Alarm correlation analysis method and device and computer equipment

Abstract

The embodiment of the invention provides an alarm correlation analysis method and device and computer equipment. The method comprises the steps of obtaining a target alarm according to a preset sliding time window; projecting the target alarm on each predetermined dimension to obtain a feature value of the target alarm on each dimension; performing screening convergence on the target alarms according to the characteristic values to obtain an associated alarm set; and determining a root cause alarm according to the main dimension of each associated alarm in the associated alarm set. According to the method, the target alarms with the incidence relation can be determined through the feature values of the target alarms in all dimensions, and the incidence alarm set is obtained; according to the main dimension to which the alarm belongs, the root cause alarm in the associated alarm set is positioned, so that the identification and positioning of the associated alarm and the root cause alarm from a huge number of alarms are realized, and the interference of irrelevant and redundant alarms can be reduced; operation and maintenance management and fault analysis are facilitated, the time consumed by operation and maintenance personnel for fault processing is shortened, and the adverse effect of faults on services is reduced.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to an alarm correlation analysis method, apparatus, and computer equipment. Background Art

[0002] As the system architecture becomes more complex and diverse, the number of alarms on the unified alarm platform in the field of operation and maintenance has become very large. In order to reduce the impact of faults on the business and shorten the time spent on fault handling, it is necessary to identify the same-source and related alarms from the massive alarms.

[0003] In the existing technical solutions, the association between alarms is determined by identifying the alarm object and marking the instance object for each alarm, and then calling the background configuration management platform and consuming the association between instance objects. However, the prerequisite for the implementation of the existing solution is to locate the instance object of the alarm object; but due to various reasons, the alarm object and the instance object in the configuration management are usually not one-to-one corresponding, so that when the solution is actually applied, an alarm may correspond to zero, one or more instance objects. In addition, the association between different instance objects in the configuration management is usually a "deployment" relationship, for example, the database is deployed on the host, the host is deployed on a port of the switch, and so on. Such associations are not rich enough and have limited effectiveness in actual production. The associations in the real environment may also be other relationships besides "deployment", and this situation cannot be identified by the instance object association in the existing solution. This makes the existing fault analysis incomplete and inaccurate.

[0004] In view of this, the embodiments of this specification aim to provide an alarm correlation analysis method, apparatus and computer device. Summary of the invention

[0005] In view of the above problems in the prior art, the purpose of the embodiments of this specification is to provide an alarm correlation analysis method, apparatus and computer device to solve the problem in the prior art that it is difficult to identify related alarms from a large number of alarms and to identify root cause alarms from related alarms.

[0006] In order to solve the above technical problems, the specific technical solutions of the embodiments of this specification are as follows:

[0007] In a first aspect, an embodiment of the present specification provides an alarm correlation analysis method, including:

[0008] Obtain target alarms according to the preset sliding time window;

[0009] Projecting the target alarm onto each predetermined dimension to obtain a characteristic value of the target alarm on each dimension;

[0010] Filter and converge the target alarms according to the characteristic values ​​to obtain a set of associated alarms;

[0011] According to the main dimension of each associated alarm in the associated alarm set, a root cause alarm in the associated alarm set is determined.

[0012] Specifically, according to the preset sliding time window, the target alarm is obtained as follows:

[0013] Obtaining a number of target alarms according to the start time node and the sliding time window;

[0014] The target alarm with the latest occurrence time among the plurality of target alarms is used as a marked target alarm, the start time node is updated with the occurrence time of the marked target alarm, and it is determined whether other alarms occur within a sliding time window after the updated start time node;

[0015] If so, it is determined that the other alarm is the target alarm, and the previous step is repeated until no other alarm occurs in the sliding time window after the updated start time node.

[0016] Further, the target alarm is screened and converged according to the characteristic value to obtain a set of associated alarms, which is:

[0017] Taking any one of the target alarms as an alarm to be associated;

[0018] Determine whether there is a dimension with the same characteristic value between the alarm to be associated and any alarm among the target alarms except the alarm to be associated;

[0019] If so, it is determined that the alarm to be associated is an associated alarm, and the set consisting of the associated alarms is the associated alarm set.

[0020] Specifically, determining the root cause alarm in the associated alarm set according to the main dimension of each associated alarm in the associated alarm set includes:

[0021] Sorting each associated alarm in the associated alarm set according to the level of its main dimension;

[0022] In the sorting results, the associated alarm with the lowest level in the main dimension is taken as the root cause alarm.

[0023] Further, determining the root cause alarm in the associated alarm set includes:

[0024] Determine whether the number of associated alarms with the lowest level of the main dimension in the sorting result is more than one;

[0025] If so, the earliest occurrence time of the associated alarms with the lowest primary dimension level is determined as the root cause alarm.

[0026] Preferably, the method further comprises:

[0027] Calculating the correlation between the root cause alarm and other associated alarms in the associated alarm set according to the preset weights of the dimensions;

[0028] The associated alarm whose correlation degree meets the preset correlation degree condition is associated with the root cause alarm and outputted.

[0029] Preferably, the method further comprises:

[0030] According to the preset weights of the various dimensions, collecting other associated alarms in the associated alarm set that have the same characteristic value as the root cause alarm in the dimension that meets the preset weight threshold;

[0031] Other associated alarms are associated with the root cause alarm and output.

[0032] In a second aspect, an embodiment of the present specification provides an alarm correlation analysis device, including:

[0033] An acquisition module is used to obtain target alarms according to a preset sliding time window;

[0034] A projection module, used for projecting the target warning onto each predetermined dimension to obtain a characteristic value of the target warning on each dimension;

[0035] A convergence module, used for screening and converging the target alarm according to the characteristic value to obtain a set of associated alarms;

[0036] The determination module is used to determine the root cause alarm in the associated alarm set according to the main dimension of each associated alarm in the associated alarm set.

[0037] In a third aspect, an embodiment of the present specification provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method provided by the above technical solution when executing the computer program.

[0038] In a fourth aspect, an embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method provided by the above technical solution is implemented.

[0039] In a fifth aspect, an embodiment of the present specification provides a computer program product, comprising at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method provided by the above technical solution.

[0040] By adopting the above technical scheme, an alarm correlation analysis method, device and computer equipment provided in the embodiments of this specification obtain the characteristic values ​​of the target alarm in each dimension by projection, and then determine the target alarm with a correlation relationship to obtain a set of correlated alarms; then locate the root cause alarm in the set of correlated alarms according to the main dimension to which the alarm belongs, thereby realizing the identification and location of correlated alarms and root cause alarms from a large number of alarms, which can reduce the interference of irrelevant and redundant alarms, facilitate operation and maintenance management and fault analysis, shorten the time spent by operation and maintenance personnel on fault handling, and reduce the adverse effects of faults on the business. In addition, there is no need to improve the existing configuration management platform, and the cost is low; the identification and location of correlated alarms and root cause alarms are simple and convenient.

[0041] In order to make the above and other purposes, features and advantages of the embodiments of this specification more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A schematic diagram of the steps of an alarm correlation analysis provided by an embodiment of this specification is shown;

[0044] Figure 2 A schematic diagram showing how to project the target warning onto various dimensions to obtain the corresponding eigenvalues;

[0045] Figure 3 A schematic diagram showing the steps of obtaining a target alarm according to a preset sliding time window is shown;

[0046] Figure 4 A schematic diagram of determining associated alarms is shown;

[0047] Figure 5 A schematic diagram of the structure of an alarm correlation analysis device provided in an embodiment of this specification is shown;

[0048] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of this specification is shown.

[0049] Description of the accompanying symbols:

[0050] 51. Get module;

[0051] 52. Projection module;

[0052] 53. Convergence module;

[0053] 54. Determine the module;

[0054] 602. Computer equipment;

[0055] 604, processor;

[0056] 606. Memory;

[0057] 608, driving mechanism;

[0058] 610, input / output module;

[0059] 612. Input devices;

[0060] 614. Output devices;

[0061] 616. Presentation equipment;

[0062] 618. Graphical user interface;

[0063] 620, network interface;

[0064] 622, communication link;

[0065] 624. Communication bus. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0067] It should be noted that the terms "first", "second", etc. in this specification and claims and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this specification described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0068] The embodiments of this specification provide an alarm correlation analysis method, apparatus, and computer device to solve the problem in the prior art that it is difficult to identify correlated alarms from a large number of alarms and to identify root cause alarms from correlated alarms. Figure 1 This is a step diagram of an alarm association method provided in an embodiment of this specification. This specification provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative work. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only order of execution. When the actual system or device product is executed, it can be executed in the order of the method shown in the embodiment or the drawings or in parallel. Specifically, Figure 1 As shown, the method may include:

[0069] S110: Obtain a target alarm according to a preset sliding time window.

[0070] S120: Projecting the target alarm onto each predetermined dimension to obtain a characteristic value of the target alarm on each dimension.

[0071] In the embodiments of this specification, the dimensions can be determined according to the technical field of actual application. For example, in the field of computer technology involved in the embodiments of this specification, it can include one or more dimensions including host name, host IP, switch name, VLAN (Virtual Local Area Network) name, SAN (Storage Area Network) switch name, NAS (Network Attached Storage) storage volume name, service system name, Virtual Server address, Pool name, IP address set in the Pool, network device name, cluster name, instance name, library name, tenant name, PDB (Pluggable Database) name, network line name, line number, network device name, Pool name, etc., and may also include other dimensions not listed.

[0072] Figure 2 FIG. 1 shows a schematic diagram of projecting target warnings onto various dimensions to obtain corresponding eigenvalues. Figure 2 As shown, it is predetermined that the target alarm A includes three dimensions, namely, dimension V, dimension W and dimension H; the characteristic values ​​of the target alarm in these three dimensions are a, a1, and a2 respectively, and the characteristic values ​​of the target alarm A can be represented by a vector as A[a, a1, a2].

[0073] It should be noted that there can be multiple target alarms, and the dimensions of the multiple target alarms are the same. In practical applications, the dimensions of the target alarms can be fewer or more, so there is a target alarm X with n dimensions, and its characteristic value can be expressed as X[x, x1, x2, ... xn-1].

[0074] S130: Screening and converging the target alarms according to the characteristic values ​​to obtain a set of associated alarms.

[0075] S140: Determine the root cause alarm in the associated alarm set according to the main dimension of each associated alarm in the associated alarm set.

[0076] The main dimension of each target alarm can be obtained through the relevant fields of the alarm information. For example, if a target alarm is a host alarm, its main dimension can be the host name or the host IP. Through the feature value, the interrelated target alarms are screened and converged into the related alarm set. Furthermore, the root cause alarm is determined from them.

[0077] An alarm correlation analysis method provided in an embodiment of this specification uses dimensional projection to obtain the characteristic values ​​of target alarms to determine the target alarms that are correlated with each other, and obtain a set of correlated alarms; then, based on the main dimension of the field where the alarm is located, the root cause alarm in the set of correlated alarms is located. The identification and location of correlated alarms and root cause alarms from a large number of alarms is achieved, which can reduce the interference of irrelevant and redundant alarms, and is beneficial to operation and maintenance management and fault analysis. In addition, this method does not require changing the complexity of the existing configuration management platform data, does not require improving the existing configuration management platform, and is low-cost; the identification and location of correlated alarms and root cause alarms are simple and convenient.

[0078] like Figure 3 As shown, in the embodiment of this specification, step S110: obtaining a target alarm according to a preset sliding time window can be further performed as follows:

[0079] S310: Acquire several target alarms according to the start time node and the sliding time window.

[0080] Specifically, a predetermined time node can be used as the start time node, or the occurrence time of a certain alarm can be used as the start time node, that is, the collection of target alarms starts from the start time node. Exemplarily, the preset sliding time window can be set to 15 minutes. That is, all alarms occurring within 15 minutes starting from the start time node are obtained as target alarms. Here, the start time node can be preset according to actual application needs.

[0081] S320: taking a target alarm with the latest occurrence time among the plurality of target alarms as a marked target alarm, and updating the start time node with the occurrence time of the marked target alarm.

[0082] S330: Determine whether other alarms occur within the sliding time window after the updated start time node.

[0083] S340: If yes, determine that the other alarm is a target alarm, and repeat the updating step.

[0084] That is, when other alarms are generated, it is determined that these newly generated other alarms are also target alarms, and the one with the latest occurrence time among these newly generated other alarms is marked as the target alarm (i.e., repeat the above step S320); the start time node is updated using the start time node of the marked target alarm (i.e., repeat the above step S330), that is, the sliding time window slides to the occurrence time of the marked target alarm.

[0085] S350: If not, then summarize the target alarms obtained in all previous sliding time windows.

[0086] For example, if N target alarms are obtained within 15 minutes starting from the preset start time node, the latest one among the N target alarms is used as the marked target alarm, and the occurrence time of the marked target alarm is used as the new start time node; the alarms that occur within 15 minutes starting from the new start time node are also used as target alarms. Furthermore, the latest one among the newly obtained target alarms is used as the new marked target alarm and the start time node is updated with its occurrence time until no other alarms occur in the sliding time window after a new start time node.

[0087] Alarms occurring in the same sliding time window or in adjacent sliding time windows are more likely to be related to each other; while alarms occurring at intervals of one or more sliding time windows are more likely to be unrelated to each other. In the embodiments of this specification, obtaining target alarms by means of sliding time windows is conducive to narrowing the determination scope of associated alarms, reducing the subsequent workload of determining associated alarms from target alarms, and improving the accuracy of determining associated alarms.

[0088] Specifically, in step S120, the characteristic values ​​of the target alarm in each dimension can be determined by the following steps:

[0089] Determine a main dimension of the target alarm and a first eigenvalue corresponding to the main dimension;

[0090] According to the first characteristic value and each other dimension of the target alarm, a second characteristic value of the target alarm corresponding to each other dimension is determined.

[0091] Exemplarily, a target alarm is a host alarm, and its main dimension is determined to be the host name (or host IP), and its first characteristic value in the main dimension is obtained, for example, the host name is a1; then, according to the host name a1, the second characteristic values ​​of the target alarm in various other dimensions are obtained from the relevant model of CMDB (Configuration Management Database), such as the second characteristic values ​​of the host machine name, access switch, SAN storage, database cluster, database instance, and so on.

[0092] Further, in the embodiment of this specification, step S130: screening and converging the target alarm according to the characteristic value to obtain the associated alarm set can be further:

[0093] Taking any one of the target alarms as an alarm to be associated;

[0094] Determine whether there is a dimension with the same characteristic value between the alarm to be associated and any alarm among the target alarms except the alarm to be associated;

[0095] If so, it is determined that the alarm to be associated is an associated alarm, and the set consisting of the associated alarms is the associated alarm set.

[0096] Figure 4 FIG. 1 shows a schematic diagram of determining associated alarms. Figure 4 As shown, the horizontal axis is the dimension of the target alarm, and the vertical axis is the different alarm objects. That is, in the figure, target alarm 6 has an eigenvalue A in the first dimension, an eigenvalue C in the third dimension, and an eigenvalue G in the fifth dimension (the eigenvalues ​​in the second dimension, the fourth dimension, and the sixth dimension are all empty). It can be seen that target alarm 6 and target alarm 4 have the same eigenvalue A in the first dimension, that is, there is a dimension with the same eigenvalue (first dimension); then target alarm 6 and target alarm 4 are associated.

[0097] Similarly, target alarm 5 and target alarm 4 have the same eigenvalue B in the second dimension, so target alarm 5 is associated with target alarm 4; and target alarm 6 and target alarm 2 have the same eigenvalue G in the fifth dimension, so target alarm 6 is associated with target alarm 2. Finally, target alarms 2, 4, 5, and 6 constitute an associated alarm set.

[0098] That is to say, in the embodiments of this specification, the alarm association determined based on the dimensional projection is transitive, that is, two alarms have the same characteristic value in a certain dimension, and one of the two alarms has the same characteristic value as the other alarm in another dimension. Then, through the transmission of the association relationship, it can be considered that there is a correlation between the three alarms. In this way, the potential correlation between alarms can be captured simply and conveniently, which is beneficial to the subsequent analysis of faults. In order to increase the correlation ratio of massive alarms, in actual application, the projection dimension can be increased as much as possible to increase the probability of association between alarms having the same characteristic value in a certain dimension.

[0099] Further, in the embodiment of the present specification, step S140: determining the root cause alarm in the associated alarm set according to the main dimension of each associated alarm in the associated alarm set may further include:

[0100] Sorting each associated alarm in the associated alarm set according to the level of its main dimension;

[0101] That is, the associated alarms are sorted according to the categories of the main dimension, from low to high and from bottom to top.

[0102] In the sorting results, the associated alarm with the lowest level in the main dimension is taken as the root cause alarm.

[0103] Considering that when there are both upper-layer alarms and lower-layer alarms, the lower-layer alarms often affect or cause the upper-layer alarms, therefore, in the embodiment of this specification, the associated alarm at the lowest level of the main dimension is determined as the root cause alarm.

[0104] Exemplarily, the associated alarm set includes host alarm A whose main dimension is host name, database alarm B whose main dimension is database cluster, load balancing alarm C whose main dimension is pool name, business alarm D whose main dimension is a certain transaction indicator, and host hardware alarm E whose main dimension is CPU occupancy. Among them, the host hardware level corresponding to the hardware name is the lowest and is the lowest level alarm. Therefore, host hardware alarm E is determined to be the root cause alarm in this associated alarm set. Generally, the levels of host hardware, host, database, middleware (load balancing), and business are arranged from low to high. When there is no associated alarm whose main dimension belongs to the host hardware level in the associated alarm set, the associated alarm whose main dimension belongs to the host level is taken as the root cause alarm.

[0105] In the embodiment of the present specification, determining the root cause alarm in the associated alarm set further includes:

[0106] Determine whether the number of associated alarms with the lowest level of the main dimension in the sorting result is more than one;

[0107] If so, the earliest occurrence time of the associated alarms with the lowest primary dimension level is determined as the root cause alarm.

[0108] For example, if, in addition to the host machine hardware alarm E with the main dimension of CPU occupancy, there is also a host machine hardware alarm F with the main dimension of memory occupancy and a host machine hardware alarm G with the main dimension of I / O, then the earliest occurrence time of alarm E, alarm F and alarm G is determined as the root cause alarm.

[0109] Taking into account that when there are both earlier alarms and later alarms, the earlier alarm often affects or causes the later alarm. Therefore, in the embodiment of this specification, the earliest occurring alarm among the lowest-level associated alarms corresponding to the main dimension is determined as the root cause alarm, which greatly improves the efficiency of identifying and determining the root cause alarm.

[0110] Furthermore, the alarm correlation analysis method provided in the embodiment of this specification also includes:

[0111] Calculating the correlation between the root cause alarm and other associated alarms in the associated alarm set according to the preset weights of the dimensions;

[0112] The associated alarm whose correlation degree meets the preset correlation degree condition is associated with the root cause alarm and outputted.

[0113] Between two alarms, when there are many dimensions, different dimensions contribute differently to the correlation between the alarms. The dimension with a higher weight contributes more to the correlation, that is, if two alarms have the same eigenvalue in the dimension with a higher weight, it indicates that the two alarms have a strong correlation; the dimension with a lower weight contributes less to the correlation, that is, if two alarms have the same eigenvalue in the dimension with a lower weight, it indicates that the two alarms are weakly correlated.

[0114] By calculating the correlation between two related alarms, the related alarm set can be further screened and converged, and the related alarms with a strong correlation with the root cause alarm can be extracted, output together with the root cause alarm, and sent and displayed to relevant operation and maintenance personnel so that they can formulate operation and maintenance plans.

[0115] The correlation can be calculated using the following formula:

[0116]

[0117] Among them, ρ x,y is the correlation degree between the associated alarm x and the associated alarm y, n is the number of dimensions, e i is the weight of the i-th dimension; F i It is related to the characteristic value of the i-th dimension of the associated alarm x and the characteristic value of the i-th dimension of the associated alarm y. When the characteristic values ​​of the associated alarm x and the associated alarm y in the i-th dimension are the same, F i =1; when the eigenvalues ​​of the associated alarm x and the associated alarm y in the i-th dimension are different, F i =0.

[0118] In some other feasible embodiments, the dimensions may be combined to calculate the correlation between two associated alarms according to actual application requirements, that is, weighted calculation is performed on only some of the dimensions.

[0119] In some other feasible embodiments, the method may further include:

[0120] According to the preset weights of the dimensions, collecting other associated alarms in the associated alarm set that have the same characteristic value as the root cause alarm in the dimension that meets the preset weight threshold;

[0121] Other associated alarms are associated with the root cause alarm and output.

[0122] Exemplarily, if the host hardware alarm E is determined to be the root cause alarm in the associated alarm set, and the host hardware alarm E has a characteristic value e in the first dimension (for example, CPU occupancy), a characteristic value e1 in the second dimension, a characteristic value e2 in the third dimension, and so on, then the characteristic value of the host hardware alarm E can be expressed as E[e, e1, e2, ...en-1].

[0123] If it is determined according to the predetermined weights that the weights of the first dimension and the second dimension in each dimension are higher and the preset weight threshold condition is met, then other associated alarms having the same characteristic value as the host hardware alarm E in the first dimension, such as alarms P and Q, and other alarms having the same characteristic value as the host hardware alarm E in the second dimension, such as alarms P and R, are selected from the associated alarm set;

[0124] These associated alarms P, Q and R are associated with the root cause alarm host hardware alarm E and output.

[0125] Furthermore, the dimensions can also be combined. Taking the above example as an example, other alarms that have the same characteristic value as the host hardware alarm E in the first dimension and the same characteristic value as the host hardware alarm E in the second dimension can be selected from the associated alarm set; the collected associated alarms are alarms P, and the alarm P is associated with the root cause alarm host hardware alarm E for output.

[0126] That is to say, before associating and outputting other associated alarms with the root cause alarm, an intersection operation may be performed on other collected alarms.

[0127] In some other feasible embodiments, the method may further include:

[0128] Calculating the number of dimensions having the same characteristic value between the root cause alarm and other associated alarms in the associated alarm set;

[0129] The associated alarms whose quantity meets a preset quantity condition are associated with the root cause alarm and outputted.

[0130] If the number of dimensions with the same characteristic value between two alarms is larger, the possibility that the two alarms have a high correlation is higher; otherwise, the possibility that the two alarms have a high correlation is lower. The associated alarms in the associated alarm set that meet the preset number condition (for example, the preset number condition may be that the number of dimensions with the same characteristic value is greater than 1) are output together with the root cause alarm to the relevant operation and maintenance personnel, so that the operation and maintenance personnel can formulate an operation and maintenance plan.

[0131] An alarm correlation analysis method provided in the embodiments of this specification can identify and confirm the correlation between alarms, and locate the root cause alarms in the associated alarms based on the dimensional field to which the alarms belong and the time when the alarms occur. The method is convenient and has high accuracy, which is beneficial to shortening the time required for operation and maintenance personnel to handle faults and reducing the adverse effects of faults on the business.

[0132] Based on the above-mentioned alarm correlation analysis method, the embodiment of this specification also provides an alarm correlation analysis device. The device may include a system (including a distributed system), software (application), module, component, server, client, etc. using the method described in the embodiment of this specification and a device combined with necessary implementation hardware. Based on the same innovative concept, the device in one or more embodiments provided in the embodiment of this specification is as described in the following embodiments. Since the implementation scheme and method of the device to solve the problem are similar, the implementation of the specific device in the embodiment of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. As used below, the term "unit" or "module" can implement a combination of software and / or hardware for predetermined functions. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0133] like Figure 5 As shown, an alarm correlation analysis device provided in an embodiment of this specification includes:

[0134] An acquisition module 51 is used to acquire a target alarm according to a preset sliding time window;

[0135] A projection module 52, configured to project the target warning onto each predetermined dimension to obtain a characteristic value of the target warning on each dimension;

[0136] A convergence module 53, configured to filter and converge the target alarms according to the characteristic values ​​to obtain a set of associated alarms;

[0137] The determination module 54 is used to determine the root cause alarm in the associated alarm set according to the main dimension of each associated alarm in the associated alarm set.

[0138] The beneficial effects obtained by the device provided in the embodiments of this specification are consistent with the beneficial effects obtained by the above method and will not be repeated here.

[0139] like Figure 6As shown, a computer device provided in an embodiment of this specification is provided. The alarm association analysis device in this specification can be a computer device in this embodiment, and the above method of this specification is executed. The computer device 602 may include one or more processors 604, such as one or more central processing units (CPUs), and each processing unit may implement one or more hardware threads. The computer device 602 may also include any memory 606, which is used to store any kind of information such as code, settings, data, etc. Non-limiting, for example, the memory 606 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 602. In one case, when the processor 604 executes an associated instruction stored in any memory or a combination of memories, the computer device 602 can perform any operation of the associated instruction. The computer device 602 also includes one or more drive mechanisms 608 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0140] The computer device 602 may also include an input / output module 610 (I / O) for receiving various inputs (via input devices 612) and for providing various outputs (via output devices 614). A specific output mechanism may include a presentation device 616 and an associated graphical user interface (GUI) 618. In other embodiments, the input / output module 610 (I / O), input device 612, and output device 614 may not be included, and the computer device 602 may be used as a computer device in a network. The computer device 602 may also include one or more network interfaces 620 for exchanging data with other devices via one or more communication links 622. One or more communication buses 624 couple the components described above together.

[0141] The communication link 622 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 622 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0142] Corresponding to Figure 1 and Figure 3 In addition to the method shown, an embodiment of the specification also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are executed.

[0143] The embodiment of the present specification also provides a computer-readable instruction, wherein when the processor executes the instruction, the program therein causes the processor to execute the following Figure 1 and Figure 3 method.

[0144] The embodiments of the present specification also provide a computer program product, including at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the following Figure 1 and Figure 3 method.

[0145] It should be understood that in the various embodiments of this specification, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0146] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this specification generally indicates that the associated objects before and after are in an "or" relationship.

[0147] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this specification.

[0148] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0149] In the several embodiments provided in this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this specification.

[0151] In addition, each functional unit in each embodiment of this specification may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0152] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this specification is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of this specification. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0153] Specific embodiments are used in this specification to illustrate the principles and implementation methods of this specification. The description of the above embodiments is only used to help understand the methods and core ideas of this specification. At the same time, for those skilled in the art, according to the ideas of this specification, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this specification.

Claims

1. A method for analyzing alarm association, characterized in that: include: Obtain target alerts based on the preset sliding time window; Projecting the target alarm onto each predetermined dimension to obtain a characteristic value of the target alarm on each dimension; Filter and converge the target alarms according to the characteristic values ​​to obtain a set of associated alarms; According to the main dimension of each associated alarm in the associated alarm set, a root cause alarm in the associated alarm set is determined.

2. The method according to claim 1, characterized in that According to the preset sliding time window, the target alarm is obtained, and further: Obtaining a number of target alarms according to the start time node and the sliding time window; The target alarm with the latest occurrence time among the plurality of target alarms is used as a marked target alarm, the start time node is updated with the occurrence time of the marked target alarm, and it is determined whether other alarms occur within a sliding time window after the updated start time node; If so, it is determined that the other alarm is the target alarm, and the previous step is repeated until no other alarm occurs in the sliding time window after the updated start time node.

3. The method according to claim 1, characterized in that The target alarm is screened and converged according to the characteristic value to obtain a set of associated alarms, which is further: Taking any one of the target alarms as an alarm to be associated; Determine whether there is a dimension with the same characteristic value between the alarm to be associated and any alarm among the target alarms except the alarm to be associated; If so, it is determined that the alarm to be associated is an associated alarm, and the set consisting of the associated alarms is the associated alarm set.

4. The method according to claim 1, characterized in that: Determining the root cause alarm in the associated alarm set according to the main dimension of each associated alarm in the associated alarm set further includes: Sorting each associated alarm in the associated alarm set according to the level of its main dimension; In the sorting results, the associated alarm with the lowest level in the main dimension is taken as the root cause alarm.

5. The method according to claim 4, characterized in that Determining the root cause alarm in the associated alarm set further includes: Determine whether the number of associated alarms with the lowest level of the main dimension in the sorting result is more than one; If so, the earliest occurrence time of the associated alarms with the lowest primary dimension level is determined as the root cause alarm.

6. The method according to claim 1, characterized in that The method further comprises: Calculating the correlation between the root cause alarm and other associated alarms in the associated alarm set according to the preset weights of the dimensions; The associated alarm whose correlation degree meets the preset correlation degree condition is associated with the root cause alarm and outputted.

7. The method according to claim 1, characterized in that The method further comprises: According to the preset weights of the various dimensions, collecting other associated alarms in the associated alarm set that have the same characteristic value as the root cause alarm in the dimension that meets the preset weight threshold; Other associated alarms are associated with the root cause alarm and output.

8. An alarm correlation analysis device, characterized in that: include: An acquisition module is used to obtain target alarms according to a preset sliding time window; A projection module, used for projecting the target warning onto each predetermined dimension to obtain a characteristic value of the target warning on each dimension; A convergence module, used for screening and converging the target alarm according to the characteristic value to obtain a set of associated alarms; The determination module is used to determine the root cause alarm in the associated alarm set according to the main dimension of each associated alarm in the associated alarm set.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that The method comprises at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1 to 7.

Images