Alarm method and device

Abstract

The embodiment of the invention provides an alarm method and device. The method comprises the steps that alarm information is acquired; in response to the fact that the alarm information exists in an active queue, an end timestamp of the alarm information in the active queue is prolonged, the active queue is used for storing the alarm information in an active state, and the end timestamp is set based on a start timestamp when the alarm information is stored in the active queue; updating the active queue based on a comparison result of an end timestamp and a current timestamp of each piece of alarm information in the active queue; and based on a preset notification condition, notifying the alarm information in the updated active queue. According to the method, the convergence of the alarm information is realized, and the problem of alarm flooding is avoided.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an alarm method and device. Background Art

[0002] Information systems are an important part of the operation of enterprises and institutions. They are the key to improving work efficiency, promoting communication and collaboration, and ensuring data management and security. In these systems, whether it is a website, server or application service, any failure in any link may cause service interruption, which in turn affects the reputation of the enterprise. Therefore, real-time monitoring of the operating status of these key components and rapid detection and response to abnormal situations are essential to maintaining enterprise operations. In order to ensure the stable operation of the information system, it is necessary to monitor the operating indicators and logs of the host, the operating status of the website, and the continuous availability of application services in real time. In this way, once any abnormality is detected, measures can be taken immediately to prevent potential service interruptions and ensure business continuity and customer satisfaction.

[0003] Currently, abnormal situations detected by the monitoring system are usually notified to relevant managers. Frequent alarms will consume a lot of energy of relevant managers to process and analyze alarm data. Summary of the invention

[0004] In view of this, the embodiments of the present disclosure provide at least one alarm method and device to solve the problem of excessive alarm notifications.

[0005] Specifically, the embodiments of the present disclosure are implemented through the following technical solutions:

[0006] In a first aspect, an alarm method is provided, the method comprising:

[0007] Get alarm information;

[0008] In response to the alarm information already existing in an active queue, extending an end timestamp of the alarm information in the active queue, the active queue being used to store the alarm information in an active state, the end timestamp being set based on a start timestamp when the alarm information is stored in the active queue;

[0009] Based on the comparison result of the end timestamp and the current timestamp of each alarm information in the active queue, updating the active queue;

[0010] Based on the preset notification condition, the updated alarm information in the active queue is notified.

[0011] In combination with any implementation manner provided in the present disclosure, the notifying the updated alarm information in the active queue based on the preset notification condition includes:

[0012] In response to reaching a preset target time, based on the notification count and the start timestamp of the alarm information in the active queue, selecting the alarm information in the alarm task corresponding to the preset target time from the active queue;

[0013] For each alarm information in the alarm task, in response to a notification frequency of a notification object to which the alarm information belongs not reaching an upper threshold, the alarm information is notified to the notification object.

[0014] In combination with any implementation manner provided in the present disclosure, in response to reaching a preset target time, based on the notification count and the start timestamp of the alarm information in the active queue, selecting the alarm information corresponding to the preset target time from the active queue includes:

[0015] In response to reaching a preset target time, traversing the alarm information in the active queue, and determining that the alarm information is the alarm information in the alarm task if the alarm information has not been notified for the first time;

[0016] In the case where the alarm information has been notified for the first time, determining the duration of the alarm information in the active queue based on the start timestamp of the alarm information;

[0017] When the duration reaches the preset target duration, the alarm information is determined to be the alarm information in the alarm task, wherein the preset target durations corresponding to different preset target times are different.

[0018] In combination with any implementation manner provided in the present disclosure, the obtaining of alarm information includes:

[0019] Receiving the alarm information sent by the monitored system;

[0020] Detecting the field format of the warning information;

[0021] When the field format of the alarm information meets the preset alarm specification, returning a response message of successful reception to the monitored system;

[0022] The format of the preset alarm specification is: alarm name field, alarm device address field, alarm source field, alarm severity field, alarm details field, and alarm summary field.

[0023] In combination with any implementation manner provided in the present disclosure, after obtaining the alarm information, the method further includes:

[0024] Extracting characteristic fields of the warning information;

[0025] Performing compression calculation on the character string of the characteristic field to obtain the fingerprint field of the alarm information;

[0026] Based on the fingerprint field, it is determined whether the alarm information exists in the active queue.

[0027] In combination with any embodiment provided in the present disclosure, the method further includes:

[0028] In response to the alarm information not existing in the active queue, the alarm information is stored in the active queue, wherein the start timestamp of the alarm information is set to the current time, and the end timestamp of the alarm information is set to the time after the current time is extended by a preset time period.

[0029] In combination with any implementation manner provided in the present disclosure, after obtaining the alarm information, the method further includes:

[0030] In response to the alarm type of the alarm information belonging to the pre-processing type, determining whether the alarm information exists in the pre-processing queue, the pre-processing type being a type that requires multiple alarm sources to determine whether it is in an active state;

[0031] If the alarm information does not exist in the pre-processing queue, placing the alarm information in the pre-processing queue;

[0032] The pre-processing queue is traversed, and when all alarm sources corresponding to the alarm information have already sounded an alarm, it is determined that the alarm information is in an active state, and it is determined whether the alarm information exists in the active queue.

[0033] In combination with any implementation manner provided in the present disclosure, the updating of the active queue based on the comparison result of the end timestamp and the current timestamp of each alarm information in the active queue includes:

[0034] Traversing the active queue, and comparing the end timestamp of the alarm information with the current timestamp;

[0035] In response to an end timestamp of the alarm information being smaller than a current timestamp, the alarm information is written to a recovered queue and the alarm information is removed from the active queue.

[0036] In a second aspect, an alarm device is provided, the device comprising:

[0037] An information acquisition module is used to obtain alarm information;

[0038] a queue maintenance module, configured to, in response to the alarm information already existing in an active queue, extend an end timestamp of the alarm information in the active queue, wherein the active queue is used to store the alarm information in an active state, and the end timestamp is set based on a start timestamp when the alarm information is stored in the active queue;

[0039] A status update module, configured to update the active queue based on a comparison result of an end timestamp of each alarm information in the active queue and a current timestamp;

[0040] The information notification module is used to notify the updated alarm information in the active queue based on the preset notification conditions.

[0041] According to a third aspect, an electronic device is provided, comprising a memory and a processor, wherein the memory is used to store computer instructions executable on the processor, and the processor is used to implement the alarm method described in any embodiment of the present disclosure when executing the computer instructions.

[0042] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0043] A pre-end judgment method is used to maintain the status changes of alarm information in the active queue. For newly added duplicate alarms, the end timestamp of the alarm information in the active queue is extended, and its storage time in the active queue is postponed, thereby achieving the convergence of alarm information and avoiding the problem of alarm flooding. It can help managers free themselves from tedious status monitoring and data analysis tasks, so that they can devote more energy to the expansion of core business and content maintenance.

[0044] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in one or more embodiments of the present disclosure or related technologies, the drawings required for use in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0046] Figure 1 is an architecture diagram of an alarm system shown in at least one embodiment of the present disclosure;

[0047] Figure 2 is a flow chart of an alarm method shown in at least one embodiment of the present disclosure;

[0048] Figure 3 is a flowchart of an alarm receiving module shown in at least one embodiment of the present disclosure;

[0049] Figure 4 is a flowchart of an alarm deduplication module according to at least one embodiment of the present disclosure;

[0050] Figure 5 is a flowchart of an alarm storage module according to at least one embodiment of the present disclosure;

[0051] Figure 6 is a flowchart of an alarm status transfer module shown in at least one embodiment of the present disclosure;

[0052] Figure 7 is a flowchart of an alarm notification module according to at least one embodiment of the present disclosure;

[0053] Figure 8 is a schematic diagram of an alarm device shown in at least one embodiment of the present disclosure;

[0054] Fig. 9 It is a schematic diagram of the hardware structure of an electronic device shown in at least one embodiment of the present disclosure. DETAILED DESCRIPTION

[0055] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0056] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0057] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0058] Implementing monitoring of the status of monitoring targets and realizing abnormal alarms places high technical requirements on managers. They not only need to be proficient in how to deploy monitoring probes and data collection software, but also must conduct in-depth comprehensive analysis after data collection to identify what constitutes an abnormality or failure and determine the specific conditions that trigger the warning. In addition, for a single target, such as a website, deploying such a system will inevitably consume valuable hardware resources. Therefore, from the perspective of technical feasibility and economic benefits, it is urgent to develop an alarm system architecture and alarm method that can support multi-target monitoring. Such a system will provide an effective solution for website managers, helping them to free themselves from the tedious tasks of status monitoring and data analysis, so that they can devote more energy to the expansion of core business and content maintenance. Through this innovative monitoring strategy, the amount of tasks for processing alarm notifications is reduced, and managers can more efficiently maintain the stability of the information system, while optimizing resource allocation and improving overall operational efficiency.

[0059] Based on this, the present disclosure provides an alarm system architecture for multiple monitoring systems and multiple alarm types, such as Figure 1 As shown, the system mainly includes the following five functional modules: alarm receiving module, alarm deduplication module, alarm storage module, alarm status flow module, and alarm notification module.

[0060] Among them, the alarm receiving module provides external alarm receiving services and receives alarm data from different monitoring systems. After receiving the alarm data, it first passes through the alarm deduplication module for deduplication processing, and then passes through the alarm storage module and is stored in the corresponding alarm queue according to the alarm type.

[0061] In this embodiment, the alarm data is stored in a triple alarm queue storage method, which includes a pre-processing queue, an active queue, and a recovered queue.

[0062] When the alarm type is a preprocessing type that requires comprehensive judgment from multiple detection sources, the alarm information is first placed in the preprocessing queue until all detection sources corresponding to the alarm information trigger the alarm. Then the alarm information is placed in the active queue. If only one or part of the detection sources triggers the alarm, it cannot be determined as a real alarm and remains in the preprocessing queue.

[0063] If the alarm type is a non-preprocessing type that does not require comprehensive judgment by multiple probes, when an alarm message is received, it is directly included in the active queue. When an alarm message in the active queue has been restored, it is removed from the active queue and included in the restored queue.

[0064] The alarm status transfer module and the alarm notification module use scheduled tasks to convert the status of alarm information in the active queue and notify the management personnel in real time.

[0065] Combine the following Figure 1 The system architecture shown illustrates the alarm method provided by the present disclosure.

[0066] Figure 2 is a flowchart of an alarm method shown in at least one embodiment of the present disclosure, the method comprising the following steps:

[0067] In step 202, alarm information is obtained.

[0068] When an abnormal situation occurs in the monitored system or an alarm rule is triggered, an alarm message will be generated. The alarm message is used to indicate the abnormal status of the monitored subject such as the website, server, data center or equipment.

[0069] This embodiment does not limit the type of alarm information. For example, it can be different types of abnormal alarms such as website abnormality, indicator abnormality, and log abnormality.

[0070] This step can be done by Figure 1 The alarm receiving module in the collection interface receives alarm information from different clusters, such as Ceph, Metric and Log in the data center, and website probes.

[0071] In one example, a unified interface specification can be set to achieve the aggregation of various types of abnormal alarms. In compliance with the interface specification, the alarm data generated by different application services can be seamlessly accessed, achieving de-differentiation.

[0072] In this example, obtaining alarm information may include: receiving the alarm information sent by the monitored system; detecting the field format of the alarm information; and returning a response message of successful reception to the monitored system when the field format of the alarm information meets the preset alarm specification.

[0073] The format of the preset alarm specification is: alarm name field, alarm device address field, alarm source field, alarm severity field, alarm details field, and alarm summary field.

[0074] For example, an alarm specification for receiving alarm interfaces is established, and alarm information is sent uniformly in the following format:

[0075]

[0076]

[0077] Among them, the alert_name field is the name of the alarm, the instance field is the IP (Internet Protocol) address of the alarm machine, the cluster field is the alarm source, severity is the alarm severity level, description is the alarm details, and summary is the alarm summary.

[0078] Before detecting the alarm specification of the alarm information, the alarm information may also be screened to select the alarm information in the system whitelist to reduce the generation of invalid alarms.

[0079] like Figure 3 As shown, the alarm receiving module provides external alarm receiving services. After the monitored system triggers the alarm rule, the alarm information is sent to the alarm receiving interface according to the preset alarm unified specification. The alarm receiving interface performs judgment and processing. The specific steps are as follows:

[0080] First, the alarm receiving interface obtains the request IP address of the alarm information and makes a judgment on the request IP address;

[0081] If the requesting IP address is not in the system whitelist, the alarm message will not be received and an insufficient permission response will be returned;

[0082] If the requesting IP address is in the system whitelist, the alarm field format is checked. If it meets the defined alarm unified specification, a successful reception response is returned.

[0083] If the defined alarm unified specification is not met, a reception failure response is returned.

[0084] Among them, the system whitelist is a list of trusted IP addresses, and only these IP addresses are allowed to access the alarm interface module, which can be set by the alarm management personnel.

[0085] When an alarm message is received, in order to facilitate the judgment whether it is a newly triggered alarm message or an old alarm message, after obtaining the alarm information, a fingerprint deduplication strategy can also be used to classify the duplicate alarm messages: extract the characteristic field of the alarm information; compress and calculate the character string of the characteristic field to obtain the fingerprint field of the alarm information; based on the fingerprint field, determine whether the alarm information exists in the active queue.

[0086] Among them, the characteristic field can be a field in the defined preset alarm specification, such as an alarm name field, an alarm device address field, an alarm source field, an alarm severity field, an alarm detail field, an alarm summary field, etc.

[0087] The string compression calculation can be performed by using compression algorithms such as Huffman coding and dictionary coding to compress the original string to obtain the fingerprint field, thereby reducing the length of the string, or by using a hash algorithm for encryption calculation to generate a fixed-length hash value as the fingerprint field, which also reduces the length of the string and facilitates the comparison of duplicate alarms. After obtaining the fingerprint field, the fingerprint field is used instead of the original string as the storage method of the alarm information in each alarm queue.

[0088] Figure 4 FIG. 1 is a flow chart of the alarm deduplication module in the embodiment of the present disclosure. Figure 4 As shown, after receiving the alarm information, the alarm deduplication process is performed. The specific steps are as follows:

[0089] First, extract the characteristic fields of the alarm information and concatenate the five characteristic fields of alert_name, instance, cluster, severity, and summary in order;

[0090] The concatenated string is encrypted using a hash algorithm, such as the SHA-1 cryptographic hash function. The encrypted string is used as the fingerprint field of the alarm to determine the uniqueness of the alarm.

[0091] If the alarm information corresponding to the fingerprint field already exists in the active queue, the end timestamp of the alarm information is updated in the active queue;

[0092] If the alarm information of the fingerprint field does not exist in the active queue, the fingerprint field of the alarm information is stored in the active queue.

[0093] For example, when an alarm message is received, the fingerprint field of the alarm message is first calculated, and then the fingerprint field is compared with the fingerprint field of the alarm message in the current active queue. If it is found that an alarm message with the same fingerprint field already exists, the count of the original alarm message is increased by 1. If it does not exist, it is placed in the active queue as a new alarm message.

[0094] In step 204, in response to the alarm information already existing in the active queue, the end timestamp of the alarm information in the active queue is extended.

[0095] The active queue is used to store the alarm information in an active state, and the end timestamp is set based on the start timestamp when the alarm information is stored in the active queue.

[0096] The start timestamp is the time point when the alarm information is stored in the active queue, and the end timestamp is the preset time point when the alarm information exits the active queue.

[0097] In other examples, in response to the alarm information not existing in the active queue, the alarm information is stored in the active queue, wherein the start timestamp of the alarm information is set to the current time, and the end timestamp of the alarm information is set to the time after the current time is extended by a preset time period.

[0098] The preset duration can be 1 hour or other durations. Add 1 hour to the current time to get the end timestamp.

[0099] In one embodiment, before this step, the method further includes:

[0100] In response to the alarm type of the alarm information belonging to the pre-processing type, determining whether the alarm information exists in a pre-processing queue;

[0101] If the alarm information does not exist in the pre-processing queue, placing the alarm information in the pre-processing queue;

[0102] The pre-processing queue is traversed, and when all alarm sources corresponding to the alarm information have already sounded an alarm, it is determined that the alarm information is in an active state, and it is determined whether the alarm information exists in the active queue.

[0103] Among them, the preprocessing type is a type that requires multiple alarm sources to determine whether it is in an active state. The alarm source is the system, device, service or application that triggers the alarm, that is, the source that detects anomalies or potential risks and issues an alarm. The alarm source can be in different regions.

[0104] For example, probes for monitoring a certain website are respectively set up at locations A, B, and C. The probe set up at location A detects that there is an abnormality in the website and generates alarm information A. The alarm type of the alarm information A belongs to the preprocessing type. If the alarm information A does not exist in the preprocessing queue, the alarm information A is placed in the preprocessing queue. If the probe set up at location B also detects that there is an abnormality in the website and generates alarm information B, the same as the above process, the alarm information B is placed in the preprocessing queue. If the probe set up at location C also detects that there is an abnormality in the website and generates alarm information C, the same as the above process, the alarm information C is placed in the preprocessing queue. When traversing the preprocessing queue, it is found that the alarm sources corresponding to the alarm information of the website have all been alarmed, and it is determined that the alarm information of the website is in an active state.

[0105] For example, Figure 5 FIG. 1 is a flow chart of the alarm storage module in the embodiment of the present disclosure. Figure 5 As shown in the figure, the alarm storage module is divided into three-tier queue mode, namely pre-processing queue, active queue, and recovered queue. The specific steps are as follows:

[0106] First, classify the alarm information according to its alarm type;

[0107] If it is a pre-processing type alarm information, determine whether the alarm information exists in the pre-processing queue according to the fingerprint field;

[0108] If it does not exist in the pre-processing queue, it is put into the pre-processing queue, and the start field in the alarm information is set to the current timestamp, the end field is set to the current time plus 1 hour, and the count is set to the initial value 1;

[0109] The start field is the field where the start timestamp is located, the end field is the field where the end timestamp is located, and the count count is used to calculate the number of occurrences of the alarm information.

[0110] If it already exists in the preprocessing queue, the count field is incremented by 1, and the end field is updated to the timestamp of the current time plus 1 hour;

[0111] Then, the preprocessing queue is traversed. If all detection sources of a certain alarm have issued alarms, it means that the alarm is an active alarm. Then, a new active alarm is generated and it is determined whether it exists in the active queue.

[0112] If it does not exist in the active queue, it is put into the active queue, and the start field is set to the current timestamp, the end field is set to the current time plus 1 hour, and the count is set to the initial value 1;

[0113] If it already exists in the active queue, the count field is incremented by 1, and the end field is updated to the timestamp of the current time plus 1 hour;

[0114] If it is a non-preprocessing type of alarm information, directly determine whether it exists in the active queue;

[0115] If it does not exist in the active queue, it is put into the active queue, and the start field is set to the current timestamp, the end field is set to the current time plus 1 hour, and the count is set to the initial value 1;

[0116] If it already exists in the active queue, the count field is incremented by 1, and the end field is updated to the timestamp of the current time plus 1 hour.

[0117] In step 206, the active queue is updated based on the comparison result between the end timestamp of each alarm information in the active queue and the current timestamp.

[0118] This step may be to traverse the active queue, compare the end timestamp of the alarm information with the current timestamp; in response to the end timestamp of the alarm information being smaller than the current timestamp, write the alarm information to the recovered queue and remove the alarm information from the active queue.

[0119] Figure 6 FIG. 1 is a flow chart of the alarm status transfer module in the embodiment of the present disclosure. Figure 6 As shown in the figure, the state flow adopts the pre-end method. If the alarm information is received continuously, the end field of the alarm information will be continuously updated to a timestamp greater than the current time. When the end field of an alarm information is less than the current timestamp, it is determined that the alarm has been restored. The specific steps are as follows:

[0120] Traverse all alarm information in the active queue and make judgments based on the end field and current timestamp in the alarm information;

[0121] If the end field of an alarm message is less than the current timestamp, it is determined that the alarm has been restored, and the alarm message is written to the restored queue and removed from the active queue;

[0122] If the end field of the alarm is not less than the current timestamp, it means that the alarm information is still active and remains in the current state without being processed.

[0123] For example, when an alarm message is received, its status is active alarm message. The expected end time of the alarm message is one hour later than the end field. If the alarm message is received again within one hour, the expected end time is postponed again. If the alarm is not received within one hour, the alarm message is judged to be in a recovered state, written to the recovered queue and removed from the active queue.

[0124] In step 208, based on a preset notification condition, the updated alarm information in the active queue is notified.

[0125] This embodiment does not limit the preset notification conditions.

[0126] In one implementation, the notifying of the updated alarm information in the active queue based on the preset notification condition includes:

[0127] In response to reaching a preset target time, based on the notification count and the start timestamp of the alarm information in the active queue, selecting the alarm information in the alarm task corresponding to the preset target time from the active queue;

[0128] For each alarm information in the alarm task, in response to a notification frequency of a notification object to which the alarm information belongs not reaching an upper threshold, the alarm information is notified to the notification object.

[0129] For example, the preset target time can be a fixed time point every day, every weekday, or a few days of each month. The alarm tasks corresponding to different preset target times can be different. For example, the alarm task at a fixed time point can be to notify only the alarm information that has not been notified, and the alarm task every Monday can be to notify the alarm information that has been in the active queue for more than three days. For alarm information with a notification count of 0, notification is made; for alarm information with a notification count of more than 1, repeated notification may not be made. The earlier the start timestamp of the alarm information, the longer the duration of the alarm, and the more repeated notifications can be made.

[0130] The limitation on notification frequency may be: a maximum of three alarm messages may be sent to the same notification object per day, and a maximum of ten alarm messages may be sent to the same notification object per week.

[0131] In one embodiment, in response to reaching a preset target time, selecting the alarm information corresponding to the preset target time from the active queue based on the notification count and the start timestamp of the alarm information in the active queue includes:

[0132] In response to reaching a preset target time, traversing the alarm information in the active queue, and determining that the alarm information is the alarm information in the alarm task if the alarm information has not been notified for the first time;

[0133] In the case where the alarm information has been notified for the first time, determining the duration of the alarm information in the active queue based on the start timestamp of the alarm information;

[0134] When the duration reaches the preset target duration, the alarm information is determined to be the alarm information in the alarm task, wherein the preset target durations corresponding to different preset target times are different.

[0135] For example, Figure 7 FIG. 1 is a flow chart of the alarm notification module in the embodiment of the present disclosure, such as Figure 7 As shown in the figure, the alarm notification adopts three notification methods: initial notification, daily notification, and weekly notification. While notifying the system administrator, it will not cause the problem of alarm notification flooding. The specific steps are as follows:

[0136] First, determine the current time and make a judgment based on the current time;

[0137] If it is 8:00 AM on Monday, select the first task, daily task, and weekly task from the active queue;

[0138] If the current time is 8:00 AM instead of Monday, select the first task and daily tasks;

[0139] If the current time is not 8 am, only the first task will be selected;

[0140] Then, the alarm information in the selected alarm tasks is summarized according to the email address of the corresponding system administrator. After the summary is completed, the administrator's recent email notification status is determined;

[0141] If more than 4 emails are sent to the mailbox in the last day, it means that the daily limit has been reached and sending is suspended;

[0142] If more than 2 emails are sent to the mailbox in the last four hours, it means that the upper limit within four hours has been reached and sending is suspended;

[0143] If more than 1 email is sent to the mailbox in the last hour, it means that the upper limit of one hour has been reached and sending is suspended;

[0144] If the upper limit is not reached in any of the above three situations, the alarm information is formatted and packaged, an email notification is sent, and the sent email record and the current sending time are stored so as to be used as a judgment condition for subsequent sending.

[0145] Among them, the selection rule of the first task is: determine whether the alarm information has been notified for the first time. If not, it is determined as the first task, and it is marked in the database after sending the email for the first notification; the selection rule of the daily task is: if the alarm information has been notified for the first time, the duration of the alarm information is determined by the start timestamp. If the duration is greater than 24 hours, it is determined as a daily level notification, that is, a daily task; the selection rule of the weekly task is: if the duration is greater than 72 hours, a weekly level notification is made, that is, a weekly task. The sending frequency is controlled as follows: a maximum of one email is sent to an administrator's mailbox within one hour, a maximum of two emails are sent to an administrator's mailbox within four hours, and a maximum of four emails are sent to an administrator within one day.

[0146] By combining the three notification methods of initial notification, daily notification, and weekly notification with frequency limits, the system administrator can be notified in a timely manner while avoiding the problem of excessive notifications.

[0147] like Figure 8 As shown, Figure 8 is a block diagram of an alarm device shown in at least one embodiment of the present disclosure, the device comprising:

[0148] The information acquisition module 81 is used to: acquire warning information;

[0149] The queue maintenance module 82 is used to: in response to the alarm information already existing in the active queue, extend the end timestamp of the alarm information in the active queue, the active queue is used to store the alarm information in the active state, and the end timestamp is set based on the start timestamp when the alarm information is stored in the active queue;

[0150] The state updating module 83 is used to update the active queue based on the comparison result of the end timestamp and the current timestamp of each alarm information in the active queue;

[0151] The information notification module 84 is used to notify the updated alarm information in the active queue based on a preset notification condition.

[0152] In one embodiment, the information notification module 84 is specifically used to: in response to reaching a preset target time, based on the number of notifications of the alarm information in the active queue and the start timestamp, select the alarm information in the alarm task corresponding to the preset target time from the active queue; for each alarm information in the alarm task, in response to the notification frequency of the notification object to which the alarm information belongs not reaching an upper limit threshold, notify the notification object of the alarm information.

[0153] In one embodiment, the information notification module 84, when used to select the alarm information corresponding to the preset target time from the active queue based on the notification number and the start timestamp of the alarm information in the active queue in response to reaching the preset target time, is specifically used to:

[0154] In response to reaching a preset target time, traversing the alarm information in the active queue, and determining that the alarm information is the alarm information in the alarm task if the alarm information has not been notified for the first time;

[0155] In the case where the alarm information has been notified for the first time, determining the duration of the alarm information in the active queue based on the start timestamp of the alarm information;

[0156] When the duration reaches the preset target duration, the alarm information is determined to be the alarm information in the alarm task, wherein the preset target durations corresponding to different preset target times are different.

[0157] In one implementation, the information acquisition module 81 is specifically used to:

[0158] Receiving the alarm information sent by the monitored system;

[0159] Detecting the field format of the warning information;

[0160] When the field format of the alarm information meets the preset alarm specification, returning a response message of successful reception to the monitored system;

[0161] The format of the preset alarm specification is: alarm name field, alarm device address field, alarm source field, alarm severity field, alarm details field, and alarm summary field.

[0162] In one implementation, the information acquisition module 81 is further configured to:

[0163] Extracting characteristic fields of the warning information;

[0164] Performing compression calculation on the character string of the characteristic field to obtain the fingerprint field of the alarm information;

[0165] Based on the fingerprint field, it is determined whether the alarm information exists in the active queue.

[0166] In one embodiment, the queue maintenance module 82 is further configured to:

[0167] In response to the alarm information not existing in the active queue, the alarm information is stored in the active queue, wherein the start timestamp of the alarm information is set to the current time, and the end timestamp of the alarm information is set to the time after the current time is extended by a preset time period.

[0168] In one embodiment, the queue maintenance module 82 is further configured to:

[0169] In response to the alarm type of the alarm information belonging to the pre-processing type, determining whether the alarm information exists in the pre-processing queue, the pre-processing type being a type that requires multiple alarm sources to determine whether it is in an active state;

[0170] If the alarm information does not exist in the pre-processing queue, placing the alarm information in the pre-processing queue;

[0171] The pre-processing queue is traversed, and when all alarm sources corresponding to the alarm information have already sounded an alarm, it is determined that the alarm information is in an active state, and it is determined whether the alarm information exists in the active queue.

[0172] In one embodiment, the status update module 83 is used to:

[0173] Traversing the active queue, and comparing the end timestamp of the alarm information with the current timestamp;

[0174] In response to an end timestamp of the alarm information being smaller than a current timestamp, the alarm information is written to a recovered queue and the alarm information is removed from the active queue.

[0175] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0176] The present disclosure also provides an electronic device, such as Fig. 9 As shown, the electronic device includes a memory 91 and a processor 92, wherein the memory 91 is used to store computer instructions that can be executed on the processor, and the processor 92 is used to implement the alarm method described in any embodiment of the present disclosure when executing the computer instructions.

[0177] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0178] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0179] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention claimed herein. The specification is intended to cover any variations, uses or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not claimed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

[0180] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0181] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. An alarm method, characterized in that: The method comprises: Get alarm information; In response to the alarm information already existing in an active queue, extending an end timestamp of the alarm information in the active queue, the active queue being used to store the alarm information in an active state, the end timestamp being set based on a start timestamp when the alarm information is stored in the active queue; Based on the comparison result of the end timestamp and the current timestamp of each alarm information in the active queue, updating the active queue; Based on the preset notification condition, the updated alarm information in the active queue is notified.

2. The method according to claim 1, characterized in that The notifying the updated alarm information in the active queue based on the preset notification condition includes: In response to reaching a preset target time, based on the notification count and the start timestamp of the alarm information in the active queue, selecting the alarm information in the alarm task corresponding to the preset target time from the active queue; For each alarm information in the alarm task, in response to a notification frequency of a notification object to which the alarm information belongs not reaching an upper threshold, the alarm information is notified to the notification object.

3. The method according to claim 1, characterized in that In response to reaching the preset target time, based on the notification count and the start timestamp of the alarm information in the active queue, selecting the alarm information corresponding to the preset target time from the active queue includes: In response to reaching a preset target time, traversing the alarm information in the active queue, and determining that the alarm information is the alarm information in the alarm task if the alarm information has not been notified for the first time; In the case where the alarm information has been notified for the first time, determining the duration of the alarm information in the active queue based on the start timestamp of the alarm information; When the duration reaches the preset target duration, the alarm information is determined to be the alarm information in the alarm task, wherein the preset target durations corresponding to different preset target times are different.

4. The method according to claim 1, characterized in that: The obtaining of alarm information includes: Receiving the alarm information sent by the monitored system; Detecting the field format of the warning information; When the field format of the alarm information meets the preset alarm specification, returning a response message of successful reception to the monitored system; The format of the preset alarm specification is: alarm name field, alarm device address field, alarm source field, alarm severity field, alarm details field, and alarm summary field.

5. The method according to claim 1, characterized in that After obtaining the alarm information, the method further includes: Extracting characteristic fields of the warning information; Performing compression calculation on the character string of the characteristic field to obtain the fingerprint field of the alarm information; Based on the fingerprint field, it is determined whether the alarm information exists in the active queue.

6. The method according to claim 1, characterized in that The method further comprises: In response to the alarm information not existing in the active queue, the alarm information is stored in the active queue, wherein the start timestamp of the alarm information is set to the current time, and the end timestamp of the alarm information is set to the time after the current time is extended by a preset time period.

7. The method according to claim 1, characterized in that After obtaining the alarm information, the method further includes: In response to the alarm type of the alarm information belonging to the pre-processing type, determining whether the alarm information exists in the pre-processing queue, the pre-processing type being a type that requires multiple alarm sources to determine whether it is in an active state; If the alarm information does not exist in the pre-processing queue, placing the alarm information in the pre-processing queue; The pre-processing queue is traversed, and when all alarm sources corresponding to the alarm information have already sounded an alarm, it is determined that the alarm information is in an active state, and it is determined whether the alarm information exists in the active queue.

8. The method according to claim 1, characterized in that The updating of the active queue based on the comparison result of the end timestamp and the current timestamp of each alarm information in the active queue includes: Traversing the active queue, and comparing the end timestamp of the alarm information with the current timestamp; In response to an end timestamp of the alarm information being smaller than a current timestamp, the alarm information is written to a recovered queue and the alarm information is removed from the active queue.

9. An alarm device, characterized in that: The device comprises: An information acquisition module is used to obtain alarm information; a queue maintenance module, configured to, in response to the alarm information already existing in an active queue, extend an end timestamp of the alarm information in the active queue, wherein the active queue is used to store the alarm information in an active state, and the end timestamp is set based on a start timestamp when the alarm information is stored in the active queue; A status update module, configured to update the active queue based on a comparison result of an end timestamp of each alarm information in the active queue and a current timestamp; The information notification module is used to notify the updated alarm information in the active queue based on the preset notification conditions.

10. An electronic device, characterized in that: The device includes a memory and a processor, wherein the memory is used to store computer instructions that can be executed on the processor, and the processor is used to implement the alarm method described in any one of claims 1 to 8 when executing the computer instructions.

Images