same attribute.

[0056] As an example, the original alarm information can be 5GC network alarm information, which can contain province attributes and network element attributes (i.e., the first field). The original alarm information can be classified into groups with the same province and network element, that is, the field information containing the first field corresponding to the target compression condition group.

[0057] In practical applications, such as Figure 2 As shown, 5GC network alarm information can be compressed using an alarm compression processing system. This system can include an alarm receiving module, an alarm compression rule configuration module, an alarm compression processing module, and an alarm post-processing module. The alarm compression rule configuration module allows for the configuration of alarm compression rules, such as dynamically configuring rules on a configuration page. After the alarm receiving module obtains the original alarm information, the alarm compression processing module can then process the received original alarm information.

[0058] Specifically, after configuring alarm compression rules, groups can be formed based on compression conditions. This allows for the determination of different compression condition groups and their corresponding alarm compression rules. These compression conditions can serve as a prerequisite for whether alarms should be compressed. They can support composite judgments based on multiple attributes, such as combining province and network element attributes to group alarm information from the same province and network element into one group.

[0059] For example, taking the original alarm information of IoT network element alarm information of province A as an example, the compression condition grouping optimization can be performed in the following way:

[0060] IF(alarm.province=A)THEN

[0061] IF(alarm.network type = IoT) THEN

[0062] IF(alarm.type=device alarm)THEN

[0063] Compression business processing 1

[0064] ELSEIF(alarm.type=component exception alarm)THEN

[0065] Compression business processing 2

[0066] The province attribute and network type attribute are the first field, and attribute information A and attribute information IoT are the field information of the first field. After obtaining the original alarm information, the compression conditions of the compression condition group are read for judgment. If the compression conditions are met, such as if the attribute information corresponding to the province attribute and network type attribute in the original alarm information matches the target compression condition group, the original alarm information can be placed under the target compression condition group. Thus, through compression condition group optimization, the duplicate judgment of province and network element can be reduced.

[0067] Step 102: Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0068] The alarm type configuration information can be used to indicate at least one alarm type, as well as the corresponding source alarm attributes for each alarm type, i.e., the second field.

[0069] As an example, the second field can be the same-source alarm attribute set in the alarm compression rule. The attribute values ​​of the same-source alarm attributes can be concatenated and calculated so that if they are consistent, they can be merged during the compression process.

[0070] In specific implementations, such as Figure 3 As shown, during the alarm processing based on the alarm compression processing module, the compression conditions can be read for judgment. If the compression conditions are met, multiple alarm attributes of the same source (i.e., the second field in the original alarm information) within the target compression condition group can be submitted to the thread pool for asynchronous multi-threaded processing. Thus, alarm processing can be performed based on alarm compression conditions for grouped multi-threaded processing, which can speed up the alarm rule matching and processing speed.

[0071] For example, by concatenating the attribute values ​​of alarms from the same source (such as the field information of the second field in the original alarm information) and calculating the hash value (i.e., field feature information) as the key, the alarm storage data in Redis (Remote Dictionary Server) can be maintained through this key.

[0072] Step 103: Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0073] In one example, taking the original alarm information as the IoT element alarm information of province A as an example, the alarm types configured under this group (i.e. target compression condition group) can be device abnormality and component abnormality. Based on the alarm compression rules corresponding to each alarm type, when the alarms are determined to be from the same source according to the same source alarm attribute, they can be merged during compression processing, for example, compression service processing 1 and compression service processing 2 as shown below.

[0074] IF(alarm.province=A)THEN

[0075] IF(alarm.network type = IoT) THEN

[0076] IF(alarm.type=device alarm)THEN

[0077] Compression business processing 1

[0078] ELSEIF(alarm.type=component exception alarm)THEN

[0079] Compression business processing 2

[0080] To enable those skilled in the art to better understand the above steps, the following example illustrates the embodiments of this application, but it should be understood that the embodiments of this application are not limited thereto.

[0081] To address the grouping process based on compression conditions and meet various compression effects and data statistics needs, it supports configuring compression conditions with some or all identical attributes. By extracting and analyzing the common attributes (i.e., the first field) of multiple compression conditions, grouping and assembly can be performed according to the compression conditions. Specifically, the same attribute can be used as the parent judgment condition, and different attributes (i.e., the second field) as the child judgment conditions. This allows for nested traversal of groupings when matching alarm rules, reducing the number of judgments for the same attributes and improving matching efficiency.

[0082] Regarding the alarm compression process, when an alarm message successfully matches an alarm compression rule, the same-source alarm attribute (i.e., the second field) configured in the alarm compression rule can be read. By extracting the corresponding attribute field information from the alarm message, the attribute field information can be concatenated to form a unique identifier string. The MD5 hash value of this string is calculated (i.e., the field feature information corresponding to the original alarm message is determined based on the second field). The string length can be controlled based on the calculated MD5 hash value. Thus, when alarm messages with the same unique identifier are detected, they are determined to be same-source alarms and need to be compressed (i.e., the original alarm message is compressed based on the field feature information under the target compression condition grouping). The alarm count can be accumulated, and the alarm time can be updated (same as the same-source alarm statistics information).

[0083] In one example, by freely configuring single or combined compression conditions, it can cope with complex alarm situations in the production environment, meet a variety of compression needs, and avoid repeated matching by grouping compression conditions. Furthermore, the use of multi-threaded concurrency during compression processing allows different compression rules to be processed independently, improving the overall compression speed.

[0084] In another example, if alarms from the same source are received by the business IT system and used directly without compression, a large number of duplicate alarms will appear in the alarm list, affecting alarm maintenance and reducing alarm processing efficiency. As business expands and network topology and systems become increasingly complex, new alarm and fault causes emerge. Compared to traditional methods using simple static compression rules, which have limited coverage and are not convenient for adjusting compression rules in complex scenarios, the technical solution in this embodiment achieves flexible configuration by adding dynamic compression rules. It can compress alarms from the same source according to compression rules, improving alarm processing efficiency, reducing system monitoring difficulty, and retaining original information such as the total number of alarms and alarm time in the compressed alarm information, which helps to quickly locate periodic problems.

[0085] In the above-described network alarm information processing method, the original alarm information is obtained, and a compression condition group matching the original alarm information is determined as the target compression condition group. Then, the second field representing the same-origin attribute corresponding to the alarm type configuration information in the target compression condition group is determined. Based on the second field, the field feature information corresponding to the original alarm information is determined. Then, under the target compression condition group, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result. This method optimizes the alarm information compression processing. By matching the compression condition group, repeated judgment processing can be avoided. Furthermore, alarm compression processing based on the same-origin attribute under the target compression condition group improves the alarm processing efficiency and can flexibly cope with complex alarm situations in the production environment, meeting various compression requirements.

[0086] In one embodiment, before the steps of obtaining the original alarm information and determining the compression condition group that matches the original alarm information as the target compression condition group, the following steps may be included:

[0087] Obtain alarm processing configuration information; the alarm processing configuration information includes grouping configuration information and compression processing information; based on the grouping configuration information and the compression processing information, obtain groups with different compression conditions.

[0088] The group configuration information can be used to indicate at least one first field. The compression processing information can include alarm type configuration information and a processing method for field information of the second field. This processing method can be used to obtain field feature information.

[0089] In one example, alarm compression rules (i.e., alarm handling configuration information) can be configured based on the alarm rules module. These alarm compression rules can consist of the following:

[0090] Compression conditions (i.e. group configuration information): This is the prerequisite for whether alarms should be compressed, and it can support multi-attribute composite judgment;

[0091] Same-source alarm attribute (i.e., the second field): If different alarm messages are received and the value of the same-source alarm attribute is exactly the same, they can be represented as same-source alarms, and then they can be merged during compression processing;

[0092] Compression cycle: Calculated from the time of the first alarm. If the compression cycle time is exceeded, compression can be performed again.

[0093] Alarm post-processing: It can be used to extend the processing of compressed alarms, including alarm severity enhancement, SMS notification, work order dispatch, custom notification, etc.

[0094] In an optional embodiment, after configuring alarm compression rules, each alarm compression rule can be grouped by compression conditions and saved to Redis.

[0095] In another example, operations and maintenance personnel can dynamically configure alarm compression rules. These rules can flexibly adjust the attributes of alarms originating from the same source after setting basic compression conditions, and support the configuration of multiple attributes. The alarm compression rules take effect in real time after configuration, thus ensuring both flexible configuration of compression rules and the simplicity of alarm processing. After compression, the number of alarms originating from the same source can be effectively reduced, which facilitates the maintenance of the 5GC network system, helps to effectively locate the root cause of the fault, and improves the efficiency of alarm processing.

[0096] In this embodiment, by obtaining alarm processing configuration information, and then obtaining groups with different compression conditions based on grouping configuration information and compression processing information, grouping can be performed based on compression conditions, avoiding repeated matching processing.

[0097] In one embodiment, determining the second field representing the same-origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determining the field feature information corresponding to the original alarm information based on the second field, may include the following steps:

[0098] From the alarm type configuration information of the target compression condition group, determine the alarm type corresponding to the original alarm information and the second field corresponding to the alarm type; extract the field information corresponding to the second field in the original alarm information; according to the processing method, obtain the field feature information corresponding to the original alarm information based on the field information of the second field.

[0099] For example, taking the alarm type of the original alarm information as device anomaly, the same-source alarm attributes (i.e., the second field) configured for device anomalies in the alarm compression rules can be read, such as device IP attribute and alarm code attribute. By extracting the corresponding attribute field information (i.e., the field information of the second field) from the alarm information, the attribute field information can be concatenated to form a unique identifier string, and the MD5 hash value of the string can be calculated. That is, according to the processing method, the field feature information corresponding to the original alarm information can be obtained based on the field information of the second field.

[0100] In this embodiment, by determining the alarm type corresponding to the original alarm information and the second field corresponding to the alarm type from the alarm type configuration information of the target compression condition group, the field information corresponding to the second field in the original alarm information is extracted, and then the field feature information corresponding to the original alarm information is obtained according to the field information of the second field according to the processing method. This enables alarm compression according to compression rules for alarms from the same source, thereby improving alarm processing efficiency.

[0101] In one embodiment, the second field may include multiple fields. Obtaining the field feature information corresponding to the original alarm information based on the field information of the second field, according to the processing method, may include the following steps:

[0102] The field information of each of the second fields is concatenated to obtain the field concatenation information corresponding to the original alarm information; the feature value of the field concatenation information is obtained according to a preset calculation method and used as the field feature information.

[0103] In one example, the fields for the same-source alarm attributes in the configured alarm compression rule are IP address and alarm code (i.e., the second field). Both alarm A and alarm B (i.e., the original alarm information) match the alarm compression rule. For alarm A, its same-source alarm attributes IP address = xxx.xxx.xxx.xxx and code = 11001101 can form a unique identifier string (i.e., field concatenation information): IP address = xxx.xxx.xxx.xxx - code = 11001101. Therefore, the MD5 value (i.e., feature value) of this string can be calculated as: XXXXXX.

[0104] In this embodiment, by concatenating the field information of each second field, the field concatenation information corresponding to the original alarm information is obtained. Then, the feature value of the field concatenation information is obtained according to the preset calculation method. As the field feature information, it can provide data judgment basis for further alarm compression for alarms from the same source, reducing the difficulty of system monitoring.

[0105] In one embodiment, after determining the second field representing the same-origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determining the field feature information corresponding to the original alarm information based on the second field, the following steps may be included:

[0106] If it is detected that no key-value pair matching the field feature information exists in the preset storage system, the original alarm information will be used as the first alarm information under the corresponding alarm type and the key-value pair.

[0107] In practical applications, after obtaining the field feature information corresponding to the original alarm information, the MD5 value of the unique identifier string is calculated. If there is no key corresponding to the MD5 value in Redis (i.e., the default storage system) (i.e., there is no key-value pair matching the field feature information), it means that the original alarm information is the first alarm and can be saved directly.

[0108] In this embodiment, if no key-value pair matching the field feature information is detected in the preset storage system, the original alarm information is used as the first alarm information under the corresponding alarm type and key-value pair. This enables different compression rules to be processed independently, thereby improving the overall compression speed.

[0109] In one embodiment, compressing the original alarm information based on the field feature information under the target compression condition grouping may include the following steps:

[0110] If a key-value pair matching the field feature information is detected in the preset storage system, under the target compression condition grouping, the alarm type corresponding to the original alarm information and the historical alarm information under the key-value pair are merged with the original alarm information.

[0111] In one example, taking alarm A and alarm B (i.e., the original alarm information) as examples, if we obtain the MD5 value (i.e., field feature information) of the string that uniquely identifies alarm A, and if alarm B has the same source alarm attributes ip=xxx.xxx.xxx.xxx and code=11001101, and the MD5 value is the same as that of alarm A after concatenation calculation, and a key based on the MD5 value already exists in Redis, then alarm B and alarm A (i.e., historical alarm information) need to be compressed and merged.

[0112] In another example, the attribute values ​​of same-origin alerts can be concatenated, and the hash value can be calculated as a key. This key can then be used to maintain Redis (e.g., ...). Figure 2 The alarm data is stored in the real-time alarm database, and the final alarm information can be synchronized to the database for storage.

[0113] In this embodiment, if a key-value pair matching the field feature information is detected in the preset storage system, the alarm type corresponding to the original alarm information and the historical alarm information under the key-value pair are merged with the original alarm information under the target compression condition grouping. This enables alarm compression processing based on the same source attribute under the target compression condition grouping, thereby improving alarm processing efficiency.

[0114] In one embodiment, after the step of compressing the original alarm information based on the field feature information, the following step may also be included:

[0115] Based on the message queue method, perform alarm post-processing operations on the compressed alarm information.

[0116] In practical applications, such as Figure 2 As shown, after the compression process is completed, the alarm post-processing module can be notified via a message queue so that it can be processed according to the alarm post-processing method in the configured alarm compression rules.

[0117] In one example, this embodiment can effectively solve the problem of duplicate processing of alarms from the same source. Through flexible rule configuration, it can cope with various complex alarms in the production environment, improve alarm processing efficiency, and reduce the difficulty of system monitoring. Moreover, by adopting alarm compression and post-processing, it can provide rich reminders so that maintenance personnel can be informed of the system status and locate and handle the problem as soon as possible after the 5GC network system or service fails. This can reduce the workload of manual maintenance and improve maintenance efficiency.

[0118] In this embodiment, by performing post-alarm processing operations on compressed alarm information based on a message queue, it is possible to provide timely feedback on system status and locate and handle the issue.

[0119] In one embodiment, the compression condition grouping may include multiple groups, and may also include the following steps:

[0120] The alarm display page shows the alarm information compression results corresponding to each of the compression condition groups; in response to any operation on any alarm information compression result, the corresponding same-source alarm statistics are displayed under any alarm information compression result.

[0121] In one example, compressed alarm information (i.e., the result of alarm information compression) can be displayed on the alarm display page. The compressed alarm status can be displayed by viewing relevant details. The total number of alarms under each compression condition can also be displayed as a statistical item. That is, the corresponding statistical information of alarms from the same source can be displayed under any alarm information compression result.

[0122] In one optional embodiment, users can flexibly configure alarm compression rules through page operations, which simplifies the rule configuration process. While ensuring full functionality, it also maintains flexibility, has higher scalability, and the overall process is controllable, which can maximize processing performance.

[0123] In this embodiment, by displaying the alarm information compression results corresponding to each compression condition group on the alarm display page, and then responding to the operation on any alarm information compression result, the corresponding same-source alarm statistics are displayed under any alarm information compression result. The alarm compression results can be visualized, and the original information such as the total number of alarms and alarm time can be retained in the compressed alarm information, which helps to quickly locate periodic problems.

[0124] In one embodiment, such as Figure 4 The diagram illustrates another method for processing network alarm information. In this embodiment, the method includes the following steps:

[0125] In step 401, alarm processing configuration information is obtained, and different compression condition groups are obtained based on grouping configuration information and compression processing information. In step 402, original alarm information is obtained, and the compression condition group matching the original alarm information is determined as the target compression condition group. In step 403, the alarm type corresponding to the original alarm information and the second field corresponding to the alarm type are determined from the alarm type configuration information of the target compression condition group. In step 404, the field information corresponding to the second field in the original alarm information is extracted. In step 405, the field information of each second field is concatenated to obtain the field concatenation information corresponding to the original alarm information, and the feature value of the field concatenation information is obtained according to a preset calculation method, serving as the field feature information. In step 406, if a key-value pair matching the field feature information is detected in the preset storage system, under the target compression condition group, the historical alarm information under the alarm type and key-value pair corresponding to the original alarm information is merged with the original alarm information to obtain the alarm information compression result. In step 407, the alarm information compression results corresponding to each compression condition group are displayed on the alarm display page. In step 408, in response to the operation on any alarm information compression result, the corresponding same-source alarm statistics are displayed under any alarm information compression result. It should be noted that the specific limitations of the above steps can be found in the specific limitations of a network alarm information processing method described above, and will not be repeated here.

[0126] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0127] Based on the same inventive concept, this application also provides a network alarm information processing apparatus for implementing the network alarm information processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more network alarm information processing apparatus embodiments provided below can be found in the limitations of the network alarm information processing method described above, and will not be repeated here.

[0128] In one embodiment, such as Figure 5As shown, a network alarm information processing device is provided, comprising:

[0129] Compression group determination module 501 is used to acquire original alarm information and determine a compression condition group that matches the original alarm information as a target compression condition group; the original alarm information includes field information of the first field corresponding to the target compression condition group;

[0130] The field feature information obtaining module 502 is used to determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and to determine the field feature information corresponding to the original alarm information based on the second field;

[0131] The compression processing module 503 is used to compress the original alarm information based on the field feature information under the target compression condition grouping to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0132] In one embodiment, the apparatus further includes:

[0133] The configuration information acquisition module is used to acquire alarm processing configuration information; the alarm processing configuration information includes grouping configuration information and compression processing information.

[0134] A grouping module is used to obtain groups with different compression conditions based on the grouping configuration information and the compression processing information;

[0135] The grouping configuration information is used to indicate at least one of the first fields; the compression processing information includes the alarm type configuration information and the processing method for the field information of the second field, wherein the processing method is used to obtain the field feature information.

[0136] In one embodiment, the field feature information obtaining module 502 includes:

[0137] The second field determination submodule is used to determine, from the alarm type configuration information of the target compression condition group, the alarm type corresponding to the original alarm information, and the second field corresponding to the alarm type;

[0138] The field information extraction submodule is used to extract the field information corresponding to the second field from the original alarm information;

[0139] The field feature information acquisition submodule is used to obtain the field feature information corresponding to the original alarm information according to the field information of the second field in accordance with the processing method.

[0140] In one embodiment, the second field includes multiple fields, and the sub-module for obtaining the field feature information includes:

[0141] The splicing unit is used to splice the field information of each of the second fields to obtain the field splicing information corresponding to the original alarm information;

[0142] The feature value calculation unit is used to obtain the feature value of the field concatenation information according to a preset calculation method, and use it as the field feature information.

[0143] In one embodiment, the apparatus further includes:

[0144] The first alarm information acquisition module is used to, if it is detected that no key-value pair matching the field feature information exists in the preset storage system, take the original alarm information as the first alarm information under the corresponding alarm type and the key-value pair.

[0145] In one embodiment, the compression processing module 503 includes:

[0146] The alarm merging submodule is used to merge the alarm type corresponding to the original alarm information and the historical alarm information under the key-value pair with the original alarm information if a key-value pair matching the field feature information is detected in the preset storage system, under the target compression condition grouping.

[0147] In one embodiment, the apparatus further includes:

[0148] The alarm post-processing module is used to perform alarm post-processing operations on compressed alarm information based on a message queue.

[0149] In one embodiment, the compression condition grouping includes multiple groups, and the apparatus further includes:

[0150] The compression result display module is used to display the compression results of the alarm information corresponding to each compression condition group on the alarm display page;

[0151] The statistics display module is used to respond to any operation on the compression result of alarm information and display the corresponding source alarm statistics under the compression result of any alarm information.

[0152] Each module in the aforementioned network alarm information processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0153] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a network alarm information processing method.

[0154] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0155] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0156] Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group;

[0157] Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0158] Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0159] In one embodiment, the processor, when executing a computer program, also implements the steps of the network alarm information processing method described in the other embodiments above.

[0160] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0161] Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group;

[0162] Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0163] Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0164] In one embodiment, when the computer program is executed by a processor, it also implements the steps of the network alarm information processing method described in the other embodiments above.

[0165] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0166] Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group;

[0167] Determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determine the field feature information corresponding to the original alarm information based on the second field;

[0168] Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

[0169] In one embodiment, when the computer program is executed by a processor, it also implements the steps of the network alarm information processing method described in the other embodiments above.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0171] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0172] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0173] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for processing network alarm information, characterized in that, The method includes: Obtain the original alarm information, determine the compression condition group that matches the original alarm information, and use it as the target compression condition group; the original alarm information contains the field information of the first field corresponding to the target compression condition group; The second field representing the same-origin attribute corresponding to the alarm type configuration information in the target compression condition group is determined, and the field feature information corresponding to the original alarm information is determined based on the second field; the field feature information is a hash value calculated based on the field concatenation information; the field concatenation information is obtained by concatenating the field information of the second field; Under the target compression condition grouping, the original alarm information is compressed based on the field feature information to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

2. The method according to claim 1, characterized in that, Before the steps of acquiring the original alarm information and determining the compression condition group that matches the original alarm information as the target compression condition group, the method further includes: Obtain alarm processing configuration information; the alarm processing configuration information includes grouping configuration information and compression processing information; Based on the grouping configuration information and the compression processing information, groups with different compression conditions are obtained; The grouping configuration information is used to indicate at least one of the first fields; the compression processing information includes the alarm type configuration information and the processing method for the field information of the second field, wherein the processing method is used to obtain the field feature information.

3. The method according to claim 2, characterized in that, The step of determining the second field representing the same-origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determining the field feature information corresponding to the original alarm information based on the second field, includes: From the alarm type configuration information of the target compression condition group, determine the alarm type corresponding to the original alarm information, and the second field corresponding to the alarm type; Extract the field information corresponding to the second field from the original alarm information; According to the processing method, based on the field information of the second field, the field feature information corresponding to the original alarm information is obtained.

4. The method according to claim 3, characterized in that, The second field includes multiple fields. According to the processing method, based on the field information of the second field, the field feature information corresponding to the original alarm information is obtained, including: The field information of each of the second fields is concatenated to obtain the field concatenation information corresponding to the original alarm information; The feature values ​​of the field concatenation information are obtained according to a preset calculation method and used as the field feature information.

5. The method according to claim 1, characterized in that, After determining the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and determining the field feature information corresponding to the original alarm information based on the second field, the method further includes: If it is detected that no key-value pair matching the field feature information exists in the preset storage system, the original alarm information will be used as the first alarm information under the corresponding alarm type and the key-value pair.

6. The method according to claim 1, characterized in that, The compression process of the original alarm information based on the field feature information under the target compression condition grouping includes: If a key-value pair matching the field feature information is detected in the preset storage system, under the target compression condition grouping, the alarm type corresponding to the original alarm information and the historical alarm information under the key-value pair are merged with the original alarm information.

7. The method according to claim 1, characterized in that, After the step of compressing the original alarm information based on the field feature information, the method further includes: Based on the message queue method, perform alarm post-processing operations on the compressed alarm information.

8. The method according to any one of claims 1 to 7, characterized in that, The compression condition grouping includes multiple groups, and the method further includes: The alarm display page shows the alarm information compression results corresponding to each of the compression condition groups. In response to any operation on the compression result of alarm information, the corresponding source alarm statistics are displayed under the compression result of any alarm information.

9. A network alarm information processing device, characterized in that, The device includes: The compression group determination module is used to acquire the original alarm information and determine the compression condition group that matches the original alarm information as the target compression condition group; the original alarm information includes the field information of the first field corresponding to the target compression condition group; The field feature information acquisition module is used to determine the second field representing the same origin attribute corresponding to the alarm type configuration information in the target compression condition group, and to determine the field feature information corresponding to the original alarm information based on the second field; the field feature information is a hash value calculated based on the field concatenation information; the field concatenation information is obtained by concatenating the field information of the second field; The compression processing module is used to compress the original alarm information based on the field feature information under the target compression condition grouping to obtain the alarm information compression result; the alarm information compression result carries the same source alarm statistics information as the original alarm information.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images