Alarm data processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses an alarm data processing method and device, electronic equipment and a storage medium. The method comprises the steps that all alarm events sent by all alarm sources are acquired; determining an alarm level of each alarm event based on pre-acquired information of all alarm sources and all alarm events; and for each alarm event, determining and executing a current alarm strategy corresponding to the current alarm event based on the alarm level of the current alarm event and a predetermined alarm rule base. According to the method provided by the invention, all received alarm sources and alarm events can be comprehensively analyzed, so that the alarm level of complex multi-source alarm data can be analyzed, and the accuracy of determining the emergency degree of the alarm events is improved. And the alarm data is accurately and timely processed according to the alarm level, so that the situations of false alarm and missing alarm are reduced.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data processing technology, and in particular to an alarm data processing method, device, electronic device and storage medium. Background Art

[0002] In the digital age, the efficiency and stability of enterprise operation and maintenance systems are crucial to business continuity. With the rapid development of information technology, enterprise operation and maintenance systems have become increasingly complex, generating a large number of alarm messages of various types.

[0003] Most existing alarm data processing systems determine whether to perform certain operations on alarm data by setting fixed thresholds for each business system when an abnormality occurs and alarm data is generated. This method is only suitable for processing simple and single alarm data. When faced with alarm data of multiple sources and types, it may lead to frequent false alarms or missed alarms. Summary of the invention

[0004] The embodiments of the present invention provide an alarm data processing method, device, electronic device and storage medium, which can comprehensively analyze the alarm data of complex and diverse business systems, thereby efficiently processing and promptly responding to the alarm data, and reducing the occurrence of false alarms and missed alarms.

[0005] In a first aspect, an embodiment of the present invention provides an alarm data processing method, comprising:

[0006] Get each alarm event sent by each alarm source;

[0007] Determine the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events;

[0008] For each alarm event, based on the alarm level of the current alarm event and a predetermined alarm rule base, a current alarm strategy corresponding to the current alarm event is determined and executed.

[0009] In a second aspect, an embodiment of the present invention provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the computer program implements an alarm data processing method as described in any one of the embodiments of the present invention.

[0010] In a third aspect, an embodiment of the present invention provides an alarm data processing device, the device comprising:

[0011] The data acquisition module is used to obtain each alarm event sent by each alarm source;

[0012] A level determination module, used to determine the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events;

[0013] The policy execution module is used to determine and execute, for each alarm event, a current alarm policy corresponding to the current alarm event based on the alarm level of the current alarm event and a predetermined alarm rule base.

[0014] In a fourth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an alarm data processing method as described in any one of the embodiments of the present invention is implemented.

[0015] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, an alarm data processing method as described in any one of the embodiments of the present invention is implemented.

[0016] In an embodiment of the present invention, each alarm event sent by each alarm source is obtained; the alarm level of each alarm event is determined based on the pre-acquired information of all alarm sources and all alarm events; for each alarm event, based on the alarm level of the current alarm event and a predetermined alarm rule base, the current alarm strategy corresponding to the current alarm event is determined and executed. The method of the embodiment of the present invention can conduct a comprehensive analysis of all alarm sources and alarm events received, so as to analyze the alarm level of complex alarm data from multiple sources, thereby improving the accuracy of determining the urgency of alarm events. The alarm data is accurately and timely processed according to the alarm level to reduce the occurrence of false alarms and missed alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A first flow chart of an alarm data processing method provided by an embodiment of the present invention;

[0019] Figure 2 A second flow chart of an alarm data processing method provided by an embodiment of the present invention;

[0020] Figure 3 A third flow chart of an alarm data processing method provided by an embodiment of the present invention;

[0021] Figure 4A schematic diagram of the structure of an alarm data processing device provided by an embodiment of the present invention;

[0022] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0024] Figure 1 This is a first flow chart of an alarm data processing method provided by an embodiment of the present invention. The method of the embodiment of the present invention can comprehensively analyze the alarm data of complex and diverse business systems, thereby efficiently processing and promptly responding to the alarm data, and reducing the occurrence of false alarms and missed alarms. The method can be executed by an alarm data processing device provided by an embodiment of the present invention, and the device can be implemented in software and / or hardware. The following embodiments will be described by taking the device integrated in an electronic device as an example. The electronic device can be a server or a computer device, etc., with reference to Figure 1 , the method may specifically include the following steps:

[0025] Step 101: Acquire each alarm event sent by each alarm source.

[0026] Among them, the alarm source is the device, program, platform or system that sends out the alarm data. The alarm sources in this solution include network devices: such as routers, switches and firewalls that can monitor network failures, performance degradation or security incidents; servers: such as physical servers and virtual servers used to detect hardware failures, performance problems or data corruption; applications: such as enterprise resource planning systems, customer relationship management systems and content management systems used to report software errors, performance bottlenecks or business logic problems; database systems that can provide alarms about transaction errors, query delays or data consistency; monitoring systems for monitoring host status, service availability and performance indicators; log management systems used to analyze log files to discover security threats or system errors, etc.

[0027] The alarm event includes the alarm data, the time when the alarm data is generated, and the impact of the alarm data. In an optional implementation, the server can obtain the alarm events sent by each alarm source through each alarm source interface in real time. After obtaining each alarm event, all alarm events are cleaned, including deleting or correcting erroneous, incomplete or inconsistently formatted data records, to obtain each cleaned alarm event.

[0028] Step 102: Determine the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events.

[0029] Among them, the information of the alarm source includes the device type and business function of the alarm source. Different alarm source information will have different effects on the level of the alarm event. The alarm level is used to indicate the severity of the alarm event. The higher the alarm level, the more serious the alarm event. Specifically, the server may receive alarm events sent by multiple alarm sources at the same time. These alarm sources may or may not be associated with each other. In order to more accurately determine the alarm level of each alarm event, in this solution, the information of all alarm sources received and all alarm events can be analyzed for correlation. If there is a strong correlation between them, the alarm level of each alarm event is determined based on the correlation. If there is no correlation between them, each alarm event is analyzed separately to obtain the alarm level of each alarm event.

[0030] For example, the server receives an alarm event whose alarm source is a database system: the database server reports insufficient disk space, and an alarm event whose alarm source is a network device: a switch in the same network reports a link interruption. After receiving these two alarm events, the server analyzes the alarm sources and finds that the database system relies on the switch in the network to report the link for data synchronization, so there is a direct relationship between the two alarm events. Further, it can be determined that these two alarm events are high-level alarm events, because the unavailability of the database service may seriously affect the application performance of the entire enterprise.

[0031] Exemplarily, the server receives an alarm event whose alarm source is a network server: reporting that the CPU usage exceeds 90%, and an alarm event whose alarm source is a security system: the firewall detects an unauthorized access attempt. After receiving these two alarm events, the server analyzes the alarm sources and determines that the two alarm sources are not directly related. The high CPU usage of the network server may be caused by excessive load or improper resource allocation, while the alarm event of the security system is about potential security threats. Further, the two alarm events are analyzed separately to obtain the alarm level of each alarm event.

[0032] Step 103: For each alarm event, based on the alarm level of the current alarm event and a predetermined alarm rule base, determine and execute a current alarm strategy corresponding to the current alarm event.

[0033] The alarm rule base includes processing rules corresponding to each alarm level, and the alarm strategy of each alarm event can be determined according to the processing rules corresponding to each alarm level. The alarm strategy is used to indicate the response method of the server to the alarm event.

[0034] Specifically, different alarm levels correspond to different alarm strategies. In an optional implementation, after obtaining the alarm level of each alarm event, the alarm method corresponding to each alarm level is searched in the alarm rule base, and the alarm strategy is determined according to the alarm method. Exemplarily, the alarm levels include low, medium and high. If the alarm level of an alarm event is low, its alarm method is determined to be suppression alarm according to the alarm rule base, and its corresponding alarm strategy is further determined to be: no alarm is sent. If the alarm level of an alarm event is medium, its alarm method is determined to be general alarm according to the alarm rule base, and its corresponding alarm strategy is further determined to be: sending prompt information to the corresponding user in the form of email or text message, and the user decides whether to process it. If the alarm level of an alarm event is high, its alarm method is determined to be immediate alarm according to the alarm rule base, and its corresponding alarm strategy is further determined to be: prohibiting the user from performing the next step, and immediately sending an alarm prompt to the user until the user fixes the abnormality.

[0035] The technical solution of this embodiment obtains each alarm event sent by each alarm source; determines the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events; for each alarm event, determines and executes the current alarm strategy corresponding to the current alarm event based on the alarm level of the current alarm event and a predetermined alarm rule base. The technical solution of this embodiment can conduct a comprehensive analysis of all alarm sources and alarm events received, so as to analyze the alarm level of complex alarm data from multiple sources, thereby improving the accuracy of determining the urgency of alarm events. Accurately and timely processing of alarm data according to the alarm level reduces the occurrence of false alarms and missed alarms.

[0036] Figure 2 The second flow chart of an alarm data processing method provided by an embodiment of the present invention is a refinement of the above embodiment. The specific method can be as follows Figure 2 As shown, the method may include the following steps:

[0037] Step 201: Acquire each alarm event sent by each alarm source.

[0038] In this solution, after obtaining each alarm event sent by each alarm source, the following steps A1 and A2 are also included:

[0039] Step A1: storing the alarm event in a predetermined historical alarm database; performing association rule analysis on all the alarm events in the historical alarm database, and determining target alarm trend information based on the analysis results.

[0040] Among them, the target alarm trend information includes the target alarm event and the probability of the target alarm event. The alarm database stores the alarm events that occurred in the historical period according to the type and occurrence time of the alarm event. After obtaining the alarm events sent by each alarm source, the data of each alarm event is sorted, and the alarm event is stored in the historical alarm database according to the equipment type and other information of the alarm source.

[0041] Furthermore, after the alarm events are stored in the historical alarm database, association rule analysis is performed on all the alarm events in the historical alarm database to mine the correlations between all the alarm events, and determine whether there are potential target alarm events based on their correlations.

[0042] For example, on a large e-commerce platform, the historical alarm database stores multiple alarm events about slow server response that occurred in the past few months. According to these alarm events, whenever the application server responds slowly, the database query speed will also drop significantly. If it happens several times in a row, it may cause the platform to be completely paralyzed. At the current moment, the various fault events obtained by the server also include slow server response, and by accumulating this slow server response event with the historical server response slow events stored in the historical database, it can be determined that the platform may soon be paralyzed, that is, the target alarm trend information is determined as: target alarm event: platform paralysis; probability of occurrence of target alarm event: large.

[0043] Step A2: When the probability of the target alarm event occurring is greater than a preset probability value, an alarm strategy for the target alarm event is determined and executed according to a historical alarm database.

[0044] The preset probability value is a value pre-determined by the server based on domain big data, etc. The historical alarm database stores various fault events, as well as solutions and alarm strategies for the fault events, etc. Specifically, when it is determined that the probability of the target alarm event is greater than the preset probability value, the alarm strategy for the target alarm event can be determined based on the solutions and alarm strategies for all fault events, etc.

[0045] Exemplarily, the target alarm trend information is determined as: target alarm event: platform paralysis; probability of occurrence of the target alarm event: a. The preset probability value is b. When a>b, the alarm strategy corresponding to the fault events such as "platform paralysis" and "system paralysis" found in the historical alarm database is: prohibit the user from performing the next operation, and immediately issue an alarm prompt to the user until the user fixes the abnormality. According to its alarm strategy, the alarm strategy of the target alarm event is determined as: prohibit the user from performing the next operation, and immediately issue an alarm prompt to the user until the user fixes the abnormality.

[0046] In the above steps, by performing correlation analysis on the alarm events in the historical alarm database, the potential relationship between different alarm events can be mined. Based on their relationship, the alarm events that may occur and their probability of occurrence can be predicted so that users can take measures in advance to avoid or mitigate the potential impact of the alarm events.

[0047] Step 202: pre-process each alarm event and extract related features to obtain each related feature of each alarm event.

[0048] Preprocessing includes data cleaning and data standardization. Correlation features are key information points in alarm events. Based on business needs and data in the historical alarm database, it is possible to determine which features in an alarm event are critical for correlation analysis, that is, to determine the correlation features of the alarm event. For example, if the alarm database shows that a certain brand of network equipment often reports connection problems, "equipment brand" can be extracted as a correlation feature.

[0049] In an optional implementation, after obtaining each alarm event, clean the data of each alarm event to exclude invalid or erroneous alarm information. Perform standardization processing such as time alignment and format unification on the cleaned alarm event to obtain the pre-processed alarm event. Extract correlation features from each alarm event, such as the device type of the alarm source (server, router, switch, etc.), the service affected by the alarm event (database service and network service, etc.), the description of the alarm event (insufficient disk space and disconnection, etc.), and the time point when the alarm event occurs.

[0050] Step 203: Perform correlation analysis on all alarm events according to the information of all alarm sources and various correlation features to obtain correlation analysis results.

[0051] The information of the alarm source includes the device type and service function of the alarm source, etc. Specifically, after the correlation features of the alarm events are obtained, the correlation analysis of all the alarm events is performed in combination with the information of all the alarm sources and each correlation feature.

[0052] In this solution, statistical methods or machine learning algorithms (such as the Apriori algorithm) can be used to perform correlation analysis on all alarm events. The Apriori algorithm is used to discover frequently occurring item sets in a large amount of data, which can reveal the relationship between different items. In the alarm event correlation analysis, the Apriori algorithm is applied to identify alarm events that occur frequently and simultaneously, thereby revealing potential systemic problems.

[0053] In an optional implementation, after obtaining the information of all alarm sources and each associated feature, all possible candidate item sets (i.e., a set containing one or more items) are generated through the Apriori algorithm. For example, all individual alarm events and alarm events of multiple device combinations in a series of alarm events. The frequency of occurrence of each candidate item set in all transactions (i.e., support) is calculated. The higher the support, the more likely the pattern is to appear in the data set. Item sets with sufficiently high support are selected as frequent item sets, which can reveal the correlation between different alarm events. A rule in the form of X→Y is generated from the frequent item set, where X and Y are both frequent item sets, and the occurrence of X can predict the occurrence of Y. If a rule indicates that multiple alarm events often occur at the same time, then there may be some correlation between these alarm events. For example, the alarm event that the database server reports insufficient disk space and the alarm event that the network switch reports link interruption appear at the same time, indicating that the network connection problem is the cause of the instability of the database service.

[0054] For example, suppose that in a large computer service company, different departments' systems have alarm events of excessive CPU usage. Through correlation analysis, it can be found that these alarm events not only overlap in time (all occurred late at night), but also involve similar services (all database-related services). According to the correlation analysis results, it can be determined that there is a broad system-level problem in each alarm source, such as overheating caused by insufficient cooling system in the data center.

[0055] Step 204: For each alarm event, determine the alarm level of the current alarm event according to the correlation analysis result, the device type and service function of the alarm source of the current alarm event.

[0056] Specifically, according to the result of correlation analysis, the severity and urgency of each alarm event can be determined. If there is a strong correlation between multiple alarm events, even if the severity and urgency of the multiple alarm events themselves are not high, due to the strong correlation between them, it can be determined that the severity and urgency of the multiple alarm events are high. If there is no correlation between multiple alarm events, and the severity and urgency of the multiple alarm events themselves are not high, it can be determined that the severity and urgency of the multiple alarm events are low.

[0057] In this solution, in addition to the results of the correlation analysis, the device type and business function of the alarm source of the current alarm event also need to be considered. For example, if a critical production server fails, even if the failure may be caused by a non-critical device, the alarm level of the alarm event should be high. Therefore, after obtaining the correlation analysis results, the preliminary alarm level of each alarm event is determined according to the correlation analysis results. The candidate alarm levels of the alarm event are determined based on the device type and business function of the alarm source of the current alarm event. If the preliminary alarm level and the candidate alarm level are consistent, the candidate alarm level is determined to be the alarm level of the current alarm event. If the preliminary alarm level and the candidate alarm level are inconsistent, the higher level is determined to be the alarm level of the current alarm event.

[0058] Through these two steps, the system can manage and respond to alarm events more intelligently, improving operation and maintenance efficiency and service quality.

[0059] Step 205: Determine the number of alarm events of each alarm level, and when the number of alarm events of at least one alarm level is greater than a preset number, update the alarm level of all alarm events in at least one alarm level.

[0060] The preset number is a value pre-determined by the server based on domain big data, etc. The preset number of alarm events of different alarm levels can be different. If there are a large number of alarm events of the same alarm level, it is necessary to further analyze these alarm events to determine whether there is a certain correlation behind them (it is possible that the device types of the alarm sources are unrelated, resulting in the implicit correlation not being analyzed in the previous steps).

[0061] In an optional implementation, after the alarm level of each alarm event is obtained, the number of alarm events of each alarm level is counted. If the number of alarm events of an alarm level exceeds a preset number, these alarm times are analyzed, and the alarm level is updated according to the analysis results. For example, after analyzing the alarm event, if it is determined that the alarm event of this level occurs because the system itself fails, the alarm level can be appropriately increased.

[0062] Step 206: For each alarm event, based on the alarm level of the current alarm event and a predetermined alarm rule base, determine and execute a current alarm strategy corresponding to the current alarm event.

[0063] In the technical solution of this embodiment, each alarm event sent by each alarm source is obtained. Each alarm event is preprocessed and associated features are extracted to obtain each associated feature of each alarm event. All alarm events are subjected to correlation analysis based on the information of all alarm sources and each associated feature to obtain the result of the correlation analysis. For each alarm event, the alarm level of the current alarm event is determined according to the result of the correlation analysis, the device type and service function of the alarm source of the current alarm event. The number of alarm events of each alarm level is determined; when the number of alarm events of at least one alarm level is greater than the preset number, the alarm level of all alarm events in at least one alarm level is updated. For each alarm event, based on the alarm level of the current alarm event and the predetermined alarm rule base, the current alarm strategy corresponding to the current alarm event is determined and executed. The solution of this embodiment can perform a comprehensive correlation analysis on the information of all alarm sources and alarm events, instead of analyzing a single alarm event. This method of determining the alarm level of an alarm event is more comprehensive and accurate. In addition, this solution counts the number of alarms of different alarm levels, further confirms the alarm level of the alarm event, and improves the accuracy of determining the urgency of the alarm event. The alarm data is processed accurately and timely according to the alarm level to reduce the occurrence of false alarms and missed alarms.

[0064] Figure 3 The third flow chart of an alarm data processing method provided by an embodiment of the present invention. The specific method can be as follows Figure 3 As shown, the method may include the following steps:

[0065] Step 301: Acquire each alarm event sent by each alarm source.

[0066] Step 302: Determine the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events.

[0067] Step 303: For each alarm event, based on the alarm level of the current alarm event and a predetermined alarm rule base, determine and execute a current alarm strategy corresponding to the current alarm event.

[0068] Step 304: Determine the current alarm state of the current alarm event based on the current alarm strategy.

[0069] Among them, the alarm status is the processing progress of the alarm event at the current moment obtained after the server executes the alarm strategy. In this solution, the alarm operation includes immediate alarm and scheduled alarm. When the current alarm operation is immediate alarm, the current alarm status is obtained in real time from the start time of the current alarm operation; when the current alarm operation is scheduled alarm, the alarm time of the scheduled alarm is determined, and the current alarm status is obtained at the alarm time.

[0070] Specifically, if the alarm operation is an immediate alarm, it means that the user needs to handle the alarm event immediately. If the alarm operation is a scheduled alarm, it means that the alarm event does not need to be handled by the user immediately, but can be handled within a scheduled time period. Therefore, when the current alarm operation is an immediate alarm, the server obtains the current alarm status in real time from the start of the current alarm operation to determine whether the user handles the alarm event in time; when the current alarm operation is a scheduled alarm, the alarm time of the scheduled alarm is determined according to the alarm strategy, and the current alarm status is obtained at the alarm time.

[0071] For example, alarm event A is a scheduled alarm, and the alarm time is 24 hours later. In order to save the computing resources of the server, the server does not need to obtain the alarm status in real time from the moment the alarm strategy is executed, but obtains the alarm status after 24 hours. If the alarm status is handled, the server can store the alarm event. If the alarm status is unhandled, a prompt message is sent to the user to prompt the user to handle the alarm event in time.

[0072] Step 305: determine alarm display information based on the current alarm event and the current alarm state, and visualize the alarm display information.

[0073] Specifically, after the alarm events and alarm status are obtained, the alarm events and alarm status are organized into a data format suitable for visual display, i.e., alarm display information. For example, a bar chart is used to represent the number of alarm events of different levels, or a pie chart is used to display the distribution of alarm events.

[0074] After the alarm display information is obtained, the alarm display information is displayed through a pre-set interactive interface. The user can view the progress of the alarm event through the interactive interface, and query, process and feedback the alarm event through the interactive interface.

[0075] The technical solution of this embodiment obtains each alarm event sent by each alarm source; determines the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events; for each alarm event, determines and executes the current alarm strategy corresponding to the current alarm event based on the alarm level of the current alarm event and the predetermined alarm rule base. Determine the current alarm state of the current alarm event based on the current alarm strategy. Determine the alarm display information based on the current alarm event and the current alarm state, and visualize the alarm display information. According to the solution of this embodiment, after executing the alarm strategy, the server can track and monitor the processing progress of the alarm event in real time, so as to facilitate the user to make timely and effective responses to the alarm state. Visual display of alarm events and alarm states improves the efficiency of alarm event information transmission.

[0076] An embodiment of the present invention also provides a computer program product.

[0077] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer program products, which can include one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor, which can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0078] Figure 4 Schematic diagram of the structure of the alarm data processing device provided in the embodiment of the present invention, which is suitable for executing the alarm data processing method provided in the embodiment of the present invention. Figure 4 As shown, the device may specifically include:

[0079] The data acquisition module 401 acquires each alarm event sent by each alarm source;

[0080] A level determination module 402, configured to determine the alarm level of each alarm event based on pre-acquired information of all alarm sources and all alarm events;

[0081] The policy execution module 403 is used to determine and execute the current alarm policy corresponding to each alarm event based on the alarm level of the current alarm event and a predetermined alarm rule base.

[0082] Optionally, the level determination module 402 is specifically used to: pre-process each alarm event and extract related features to obtain each related feature of each alarm event;

[0083] Perform correlation analysis on all alarm events based on the information of all alarm sources and various correlation features to obtain correlation analysis results;

[0084] For each alarm event, the alarm level of the current alarm event is determined according to the correlation analysis result, the device type of the alarm source of the current alarm event, and the service function.

[0085] Optionally, the level determination module 402 is further configured to: determine the number of alarm events of each alarm level;

[0086] When the number of alarm events of at least one alarm level is greater than a preset number, the alarm levels of all alarm events in the at least one alarm level are updated.

[0087] Optionally, the policy execution module 403 is specifically configured to: determine a current alarm state of the current alarm event based on the current alarm policy;

[0088] Alarm display information is determined based on the current alarm event and the current alarm state, and the alarm display information is visually displayed.

[0089] Optionally, the policy execution module 403 is further used to: when the current alarm operation is the immediate alarm, obtain the current alarm state in real time from the start time of executing the current alarm operation;

[0090] When the current alarm operation is the scheduled alarm, the alarm time of the scheduled alarm is determined, and at the alarm time, the current alarm state is acquired.

[0091] Optionally, the level determination module 402 is further configured to: store the alarm event in a predetermined historical alarm database;

[0092] Performing association rule analysis on all alarm events in the historical alarm database, and determining target alarm trend information according to the analysis results; wherein the alarm trend information includes target alarm events and the probability of occurrence of the target alarm events;

[0093] When the probability of occurrence of the target alarm event is greater than a preset probability value, an alarm strategy for the target alarm event is determined and executed according to the historical alarm database.

[0094] The alarm data processing device provided in the embodiment of the present invention can execute the alarm data processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For the contents not described in detail in this embodiment, reference can be made to the description in any method embodiment of the present invention.

[0095] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, referring to Figure 5 , Figure 5 The electronic device 12 shown is only an example and should not limit the functions and scope of use of the embodiments of the present application. Figure 5As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0096] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0097] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0098] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0099] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0100] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the electronic device 12, and / or may communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 12 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the electronic device 12 via the bus 18. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0101] The processing unit 16 executes various functional applications and data processing by running the programs stored in the system memory 28, for example, implementing an alarm data processing method provided in an embodiment of the present invention: obtaining each alarm event sent by each alarm source; determining the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events; for each alarm event, determining and executing the current alarm strategy corresponding to the current alarm event based on the alarm level of the current alarm event and a predetermined alarm rule base.

[0102] The embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, an alarm data processing method provided by all the embodiments of the present invention is implemented: obtaining each alarm event sent by each alarm source; determining the alarm level of each alarm event based on the information of all alarm sources and all alarm events obtained in advance; for each alarm event, based on the alarm level of the current alarm event and the predetermined alarm rule base, determining and executing the current alarm strategy corresponding to the current alarm event. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electronic device, device or device of electrical, magnetic, optical, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction executing electronic device, apparatus, or device.

[0103] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction-executing electronic device, apparatus, or device.

[0104] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0105] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0106] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for processing alarm data, characterized in that: The method comprises: Get each alarm event sent by each alarm source; Determine the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events; For each alarm event, based on the alarm level of the current alarm event and a predetermined alarm rule base, a current alarm strategy corresponding to the current alarm event is determined and executed.

2. The method according to claim 1, characterized in that The information of the alarm source includes the device type and service function of the alarm source, and the alarm level of each alarm event is determined based on the pre-acquired information of all alarm sources and all alarm events, including: Preprocess each alarm event and extract related features to obtain each related feature of each alarm event; Perform correlation analysis on all alarm events based on the information of all alarm sources and various correlation features to obtain correlation analysis results; For each alarm event, the alarm level of the current alarm event is determined according to the correlation analysis result, the device type of the alarm source of the current alarm event, and the service function.

3. The method according to claim 2, characterized in that Before determining and executing a current alarm strategy corresponding to the current alarm event based on the alarm level of the current alarm event and a predetermined alarm rule base, the method further includes: Determine the number of alarm events at each alarm level; When the number of alarm events of at least one alarm level is greater than a preset number, the alarm levels of all alarm events in the at least one alarm level are updated.

4. The method according to claim 1, characterized in that: The method further comprises: Determine the current alarm state of the current alarm event based on the current alarm strategy; Alarm display information is determined based on the current alarm event and the current alarm state, and the alarm display information is visually displayed.

5. The method according to claim 4, characterized in that The alarm strategy includes an alarm operation, and the alarm operation includes an immediate alarm and a scheduled alarm. Determining a current alarm state of the current alarm event based on the current alarm strategy includes: When the current alarm operation is the immediate alarm, obtaining the current alarm state in real time from the start time of executing the current alarm operation; When the current alarm operation is the scheduled alarm, the alarm time of the scheduled alarm is determined, and at the alarm time, the current alarm state is acquired.

6. The method according to claim 1, characterized in that After acquiring each alarm event sent by each alarm source, the method further includes: Storing the alarm event in a predetermined historical alarm database; Performing association rule analysis on all alarm events in the historical alarm database, and determining target alarm trend information according to the analysis results; wherein the alarm trend information includes target alarm events and the probability of occurrence of the target alarm events; When the probability of occurrence of the target alarm event is greater than a preset probability value, an alarm strategy for the target alarm event is determined and executed according to the historical alarm database.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements an alarm data processing method according to any one of claims 1 to 6.

8. An alarm data processing device, characterized in that: include: The data acquisition module is used to obtain each alarm event sent by each alarm source; A level determination module, used to determine the alarm level of each alarm event based on the pre-acquired information of all alarm sources and all alarm events; The policy execution module is used to determine and execute, for each alarm event, a current alarm policy corresponding to the current alarm event based on the alarm level of the current alarm event and a predetermined alarm rule base.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, an alarm data processing method as described in any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, an alarm data processing method as described in any one of claims 1 to 6 is implemented.

Images