Method, apparatus, device and computer readable medium for processing alarm information

Abstract

The application discloses a method and device for processing alarm information, an equipment and a computer readable medium, and relates to the technical field of cloud computing. A specific embodiment of the method comprises the following steps: receiving alarm information sent by an application monitoring system, screening out to-be-verified alarm information based on an access point identifier, a service identifier and an abnormal time of time consumption in the alarm information, and establishing a to-be-verified alarm information queue with the to-be-verified alarm information; in response to an alarm time period setting instruction, reviewing the to-be-verified alarm information according to an average processing time of the to-be-verified alarm information within a preset alarm time period in the alarm time period setting instruction, and screening out to-be-analyzed alarm information; obtaining online transaction information of an access point from a configuration management database according to an access point identifier in the to-be-analyzed alarm information, and processing a fault of the access point according to the online transaction information of the access point. The embodiment can process the fault of the access point in time, thereby guaranteeing normal operation of the system.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a method, apparatus, device, and computer-readable medium for processing alarm information. Background Technology

[0002] With the booming development of financial business and data, the daily user access volume is increasing, making the operation and maintenance of financial data centers that support services increasingly difficult, and production incidents occur frequently.

[0003] In developing this invention, the inventors discovered at least the following problems in the prior art: Current automated operation and maintenance tools can obtain alarm information by reading and parsing system logs, and then manually determine the handling method. Because fault diagnosis and handling cannot be completed in a timely manner, it affects the normal operation of the system and increases the impact on business. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method, apparatus, device, and computer-readable medium for processing alarm information, which can promptly handle access point faults and thus ensure the normal operation of the system.

[0005] To achieve the above objectives, according to one aspect of the present invention, a method for processing alarm information is provided, comprising:

[0006] Receive alarm information sent by the application monitoring system, filter out alarm information to be verified based on the access point identifier, service identifier and abnormal time consumption in the alarm information, and establish a queue of alarm information to be verified based on the alarm information to be verified.

[0007] In response to the alarm time period setting instruction, within the preset alarm time period in the alarm time period setting instruction, the alarm information to be verified in the alarm information queue to be verified is reviewed according to the average processing time of the alarm information to be verified, and the alarm information to be parsed is filtered out.

[0008] Based on the access point identifier in the alarm information to be parsed, the online transaction information of the access point is obtained from the configuration management database, and the fault of the access point is processed according to the online transaction information of the access point.

[0009] The receiving application monitoring system receives alarm information, filters out alarm information to be verified based on the access point identifier, service identifier, and abnormal time consumption in the alarm information, and establishes a queue of alarm information to be verified based on the alarm information to be verified, including:

[0010] The alarm information is obtained from the raw information sent by the application monitoring system based on the abnormal time in the abnormal time field identifier and the preset abnormal time threshold.

[0011] The alarm information sent by the application monitoring system is filtered out according to the preset verification fields, and a queue of information to be verified is established based on the access point identifier and server identifier in the alarm information to be verified.

[0012] The response to the alarm time period setting instruction involves, within the preset alarm time period specified in the instruction, reviewing the alarm information to be verified in the alarm information queue based on the average processing time of the alarm information to be verified, and filtering out the alarm information to be parsed, including:

[0013] In response to an alarm time period setting instruction, a preset alarm time period is obtained from the alarm time period setting instruction. The preset alarm time period is data obtained periodically based on the processing of alarm information.

[0014] Within the preset alarm time period in the alarm time period setting instruction, the abnormal time consumption of the alarm information to be verified in the queue of alarm information to be verified is reviewed according to the average processing time of the alarm information to be verified, and the alarm information to be verified with an abnormal time consumption greater than the average processing time is regarded as the alarm information to be parsed.

[0015] After establishing the queue of alarm information to be verified, the following is also included:

[0016] Extract the access point identifier and service identifier from the alarm information to be verified, and obtain the server identifier according to the extracted service identifier;

[0017] If the number of alarm messages corresponding to the same server identifier in the queue of alarm messages to be verified is greater than a preset number, then the server corresponding to the server identifier will be marked as pending verification.

[0018] The step of reviewing the abnormal processing time of alarm messages in the queue of alarm messages to be verified based on the average processing time of the alarm messages to be verified, and identifying alarm messages with abnormal processing time greater than the average processing time as alarm messages to be parsed, includes:

[0019] The average processing time of the alarm information to be verified is updated based on the frequency of alarm information sent by the application monitoring system and the actual processing time of the alarm information to be verified.

[0020] The abnormal time consumption in the alarm information queue to be verified is reviewed based on the average processing time after the update of the alarm information to be verified, and the alarm information to be verified with an abnormal time consumption greater than the updated average processing time is regarded as the alarm information to be parsed.

[0021] The step of retrieving the access point's online transaction information from the configuration management database based on the access point identifier in the alarm information to be parsed, and processing the access point's fault according to the access point's online transaction information, includes:

[0022] Based on the access point identifier in the alarm information to be parsed, retrieve the online transaction information of the access point from the configuration management database;

[0023] If the online transaction information of the access point includes offline transactions, the server startup script is directly invoked to start the server corresponding to the access point in turn to handle the failure of the access point.

[0024] If the online transaction information of the access point includes online transactions, then the servers corresponding to the access points are started or isolated in turn according to the number of access points to handle the failure of the access points.

[0025] After processing the access point's fault according to the online transaction information of the access point, the method further includes:

[0026] The alarm information sent by the application monitoring system, the average processing time of the alarm information to be verified, the online transaction information of the access point, and the method of handling the fault of the access point are used as training data to train an alarm information processing model. The alarm information processing model is used to receive the latest alarm information sent by the application monitoring system and output the method of handling the fault of the access point.

[0027] According to a second aspect of the present invention, an apparatus for processing alarm information is provided, comprising:

[0028] The first filtering module is used to receive alarm information sent by the application monitoring system, filter out alarm information to be verified based on the access point identifier, service identifier and abnormal time consumption in the alarm information, and establish a queue of alarm information to be verified based on the alarm information to be verified.

[0029] The second filtering module is used to respond to the alarm time period setting instruction, and within the preset alarm time period in the alarm time period setting instruction, to review the alarm information to be verified in the alarm information queue according to the average processing time of the alarm information to be verified, and to filter out the alarm information to be parsed.

[0030] The processing module is used to obtain the online transaction information of the access point from the configuration management database based on the access point identifier in the alarm information to be parsed, and to process the fault of the access point according to the online transaction information of the access point.

[0031] According to a third aspect of the present invention, an electronic device for processing alarm information is provided, comprising:

[0032] One or more processors;

[0033] Storage device for storing one or more programs.

[0034] When the one or more programs are executed by the one or more processors, the one or more processors perform the methods described above.

[0035] According to a fourth aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method as described above.

[0036] According to a fifth aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method as described above in the embodiments of the present invention.

[0037] One embodiment of the above invention has the following advantages or beneficial effects: It receives alarm information sent by an application monitoring system; based on the access point identifier, service identifier, and abnormal time consumption in the alarm information, it filters out alarm information to be verified and establishes a queue of alarm information to be verified using the alarm information to be verified; in response to an alarm time period setting instruction, within a preset alarm time period in the alarm time period setting instruction, it reviews the alarm information to be verified in the queue of alarm information to be verified according to the average processing time of the alarm information to be verified, and filters out alarm information to be parsed; based on the access point identifier in the alarm information to be parsed, it retrieves the online transaction information of the access point from the configuration management database, and processes the fault of the access point according to the online transaction information of the access point. The queue of alarm information to be verified and the alarm information to be parsed are obtained by filtering based on the alarm information, which helps to shield false alarms, thereby reducing the number of alarm information to be analyzed, and promptly processing access point faults, thus ensuring the normal operation of the system.

[0038] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0039] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0040] Figure 1 This is a schematic diagram of the main flow of a method for processing alarm information according to an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the process of filtering out alarm information to be verified and establishing a verification information queue based on the alarm information to be verified according to an embodiment of the present invention;

[0042] Figure 3This is a flowchart illustrating the process of verifying alarm information in the alarm information queue according to an embodiment of the present invention.

[0043] Figure 4 This is a flowchart illustrating the average processing time for updating alarm information to be verified according to an embodiment of the present invention.

[0044] Figure 5 This is a schematic diagram of the process for identifying the server to be verified according to an embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram of the process for handling access point faults according to the online transaction information of the access point, according to an embodiment of the present invention.

[0046] Figure 7 This is a schematic diagram of the main structure of the device for processing alarm information according to an embodiment of the present invention;

[0047] Figure 8 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0048] Figure 9 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0049] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. The acquisition, storage, use, and processing of data in the technical solutions of this application all comply with relevant national laws and regulations.

[0050] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0051] During system operation, the Java Virtual Machine (JVM) reclaims various useless data and objects generated by the system's memory usage; this is known as garbage collection. Garbage collection is performed using specific strategies, including when memory reaches its limit, when available memory is insufficient, or through scheduled garbage collection. These operations are generally periodic, with each garbage collection cycle called a Full GC.

[0052] During a Full GC, the entire system will be frozen, unable to perform any other operations, and business functions will be suspended. While most systems can tolerate this brief suspension, it can be fatal for critical systems or during peak traffic periods like holidays, significantly impacting the user experience.

[0053] Since Full GC issues are very common in production, and according to data center specifications, if a single Full GC takes more than 10 seconds or the number of Full GCs is frequent, then such a Full GC is considered an abnormal Full GC.

[0054] Abnormal Full GC issues can lead to longer transaction response times, affecting the system's ability to respond to external events, and even causing system failures. This can be fatal for critical business systems in the financial industry, resulting in incalculable losses and consequences.

[0055] The current mainstream approach is to obtain Full GC logs from the system through automated operation and maintenance tools such as application monitoring, and then read and parse them to obtain Full GC alarm information. However, these alarms require manual judgment to determine whether they meet the criteria for a Full GC fault, and the fault must be determined by combining information such as system deployment and high availability to determine how to isolate and handle it.

[0056] In other words, when a critical system experiences a Full GC failure, the system is unable to respond externally. However, due to a large amount of manual judgment and the offline nature of information, it is impossible to complete the diagnosis and handling of the failure in a timely manner, quickly restore the system, and reduce the impact on business. This is very serious for the financial industry, which has high requirements for business continuity.

[0057] To address the inability to diagnose and handle faults in a timely manner, the following technical solutions from the embodiments of the present invention can be adopted.

[0058] See Figure 1 , Figure 1 This is a schematic diagram of the main flow of a method for processing alarm information according to an embodiment of the present invention. Based on the alarm information, a queue of alarm information to be verified and alarm information to be parsed are obtained through filtering, and then the faults of the access points are handled in a targeted manner. Figure 1 As shown in Figure 100, the specific steps include:

[0059] S101. Receive alarm information sent by the application monitoring system, filter out alarm information to be verified based on the access point identifier, service identifier and abnormal time consumption in the alarm information, and establish a queue of alarm information to be verified based on the alarm information to be verified.

[0060] In one embodiment of the present invention, Figure 1 The cloud platform is the primary entity executing each step in the process. A cloud platform is an internet-based computing method that allows users to access and use resources and applications stored on remote servers via the internet. The cloud platform provides a flexible and scalable way to manage computing resources. By processing alarm information through the cloud platform, access point failures can be addressed promptly.

[0061] Application monitoring systems are used to monitor application execution and send alerts. As an example, alerts may include Full GC failure alerts.

[0062] After receiving alarm information from the application monitoring system, the system parses the alarm information to obtain the access point identifier, service identifier, and abnormal timeout duration. The abnormal timeout duration is the duration of the Full GC failure at the access point.

[0063] Considering the large number of alarm messages, but the fact that some are false alarms, alarm messages to be verified can be filtered based on the access point identifier, service identifier, and abnormal time consumption. A queue of alarm messages to be verified can then be established. Valid alarm messages are then selected from this queue.

[0064] See Figure 2 That is, 200. Figure 2 This is a schematic diagram illustrating the process of filtering out alarm information to be verified and establishing a verification information queue based on the alarm information to be verified, according to an embodiment of the present invention. Specifically, it includes the following steps:

[0065] S201. In the raw information sent by the application monitoring system, obtain alarm information based on the abnormal time in the abnormal time field identifier and the preset abnormal time threshold.

[0066] The application monitoring system sends raw information, from which alarm information can be extracted. Specifically, alarm information is retrieved based on the abnormal time in the abnormal time field and a preset abnormal time threshold. For example, if the abnormal time in the abnormal time field exceeds the preset abnormal time threshold, the raw information is treated as alarm information. Alarm information is then extracted from the raw information using the preset abnormal time threshold.

[0067] As an example, the original information is generally in key-value format. The original information includes: system abbreviation; ap name; FULLGC [smsap_dom:] GC timeout exception, current value: 19.11, alarm range [10, +∞); occurrence time: 09 / 24 / 2020 11:42:00.

[0068] GC time refers to the time spent by the garbage collector performing garbage collection operations during the execution of a computer program. An abnormal GC time indicates that the abnormal time in the abnormal time field exceeds a preset abnormal time threshold; in this case, the original information will be treated as an alarm.

[0069] S202. Filter out the alarm information to be verified from the alarm information sent by the application monitoring system according to the preset verification fields, and establish a verification information queue based on the access point identifier and server identifier in the alarm information to be verified.

[0070] In embodiments of the present invention, to improve the relevance of alarm information, preset verification fields are used to filter alarm information to be verified. As an example, the preset verification fields include mSrv and FULLGC. mSrv is used to identify the number of server tasks. FULLGC is used to identify Full GC failure alarm information.

[0071] In a Customer Information Control System (CICS), setting the MaxServer and MinServer parameters directly affects the allocation and processing capacity of system resources. The msrv value refers to setting both MaxServer and MinServer to the same value; in this case, the system will always maintain that number of server tasks.

[0072] The alarm messages to be verified are filtered out, and a queue of messages to be verified is established based on the access point identifier and server identifier in the alarm messages. In this way, the queue of messages to be verified includes multiple alarm messages to be verified, and each alarm message to be verified is distinguished by the access point identifier and server identifier.

[0073] exist Figure 2 In one embodiment, a queue of information to be verified is established based on the alarm information to be verified, so as to improve the accuracy and efficiency of processing the information to be verified.

[0074] S102. In response to the alarm time period setting instruction, within the preset alarm time period in the alarm time period setting instruction, review the alarm information to be verified in the alarm information queue according to the average processing time of the alarm information to be verified, and filter out the alarm information to be parsed.

[0075] In one embodiment of the present invention, in order to filter out the real fault information, i.e., the alarm information to be parsed, from the alarm information queue to be verified, it is necessary to review the alarm information to be verified in the queue within a preset alarm time period based on the average processing time of the alarm information to be verified. The preset alarm time period is obtained from an alarm time period setting instruction. Specifically, upon receiving an alarm time period setting instruction sent by the user, the preset alarm time period is obtained from the alarm time period setting instruction.

[0076] See Figure 3 That is, 300. Figure 3 This is a flowchart illustrating the process of verifying alarm information in the alarm information queue according to an embodiment of the present invention. Specifically, it includes the following steps:

[0077] S301. In response to the alarm time period setting command, obtain the preset alarm time period from the alarm time period setting command. The preset alarm time period is data obtained periodically based on the processing of alarm information.

[0078] Upon receiving the alarm time period setting instruction, the system parses the instruction and retrieves the preset alarm time period. The preset alarm time period is used to verify the alarm information awaiting verification in the queue, monitoring the processing time of the alarm information within the preset time period to identify false alarms. For example, the preset alarm time period includes 3 minutes.

[0079] In one embodiment of the present invention, the preset alarm time period is based on data obtained periodically during alarm information processing. That is, the preset alarm time period is not static, but rather is obtained periodically according to the alarm information processing. Because the preset alarm time period is obtained periodically, it is applicable to various application scenarios and has strong applicability.

[0080] S302. Within the preset alarm time period in the alarm time period setting instruction, review the abnormal time consumption of the alarm information to be verified in the queue of alarm information to be verified according to the average processing time of the alarm information to be verified, and take the alarm information to be verified with an abnormal time consumption greater than the average processing time as the alarm information to be parsed.

[0081] Within the preset alarm time period specified in the alarm time period setting command, verification is performed based on the average processing time of the alarm information to be verified. As an example, the average processing time of the alarm information to be verified is the average processing time of the alarm information to be verified in the queue during the previous preset alarm time period.

[0082] If an alarm message whose abnormal processing time exceeds the average processing time is considered a genuine alarm message, then such alarm messages will be treated as alarm messages to be parsed.

[0083] If the abnormal processing time of the alarm message to be verified is less than or equal to the average processing time, then the alarm message to be verified is a false alarm message.

[0084] exist Figure 3 In this embodiment, the average processing time of the alarm information to be verified is used for review in order to filter out the alarm information to be parsed from the alarm information queue to avoid false alarms.

[0085] See Figure 4 That is, 400. Figure 4 This is a flowchart illustrating the average processing time for updating alarm information to be verified according to an embodiment of the present invention. Specifically, it includes the following steps:

[0086] S401. Update the average processing time of the alarm information to be verified based on the frequency of alarm information sent by the application monitoring system and the actual processing time of the alarm information to be verified.

[0087] In one embodiment of the present invention, the average processing time of the alarm information to be verified is updated based on the frequency of alarm information sent by the application monitoring system and the actual processing time of the alarm information to be verified.

[0088] The higher the frequency of alarm messages sent by the application monitoring system, the higher the average processing time update frequency of the alarm messages to be verified.

[0089] As an example, the processing time period is determined based on the frequency of alarm messages sent by the application monitoring system. Based on the actual processing time of the alarm messages to be verified within the aforementioned processing time period, the average processing time of the alarm messages to be verified is obtained. This average processing time of the alarm messages to be verified is then used as the updated average processing time.

[0090] S402. Based on the average processing time after the update of the alarm information to be verified, review the abnormal time in the alarm information to be verified in the queue of alarm information to be verified, and take the alarm information to be verified with an abnormal time greater than the updated average processing time as the alarm information to be parsed.

[0091] After updating the average processing time of the alarm information to be verified, the abnormal time in the alarm information to be verified in the queue is reviewed based on the updated average processing time. The alarm information to be verified with an abnormal time greater than the updated average processing time is taken as the alarm information to be parsed.

[0092] exist Figure 4 In one embodiment, the average processing time of the alarm information to be verified is updated by utilizing the frequency of alarm information sent by the application monitoring system, so as to improve the accuracy of filtering alarm information to be parsed.

[0093] See Figure 5 That is, 500. Figure 5 This is a schematic diagram illustrating the process of identifying a server to be verified according to an embodiment of the present invention. Specifically, it includes the following steps:

[0094] S501. Extract the access point identifier and service identifier from the alarm information to be verified, and obtain the server identifier according to the extracted service identifier.

[0095] In an embodiment of the present invention, after establishing a queue of alarm information to be verified, servers to be checked can be selected based on the queue of alarm information to be verified.

[0096] Specifically, the access point identifier and service identifier are extracted from the alarm information to be verified. The access point identifier is used to distinguish access points. The service identifier is used to identify the server corresponding to the service. The server identifier can be obtained from the extracted service identifier. As an example, if the service identifier is service 1, in the Configuration Management Database (CMDB), according to the extracted service identifier: server, the server identifier is found to be: server A.

[0097] S502. If the number of alarm messages to be verified corresponding to the same server identifier in the queue of alarm messages to be verified is greater than the preset number, then the server corresponding to the server identifier will be marked as pending verification.

[0098] For each alarm message in the queue awaiting verification, its corresponding server identifier is determined. Then, the number of alarm messages corresponding to each server identifier is determined. If the number of alarm messages corresponding to the same server identifier in the queue exceeds a preset number, it indicates a high probability of server failure for that server identifier. Therefore, the server corresponding to that server identifier is marked as pending verification, and verification is then performed on that server.

[0099] As an example, alarm information to be verified includes access point identifier 1 and server identifier A in alarm information a; access point identifier 2 and server identifier A in alarm information b; and access point identifier 3 and server identifier A in alarm information c. The preset quantity is 2, so the server corresponding to server identifier A is marked as pending verification. The server corresponding to server identifier A is suspected of having a Full GC failure.

[0100] exist Figure 5In this embodiment, the servers to be checked can be directly filtered out based on the number of corresponding servers in the alarm information to be checked, thereby improving the efficiency of processing alarm information.

[0101] S103. Obtain the online transaction information of the access point from the configuration management database based on the access point identifier in the alarm information to be parsed, and handle the access point fault according to the online transaction information of the access point.

[0102] In an embodiment of the present invention, in order to handle access point failures, the online transaction information of the access point can be obtained from the configuration management database based on the access point identifier in the alarm information to be parsed, and the access point failure can be handled according to the online transaction information of the access point.

[0103] See Figure 6 That is, 600. Figure 6 This is a flowchart illustrating the process of handling access point faults according to online transaction information of the access point, based on an embodiment of the present invention. Specifically, it includes the following steps:

[0104] S601. Obtain the online transaction information of the access point from the configuration management database based on the access point identifier in the alarm information to be parsed.

[0105] Based on the access point identifier in the alarm message to be parsed, retrieve the access point's online transaction information from the configuration management database. Use the online transaction information to determine whether the access point can be directly restarted to resolve the fault.

[0106] S602 If the online transaction information of the access point includes offline transactions, the server startup script is directly invoked to start the server corresponding to the access point in turn to handle the access point failure.

[0107] If an access point's online transaction information includes offline transactions, it means the access point itself is not involved in online transactions. Restarting the access point will not affect the normal operation of other access points. A server startup script can be invoked to start the server corresponding to each access point in turn to handle access point failures.

[0108] S603 If the online transaction information of the access point includes online transactions, then the server corresponding to the access point will be started or isolated in turn according to the number of access points to handle the access point failure.

[0109] If an access point's online transaction information includes online transactions, it means that the access point is involved in online transactions. Restarting an access point will affect the normal operation of other access points. Therefore, it is necessary to start or isolate the servers corresponding to the access points in turn, according to the number of access points, to handle access point failures.

[0110] As an example, if the number of access points in the alarm information to be parsed is less than or equal to the preset number of isolated access points, then the server corresponding to the access point in the alarm information to be parsed is isolated.

[0111] As an example, if the number of access points in the alarm information to be parsed exceeds the preset number of isolated access points, then the servers corresponding to the access points will be restarted in batches. As an example, the restart batches include a first batch and a second batch. The first batch re-switches one server; the second batch restarts two servers.

[0112] exist Figure 6 In the embodiments, for the online transaction information of the access point, the fault of the access point is handled in a corresponding manner.

[0113] In one embodiment of the present invention, after handling the access point fault, in order to achieve automatic processing of alarm information, a model can be trained and the trained model can be used to process the alarm information.

[0114] Specifically, the alarm information sent by the application monitoring system, the average processing time of alarm information to be verified, the online transaction information of the access point, and the way to handle access point faults are used as training data to train an alarm information processing model.

[0115] The alarm information processing model is used to receive the latest alarm information sent by the application monitoring system and output the method for handling access point failures.

[0116] By adopting the alarm information processing model described above, and based on historical alarm information and access point failure methods, automatic processing of alarm information is achieved, thereby improving business continuity.

[0117] In the embodiments of the present invention described above, alarm information sent by the application monitoring system is received. Based on the access point identifier, service identifier, and abnormal time consumption in the alarm information, alarm information to be verified is filtered out, and a queue of alarm information to be verified is established using the alarm information to be verified. In response to an alarm time period setting instruction, within a preset alarm time period in the alarm time period setting instruction, the alarm information to be verified in the queue of alarm information to be verified is reviewed according to the average processing time of the alarm information to be verified, and alarm information to be parsed is filtered out. Based on the access point identifier in the alarm information to be parsed, the online transaction information of the access point is obtained from the configuration management database, and the fault of the access point is processed according to the online transaction information of the access point. The queue of alarm information to be verified and the alarm information to be parsed are obtained by filtering based on the alarm information, which helps to shield false alarms, thereby reducing the number of alarm information to be analyzed, and timely processing of access point faults, thereby ensuring the normal operation of the system.

[0118] See Figure 7 , Figure 7 This is a schematic diagram of the main structure of a device for processing alarm information according to an embodiment of the present invention. The device for processing alarm information can implement a method for processing alarm information, such as... Figure 7 As shown in 700, the device for processing alarm information specifically includes:

[0119] The first filtering module 701 is used to receive alarm information sent by the application monitoring system, filter out alarm information to be verified based on the access point identifier, service identifier and abnormal time consumption in the alarm information, and establish a queue of alarm information to be verified based on the alarm information to be verified.

[0120] The second filtering module 702 is used to respond to the alarm time period setting instruction, and within the preset alarm time period in the alarm time period setting instruction, to review the alarm information to be verified in the alarm information queue to be verified according to the average processing time of the alarm information to be verified, and to filter out the alarm information to be parsed.

[0121] The processing module 703 is used to obtain the online transaction information of the access point from the configuration management database based on the access point identifier in the alarm information to be parsed, and to process the fault of the access point according to the online transaction information of the access point.

[0122] In one embodiment of the present invention, the first filtering module 701 is specifically used to obtain the alarm information from the original information sent by the application monitoring system based on the abnormal time in the abnormal time field identifier and the preset abnormal time threshold.

[0123] The alarm information sent by the application monitoring system is filtered out according to the preset verification fields, and a queue of information to be verified is established based on the access point identifier and server identifier in the alarm information to be verified.

[0124] In one embodiment of the present invention, the second filtering module 702 is specifically used to obtain a preset alarm time period from the alarm time period setting instruction in response to the alarm time period setting instruction. The preset alarm time period is data obtained periodically based on the processing of alarm information.

[0125] Within the preset alarm time period in the alarm time period setting instruction, the abnormal time consumption of the alarm information to be verified in the queue of alarm information to be verified is reviewed according to the average processing time of the alarm information to be verified, and the alarm information to be verified with an abnormal time consumption greater than the average processing time is regarded as the alarm information to be parsed.

[0126] In one embodiment of the present invention, the second filtering module 702 is specifically used to extract the access point identifier and service identifier from the alarm information to be verified, and to obtain the server identifier according to the extracted service identifier.

[0127] If the number of alarm messages corresponding to the same server identifier in the queue of alarm messages to be verified is greater than a preset number, then the server corresponding to the server identifier will be marked as pending verification.

[0128] In one embodiment of the present invention, the second filtering module 702 is specifically used to update the average processing time of the alarm information to be verified based on the frequency of the alarm information sent by the application monitoring system and the actual processing time of the alarm information to be verified.

[0129] The abnormal time consumption in the alarm information queue to be verified is reviewed based on the average processing time after the update of the alarm information to be verified, and the alarm information to be verified with an abnormal time consumption greater than the updated average processing time is regarded as the alarm information to be parsed.

[0130] In one embodiment of the present invention, the processing module 703 is specifically used to obtain the online transaction information of the access point from the configuration management database based on the access point identifier in the alarm information to be parsed;

[0131] If the online transaction information of the access point includes offline transactions, the server startup script is directly invoked to start the server corresponding to the access point in turn to handle the failure of the access point.

[0132] If the online transaction information of the access point includes online transactions, then the servers corresponding to the access points are started or isolated in turn according to the number of access points to handle the failure of the access points.

[0133] In one embodiment of the present invention, the processing module 703 is specifically used to train an alarm information processing model by using the alarm information sent by the application monitoring system, the average processing time of the alarm information to be verified, the online transaction information of the access point, and the method of handling the fault of the access point as training data. The alarm information processing model is used to receive the latest alarm information sent by the application monitoring system and output the method of handling the fault of the access point.

[0134] Figure 8 An exemplary system architecture 800 is shown, in which a method or apparatus for processing alarm information can be applied according to embodiments of the present invention.

[0135] like Figure 8 As shown, system architecture 800 may include terminal devices 801, 802, and 803, a network 804, and a server 805. Network 804 serves as the medium for providing communication links between terminal devices 801, 802, and 803 and server 805. Network 804 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0136] Users can use terminal devices 801, 802, and 803 to interact with server 805 via network 804 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 801, 802, and 803, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0137] Terminal devices 801, 802, and 803 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0138] Server 805 can be a server providing various services, such as a backend management server supporting shopping websites browsed by users using terminal devices 801, 802, and 803 (for example only). The backend management server can analyze and process data such as received product information query requests, and feed back the processing results (such as target push information and product information - for example only) to the terminal devices.

[0139] It should be noted that the method for processing alarm information provided in the embodiments of the present invention is generally executed by server 805, and correspondingly, the device for processing alarm information is generally located in server 805.

[0140] It should be understood that Figure 8 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0141] A computing program product according to an embodiment of the present invention includes a computer program, which, when executed by a processor, implements the method for processing alarm information provided in an embodiment of the present invention.

[0142] The following is for reference. Figure 9 It shows a schematic diagram of the structure of a computer system 900 suitable for implementing a terminal device of the present invention. Figure 9 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0143] like Figure 9As shown, the computer system 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 902 or programs loaded from storage section 908 into random access memory (RAM) 903. The RAM 903 also stores various programs and data required for the operation of the system 900. The CPU 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0144] The following components are connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 910 as needed so that computer programs read from it can be installed into storage section 908 as needed.

[0145] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by central processing unit (CPU) 901, it performs the functions defined above in the system of this invention.

[0146] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0147] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0148] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be housed in a processor; for example, a processor may be described as including a first filtering module, a second filtering module, and a processing module. The names of these modules do not necessarily limit the module itself. For example, the first filtering module may also be described as "receiving alarm information sent by an application monitoring system, filtering out alarm information to be verified based on the access point identifier, service identifier, and abnormal time consumption in the alarm information, and establishing a queue of alarm information to be verified using the alarm information to be verified."

[0149] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include:

[0150] Receive alarm information sent by the application monitoring system, filter out alarm information to be verified based on the access point identifier, service identifier and abnormal time consumption in the alarm information, and establish a queue of alarm information to be verified based on the alarm information to be verified.

[0151] In response to the alarm time period setting instruction, within the preset alarm time period in the alarm time period setting instruction, the alarm information to be verified in the alarm information queue to be verified is reviewed according to the average processing time of the alarm information to be verified, and the alarm information to be parsed is filtered out.

[0152] Based on the access point identifier in the alarm information to be parsed, the online transaction information of the access point is obtained from the configuration management database, and the fault of the access point is processed according to the online transaction information of the access point.

[0153] According to the technical solution of this embodiment of the invention, alarm information sent by an application monitoring system is received. Based on the access point identifier, service identifier, and abnormal time consumption in the alarm information, alarm information to be verified is filtered out, and a queue of alarm information to be verified is established using the alarm information to be verified. In response to an alarm time period setting instruction, within a preset alarm time period in the alarm time period setting instruction, the alarm information to be verified in the queue of alarm information to be verified is reviewed according to the average processing time of the alarm information to be verified, and alarm information to be parsed is filtered out. Based on the access point identifier in the alarm information to be parsed, the online transaction information of the access point is obtained from the configuration management database, and the fault of the access point is processed according to the online transaction information of the access point. The queue of alarm information to be verified and the alarm information to be parsed are obtained by filtering based on the alarm information, which helps to shield false alarms, thereby reducing the number of alarm information to be analyzed, and timely processing of access point faults, thereby ensuring the normal operation of the system.

[0154] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

[0155] It should be noted that the collection, analysis, use, transmission, and storage of user personal information involved in the technical solution of this invention all comply with relevant laws and regulations, are used for legitimate and reasonable purposes, and are not shared, disclosed, or sold outside of these legitimate uses, and are subject to supervision and management by regulatory authorities. Necessary measures should be taken to prevent unauthorized access to such personal information data, ensure that personnel authorized to access personal information data comply with relevant laws and regulations, and ensure the security of user personal information. Once this user personal information data is no longer needed, the risk should be minimized by restricting or even prohibiting data collection and / or deleting the data.

[0156] When applicable, including in certain relevant applications, data deidentification is used to protect user privacy, such as by removing specific identifiers (e.g., date of birth), controlling the amount or specificity of stored data (e.g., collecting location data at the city level rather than at the specific address level), controlling how data is stored, and / or other methods of deidentification.

Claims

1. A method for processing alarm information, characterized in that, Applied to cloud platforms, including: Receive alarm information sent by the application monitoring system, filter out alarm information to be verified based on the access point identifier, service identifier and abnormal time consumption in the alarm information, and establish a queue of alarm information to be verified based on the alarm information to be verified. In response to the alarm time period setting instruction, within the preset alarm time period in the alarm time period setting instruction, the alarm information to be verified in the queue of alarm information to be verified is reviewed according to the average processing time of the alarm information to be verified, and the alarm information to be parsed is filtered out; the average processing time of the alarm information to be verified is the average processing time of the alarm information to be verified in the queue of alarm information to be verified in the previous preset alarm time period. Based on the access point identifier in the alarm information to be parsed, the online transaction information of the access point is obtained from the configuration management database, and the fault of the access point is processed according to the online transaction information of the access point; The receiving application monitoring system receives alarm information, filters out alarm information to be verified based on the access point identifier, service identifier, and abnormal time consumption in the alarm information, and establishes a queue of alarm information to be verified based on the alarm information to be verified, including: The alarm information is obtained from the raw information sent by the application monitoring system based on the abnormal time in the abnormal time field identifier and the preset abnormal time threshold. The alarm information to be verified is filtered out from the alarm information sent by the application monitoring system according to the preset verification fields, and a queue of alarm information to be verified is established with the access point identifier and server identifier in the alarm information to be verified. In response to the alarm time period setting instruction, within the preset alarm time period in the alarm time period setting instruction, the alarm information to be verified in the alarm information queue to be verified is reviewed according to the average processing time of the alarm information to be verified, and the alarm information to be parsed is filtered out, including: In response to an alarm time period setting instruction, a preset alarm time period is obtained from the alarm time period setting instruction. The preset alarm time period is data obtained periodically based on the processing of alarm information. Within the preset alarm time period in the alarm time period setting instruction, the abnormal time consumption of the alarm information to be verified in the queue of alarm information to be verified is reviewed according to the average processing time of the alarm information to be verified, and the alarm information to be verified with an abnormal time consumption greater than the average processing time is regarded as the alarm information to be parsed.

2. The method for processing alarm information according to claim 1, characterized in that, After establishing the alarm information queue to be verified based on the alarm information to be verified, the method further includes: Extract the access point identifier and service identifier from the alarm information to be verified, and obtain the server identifier according to the extracted service identifier; If the number of alarm messages in the queue corresponding to the same server identifier is greater than a preset number, then the server corresponding to the server identifier will be marked as pending verification.

3. The method for processing alarm information according to claim 1, characterized in that, The step of reviewing the abnormal processing time of alarm messages in the queue of alarm messages to be verified based on the average processing time of the alarm messages to be verified, and identifying alarm messages with abnormal processing time greater than the average processing time as alarm messages to be parsed, includes: The average processing time of the alarm information to be verified is updated based on the frequency of alarm information sent by the application monitoring system and the actual processing time of the alarm information to be verified. The abnormal time consumption in the alarm information queue to be verified is reviewed based on the average processing time after the update of the alarm information to be verified, and the alarm information to be verified with an abnormal time consumption greater than the updated average processing time is regarded as the alarm information to be parsed.

4. The method for processing alarm information according to claim 1, characterized in that, The step of retrieving the access point's online transaction information from the configuration management database based on the access point identifier in the alarm information to be parsed, and processing the access point's fault according to the access point's online transaction information, includes: Based on the access point identifier in the alarm information to be parsed, retrieve the online transaction information of the access point from the configuration management database; If the online transaction information of the access point includes offline transactions, the server startup script is directly invoked to start the server corresponding to the access point in turn to handle the failure of the access point. If the online transaction information of the access point includes online transactions, then the servers corresponding to the access points are started or isolated in turn according to the number of access points to handle the failure of the access points.

5. The method for processing alarm information according to claim 1, characterized in that, After processing the access point's fault according to the online transaction information of the access point, the method further includes: The alarm information sent by the application monitoring system, the average processing time of the alarm information to be verified, the online transaction information of the access point, and the method of handling the fault of the access point are used as training data to train an alarm information processing model. The alarm information processing model is used to receive the latest alarm information sent by the application monitoring system and output the method of handling the fault of the access point.

6. A device for processing alarm information, characterized in that, Applied to cloud platforms, including: The first filtering module is used to receive alarm information sent by the application monitoring system, filter out alarm information to be verified based on the access point identifier, service identifier, and abnormal time consumption in the alarm information, and establish a queue of alarm information to be verified based on the alarm information to be verified; and to obtain the alarm information from the original information sent by the application monitoring system according to the abnormal time consumption in the abnormal time consumption field identifier and a preset abnormal time threshold; to filter out alarm information to be verified from the alarm information sent by the application monitoring system according to a preset verification field, and establish a queue of alarm information to be verified based on the access point identifier and server identifier in the alarm information to be verified. The second filtering module is configured to, in response to an alarm time period setting instruction, within a preset alarm time period specified in the alarm time period setting instruction, review the alarm information to be verified in the alarm information queue based on the average processing time of the alarm information to be verified, and filter out the alarm information to be parsed; and, in response to the alarm time period setting instruction, obtain a preset alarm time period from the alarm time period setting instruction, wherein the preset alarm time period is data obtained periodically based on the processing of alarm information; within the preset alarm time period specified in the alarm time period setting instruction, review the abnormal time consumption of the alarm information to be verified in the alarm information queue based on the average processing time of the alarm information to be verified, and identify the alarm information to be verified whose abnormal time consumption is greater than the average processing time as the alarm information to be parsed; wherein the average processing time of the alarm information to be verified is the average processing time of the alarm information to be verified in the alarm information queue within the previous preset alarm time period. The processing module is used to obtain the online transaction information of the access point from the configuration management database based on the access point identifier in the alarm information to be parsed, and to process the fault of the access point according to the online transaction information of the access point.

7. An electronic device for processing alarm information, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-5.

8. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-5.

Images