Intelligent alarm decision-to-order conversion method, system, device and medium

Abstract

The invention provides an intelligent alarm decision-to-order conversion method, system and device and a medium, and the method comprises the steps: obtaining real-time monitoring data, carrying out the monitoring index query of the real-time monitoring data based on a self-defined alarm rule, and determining the index data; condition judgment is carried out on the index data according to the alarm rule, and an alarm instance is determined; traversing all the alarm instances, determining the alarm type of each alarm instance, aggregating the alarm instances according to the alarm types, and determining target alarm data; and generating a work order according to the target alarm data, and forwarding the work order to a specified operation and maintenance end based on a predefined Activiti process for alarm task processing. According to the invention, decisions can be made according to newest information, and report omission is reduced; and the execution path of the Activiti process is dynamically controlled, so that the alarm processing efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of workflow management and intelligent decision support technology, and in particular to an intelligent alarm decision transfer method, system, device and medium. Background Art

[0002] Traditional alarm processing systems usually rely on static rules, which are defined when the system is designed and remain unchanged during operation. Such static rule systems usually have the following major limitations:

[0003] Traditional systems under static rules often find it difficult to make dynamic decisions based on the latest real-time data, resulting in an inability to respond to emergencies or environmental changes in a timely manner, and prone to missed reports; and as the scale and complexity of the system increase, the number of decisions that traditional alarm processing systems have to execute also increases. Since traditional systems find it difficult to adapt to complex situations in dynamic environments, the alarm processing efficiency of traditional systems cannot be improved. Summary of the invention

[0004] The embodiment of the present invention provides an intelligent alarm decision transfer method, system, device and medium to solve the problems existing in the related technologies. The technical solution is as follows:

[0005] In a first aspect, an embodiment of the present invention provides an intelligent alarm decision-making order transfer method, comprising:

[0006] Obtain real-time monitoring data, query monitoring indicators based on custom alarm rules, and determine indicator data;

[0007] Perform conditional judgment on indicator data according to alarm rules to determine alarm instances;

[0008] Traverse all alarm instances, determine the alarm type of each alarm instance, aggregate each alarm instance according to the alarm type, and determine the target alarm data;

[0009] Generate a work order based on the target alarm data, and transfer the work order to the designated operation and maintenance end for alarm task processing based on the predefined Activiti process.

[0010] In one embodiment, it further includes:

[0011] Get the PromQL expression, define the alarm rules and query time according to the PromQL expression, enable Prometheus to traverse each alarm rule regularly according to the query time, and perform monitoring indicator query operations and condition judgment operations according to the alarm rules.

[0012] In one implementation, querying monitoring indicators of real-time monitoring data based on a custom alarm rule includes:

[0013] Traverse each alarm rule and generate PromQL query instructions according to the alarm rules;

[0014] Execute the PromQL query command to query the specified data value corresponding to each monitoring indicator at the current moment and determine the indicator data.

[0015] In one implementation, conditional judgment of indicator data according to the alarm rule includes:

[0016] Execute PromQL query instructions to compare indicator data with the defined conditions in the alarm rules, and generate a corresponding alarm instance when any indicator data meets the defined conditions; the alarm instance records the trigger rule name, current timestamp, label information, and current data value.

[0017] In one implementation, aggregating each alarm instance according to the alarm type includes:

[0018] Determine the trigger time of each alarm instance based on the current timestamp, and aggregate all alarm instances whose trigger times are within the same specified time range; and / or,

[0019] Identify the event type of each alarm instance according to the tag information, and aggregate the alarm instances of the same event type; and / or,

[0020] Identify the trigger rule name of each alarm instance and aggregate the alarm instances with the same trigger rule name.

[0021] In one embodiment, it further includes:

[0022] Get the processing feedback results of the specified operation and maintenance end, analyze the processing feedback results based on the exclusive gateway, and transfer the Activiti process flow to the process branch to execute the specified tasks corresponding to the process branch when the processing feedback results meet the specified conditions of any process branch.

[0023] In one embodiment, it further includes:

[0024] Get the processing feedback results, update the alarm status of the Activiti process by specifying the service task, and record the relevant logs.

[0025] In a second aspect, an embodiment of the present invention provides an intelligent alarm decision-making order transfer system, which executes the intelligent alarm decision-making order transfer method as described above.

[0026] In a third aspect, an embodiment of the present invention provides an electronic device, the device comprising: a memory and a processor. The memory and the processor communicate with each other through an internal connection path, the memory is used to store instructions, the processor is used to execute the instructions stored in the memory, and when the processor executes the instructions stored in the memory, the processor executes the method in any one of the above-mentioned embodiments.

[0027] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a computer, the method in any one of the above-mentioned embodiments is executed.

[0028] The advantages or beneficial effects of the above technical solution include at least:

[0029] The Activiti process of the present invention can predefine the business process of alarm processing, and perform alarm evaluation on the real-time monitoring data fed back by the Activiti process in real time based on the customized alarm rules in the rule engine, so that the system can make decisions based on the latest information and reduce missed reports; and after aggregating the alarm instances, the alarm work orders are transferred according to the Activiti process, the execution path of the Activiti process is dynamically controlled, the efficiency and accuracy of alarm processing are improved, and false alarms and missed reports are further reduced.

[0030] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present invention will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in the present invention and should not be regarded as limiting the scope of the present invention.

[0032] Figure 1 This is a flow chart of the intelligent alarm decision-making order transfer method of the present invention;

[0033] Figure 2 This is a timing diagram of the alarm transfer order of the intelligent alarm decision transfer order system of the present invention;

[0034] Figure 3 This is the alarm transfer flow chart of the present invention;

[0035] Figure 4 This is the intelligent alarm decision-making order transfer system architecture of the present invention;

[0036] Figure 5 The structure block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0038] Traditional alarm processing systems usually rely on static rules, which are defined during system design and remain unchanged during operation, making it difficult to adapt to complex situations in dynamic environments. This static rule system has the following main limitations:

[0039] Lack of flexibility: Static rules are difficult to adjust quickly in the face of changing environments and needs. Any modification of rules requires redeployment of the system, resulting in slow response.

[0040] Difficulty managing complexity: As the size and complexity of the system increases, the number and complexity of static rules also increase, making maintenance increasingly difficult.

[0041] Poor real-time performance: Traditional systems often find it difficult to make dynamic decisions based on real-time monitoring data, resulting in an inability to respond to emergencies or environmental changes in a timely manner.

[0042] Lack of accuracy: Static rules cannot use the latest data to make decisions, which may lead to false positives or false negatives.

[0043] Lack of process management: When using Drools alone, although decisions can be made through the rule engine, there is a lack of comprehensive management and monitoring of the entire processing process. Alarm processing is usually not just a one-time decision, but also involves multi-step process management, such as receiving, verifying, notifying, tracking, and upgrading.

[0044] In order to improve the efficiency and accuracy of alarm processing, this embodiment provides an intelligent alarm decision transfer method, which combines the Activiti workflow engine and the rule engine. The rule engine dynamically manages the alarm processing process, classifies, prioritizes and assigns processing personnel to alarms according to pre-defined rules to achieve intelligent alarm decision support. This technology combines the process management of workflows and the decision-making capabilities of rule engines, improves the efficiency and accuracy of alarm processing, and is suitable for complex operation and maintenance and monitoring scenarios. The method of this embodiment specifically includes the following steps:

[0045] Step S1: Define rules

[0046] In this embodiment, the alarm rules are defined by the rule engine, where the rule engine is a software component used to manage and execute business rules. It allows users to separate business logic and decision logic from the main code of the application and manage and modify them through rules without modifying the application code. The rule engine is usually used in scenarios such as dynamic decision-making, data verification, and event processing.

[0047] This embodiment can define the rules for alarm processing by configuring the DSL (domain-specific language) or other configuration methods of the rule engine in the background, including setting rule conditions and determining rule actions, wherein the alarm rules can determine whether the alarm needs to be transferred and to which personnel or departments the alarm should be transferred based on the attributes, severity, source and other conditions of the alarm.

[0048] Step S2: Activiti process design

[0049] The Activiti workflow engine in this embodiment generates the Activiti process for the specified scenario, where Activiti is a lightweight workflow and business process management platform. It is an open source project based on Java and aims to simplify the management and execution of business processes. Activiti provides a powerful process engine that supports the definition, execution and management of various complex business processes and workflows.

[0050] This embodiment uses the Activiti BPMN (Business Process Modeling and Notation) tool to design the workflow of alarm processing by configuring the background. Figure 2 As shown, this includes the definition of steps such as alarm reception, analysis, processing, and order transfer.

[0051] Step S3: Alarm intelligent decision-making order transfer

[0052] refer to Figure 1 , Figure 2 As shown, this embodiment cooperates with the Activiti process engine and the rule engine to perform intelligent decision-making and order transfer operations for alarms. Specifically:

[0053] Step S31: Obtain real-time monitoring data from Prometheus, perform monitoring indicator query on the real-time monitoring data based on the customized alarm rules, and determine the indicator data.

[0054] When the Activiti workflow engine executes each task in the Activiti process, the pre-configured Prometheus can be used to collect real-time monitoring data for each task, including indicators, logs, and events, etc. The collected data is cleaned, the same type of alarms are aggregated, and then the processed data is passed to the Activit workflow engine.

[0055] Furthermore, users can define alarm rules in Prometheus, which are described based on the PromQL (Prometheus Query Language) syntax. The system obtains the PromQL expression defined by the user and defines the alarm rules based on the PromQL expression. The alarm rules usually include query and condition judgment of indicator data, such as whether it exceeds a certain threshold, whether the duration exceeds the preset time period, etc.

[0056] In addition, the query time can be defined according to the PromQL expression, that is, Prometheus regularly evaluates the defined alarm rules according to the defined query time, that is, Prometheus regularly traverses each alarm rule according to the query time, and generates the corresponding PromQL query instructions according to each alarm rule. For each alarm rule, Prometheus will execute the corresponding PromQL query to obtain the specified data value corresponding to each monitoring indicator at the current moment, determine the indicator data, and the indicator data is used for subsequent conditional judgment.

[0057] Step S32: Perform conditional judgment on the indicator data according to the alarm rules to determine the alarm instance.

[0058] Specifically, execute the PromQL query instruction, compare the indicator data with the defined conditions in the alarm rule, and Prometheus generates a corresponding alarm instance when any indicator data meets the defined conditions; the conditions defined in the alarm rule can be threshold judgment, that is, judging whether the indicator data exceeds the preset threshold, and if it exceeds, an alarm instance is generated. The alarm instance contains specific information about the alarm, such as the alarm instance records the trigger rule name, current timestamp, label information, and current data value.

[0059] Furthermore, in order to ensure that the data format obtained from Prometheus conforms to the expected format, Prometheus usually uses text format for data transmission and storage so that the data can be correctly parsed and processed.

[0060] Step S33: traverse all alarm instances, determine the alarm type of each alarm instance, aggregate each alarm instance according to the alarm type, and determine target alarm data.

[0061] Parse and analyze the alarm instances obtained from Prometheus to identify the alarm type. Alarm types can be identified by indicator name, label or other metadata. These marking methods are usually complementary. Through their combined use, complex monitoring scenarios and alarm requirements can be effectively managed and responded to.

[0062] Methods for identifying alarm types:

[0063] Metric name: A set of standardized metric naming rules are predefined. For example, metrics starting with alert_ indicate alert types, such as alert_cpu_usage. Metric names are usually used to directly identify and classify specific types of metrics, providing a static naming convention that allows the monitoring system to directly identify and process related alert data.

[0064] Labels: Use Prometheus's labeling mechanism to add labels to different types of alerts. For example, severity=high can indicate a high-level alert. Labels provide a dynamic metadata mechanism that allows for more detailed classification and filtering of metrics. The flexibility of labels allows for dynamic organization and analysis of monitoring data based on different needs.

[0065] Alert rules: When configuring alert rules in Prometheus, you can define a unique identifier or description for each type of alert to identify it during subsequent processing. Alert rules define the logic of when an alert is triggered and how to handle it. They are used in conjunction with indicators and labels to ensure that alerts are generated and processed correctly when specific conditions are met.

[0066] In order to further improve the system efficiency, this embodiment can aggregate the data of each alarm instance. Specifically, the data of the alarm instance can be aggregated by time window, event type, device or source, statistics (average value, maximum and minimum values), etc.:

[0067] (1) Time window aggregation: Determine the trigger time of each alarm instance based on the current timestamp, and aggregate the data of alarm instances within a certain time range, such as alarm data aggregation every minute, hour, or day. This method is suitable for periodic analysis and report generation.

[0068] (2) Event type aggregation: Identify the event type of each alarm instance based on the tag information and merge alarm data of the same category or type. For example, aggregate all alarms related to network devices to distinguish them from alarm data of servers or applications.

[0069] (3) Device or source aggregation: Identifying the data source of each alarm instance based on tag information and aggregating alarm data from the same device or source helps monitor the overall status of a specific device or service.

[0070] (4) Conditional trigger aggregation: Identify the trigger rule name of each alarm instance and trigger the aggregation of alarm data based on the same trigger rule conditions. For example, when the alarm frequency of a specific device exceeds the threshold, the aggregation and analysis of alarm data is triggered.

[0071] (5) Statistical aggregation: Average aggregation is to average the numerical alarm data within a period of time, such as calculating the average CPU usage or network traffic per hour. Maximum and minimum aggregation respectively record the maximum and minimum values ​​of the numerical alarm data within a period of time, which is used to find the highest or lowest peak value within a certain period of time.

[0072] In some embodiments, appropriate error handling mechanisms may also be implemented to handle errors or abnormal situations that may occur during data transmission or processing, and to perform data filtering to ensure that only valid alarm data is passed to Activiti, avoiding unnecessary data transmission and processing burdens.

[0073] Step S34: Generate a work order based on the target alarm data, and transfer the work order to the designated operation and maintenance end for alarm task processing based on the predefined Activiti process.

[0074] The alarm data processed in step S33 is transmitted to the Activiti workflow engine. This step can be implemented by calling the REST API provided by Activiti, using a message queue, etc.

[0075] The Activiti process engine performs preliminary processing on the alarm data to generate a work order, and then uses JavaService Task to call the alarm rules of the rule engine for alarm processing. The rule engine queries the rule matching results designed in step S1 through the rule library, and returns the alarm rule results to act on the Activiti process engine.

[0076] refer to Figure 3 As shown, using Activiti's Exclusive Gateway, according to the preset alarm rules, the alarm notification generated based on the alarm data is distributed to the person in charge of the business system and / or the person in charge of the leadership task. In the alarm rules, the corresponding person in charge is configured in advance according to different alarm types. For example, different alarm types such as high CPU utilization, abnormal memory usage, insufficient storage space, and abnormal network connection are configured to different persons in charge. The alarm notification can also be synchronized to the person in charge or the leader at the next higher level according to the degree of the alarm; for example, alarm notifications such as abnormal memory usage are distributed to the corresponding person in charge of the business system, while security-related alarms need to notify the person in charge of the business system and the person in charge.

[0077] Afterwards, after the person in charge of the business system and the person in charge respond to the alarm notification, the Activiti process engine continues to distribute processing tasks to the designated operation and maintenance end according to its predefined process steps, such as matching the network team for the network, and matching the operation and maintenance team for the CPU, memory, storage, etc. Activiti's Exclusive Gateway gateway distributes specific processing teams based on this result condition.

[0078] After obtaining any processing feedback results, the system analyzes the processing feedback results based on the exclusive gateway. If the processing feedback results meet the specified conditions of any process branch, the alarm process flow is transferred to the process branch to execute the specified tasks corresponding to the process branch. Among them, users can click to process the alarm and return the processing feedback results through the business system interface. According to the processing feedback results, the Exclusive Gateway of Activiti decides whether to report to the relevant system units for technical support.

[0079] After the user feeds back the alarm processing results to the Activiti process engine, Activiti updates the alarm status through the Service Task and records the relevant logs.

[0080] This embodiment introduces the rule engine into the Activiti alarm process for several main purposes and advantages:

[0081] 1. Flexibility and Configurability:

[0082] The rule engine enables users to define and manage rules for alarm processing, which can be dynamically configured and modified according to actual needs without modifying the source code or redeploying the process. This flexibility enables the system to quickly adapt to different business needs and changing alarm processing strategies.

[0083] 2. Automation and efficiency:

[0084] The rule engine can automatically process alarms and quickly classify, analyze and respond to alarms based on pre-set rules and logic. This automation greatly improves the efficiency of alarm processing, reduces the need for manual intervention, and reduces processing delays.

[0085] 3. Real-time decision-making capabilities:

[0086] The rule engine can monitor and process alarms in real time and respond to various complex alarm situations immediately. This real-time decision-making capability ensures that the system responds and processes alarm events quickly, thereby minimizing potential business interruptions or losses.

[0087] 4. Integration capabilities:

[0088] As a process engine, Activiti can be seamlessly integrated with the rule engine, so that the alarm processing process is closely integrated with the business process. The rule engine can automatically adjust the alarm processing strategy according to the specific requirements of the business process to ensure the coordination and consistency of alarm processing with the overall business operation.

[0089] In general, the purpose of introducing a rule engine into the Activiti alert process is to optimize and enhance the efficiency and quality of alert processing by improving flexibility, automation, and real-time decision-making capabilities, thereby improving the stability and reliability of the overall business.

[0090] Another embodiment of the present invention provides an intelligent alarm decision transfer system, which executes the intelligent alarm decision transfer method as described above. Figure 4 As shown, the intelligent alarm decision-making order transfer system includes a monitoring data acquisition module, a rule engine module, an Activiti process engine module, a business processing interface module, a configuration background module and a data storage module.

[0091] The monitoring data collection module supports access to real-time monitoring data, including indicators, logs, and events, from a variety of cloud service providers (such as AWS, Azure, and Tianyi Cloud), virtualization platforms (such as VMware and OpenStack), etc. The data collector uses the API or custom plug-ins provided by the cloud service provider to collect and transmit data to ensure the accuracy and timeliness of the data. The collected data is cleaned, standardized, and converted to adapt to the subsequent rule engine processing.

[0092] The rule engine module performs real-time analysis and decision-making on monitoring data based on predefined rule sets. It supports flexible rule definition and management, allowing dynamic adjustment of rule sets to meet different monitoring needs. Open source rule engines such as Drools can be used to achieve high performance and scalable rule execution capabilities.

[0093] The Activiti process engine module is responsible for managing and executing the alarm processing process to ensure the controllability and transparency of the process. It supports the design and execution of complex alarm processing processes, including task allocation, progress tracking, approval processes, and notification links. This module provides a visual process designer and execution engine that is closely integrated with business needs to help users optimize and automate alarm processing processes.

[0094] The business processing interface module is a web-based user interface designed for real-time viewing of cloud resource monitoring data and alarm status. It not only supports the management and configuration of alarm processing processes, including user role permission settings and personalized interface customization, but also helps users quickly identify and solve problems in cloud resource management through intuitive data visualization and operation interfaces.

[0095] Configuring the backend module includes configuring the Activiti BPMN file and the rule engine rule DSL. Through these configurations, the graphical design and management of business processes and the flexible definition of rule engine rules are realized, ensuring that the system can efficiently handle various business processes and rule-driven decision support.

[0096] The data storage module is used to store alarm information, rule configuration, historical data, etc.

[0097] The intelligent alarm decision-making order transfer system of this embodiment can achieve the following beneficial effects:

[0098] 1. Alarm processing flow design: Use Activiti to design the alarm processing flow, including alarm reception, analysis, classification and order transfer. The rule engine can automatically decide whether to transfer the order and to which department to transfer the order according to the attributes and conditions of the alarm.

[0099] 2. Alarm processing priority management: By setting up a rule engine, it is possible to automatically decide whether the alarm should be escalated to the leadership based on the severity, urgency and other attributes of the alarm, ensuring that high-severity and high-priority alarms receive timely attention.

[0100] 3. Alarm classification and distribution: According to the rules set by the rule engine, the received alarms are automatically classified and distributed. For example, according to the type, source, historical data, etc. of the alarm, it is automatically decided to which department or specific engineer the alarm will be transferred to.

[0101] 4. Dynamic decision-making ability: The combination of Activiti and the rule engine allows the processing of alarms to be dynamically adjusted based on real-time data and predefined rules. The rule engine is responsible for defining and managing the rules for alarm processing, such as determining the alarm processing path based on conditions such as alarm type, source, and severity. This allows the system to automatically adjust the processing strategy in different situations without manual intervention.

[0102] The functions of each module in the system of the embodiment of the present invention can be found in the corresponding description of the above method, which will not be repeated here.

[0103] Another embodiment of the present invention provides an electronic device, Figure 5 FIG. 2 shows a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 5 As shown, the electronic device includes: a memory 100 and a processor 200, wherein the memory 100 stores a computer program that can be run on the processor 200. When the processor 200 executes the computer program, the intelligent alarm decision-making order transfer method in the above embodiment is implemented. The number of the memory 100 and the processor 200 can be one or more.

[0104] The electronic device also includes:

[0105] The communication interface 300 is used to communicate with external devices and perform data exchange transmission.

[0106] If the memory 100, the processor 200 and the communication interface 300 are implemented independently, the memory 100, the processor 200 and the communication interface 300 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0107] Optionally, in a specific implementation, if the memory 100, the processor 200 and the communication interface 300 are integrated on a chip, the memory 100, the processor 200 and the communication interface 300 can communicate with each other through an internal interface.

[0108] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present invention when executed by a processor.

[0109] An embodiment of the present invention further provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present invention.

[0110] An embodiment of the present invention also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided by the embodiment of the invention.

[0111] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced RISC machines (ARM) architecture.

[0112] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory, and may also include a non-volatile random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0113] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0114] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0115] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0116] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of various changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An intelligent alarm decision-making order transfer method, characterized in that: include: Acquire real-time monitoring data, perform monitoring indicator query on the real-time monitoring data based on custom alarm rules, and determine indicator data; Perform conditional judgment on the indicator data according to the alarm rule to determine the alarm instance; Traversing all the alarm instances, determining the alarm type of each of the alarm instances, aggregating each of the alarm instances according to the alarm type, and determining target alarm data; Generate a work order based on the target alarm data, and transfer the work order to the designated operation and maintenance end for alarm task processing based on the predefined Activiti process.

2. The intelligent alarm decision-making order transfer method according to claim 1 is characterized in that: Also includes: Obtain a PromQL expression, define the alarm rule and query time according to the PromQL expression, enable Prometheus to regularly traverse each of the alarm rules according to the query time, and perform monitoring indicator query operations and condition judgment operations according to the alarm rules.

3. The intelligent alarm decision-making order transfer method according to claim 2 is characterized in that: The querying of monitoring indicators of the real-time monitoring data based on the customized alarm rules includes: Traverse each of the alarm rules and generate a PromQL query instruction according to the alarm rules; Execute the PromQL query instruction to query the specified data value corresponding to each of the monitoring indicators at the current moment, and determine the indicator data.

4. The intelligent alarm decision-making order transfer method according to claim 3 is characterized in that: The conditional judgment of the indicator data according to the alarm rule includes: Execute the PromQL query instruction, compare the indicator data with the definition conditions in the alarm rule, and generate a corresponding alarm instance when any of the indicator data meets the definition conditions; the alarm instance records the trigger rule name, current timestamp, label information and current data value.

5. The intelligent alarm decision-making order transfer method according to claim 4 is characterized in that: The aggregating the alarm instances according to the alarm type includes: Determine the triggering time of each alarm instance according to the current timestamp, and aggregate all the alarm instances whose triggering times are within the same specified time range; and / or, Identify the event type of each alarm instance according to the tag information, and aggregate the alarm instances of the same event type; and / or, The trigger rule name of each of the alarm instances is identified, and the alarm instances with the same trigger rule name are aggregated.

6. The intelligent alarm decision-making order transfer method according to claim 1 is characterized in that: Also includes: Obtain the processing feedback result of the specified operation and maintenance end, analyze the processing feedback result based on the exclusive gateway, and if the processing feedback result meets the specified conditions of any process branch, transfer the Activiti process flow to the process branch to execute the specified task corresponding to the process branch.

7. The intelligent alarm decision-making order transfer method according to claim 6 is characterized in that: Also includes: Obtain the processing feedback result, update the alarm status of the Activiti process by specifying the service task, and perform relevant log records.

8. An intelligent alarm decision-making order transfer system, characterized in that: Execute the intelligent alarm decision-making order transfer method as described in any one of claims 1 to 7.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the intelligent alarm decision-making order transfer method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the intelligent alarm decision-making order transfer method according to any one of claims 1 to 7 is implemented.

Images