Alarm information processing method and system

Abstract

The invention relates to an alarm information processing method and system, and the method comprises the steps: obtaining at least one piece of alarm information; analyzing the alarm information to obtain at least one of category information, source information, archived information or content state information of the alarm information; and in response to at least one of the category information, the source information and the archived information or the content state information of the alarm information, determining a processing mode of the alarm information, and processing the alarm information based on the determined processing mode. According to the method, the category, the source and the content state of the alarm information can be controlled, so that the alarm information processing mode can be determined based on different categories, sources and content states, and the alarm information is processed based on the determined processing mode; therefore, the processing of the alarm information is more intelligent, accurate and efficient.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and system for processing alarm information. Background Art

[0002] With the rapid development of enterprise digitalization, building a data center is an indispensable link. At the same time, how to operate and maintain data is a technical problem that needs to be solved urgently. In the operation and maintenance of data, the number of business systems involved increases, the technical components continue to be enriched, the business scenarios continue to expand, and the configured monitoring tools and monitoring strategies are also constantly enriched.

[0003] In the prior art, when alarm information is discovered in the operation and maintenance management of data, it is mainly through manual analysis of the alarm information and repair based on experience. However, it is impossible to automatically control the alarm information, and it is impossible to ensure accurate processing and efficient response of the alarm information. Summary of the invention

[0004] Based on this, it is necessary to provide a method and system for processing alarm information that can automatically control the alarm information in response to the above technical problems.

[0005] In some embodiments, the present application provides a method for processing alarm information, including:

[0006] Obtain at least one warning information;

[0007] Parsing the warning information to obtain at least one of category information, source information, whether the warning information is archived information, or content status information of the warning information;

[0008] In response to at least one of the category information, the source information, whether the information is archived or the content status information of the alarm information, a processing method for the alarm information is determined, and the alarm information is processed based on the determined processing method.

[0009] In some embodiments, the method further comprises:

[0010] Determining the category information of the warning information based on the impact level of the warning information;

[0011] Determining the source information of the alarm information based on a source platform of the alarm information;

[0012] Determining whether the warning information is archived information based on the coding information or the similarity recognition algorithm of the warning information;

[0013] Based on the content identification of the alarm information, it is determined whether the content status information of the alarm information is complete alarm information.

[0014] In some embodiments, the content status information of the warning information includes whether the warning information is integrity information;

[0015] In response to the content status of the alarm information being a complete status, matching a corresponding alarm information processing method based on the alarm information in the complete status, and processing the alarm information based on the matched processing method;

[0016] In response to the content status of the alarm information being in an incomplete state, the alarm information is completed to obtain the complete alarm information, and the corresponding alarm information processing method is continued to be matched based on the alarm information in the complete state, and the alarm information is processed based on the matched processing method.

[0017] In some embodiments, the method further comprises:

[0018] In response to the alarm information being archived information, processing the current alarm information based on a processing method for archived alarm information;

[0019] In response to the alarm information not being archived information, a corresponding processing method is matched based on the current alarm information, the current alarm information is processed based on the latest matched processing method, and the current alarm information and processing method are archived.

[0020] In some embodiments, the method further comprises:

[0021] The processing method of the alarm information includes one or more of automatic processing, semi-automatic processing and human-computer interaction processing.

[0022] In some embodiments, the method further comprises:

[0023] Alarm information is collected based on multiple information platforms, wherein each of the alarm information platforms is associated with an alarm information collector, and the alarm information is transmitted based on a communication protocol, wherein the alarm information collected by each of the information platforms is concentrated in the alarm information collector, each of the information platforms is configured with a corresponding embedding probe, and the alarm information is automatically archived based on the collection and triggering of the embedding probe.

[0024] In some embodiments, the method also includes collecting information on the physical devices, platform processes, and running tasks under its jurisdiction, dividing the collected information into alarm levels based on the docked application system and a preset division method, and distributing alarm information of different levels separately to match corresponding processing methods.

[0025] In some embodiments, the method also includes: matching the corresponding type of processing method based on the task type corresponding to the alarm information; the task types include data collection tasks, data processing tasks, data push tasks, and application system customized tasks; taking the same type of processing method for the task collection task and the data push task, locking the abnormal field to automatically generate expansion statements and execute automatic re-running tasks; for the data processing task, calling the system resource allocation parameters to perform elastic scaling resource processing.

[0026] In some embodiments, the method further includes: storing the alarm information and the corresponding processing method in a large model, and performing learning and training on the large model so that the large model has similar error recognition and analysis functions.

[0027] The present application also provides an alarm information processing system, comprising:

[0028] An acquisition module, used to acquire at least one alarm information;

[0029] A parsing module, used to parse the alarm information to obtain at least one of category information, source information, whether the alarm information is archived information, or content status information of the alarm information;

[0030] A processing module is used to determine a processing method for the alarm information in response to at least one of the category information, the source information, whether the alarm information is archived information, or the content status information of the alarm information, and process the alarm information based on the determined processing method.

[0031] The above-mentioned alarm information processing method and system control the category, source and content status of the alarm information, so as to determine the alarm information processing method based on different categories, sources and content status, and process the alarm information based on the determined processing method. This makes the processing of alarm information more intelligent, accurate and efficient, realizes batch processing of a large amount of alarm information, reduces manual workload, and ensures accurate processing and efficient response of alarm information. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a flowchart of a method for processing alarm information provided in one of the embodiments of the present application;

[0033] Figure 2 It is a flowchart of S12 in the method for processing alarm information provided in one of the embodiments of the present application;

[0034] Figure 3 It is a flowchart of S13 in the method for processing alarm information provided in one of the embodiments of the present application;

[0035] Figure 4 It is a flowchart of S14 in the method for processing alarm information provided in one of the embodiments of the present application;

[0036] Figure 5 It is a schematic diagram of the structure of the alarm information processing system provided in one of the embodiments of the present application;

[0037] Figure 6 is a hardware diagram of an electronic device according to an exemplary embodiment;

[0038] Figure 7 This is a schematic diagram of a big data operation and maintenance alarm processing flow provided in one of the embodiments of the present application;

[0039] Figure 8 This is a schematic diagram of the principle of an alarm information collector provided in one of the embodiments of the present application;

[0040] Fig. 9 It is a flowchart of an alarm processing center provided in one of the embodiments of the present application;

[0041] Fig.10 It is a schematic diagram of the intelligent solution center process provided in one of the embodiments of the present application;

[0042] Fig.11 is a flowchart of an alarm information processing method provided by another embodiment of the present application;

[0043] Fig.12 A module diagram of an alarm information processing system provided in another embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] like Fig.11 As shown, in one embodiment, the present application provides a method for processing alarm information, including: step 1101, obtaining at least one alarm information; step 1102, parsing the alarm information to obtain at least one of the category information, source information, whether it is archived information, or content status information of the alarm information; step 1103, in response to at least one of the category information, source information, whether it is archived information, or content status information of the alarm information, determining a processing method for the alarm information, and processing the alarm information based on the determined processing method.

[0046] In some embodiments, the method also includes: determining the category information of the alarm information based on the impact level of the alarm information; determining the source information of the alarm information based on the source platform of the alarm information; determining whether the alarm information is archived information based on the encoding information or similarity recognition algorithm of the alarm information; and determining whether the content status information of the alarm information is complete alarm information based on content recognition of the alarm information.

[0047] In some embodiments, the content status information of the alarm information includes whether the alarm information is integrity information; in response to the content status of the alarm information being a complete status, matching the corresponding alarm information processing method based on the alarm information in the complete status, and processing the alarm information based on the matched processing method; in response to the content status of the alarm information being an incomplete status, completing the content of the alarm information to obtain the complete alarm information, and continuing to match the corresponding alarm information processing method based on the alarm information in the complete status, and processing the alarm information based on the matched processing method.

[0048] See also Figure 1 , provides a method for processing alarm information, which is applied to the data platform; the operation and maintenance management method of the alarm information includes:

[0049] Step S11: Obtain at least one warning information;

[0050] Step S12: determining the content status based on the warning information;

[0051] Step S13: if the content status is a complete status, determining the alarm type based on the alarm information;

[0052] Step S14: triggering a corresponding processing method based on the alarm type, wherein the processing method includes at least one of automatic processing, semi-automatic processing and human-computer interaction processing.

[0053] In an embodiment of the present application, through the method in the embodiment of the present application, the content status of the alarm information is controlled, so that the type of the alarm information is identified when the content status is in a complete state, so as to determine the alarm type based on the alarm information, thereby triggering the corresponding processing method based on the alarm type, and then automatically controlling the alarm information according to the processing method, thereby realizing batch processing of a large amount of alarm information, reducing manual workload, and ensuring accurate processing and efficient response of alarm information.

[0054] In some embodiments, the method also includes: collecting alarm information based on multiple information platforms, wherein each of the alarm information platforms is associated with an alarm information collector, and transmitting the alarm information based on a communication protocol, wherein the alarm information collected by each of the information platforms is concentrated in the alarm information collector, and each of the information platforms is configured with a corresponding embedding probe, and the alarm information is automatically archived based on the collection and triggering of the embedding probe.

[0055] In step S11, obtaining at least one warning information;

[0056] Before obtaining at least one alarm information, each information platform is associated with an alarm information collector, and the alarm information is transmitted based on the communication protocol, wherein the alarm information corresponding to each information platform is concentrated in the alarm information collector, each of the information platforms is configured with a corresponding embedding probe, and the automatic archiving of the alarm information is triggered based on the embedding probe. Optionally, the communication protocol is an http communication protocol, and each information platform includes at least one of a big data platform, a data warehouse, a reporting platform, a zabbix platform, and a user-defined program platform.

[0057] At this time, association is made for each information platform, and corresponding probes are configured to collect and summarize relevant information into the alarm information collector. It also supports storing relevant information in the information creation environment, and adds functions such as receiving information and receiving source information.

[0058] See also Figure 8 Through the HTTP communication protocol, it supports message formats such as text and markdown, and adds relevant probes to existing monitoring programs such as the existing big data platform, data warehouse, reporting platform, zabbix, and user-defined programs, so as to uniformly collect and aggregate relevant information into the alarm information collector, support storage in the information creation environment, and increase its receiving information and receiving source information. Figure 2 Principle of alarm information collector.

[0059] Furthermore, based on the alarm information collector, the alarm information transmitted by each information platform is collected to obtain at least one alarm information, and then the alarm information is parsed, thereby ensuring the control of the alarm information. The form of the alarm information includes message formats such as text and markdown.

[0060] refer to Figure 3 , in step S13, if the content status is a complete status, determining the alarm type based on the alarm information;

[0061] In the specific implementation process of this application, the specific steps may be:

[0062] S131: If the content status is a complete status, determining an error code value based on the warning information;

[0063] S132: Determine the alarm type according to the error code value.

[0064] In an embodiment of the present application, the content status is controlled. At this time, if the content status is a complete status, the error code value is determined based on the alarm information; the alarm type is determined according to the error code value, thereby defining the alarm type to facilitate processing based on the alarm type, thereby controlling the alarm type and clarifying the alarm type corresponding to the alarm information.

[0065] In addition, the alarm type is defined according to the alarm code. At this time, for routine problems such as task re-running, real-time task launching, and insufficient character field length, the relevant tasks can be automatically repaired without manual intervention. For operations that require manual intervention, the log message prompts are simplified, such as database network failure and incorrect passwords. Often, the log information printed by multiple platforms and multiple components is not the same. After information cleaning and integration, the problem can be further identified, and the operation and maintenance personnel are prompted with the final solution steps that need to be coordinated.

[0066] refer to Figure 4 S14: triggering a corresponding processing method based on the alarm type, the processing method including at least one of automatic processing, semi-automatic processing and human-computer interaction processing; the processing method of the alarm information includes one or more of automatic processing, semi-automatic processing and human-computer interaction processing.

[0067] In some embodiments, the method further includes: in response to the alarm information being archived information, processing the current alarm information based on a processing method for archived alarm information; in response to the alarm information not being archived information, matching a corresponding processing method based on the current alarm information, processing the current alarm information based on the most recently matched processing method, and archiving the current alarm information and the processing method.

[0068] In the specific implementation process of this application, the specific steps may be:

[0069] S141: Compare the alarm type with the data operation and maintenance knowledge base;

[0070] S142: If the alarm type exists in the data operation and maintenance knowledge base, a corresponding processing method is matched based on the alarm type, and the processing method includes at least one of automatic processing, semi-automatic processing, and human-computer interaction processing.

[0071] In an embodiment of the present application, the content status of the alarm information is controlled, so that the type of the alarm information is identified when the content status is in a complete state, so as to determine the alarm type based on the alarm information, thereby triggering a corresponding processing method based on the alarm type, and then automatically controlling the alarm information according to the processing method, thereby realizing batch processing of a large amount of alarm information, reducing manual workload, and ensuring accurate processing of alarm information and efficient response.

[0072] At this time, the alarm type is compared with the data operation and maintenance knowledge base to make it clear whether the data operation and maintenance knowledge base records the alarm type, and then control the alarm type.

[0073] Furthermore, if the alarm type exists in the data operation and maintenance knowledge base, the corresponding processing method is matched based on the alarm type, and then the alarm information is automatically controlled according to the processing method, realizing batch processing of a large amount of alarm information, reducing manual workload, and ensuring accurate processing and efficient response of alarm information. Optionally, the processing method includes at least one of automatic processing, semi-automatic processing, and human-computer interactive processing.

[0074] Specifically, in the data operation and maintenance knowledge base, select the abnormal scenarios and processing scripts that match the alarm type; trigger the automatic processing according to the alarm information and the complete processing script. At this time, for the automatic processing cases, such as during the data collection and push process, due to the change of the source system table field attributes, the target table field can be automatically matched and expanded due to the insufficient length of the character type.

[0075] Specifically, in the data operation and maintenance knowledge base, select the abnormal scenarios and processing scripts that match the alarm type; trigger semi-automatic processing based on the alarm information and some processing scripts. At this time, for semi-automatic processing cases, such as during the data collection and push process, due to changes in the source system table field attributes, such as missing fields in the source table, database connection failure, database password changes, database table locks, etc., intelligent guidance is provided to prompt the operation and maintenance personnel to contact the corresponding person in charge for manual intervention.

[0076] Specifically, in the data operation and maintenance knowledge base, it is impossible to filter out abnormal scenarios and processing scripts that match the alarm type, and output prompt signals to trigger human-computer interaction processing according to the prompt signals. At this time, for human-computer interaction processing cases, if there is a solution that cannot match the existing knowledge inventory, directly contact the operation and maintenance personnel, display the relevant imagination and logs, and prompt the operation and maintenance personnel to solve the problem.

[0077] In addition, for other alarm information, if the collected information is incomplete, such as false alarms, lack of information on the person responsible for alarm information processing, and inappropriate alarm information description, these issues are collected and sent to the operation and maintenance management center, and the operation and maintenance personnel are asked to modify the corresponding alarm configuration for completion and optimization.

[0078] In an embodiment of the present application, at least one alarm message is obtained through the method in the embodiment of the present application; the content status is determined based on the alarm message; if the content status is a complete status, the alarm type is determined based on the alarm message; and a corresponding processing method is triggered based on the alarm type, and the processing method includes at least one of automatic processing, semi-automatic processing, and human-computer interaction processing. At this time, the content status of the alarm message is controlled, so that the type of the alarm message is identified when the content status is in a complete state, so that the alarm type is determined based on the alarm message, so that the corresponding processing method is triggered based on the alarm type, and then the alarm information is automatically controlled according to the processing method, so as to realize batch processing of a large amount of alarm information, reduce manual workload, and ensure accurate processing of alarm information and efficient response.

[0079] At this time, by formulating detailed operation and maintenance processes and standard operating procedures (SOPs), we ensure the consistency and traceability of operation and maintenance work. This reduces unnecessary operational errors and duplication of work, allowing operation and maintenance personnel to focus more on key tasks; at the same time, it realizes real-time monitoring and fault warning during data operation, greatly improving the efficiency of troubleshooting and ensuring system stability.

[0080] The above-mentioned alarm information processing method and system control the category, source and content status of the alarm information, so as to determine the alarm information processing method based on different categories, sources and content status, and process the alarm information based on the determined processing method. This makes the processing of alarm information more intelligent, accurate and efficient, realizes batch processing of a large amount of alarm information, reduces manual workload, and ensures accurate processing and efficient response of alarm information.

[0081] In some embodiments, the content status information of the alarm information includes whether the alarm information is integrity information; in response to the content status of the alarm information being a complete status, matching the corresponding alarm information processing method based on the alarm information in the complete status, and processing the alarm information based on the matched processing method; in response to the content status of the alarm information being an incomplete status, completing the content of the alarm information to obtain the complete alarm information, and continuing to match the corresponding alarm information processing method based on the alarm information in the complete status, and processing the alarm information based on the matched processing method.

[0082] refer to Figure 2 , in step S12, determining the content status based on the warning information;

[0083] In the specific implementation process of this application, the specific steps may be:

[0084] S121: triggering cleaning and integration based on the alarm information, and outputting the cleaned and integrated alarm information;

[0085] S122: Determine corresponding content according to the cleaned and integrated alarm information;

[0086] S123: Determine the content status based on the integrity test of the content.

[0087] In the embodiment of the present application, alarm information is introduced, and cleaning and integration is triggered based on the alarm information, so that the alarm information is processed under the cleaning and integration, thereby outputting the cleaned and integrated alarm information. Information control is performed on the cleaning and integration of the alarm information, so that the alarm information is processed, and duplicate information or abnormal information is eliminated, thereby ensuring the accuracy of the cleaned and integrated alarm information.

[0088] At this time, the corresponding content is determined based on the cleaned and integrated alarm information, so that the content is managed and controlled, and then the content is tested for integrity, so that the content status is determined based on the content integrity test, and the content status is frozen. The content status includes a complete state and an incomplete state. The degree of integrity of the content is presented based on the content status, so that the corresponding processing can be matched based on the complete state and the incomplete state.

[0089] In addition, after the cleaning and integration is triggered based on the alarm information, the corresponding method information is matched based on the alarm information, and the alarm method is determined according to the method information, thereby defining the alarm method associated with the alarm information, so as to realize the tracing of the alarm method. Optionally, the alarm method includes telephone, enterprise WeChat, email or SMS.

[0090] Furthermore, after the cleaning and integration is triggered based on the alarm information, the contact information is matched based on the alarm information, and the contact is defined according to the contact information, thereby defining the contact associated with the alarm information, so as to facilitate the tracing of the contact.

[0091] Alternatively, after the cleaning and integration is triggered based on the alarm information, information tracing is triggered based on the alarm information, and the type of the source is defined, thereby defining the type of the source associated with the alarm information, so as to facilitate tracing of the type of the source. Optionally, the type of the source includes task alarm, platform alarm, business data alarm, and other alarms.

[0092] In addition, the alarm information collected by the alarm information collector is cleaned and integrated, the core data and valid data are cleaned and classified, and the responsible persons, maintenance personnel, alarm codes, alarm topics, and alarm details are effectively distinguished.

[0093] As enterprise digitalization is in full swing, building a data middle platform is an indispensable link. During the construction, data operation and maintenance management is an urgent need. Improving operation and maintenance efficiency, reducing operation and maintenance costs, and ensuring system stability are top priorities.

[0094] The big data operation and maintenance management method and its implementation system are the life cycle of closed-loop data, covering the operation and maintenance management of data centers, involving the management and monitoring of multiple IT resources such as servers, network equipment, storage equipment, and security equipment, solving the problems of relying on manual inspections, manual configuration, and troubleshooting in the past, which are inefficient, slow to respond, and prone to errors. The data operation and maintenance management method and its implementation system provided by this application use automated tools, big data analysis, artificial intelligence, etc., to achieve real-time monitoring and early warning of IT resources in data centers, which can timely discover and solve potential problems and automatically solve problems.

[0095] Specifically, there are currently the following technical issues:

[0096] Alarm flooding: As the construction scale of data centers continues to expand, the number of business systems involved increases, the number of technical components continues to increase, and the number of business scenarios continues to expand, the number of configured monitoring tools and monitoring strategies also continues to increase, resulting in an increasing cost of operation and maintenance. In some cases, the monitoring and alarm systems may generate a large number of alarm information, many of which may be false alarms or unnecessary. This may cause operation and maintenance personnel to be unable to deal with real problems in a timely manner, or miss important alarm information.

[0097] Resource configuration management: As the number and types of resources increase, the complexity of resource configuration management will also increase. This may lead to an increase in management costs and a decrease in operation and maintenance efficiency. Essentially, there is a lack of a system for unified collection.

[0098] Poor timeliness and insufficient impact analysis: Complex alarm notifications result in the operation and maintenance personnel being unable to receive alarm information in a timely manner. There is no substantial classification and grading management of alarm information to distinguish the severity of faults or problems, resulting in the inability to meet the requirements of rapid response to business needs.

[0099] Lack of knowledge base collection and storage: a variety of technologies and knowledge, including network, storage, security, operating system, etc. Operation and maintenance personnel need to have a high level of skills to be competent for the job. For repeated fragmented alarm information, a system is needed to carry out the collection and integration of alarm phenomena, causes, and solutions.

[0100] No automation and intelligence: Currently, data center operations and maintenance mainly rely on manual analysis and experience in fault location, diagnosis and recovery, and the degree of automation and intelligence is relatively low. This results in operations and maintenance personnel spending a lot of time troubleshooting after a data failure occurs, affecting the rapid recovery of the business.

[0101] The big data-based operation and maintenance management method and its implementation system provided by the present application are aimed at the existing problems of alarm proliferation, multiple business systems, multiple technical components, multiple operation and maintenance resource management configurations, low processing efficiency, lack of automated knowledge base collection and storage, lack of automation and intelligence, etc., through a unified point-of-sale probe, the probe is added to the big data platform, data warehouse, reporting platform, zabbix, and user-defined program, and all alarm information is transmitted to the alarm information collector through the probe. The alarm processing center determines the alarm information data, cleans and integrates the data, classifies and grades it, determines non-existing abnormal alarms, and stores the relevant abnormal alarm information in the data operation and maintenance knowledge base. If there are omissions in the alarm information determination, the data is imported into the operation and maintenance management center, and the operation and maintenance personnel complete the relevant information from the aspects of platform, task, application, business application data rules, etc.

[0102] All alarm information is uniformly collected into the intelligent solution center, which performs operation and maintenance processing according to the identified alarm types, and performs automatic, semi-automatic, and fully manual processing of relevant operation and maintenance scenarios according to the maturity of the processing solutions to complete the abnormal alarm processing. Figure 7 Big data operation and maintenance alarm processing process.

[0103] For the collection of alarm information, see Figure 8 , can support message formats such as text and markdown through the http communication protocol, add relevant probes to existing monitoring programs such as big data platforms, data warehouses, reporting platforms, zabbix, and user-defined programs, and uniformly collect and summarize relevant information into the alarm information collector, and support storage in the information creation environment, and increase its receiving information and receiving source information. Figure 8 The principle of alarm information collector is given.

[0104] For more information about the alarm information processing center, see Fig. 9. According to the alarm information received, the alarm information is classified and processed according to the five levels of impact, such as P0-P4. According to the type of source, it is divided into five types, such as task alarm, platform alarm, business data alarm, and other alarms. According to the error code value of the alarm, it is determined whether the alarm has similar error information archived in the data operation and maintenance knowledge base. For abnormal alarms that are not archived in the knowledge base, the information is stored. For other alarms, the collected information is incomplete, such as false alarms, lack of information on the person responsible for alarm information processing, and inappropriate description of alarm information. The information is collected to the operation and maintenance management center and reported to the operation and maintenance personnel to modify the corresponding alarm configuration for completion and optimization. Fig. 9 Alarm processing center process.

[0105] The data operation and maintenance knowledge base mainly stores existing mature operation and maintenance processing solutions. For immature operation and maintenance processing solutions, after data collection, technical personnel will supplement the relevant processing commands and steps to determine automatic repair, semi-automatic repair, and manual processing.

[0106] The operation and maintenance management center is mainly responsible for the operation and maintenance management of false alarms, lack of information on the person responsible for alarm information processing, and inappropriate description of alarm information. The operation and maintenance management center uniformly improves the alarm information to ensure that all task anomalies, platform anomalies, business data anomalies, and application anomalies are maintained by relevant responsible persons. There is a unified entry for changing and maintaining the relevant description of the alarm information, and the relevant alarms can be cleared in a timely manner for false alarm related alarm information.

[0107] The intelligent solution center can realize a combination of automated operation and maintenance, semi-automated operation and maintenance, and manual processing.

[0108] In an automated operation and maintenance case, such as during the data collection and push process, due to changes in the source system table field attributes, similar to the insufficient length of the character type, the target table field can be automatically matched and expanded.

[0109] Semi-automated operation and maintenance: For example, during the process of data collection and push, due to changes in the field attributes of the source system table, such as missing fields in the source table, database connection failure, database password change, database table lock and other problems, intelligent guidance will be provided to prompt the operation and maintenance personnel to contact the corresponding person in charge for manual intervention.

[0110] Manual processing: When encountering a solution that cannot match the existing knowledge inventory, directly contact the operation and maintenance personnel, display the relevant imagination and logs, and prompt the operation and maintenance personnel to solve the problem. Fig.10 Intelligent solution center process.

[0111] The embodiments provided in this application, by constructing a data operation and maintenance management method and its implementation system, have at least the following technical advantages compared to the original distributed operation and maintenance management:

[0112] Standardized and standardized operation and maintenance process: By formulating detailed operation and maintenance processes and standard operating procedures (SOPs), the consistency and traceability of operation and maintenance work are ensured. Unnecessary operating errors and duplication of work are reduced, allowing operation and maintenance personnel to focus more on key tasks.

[0113] Introducing automated tools and monitoring systems: Real-time monitoring and fault warning during data operation are achieved, greatly improving the efficiency of troubleshooting and ensuring system stability.

[0114] Optimize resource management: The operation and maintenance management system can manage the enterprise's IT resources in an all-round way. By predicting the trend and rules of resource use, it can automatically adjust the service quality and reduce the risk of system crashes. Automated execution of operations (such as log management, process approval, server backup, etc.) reduces the enterprise's operation and maintenance costs and improves efficiency.

[0115] Strengthen security: Security inspections and emergency response mechanisms can promptly detect and respond to security threats, ensuring the physical and network security of the data center. Permission management and log auditing functions can strictly control and supervise the operations of maintenance personnel to prevent internal leaks and misoperations.

[0116] Provide decision support: The data analysis function can provide comprehensive data support for enterprises, help enterprises understand the operation status and problems of the system, and provide a scientific basis for decision-making. The report analysis function can intuitively display operation and maintenance data, helping management to better understand the effect of operation and maintenance work.

[0117] In summary, compared with existing technologies, the big data operation and maintenance management method and its implementation system have many advantages and effects, such as significantly improving operation and maintenance efficiency, ensuring system stability, optimizing resource management, strengthening security, providing decision support and simplifying operation and maintenance processes. These advantages and effects not only improve the IT operation and maintenance management level of enterprises, but also provide strong technical support for the development of enterprises.

[0118] Because the big data operation and maintenance management method and its implementation system mainly integrate, clean and provide services for the monitoring information in the original data systems, without changing the internal management mechanism of the original application system, for example, without using the big data operation and maintenance management method and its implementation system, it is necessary to create monitoring scripts in the internal monitoring system of each big data system and send them to the enterprise WeChat group. The operation and maintenance personnel customize the enterprise WeChat group with their own rules to monitor the message observation, and then log in to the corresponding management platform for maintenance work according to the event problem. For the problem handling method, judging and analyzing the problem based on the mature experience in the past may lack the accumulation and inheritance of effective problem handling, resulting in a longer time cycle for problem handling, but it still fundamentally solves the problem.

[0119] The alarm information collector of this application supports http protocol message transmission, and the message transmission supports text protocol format and Markdown protocol format. Users only need to add relevant probe codes to the originally developed monitoring program to realize real-time collection and archiving of monitoring information.

[0120] The alarm processing center of this application: cleans and integrates the alarm information collected by the collector, cleans and classifies the core data + valid data, and effectively distinguishes the responsible person, maintenance personnel, alarm code, alarm subject, and alarm details.

[0121] The intelligent operation and maintenance center of this application: Based on the alarm codes collected by the alarm information integration center, for routine problems such as task re-running, real-time task launching, and insufficient character field length, the center can automatically repair related tasks without manual intervention. For operations that require manual intervention, the log message prompts are simplified, such as database network failure, incorrect passwords, etc. The log information printed by multiple platforms and multiple components is often different. After information cleaning and integration, the problem is further identified, and the operation and maintenance personnel are prompted with the final solution steps that need to be coordinated.

[0122] In some embodiments, the method also includes collecting information on the physical devices, platform processes, and running tasks under its jurisdiction, dividing the collected information into alarm levels based on the docked application system and a preset division method, and distributing alarm information of different levels separately to match corresponding processing methods.

[0123] In some embodiments, the method also includes: matching the corresponding type of processing method based on the task type corresponding to the alarm information; the task types include data collection tasks, data processing tasks, data push tasks, and application system customized tasks; taking the same type of processing method for the task collection task and the data push task, locking the abnormal field to automatically generate expansion statements and execute automatic re-running tasks; for the data processing task, calling the system resource allocation parameters to perform elastic scaling resource processing.

[0124] In some embodiments, the method further includes: storing the alarm information and the corresponding processing method in a large model, and performing learning and training of the large model so that the large model has similar error recognition and analysis functions.

[0125] Specifically, the physical equipment, platform processes, and running tasks under jurisdiction are collected in a unified manner, and the corresponding alarm levels are divided according to the security level and impact analysis required by the docked application system and the company's information system. For example, it can be divided into three levels in total, corresponding to P0, P1, and P2. For applications with different levels of requirements, the processing delay and alarm method are different. For P0-level alarms, direct remote automatic dialing and sending corresponding WeChat messages to the corresponding person in charge and related personnel are required to respond and feedback within 30 minutes. At the same time, the corresponding task emergency manual is required. For P1-level alarms, emails and WeChat notifications are sent, requiring personnel to complete the processing and feedback within 6 hours. For P2-level alarms, email notifications are sent, requiring personnel to respond and resolve within 12 hours.

[0126] Under the unified collection of physical devices, platform processes, and running tasks under its jurisdiction, alarm information for different tasks is distributed. For damage or abnormalities of physical devices, such as common hard disk failures and memory failures, the alarm notifies the corresponding device administrator of the corresponding device failure and feedbacks the corresponding machine model, style and other information to facilitate the device administrator to replace the equipment. For abnormal running processes in the system, an automatic recovery mechanism for some processes is configured. When system resources meet the conditions, the alarm is issued and the automatic restart service is restored according to the pre-set automatic restart command. If the system's automated intervention method cannot solve the problem, contact the corresponding operation and maintenance personnel for processing.

[0127] The tasks of various granularities running in the system are mainly divided into four categories: data collection, data processing, data push, and application system customized tasks. The exception handling structures of data collection and data push are very similar. When processing, they are classified into the same category. They mainly face the common problem of source system field expansion and target system not expanding, which leads to errors. For this type of situation, the error information of the task log is captured, the corresponding exception field is locked, and the corresponding expansion statement is automatically generated and executed according to the exception handling plan. After the execution is completed, the task is automatically re-run. Because the corresponding database cannot be connected due to network fluctuations, the probe program first detects whether the corresponding network is restored, and then re-runs the task. For data processing tasks, it may be due to the uneven distribution of platform resources, resulting in resource-limited errors. The system-related resource allocation parameters are mobilized to perform reasonable elastic scaling of resources.

[0128] At the same time, all task error information is uniformly collected and stored in the data operation and maintenance knowledge base, and connected to the big model to facilitate subsequent knowledge retrieval and use the AI ​​reasoning capabilities of the big model to achieve intelligent analysis of similar errors.

[0129] Traditional alarm information can be collected uniformly through a unified alarm mechanism. However, due to the huge amount of collected logs, users have increasingly strong requirements for comprehensive observability of the operation of each platform. A system is needed to further converge the alarm information, associate multiple alarm information caused by the same problem, and integrate similar error information, thereby further reducing the amount of alarm processing.

[0130] Through the integration of large-model AI algorithms, data operation and maintenance management has changed from passive response to active prediction, realizing the full process automation of data collection, analysis, and intelligent decision-making for data operation and maintenance.

[0131] Users only need to express their needs for log data analysis, and the system can automatically complete data retrieval and generate analysis charts in massive log data. At the same time, the system independently analyzes massive operation and maintenance data, intelligently identifies potential operation and maintenance problems, and provides data-based insights and suggestions, greatly improving data processing efficiency, reducing the dependence on the professional skills of operation and maintenance personnel, and making operation and maintenance decisions more scientific and efficient.

[0132] like Fig.12 As shown, the present application also provides an alarm information processing system, the system comprising:

[0133] The acquisition module 1201 is used to acquire at least one alarm information;

[0134] The parsing module 1202 is used to parse the alarm information to obtain at least one of the category information, source information, whether the alarm information is archived information, or content status information of the alarm information;

[0135] The processing module 1203 is used to determine a processing method for the alarm information in response to at least one of the category information, the source information, whether the alarm information is archived information, or the content status information of the alarm information, and process the alarm information based on the determined processing method.

[0136] See also Figure 5 , Figure 5 It is a schematic diagram of the structural composition of an alarm information processing system provided in another embodiment of the present application.

[0137] like Figure 5 As shown, an operation and maintenance management system for alarm information, the alarm information processing system includes:

[0138] An acquisition module 21, used to acquire at least one alarm information;

[0139] A status module 22, configured to determine a content status based on the warning information;

[0140] A type module 23, configured to determine an alarm type based on the alarm information if the content status is a complete status;

[0141] The operation and maintenance module 24 is used to trigger a corresponding processing method based on the alarm type, and the processing method includes at least one of automatic processing, semi-automatic processing and human-computer interaction processing.

[0142] Example

[0143] See also Figure 6 , refer to the following Figure 6 The electronic device 40 according to this embodiment of the present application is described. Figure 6 The electronic device 40 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0144] like Figure 6 As shown, the electronic device 40 is in the form of a general computing device. The components of the electronic device 40 may include but are not limited to: at least one processing unit 41, at least one storage unit 42, and a bus 43 connecting different system components (including the storage unit 42 and the processing unit 41).

[0145] The storage unit stores program codes, which can be executed by the processing unit 41, so that the processing unit 41 executes the steps described in the above “Embodiment Method” section of this specification according to various exemplary implementations of the present application.

[0146] The storage unit 42 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 421 and / or a cache memory unit 422 , and may further include a read-only memory unit (ROM) 423 .

[0147] The storage unit 42 may also include a program / utility 424 having a set (at least one) of program modules 425, such program modules 425 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0148] Bus 43 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0149] The electronic device 40 may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 40, and / or any device that enables the electronic device 40 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 44. Furthermore, the electronic device 40 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 45. Figure 6 As shown, the network adapter 45 communicates with other modules of the electronic device 40 via the bus 43. It should be understood that although Figure 6 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup planning systems.

[0150] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0151] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc. In addition, it stores computer program instructions, and when the computer program instructions are executed by a computer, the computer executes the above method.

[0152] In addition, the above describes in detail the alarm information processing method and system provided in the embodiments of the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for processing alarm information, characterized in that: include: Obtain at least one warning information; Parsing the warning information to obtain at least one of category information, source information, whether the warning information is archived information, or content status information of the warning information; In response to at least one of the category information, the source information, whether the information is archived or the content status information of the alarm information, a processing method for the alarm information is determined, and the alarm information is processed based on the determined processing method.

2. The method according to claim 1, characterized in that The method further comprises: Determining the category information of the warning information based on the impact level of the warning information; Determining the source information of the alarm information based on a source platform of the alarm information; Determining whether the warning information is archived information based on the coding information or the similarity recognition algorithm of the warning information; Based on the content identification of the alarm information, it is determined whether the content status information of the alarm information is complete alarm information.

3. The method according to claim 2, characterized in that The content status information of the warning information includes whether the warning information is integrity information; In response to the content status of the alarm information being a complete status, matching a corresponding alarm information processing method based on the alarm information in the complete status, and processing the alarm information based on the matched processing method; In response to the content status of the alarm information being in an incomplete state, the alarm information is completed to obtain the complete alarm information, and the corresponding alarm information processing method is continued to be matched based on the alarm information in the complete state, and the alarm information is processed based on the matched processing method.

4. The method according to claim 2, characterized in that The method further comprises: In response to the alarm information being archived information, processing the current alarm information based on a processing method for archived alarm information; In response to the alarm information not being archived information, a corresponding processing method is matched based on the current alarm information, the current alarm information is processed based on the latest matched processing method, and the current alarm information and processing method are archived.

5. The method according to claim 1, characterized in that The method further comprises: The processing method of the alarm information includes one or more of automatic processing, semi-automatic processing and human-computer interaction processing.

6. The method according to claim 1, characterized in that The method further comprises: Alarm information is collected based on multiple information platforms, wherein each of the alarm information platforms is associated with an alarm information collector, and the alarm information is transmitted based on a communication protocol, wherein the alarm information collected by each of the information platforms is concentrated in the alarm information collector, each of the information platforms is configured with a corresponding embedding probe, and the alarm information is automatically archived based on the collection and triggering of the embedding probe.

7. The method according to claim 1, characterized in that Collect information on the physical devices, platform processes, and running tasks under jurisdiction, divide the collected information into alarm levels based on the docked application system and the preset division method, and distribute the alarm information of different levels separately to match the corresponding processing methods.

8. The method according to claim 1, characterized in that The method further includes: matching a processing method of a corresponding type based on the task type corresponding to the alarm information; The task types include data collection tasks, data processing tasks, data push tasks, and application system customization tasks; The same type of processing is adopted for the task collection task and the data push task, the abnormal field is locked, the expansion statement is automatically generated, and the automatic re-run task is executed; For the data processing task, the system resource allocation parameters are called to perform elastic resource processing.

9. The method according to claim 1, characterized in that: The method also includes: storing the alarm information and the corresponding processing method in a large model, and performing learning and training on the large model so that the large model has a similar error recognition and analysis function.

10. An alarm information processing system, characterized in that: The system comprises: An acquisition module, used to acquire at least one alarm information; A parsing module, used to parse the alarm information to obtain at least one of category information, source information, whether the alarm information is archived information, or content status information of the alarm information; A processing module is used to determine a processing method for the alarm information in response to at least one of the category information, the source information, whether the alarm information is archived information, or the content status information of the alarm information, and process the alarm information based on the determined processing method.

Images