An alarm intelligent dispatching method and device

Abstract

This invention relates to an intelligent alarm dispatching method and apparatus, belonging to the field of intelligent dispatching technology. The method includes: acquiring raw alarm data; preprocessing the raw alarm data and storing it in a raw alarm table; splitting the alarm circuits in the raw alarm table and storing alarm data with alarm states ADD and DEL in an alarm aggregation table; writing alarm data meeting the conditions in the alarm aggregation table into an alarm aggregation table according to the ADD and DEL alarm state aggregation algorithms; and intelligently analyzing the alarm data in the alarm aggregation table based on alarm template configuration parameters to perform dispatching processing. This invention improves dispatching efficiency and enables faster response and problem resolution by preprocessing and splitting the raw alarm data, performing aggregation analysis on the integrated alarm table, and intelligently analyzing the alarm data in the aggregation table based on alarm template configuration parameters.

Description

Technical Field

[0001] This invention belongs to the field of intelligent dispatching technology, and particularly relates to an alarm-based intelligent dispatching method and device. Background Technology

[0002] With the rapid development of internet applications and the continuous expansion of telecommunications networks, the number of alarms has increased dramatically. Due to the centralization of network monitoring, the workload of alarm dispatching is enormous, and manual dispatching is inefficient, often resulting in missed or incorrect dispatches. Summary of the Invention

[0003] In view of the shortcomings of the prior art, the purpose of the invention is to provide an alarm intelligent dispatching method and device, which not only significantly improves dispatching efficiency, reduces human intervention and delays, but also responds to and solves problems more quickly.

[0004] A first aspect of the present invention provides an intelligent alarm dispatching method, comprising:

[0005] Obtain raw alarm data;

[0006] The original alarm data is preprocessed and then stored in the original alarm table;

[0007] The alarm circuits in the original alarm table are split, and the alarm data with alarm statuses of ADD and DEL, as well as the split alarm circuits, are stored in the alarm integration table.

[0008] Based on the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm, alarm data that meets the conditions in the alarm integration table is written into the alarm aggregation table;

[0009] Based on the alarm template configuration parameters, the system intelligently analyzes the alarm data in the alarm aggregation table and dispatches alarms accordingly.

[0010] Furthermore, in the above-mentioned intelligent alarm dispatching method, the original alarm data is preprocessed and then stored in the original alarm table. The preprocessing methods include at least: splitting, formatting, normalization, deduplication, and outlier removal.

[0011] Furthermore, in the above-mentioned intelligent alarm dispatching method, the alarm data that meets the conditions in the alarm integration table is written into the alarm aggregation table according to the alarm status ADD aggregation algorithm, including:

[0012] Check if there is alarm data in the alarm consolidation table;

[0013] If the check result shows that there is no alarm data in the alarm consolidation table, insert alarm data into the alarm consolidation table;

[0014] Check if there are any alarm data in the alarm aggregation table with an alarm status of ADD;

[0015] If the check result shows that there is no alarm data with an ADD status in the alarm aggregation table, create alarm data with an ADD status in the alarm aggregation table; if the check result shows that there is alarm data in the alarm aggregation table and the alarm status is ADD, increase the alarm count in the alarm aggregation table.

[0016] Check the alarm awareness level of the alarm data. If the check result is that the alarm awareness level of the alarm data is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the check result is that the alarm awareness level of the alarm data is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0017] Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0018] Furthermore, in the above-mentioned intelligent alarm dispatching method, the alarm data that meets the conditions in the alarm integration table is written into the alarm aggregation table according to the alarm status ADD aggregation algorithm, including:

[0019] Check if there is alarm data in the alarm consolidation table;

[0020] If the check result shows that there is alarm data in the alarm integration table and the alarm status is ADD or DEL, determine the magnitude of the occurrence time of the original alarm data and the occurrence time of the alarm data in the alarm integration table;

[0021] If the determination result is that the occurrence time of the original alarm data is greater than the occurrence time of the alarm data in the alarm integration table, update the alarm occurrence time in the alarm integration table; if the determination result is that the occurrence time of the original alarm data is less than the occurrence time of the alarm data in the alarm integration table, then the data in the alarm integration table remains unchanged.

[0022] Check if there are any alarm data in the alarm aggregation table with an alarm status of ADD;

[0023] If the check result shows that there is no alarm data with an ADD status in the alarm aggregation table, create alarm data with an ADD status in the alarm aggregation table; if the check result shows that there is alarm data in the alarm aggregation table and the alarm status is ADD, increase the alarm count in the alarm aggregation table.

[0024] Check the alarm awareness level of the alarm data. If the check result is that the alarm awareness level of the alarm data is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the check result is that the alarm awareness level of the alarm data is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0025] Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0026] Furthermore, in the above-mentioned intelligent alarm dispatching method, alarm data that meets the conditions in the alarm consolidation table is written into the alarm aggregation table according to the alarm status DEL aggregation algorithm, including:

[0027] Check if there is alarm data in the alarm consolidation table;

[0028] If the check result shows that there is alarm data in the alarm consolidation table and the alarm status is DEL;

[0029] Compare the occurrence and clearance times of the original alarm data with the occurrence and clearance times of the alarm data in the alarm consolidation table;

[0030] If the determination result is that the occurrence time and clearance time of the original alarm data are greater than the occurrence time and clearance time of the alarm data in the alarm integration table, update the occurrence time and clearance time of the alarm data in the alarm integration table. If the determination result is that the occurrence time and clearance time of the original alarm data are less than the occurrence time and clearance time of the alarm data in the alarm integration table, then the data in the alarm integration table remains unchanged.

[0031] Check if there are alarms with a status of DEL in the alarm aggregation table. If the check result is that there are no alarms with a status of DEL in the alarm aggregation table, create a new alarm with a status of DEL in the alarm aggregation table. If the check result is that there are alarms with a status of DEL in the alarm aggregation table, update the alarm occurrence time and alarm time in the alarm aggregation table to the alarm clearance time. If the check result is that there are alarms with a status of ADD in the alarm aggregation table, reduce the alarm count in the alarm aggregation table. When the alarm count in the alarm aggregation table is 0, change the alarm status in the alarm aggregation table and add the alarm clearance time.

[0032] Determine the alarm awareness level of the alarm consolidation table and the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0033] Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0034] Furthermore, in the above-mentioned intelligent alarm dispatching method, alarm data that meets the conditions in the alarm consolidation table is written into the alarm aggregation table according to the alarm status DEL aggregation algorithm, including:

[0035] Check if there are any alarm data with an alarm status of DEL in the alarm consolidation table;

[0036] If the check result shows that there is no alarm data with alarm status DEL in the alarm integration table, insert the data with alarm status DEL into the alarm integration table, and update the alarm occurrence time and alarm time in the alarm integration table to the alarm clearance time.

[0037] Check if there is any alarm data with the status of DEL in the alarm aggregation table. If the check result is that there is no alarm data with the status of DEL in the alarm aggregation table, create a new alarm data with the status of DEL in the alarm aggregation table. If the check result is that there is alarm data with the status of DEL in the alarm aggregation table, check if the alarm status of the alarm aggregation table is ADD.

[0038] If the check result shows that the alarm status of the alarm aggregation table is ADD, change the alarm status of the alarm aggregation table and add the alarm data clearing time.

[0039] Determine the alarm awareness level of the alarm consolidation table and the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0040] Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0041] Furthermore, the aforementioned intelligent alarm dispatching method also includes:

[0042] Determine whether the alarm has been cleared within the set time period;

[0043] If the judgment result is that the item has not been cleared within the set time period, an automatic order will be dispatched; if the judgment result is that the item has been cleared within the set time period, no order will be dispatched.

[0044] A second aspect of the present invention also provides an alarm-based intelligent dispatching device, comprising:

[0045] Acquisition module: Used to acquire raw alarm data;

[0046] Preprocessing module: Used to preprocess the raw alarm data and then store it in the raw alarm table;

[0047] Storage module: used to split the alarm circuits in the original alarm table, store the alarm data with alarm status of ADD and DEL and the split alarm circuits into the alarm integration table;

[0048] Write module: Used to write alarm data that meets the conditions in the alarm integration table into the alarm aggregation table according to the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm;

[0049] Alarm Dispatch Module: Used to intelligently analyze alarm data in the alarm aggregation table based on alarm template configuration parameters and dispatch alarms accordingly.

[0050] A third aspect of the present invention also provides an electronic device comprising: a processor and a memory;

[0051] The processor executes one of the above-mentioned intelligent alarm dispatching methods by calling programs or instructions stored in memory.

[0052] In a fourth aspect, the present invention also provides a computer-readable storage medium that stores a program or instructions that cause a computer to execute an alarm intelligent dispatching method as described above.

[0053] The beneficial effects of this invention are as follows: This invention acquires raw alarm data; preprocesses the raw alarm data and stores it in a raw alarm table; splits the alarm circuits in the raw alarm table and stores alarm data with alarm states ADD and DEL in an alarm consolidation table; writes alarm data that meets the conditions in the alarm consolidation table into the alarm aggregation table according to the alarm state ADD aggregation algorithm and the alarm state DEL aggregation algorithm; and intelligently analyzes the alarm data in the alarm aggregation table based on alarm template configuration parameters to perform dispatch processing. This invention preprocesses and splits the raw alarm data to obtain an alarm consolidation table, performs aggregation analysis on the alarm consolidation table to obtain an alarm aggregation table, and intelligently analyzes the alarm data in the alarm aggregation table based on alarm template configuration parameters to perform dispatch processing, which not only improves dispatch efficiency and reduces human intervention and delays, but also enables faster response and problem resolution. Attached Figure Description

[0054] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0055] Figure 1 A diagram illustrating an intelligent alarm dispatching method provided in an embodiment of the present invention;

[0056] Figure 2 This invention provides a method for aggregating alarm data using the ADD aggregation algorithm. Figure 1 ;

[0057] Figure 3 This invention provides a method for aggregating alarm data using the ADD aggregation algorithm. Figure 2 ;

[0058] Figure 4 This invention provides a method for aggregating alarm data using the DEL aggregation algorithm. Figure 1 ;

[0059] Figure 5 This invention provides a method for aggregating alarm data using the DEL aggregation algorithm. Figure 2 ;

[0060] Figure 6 A diagram of an intelligent alarm dispatching device provided in an embodiment of the present invention;

[0061] Figure 7 This is a schematic block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0062] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0063] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0064] In the description of this invention, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0065] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0066] This invention proposes an intelligent alarm dispatching method, device, electronic device, and storage medium, which not only significantly improves dispatching efficiency and reduces human intervention and delays, but also enables faster response and problem resolution.

[0067] Method Implementation Examples

[0068] Figure 1 This diagram illustrates an intelligent alarm dispatching method provided in an embodiment of the present invention.

[0069] In a first aspect, the present invention proposes an intelligent alarm dispatching method, combining... Figure 1 It includes five steps, S1 to S5:

[0070] S1: Obtain raw alarm data.

[0071] Specifically, in this embodiment of the invention, the original alarm data is the original alarm information pushed by the KAFKA Channel Consumer Group Integrated Alarm System.

[0072] S2: The original alarm data is preprocessed and then stored in the original alarm table.

[0073] Specifically, in this embodiment of the invention, the original alarm data is split, formatted, normalized, deduplicated, and de-outliered before being stored in the original alarm table, so that the data in the original alarm table is accurate and subsequent data processing is faster and more accurate.

[0074] S3: Split the alarm circuits in the original alarm table, store the alarm data with alarm statuses of ADD and DEL, and the split alarm circuits into the alarm integration table.

[0075] Specifically, in this embodiment of the invention, the alarm circuits in the original alarm table are split based on information such as circuit name, alarm ID, alarm source, and alarm type. The alarm integration table stores alarm data for alarm circuits that have been split and alarms with alarm statuses of ADD and DEL.

[0076] S4: Write the alarm data that meets the conditions in the alarm integration table into the alarm aggregation table according to the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm.

[0077] Specifically, in this embodiment of the invention, writing alarm data that meets the conditions in the alarm integration table into the alarm aggregation table according to the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm is performed by comparing the alarm status, alarm time, alarm level, alarm count, etc. in the alarm integration table and the alarm aggregation table based on the alarm status ADD or DEL and six data columns. The specific method is described in detail below.

[0078] S5: Intelligently analyzes alarm data in the alarm aggregation table based on alarm template configuration parameters and dispatches alarms accordingly.

[0079] Specifically, in this embodiment of the invention, the dispatching process is intelligent dispatching. Intelligent dispatching is implemented through the DCOOS interface, using HTTP+JSON format to interconnect with the integrated dispatching system. Alarm dispatching rules are set in the alarm template, and the alarm data in the alarm aggregation table is intelligently analyzed. For alarm circuits that meet the dispatching rules, they are automatically dispatched to the dispatching department according to the circuit attributes. The dispatching department then dispatches the alarm fault order to the designated receiving workstation for fault handling.

[0080] Figure 2 This invention provides a method for aggregating alarm data using the ADD aggregation algorithm. Figure 1 .

[0081] Furthermore, in the aforementioned intelligent alarm dispatching method, alarm data meeting certain conditions in the alarm consolidation table are written into the alarm aggregation table based on the alarm status ADD aggregation algorithm, combined with... Figure 2 It includes six steps, S21 to S26:

[0082] S21: Check if there is alarm data in the alarm consolidation table;

[0083] S22: If the check result shows that there is no alarm data in the alarm consolidation table, insert alarm data into the alarm consolidation table;

[0084] S23: Check if there are any alarm data with an alarm status of ADD in the alarm aggregation table;

[0085] S24: If the check result shows that there is no alarm data with an alarm status of ADD in the alarm aggregation table, create alarm data with an alarm status of ADD in the alarm aggregation table; if the check result shows that there is alarm data in the alarm aggregation table and the alarm status is ADD, increase the alarm count in the alarm aggregation table.

[0086] S25: Check the alarm awareness level of the alarm data. If the check result is that the alarm awareness level of the alarm data is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the check result is that the alarm awareness level of the alarm data is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0087] S26: Check if the alarm status of the alarm aggregation table is DEL. If the check result is that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0088] Specifically, in this embodiment of the invention, the alarm aggregation table is checked based on six data columns: domain, alarm_source, alarm_type, probable_cause, alarm_location, and cir_name. Steps S21 to S26 are methods for aggregating alarm data based on whether there is alarm data in the alarm integration table or alarm data with an ADD status in the alarm aggregation table.

[0089] Figure 3 This invention provides a method for aggregating alarm data using the ADD aggregation algorithm. Figure 2 .

[0090] Furthermore, in the aforementioned intelligent alarm dispatching method, alarm data meeting certain conditions in the alarm consolidation table are written into the alarm aggregation table based on the alarm status ADD aggregation algorithm, combined with... Figure 3 It includes seven steps, S31 to S37:

[0091] S31: Check if there is alarm data in the alarm consolidation table;

[0092] S32: If the check result shows that there is alarm data in the alarm integration table and the alarm status is ADD or DEL, determine the magnitude of the occurrence time of the original alarm data and the occurrence time of the alarm data in the alarm integration table;

[0093] S33: If the judgment result is that the occurrence time of the original alarm data is greater than the occurrence time of the alarm data in the alarm integration table, update the alarm occurrence time in the alarm integration table; if the judgment result is that the occurrence time of the original alarm data is less than the occurrence time of the alarm data in the alarm integration table, the data in the alarm integration table remains unchanged.

[0094] S34: Check if there are any alarm data with an alarm status of ADD in the alarm aggregation table;

[0095] S35: If the check result shows that there is no alarm data with an alarm status of ADD in the alarm aggregation table, create alarm data with an alarm status of ADD in the alarm aggregation table; if the check result shows that there is alarm data in the alarm aggregation table and the alarm status is ADD, increase the alarm count in the alarm aggregation table.

[0096] S36: Check the alarm awareness level of the alarm data. If the check result is that the alarm awareness level of the alarm data is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the check result is that the alarm awareness level of the alarm data is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0097] S37: Check if the alarm status of the alarm aggregation table is DEL. If the check result is that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0098] Specifically, in this embodiment of the invention, the alarm aggregation table is checked based on six data columns: domain, alarm_source, alarm_type, probable_cause, alarm_location, and cir_name. Steps S31 to S37 are a method for aggregating alarm data based on whether the alarm integration table contains alarm data or whether the alarm aggregation table contains alarm data with an ADD status.

[0099] Figure 4 This invention provides a method for aggregating alarm data using the DEL aggregation algorithm. Figure 1 .

[0100] Furthermore, in the aforementioned intelligent alarm dispatching method, alarm data meeting the conditions in the alarm consolidation table are written into the alarm aggregation table according to the alarm status DEL aggregation algorithm, combined with... Figure 4 It includes seven steps, S41 to S47:

[0101] S41: Check if there is alarm data in the alarm consolidation table;

[0102] S42: If the check result shows that there is alarm data in the alarm consolidation table and the alarm status is DEL;

[0103] S43: Compare the occurrence and clearance times of the original alarm data with the occurrence and clearance times of the alarm data in the alarm consolidation table;

[0104] S44: If the judgment result is that the occurrence time and clearing time of the original alarm data are greater than the occurrence time and clearing time of the alarm data in the alarm integration table, update the occurrence time and clearing time of the alarm data in the alarm integration table. If the judgment result is that the occurrence time and clearing time of the original alarm data are less than the occurrence time and clearing time of the alarm data in the alarm integration table, then the data in the alarm integration table remains unchanged.

[0105] S45: Check if there is any alarm data with the alarm status of DEL in the alarm aggregation table. If the check result is that there is no alarm data with the alarm status of DEL in the alarm aggregation table, create a new alarm data with the alarm status of DEL in the alarm aggregation table. If the check result is that there is alarm data with the alarm status of DEL in the alarm aggregation table, update the alarm occurrence time and alarm time in the alarm aggregation table to the alarm clearance time. If the check result is that there is alarm data with the alarm status of ADD in the alarm aggregation table, reduce the alarm count in the alarm aggregation table. When the alarm count in the alarm aggregation table is 0, change the alarm status in the alarm aggregation table and add the alarm clearance time.

[0106] S46: Determine the difference between the alarm awareness level of the alarm integration table and the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm integration table is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm integration table is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0107] S47: Check if the alarm status of the alarm aggregation table is DEL. If the check result is that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0108] Specifically, in this embodiment of the invention, the alarm aggregation table is checked based on six data columns: domain, alarm_source, alarm_type, probable_cause, alarm_location, and cir_name. Steps S41 to S47 are a method for aggregating alarm data that exists in the alarm integration table and whose alarm status is DEL, and for aggregating alarm data with or without alarm status DEL in the alarm aggregation table.

[0109] Figure 5 This invention provides a method for aggregating alarm data using the DEL aggregation algorithm. Figure 2 .

[0110] Furthermore, in the aforementioned intelligent alarm dispatching method, alarm data meeting the conditions in the alarm consolidation table are written into the alarm aggregation table according to the alarm status DEL aggregation algorithm, combined with... Figure 5 It includes six steps, S51 to S56:

[0111] S51: Check if there are any alarm data with an alarm status of DEL in the alarm consolidation table;

[0112] S52: If the check result shows that there is no alarm data with alarm status DEL in the alarm integration table, insert the data with alarm status DEL into the alarm integration table, and update the alarm occurrence time and alarm time in the alarm integration table to the alarm clearance time.

[0113] S53: Check if there is any alarm data with the alarm status of DEL in the alarm aggregation table. If the check result is that there is no alarm data with the alarm status of DEL in the alarm aggregation table, create a new alarm data with the alarm status of DEL in the alarm aggregation table. If the check result is that there is alarm data with the alarm status of DEL in the alarm aggregation table, check if the alarm status of the alarm aggregation table is ADD.

[0114] S54: If the check result shows that the alarm status of the alarm aggregation table is ADD, change the alarm status of the alarm aggregation table and add the alarm data clearing time.

[0115] S55: Determine the difference between the alarm awareness level of the alarm integration table and the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm integration table is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm integration table is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table.

[0116] S56: Check if the alarm status of the alarm aggregation table is DEL. If the check result is that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

[0117] Specifically, in this embodiment of the invention, the alarm aggregation table is checked based on six data columns: domain, alarm_source, alarm_type, probable_cause, alarm_location, and cir_name. Steps S51 to S56 are methods for aggregating alarm data based on whether or not there is alarm data with the alarm status of DEL in the alarm aggregation table.

[0118] Furthermore, the aforementioned intelligent alarm dispatching method also includes:

[0119] Determine whether the alarm has been cleared within the set time period;

[0120] If the judgment result is that the item has not been cleared within the set time period, an automatic order will be dispatched; if the judgment result is that the item has been cleared within the set time period, no order will be dispatched.

[0121] Specifically, in this embodiment of the invention, intelligent work order dispatch can be a delayed processing method, which determines whether the alarm has been cleared within a set time period; if the determination result is that it has not been cleared within the set time period, automatic work order dispatch is performed; if it has been cleared within the set time period, it is regarded as an instantaneous alarm and no work order is dispatched.

[0122] Device Examples

[0123] Figure 6 This is a diagram of an intelligent alarm dispatching device provided in an embodiment of the present invention.

[0124] In a second aspect, the present invention also proposes an alarm-based intelligent dispatching device, combined with Figure 6 ,include:

[0125] Acquisition Module 61: Used to acquire raw alarm data.

[0126] Specifically, in this embodiment of the invention, the acquisition module 61 acquires the original alarm data through the original alarm information pushed by the KAFKA Channel Consumer Group Integrated Alarm System.

[0127] Preprocessing module 62: Used to preprocess the original alarm data and then store it in the original alarm table.

[0128] Specifically, in this embodiment of the invention, the preprocessing module 62 performs operations such as splitting, formatting, normalizing, deduplicating, and removing outliers on the original alarm data and then stores it in the original alarm table, so that the data in the original alarm table is accurate and subsequent data processing is faster and more accurate.

[0129] Storage module 63: used to split the alarm circuits in the original alarm table, store the alarm data of ADD and DEL states and the split alarm circuits into the alarm integration table.

[0130] Specifically, in this embodiment of the invention, the storage module 63 splits the alarm circuits in the original alarm table based on information such as circuit name, alarm ID, alarm source, and alarm type. The alarm integration table stores alarm data that has been split into alarm circuits and alarms with alarm statuses of ADD and DEL.

[0131] Write module 64: Used to write alarm data that meets the conditions in the alarm integration table into the alarm aggregation table according to the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm.

[0132] Specifically, in this embodiment of the invention, the writing module 64 writes alarm data that meets the conditions in the alarm integration table into the alarm aggregation table according to the alarm status ADD or DEL aggregation algorithm and the alarm status DEL aggregation algorithm. This is done by performing aggregation calculations based on the alarm status ADD or DEL and six data columns, comparing the alarm status, alarm time, alarm level, alarm count, etc. in the alarm integration table and the alarm aggregation table. The specific method is described in detail below.

[0133] Dispatch module 65: Used to intelligently analyze alarm data in the alarm aggregation table based on alarm template configuration parameters and dispatch alarms accordingly.

[0134] Specifically, in this embodiment of the invention, the dispatch module 65 performs intelligent dispatch. Intelligent dispatch is implemented through the DCOOS interface, using HTTP+JSON format to interconnect with the integrated dispatch system. Alarm dispatch rules are set in the alarm template, and the alarm data in the alarm aggregation table is intelligently analyzed. For alarm circuits that meet the dispatch rules, they are automatically dispatched to the dispatch department according to the circuit attributes. The dispatch department then dispatches the alarm fault order to the corresponding designated receiving workstation for fault handling.

[0135] A third aspect of the present invention also provides an electronic device comprising: a processor and a memory;

[0136] The processor executes one of the above-mentioned intelligent alarm dispatching methods by calling programs or instructions stored in memory.

[0137] In a fourth aspect, the present invention also provides a computer-readable storage medium that stores a program or instructions that cause a computer to execute an alarm intelligent dispatching method as described above.

[0138] Figure 7 This is a schematic block diagram of an electronic device provided in an embodiment of the present invention.

[0139] like Figure 7 As shown, the electronic device includes at least one processor 701, at least one memory 702, and at least one communication interface 703. The various components of the electronic device are coupled together via a bus system 704. The communication interface 703 is used for information transmission with external devices. It is understood that the bus system 704 is used to implement communication between these components. In addition to a data bus, the bus system 704 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 7 The general designated all buses as Bus System 704.

[0140] It is understood that the memory 702 in this embodiment may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.

[0141] In some implementations, memory 702 stores elements such as executable units or data structures, or subsets thereof, or extended sets thereof: operating systems and applications.

[0142] The operating system includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application programs include various applications, such as media players and browsers, used to implement various application functions. The program implementing any method in the intelligent alarm dispatching method provided in this embodiment of the invention can be included in the application programs.

[0143] In this embodiment of the invention, the processor 701 executes the steps of various embodiments of the alarm intelligent dispatching method provided by the present invention by calling the program or instructions stored in the memory 702, specifically, the program or instructions stored in the application program.

[0144] Obtain raw alarm data;

[0145] The raw alarm data is preprocessed and then stored in the raw alarm table;

[0146] The alarm circuits in the original alarm table are split and the alarm data in the ADD and DEL states are stored in the alarm integration table;

[0147] Based on the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm, alarm data that meets the conditions in the alarm integration table is written into the alarm aggregation table;

[0148] Based on the alarm template configuration parameters, the system intelligently analyzes the alarm data in the alarm aggregation table and dispatches alarms accordingly.

[0149] Any method in the intelligent alarm dispatching method provided in this embodiment of the invention can be applied to, or implemented by, the processor 701. The processor 701 can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 701 or by instructions in software form. The processor 701 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor.

[0150] In the intelligent alarm dispatching method provided by this invention, any step of the method can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software units in the decoding processor. The software unit can reside in a random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 702, and processor 701 reads the information in memory 702 and combines it with its hardware to complete the steps of the method.

[0151] Those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention and form different embodiments.

[0152] Those skilled in the art will understand that the descriptions of the various embodiments have different focuses, and for parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0153] Although embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention. All such modifications and variations fall within the scope defined by the appended claims. The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0154] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An intelligent alarm dispatching method, characterized in that, include: Obtain raw alarm data; The original alarm data is preprocessed and then stored in the original alarm table; The alarm circuits in the original alarm table are split, and the alarm data with alarm statuses of ADD and DEL, as well as the split alarm circuits, are stored in the alarm integration table. Based on the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm, alarm data that meets the conditions in the alarm integration table is written into the alarm aggregation table; Based on the intelligent analysis of alarm template configuration parameters, alarm data in the alarm aggregation table is dispatched. The alarm data that meets the conditions in the alarm aggregation table is written into the alarm aggregation table according to the alarm status ADD aggregation algorithm, including: Check if there is alarm data in the alarm consolidation table; If the check result shows that there is no alarm data in the alarm consolidation table, insert alarm data into the alarm consolidation table; Check if there are any alarm data in the alarm aggregation table with an alarm status of ADD; If the check result shows that there is no alarm data with an ADD status in the alarm aggregation table, create alarm data with an ADD status in the alarm aggregation table; if the check result shows that there is alarm data in the alarm aggregation table and the alarm status is ADD, increase the alarm count in the alarm aggregation table. Check the alarm awareness level of the alarm data. If the check result is that the alarm awareness level of the alarm data is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the check result is that the alarm awareness level of the alarm data is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table. Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

2. The intelligent alarm dispatching method according to claim 1, characterized in that, The original alarm data is preprocessed and then stored in the original alarm table. The preprocessing methods include at least: splitting, formatting, normalizing, deduplication, and outlier removal.

3. The intelligent alarm dispatching method according to claim 1, characterized in that, The alarm data that meets the conditions in the alarm aggregation table is written into the alarm aggregation table according to the alarm status ADD aggregation algorithm, including: Check if there is alarm data in the alarm consolidation table; If the check result shows that there is alarm data in the alarm integration table and the alarm status is ADD or DEL, determine the magnitude of the occurrence time of the original alarm data and the occurrence time of the alarm data in the alarm integration table; If the determination result is that the occurrence time of the original alarm data is greater than the occurrence time of the alarm data in the alarm integration table, update the alarm occurrence time in the alarm integration table; if the determination result is that the occurrence time of the original alarm data is less than the occurrence time of the alarm data in the alarm integration table, the data in the alarm integration table remains unchanged. Check if there are any alarm data in the alarm aggregation table with an alarm status of ADD; If the check result shows that there is no alarm data with an ADD status in the alarm aggregation table, create alarm data with an ADD status in the alarm aggregation table; if the check result shows that there is alarm data in the alarm aggregation table and the alarm status is ADD, increase the alarm count in the alarm aggregation table. Check the alarm awareness level of the alarm data. If the check result is that the alarm awareness level of the alarm data is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the check result is that the alarm awareness level of the alarm data is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table. Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

4. The intelligent alarm dispatching method according to claim 1, characterized in that, Based on the alarm status DEL aggregation algorithm, alarm data that meets the conditions in the alarm consolidation table is written into the alarm aggregation table, including: Check if there is alarm data in the alarm consolidation table; If the check result shows that there is alarm data in the alarm consolidation table and the alarm status is DEL; Compare the occurrence and clearance times of the original alarm data with the occurrence and clearance times of the alarm data in the alarm consolidation table; If the determination result is that the occurrence time and clearance time of the original alarm data are greater than the occurrence time and clearance time of the alarm data in the alarm integration table, update the occurrence time and clearance time of the alarm data in the alarm integration table. If the determination result is that the occurrence time and clearance time of the original alarm data are less than the occurrence time and clearance time of the alarm data in the alarm integration table, then the data in the alarm integration table remains unchanged. Check if there are alarms with a status of DEL in the alarm aggregation table. If the check result is that there are no alarms with a status of DEL in the alarm aggregation table, create a new alarm with a status of DEL in the alarm aggregation table. If the check result is that there are alarms with a status of DEL in the alarm aggregation table, update the alarm occurrence time and alarm time in the alarm aggregation table to the alarm clearance time. If the check result is that there are alarms with a status of ADD in the alarm aggregation table, reduce the alarm count in the alarm aggregation table. When the alarm count in the alarm aggregation table is 0, change the alarm status in the alarm aggregation table and add the alarm clearance time. Determine the alarm awareness level of the alarm consolidation table and the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table. Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

5. The intelligent alarm dispatching method according to claim 1, characterized in that, Based on the alarm status DEL aggregation algorithm, alarm data that meets the conditions in the alarm consolidation table is written into the alarm aggregation table, including: Check if there are any alarm data with an alarm status of DEL in the alarm consolidation table; If the check result shows that there is no alarm data with alarm status DEL in the alarm integration table, insert the data with alarm status DEL into the alarm integration table, and update the alarm occurrence time and alarm time in the alarm integration table to the alarm clearance time. Check if there is any alarm data with the status of DEL in the alarm aggregation table. If the check result is that there is no alarm data with the status of DEL in the alarm aggregation table, create a new alarm data with the status of DEL in the alarm aggregation table. If the check result is that there is alarm data with the status of DEL in the alarm aggregation table, check if the alarm status of the alarm aggregation table is ADD. If the check result shows that the alarm status of the alarm aggregation table is ADD, change the alarm status of the alarm aggregation table and add the alarm data clearing time. Determine the alarm awareness level of the alarm consolidation table and the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the alarm awareness level of the alarm consolidation table is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table. Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

6. The intelligent alarm dispatching method according to claim 1, characterized in that, The method further includes: Determine whether the alarm has been cleared within the set time period; If the judgment result is that the item has not been cleared within the set time period, an automatic order will be dispatched; if the judgment result is that the item has been cleared within the set time period, no order will be dispatched.

7. An alarm-based intelligent dispatching device, characterized in that, include: Acquisition module: Used to acquire raw alarm data; Preprocessing module: used to preprocess the original alarm data and then store it in the original alarm table; Storage module: used to split the alarm circuits in the original alarm table, store the alarm data with alarm status of ADD and DEL and the split alarm circuits into the alarm integration table; Write module: Used to write alarm data that meets the conditions in the alarm integration table into the alarm aggregation table according to the alarm status ADD aggregation algorithm and the alarm status DEL aggregation algorithm; The dispatch module is used to intelligently analyze and dispatch alarm data in the alarm aggregation table based on the alarm template configuration parameters. The alarm data that meets the conditions in the alarm aggregation table is written into the alarm aggregation table according to the alarm status ADD aggregation algorithm, including: Check if there is alarm data in the alarm consolidation table; If the check result shows that there is no alarm data in the alarm consolidation table, insert alarm data into the alarm consolidation table; Check if there are any alarm data in the alarm aggregation table with an alarm status of ADD; If the check result shows that there is no alarm data with an ADD status in the alarm aggregation table, create alarm data with an ADD status in the alarm aggregation table; if the check result shows that there is alarm data in the alarm aggregation table and the alarm status is ADD, increase the alarm count in the alarm aggregation table. Check the alarm awareness level of the alarm data. If the check result is that the alarm awareness level of the alarm data is greater than the alarm awareness level of the alarm aggregation table, update the alarm awareness level of the alarm aggregation table. If the check result is that the alarm awareness level of the alarm data is less than the alarm awareness level of the alarm aggregation table, do not update the alarm awareness level of the alarm aggregation table. Check if the alarm status of the alarm aggregation table is DEL. If the check result shows that the alarm status of the alarm aggregation table is DEL, no operation is performed on the alarm aggregation table.

8. An electronic device, characterized in that, include: Processor and memory; The processor executes an alarm intelligent dispatch method as described in any one of claims 1 to 6 by calling the program or instructions stored in the memory.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program or instructions that cause a computer to execute an alarm intelligent dispatching method as described in any one of claims 1 to 6.

Images