Alarm event convergence method and device

Abstract

The invention relates to an alarm event convergence method and device, and belongs to the technical field of alarm event convergence, and the method comprises the steps: receiving alarm event data by using an Nginx cluster reverse proxy dynamically extensible distributed receiving data rear-end cluster; the alarm event data are written into a Rocket MQ distributed cluster; the convergence cluster monitors the corresponding Topic of the Rocket MQ distributed cluster, and after the current alarm event information pushed by the monitored Rocket MQ is received, convergence calculation is carried out on the current alarm event; wherein the convergence calculation of the current alarm event comprises the following steps: combining different convergence dimension sets according to the current alarm event information; matching a predefined convergence rule by using a multi-thread technology according to different convergence dimension sets; and querying the existing alarm event information according to the matched predefined convergence rule, and carrying out convergence combination on the current alarm event and the existing convergence alarm event according to a query result.

Description

Technical Field

[0001] The present invention belongs to the technical field of alarm event convergence, and in particular relates to an alarm event convergence method and device. Background Art

[0002] With the development of the Internet of Things (IoT), various devices and systems connected to the Internet will generate a large amount of alarm event information when they are abnormal. Traditional alarm event convergence systems usually face the following problems when dealing with a large amount of alarm data information:

[0003] Slow convergence speed: Traditional alarm event convergence systems often adopt a monolithic architecture and cannot dynamically expand when they cannot handle a large amount of alarm data.

[0004] Fixed convergence degree of alarm information: In traditional alarm event convergence systems, the convergence indicator dimensions are relatively fixed and cannot be customized.

[0005] Poor convergence of alarm information: Traditional alarm event convergence systems have a relatively single dimension of convergence indicators and poor convergence of alarm events. When a large number of alarms are generated, it is easy to cause a large number of repeated and invalid alarm events, affecting the judgment of monitoring and operation and maintenance personnel.

[0006] In summary, the traditional alarm event convergence system has problems such as slow convergence speed, fixed convergence degree of alarm information, and poor convergence degree of alarm information. Therefore, a more comprehensive and reliable alarm event convergence solution is needed to address these problems. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the purpose of the invention is to provide an alarm event convergence method and device, which performs multi-threaded computing convergence on alarm events and efficiently calculates converged alarm events, which not only reduces the impact of convergence calculations on the timeliness of alarm notifications, but also avoids the interference of a large number of alarms to monitoring and operation and maintenance personnel through convergence.

[0008] A first aspect of the present invention provides an alarm event convergence method, comprising:

[0009] Use Nginx cluster reverse proxy to dynamically expand the distributed data receiving backend cluster to receive alarm event data;

[0010] Write alarm event data to the RocketMQ distributed cluster;

[0011] The convergence cluster monitors the corresponding Topic of the RocketMQ distributed cluster. After receiving the current alarm event information pushed by the monitored RocketMQ, it performs convergence calculation on the current alarm event.

[0012] The convergence calculation of the current alarm event includes:

[0013] Different convergence dimension sets are formed according to the current alarm event information;

[0014] Use multi-threading technology to match pre-defined convergence rules according to different sets of convergence dimensions;

[0015] The existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event is converged and merged with the existing convergence alarm event according to the query result.

[0016] Furthermore, the above-mentioned alarm event convergence method further includes:

[0017] Use multi-threading technology to match pre-defined convergence rules according to different sets of convergence dimensions;

[0018] When no predefined convergence rule is matched, the default convergence rule is returned.

[0019] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, including:

[0020] According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information;

[0021] If the query result shows that the current alarm event exists in the existing convergence alarm event information, query whether there is a converged event detail that is the same as the current alarm event under the convergence alarm event;

[0022] If the query result shows that there is a convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the status of the current alarm event information is an alarm status;

[0023] If the judgment result is that the state of the current alarm event information is an alarm state, the alarm count of the convergence alarm event details that is the same as the current alarm event in the existing alarm event information is updated by adding 1, and the alarm count of the existing convergence alarm event is updated by adding 1.

[0024] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, including:

[0025] According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information;

[0026] If the query result is that the current alarm event information does not exist in the existing convergence alarm event information, determine whether the state of the current alarm event information is an alarm state;

[0027] If the judgment result is that the state of the current alarm event is an alarm state, new alarm event data is generated based on the existing convergence alarm event information, and an alarm is pushed; if the judgment result is that the state of the current alarm event is a recovery state, the convergence merge is terminated.

[0028] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, including:

[0029] According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information;

[0030] If the query result shows that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event;

[0031] If the query result is that there is no convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the status of the current alarm event information is an alarm status;

[0032] If the judgment result is that the status of the current alarm event is an alarm status, the current alarm event will be converged to the existing convergence alarm event, and the convergence event details will be generated based on the current alarm event information, and the alarm count of the existing convergence alarm event will be updated plus 1; if the judgment result is that the status of the current alarm event is not an alarm status, the convergence merge will be terminated.

[0033] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, including:

[0034] According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information;

[0035] If the query result shows that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event;

[0036] If the query result shows that there is a convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the status of the current alarm event information is an alarm status;

[0037] If the judgment result is that the status of the current alarm event information is not an alarm status, the status of the convergence alarm event details is updated to recovery, and it is judged whether the status of the convergence alarm event details under the existing convergence alarm events is all recovered;

[0038] If the judgment result is the convergence alarm event details status under the existing convergence alarm event, the existing convergence alarm event is updated to recovery, and the convergence merge is ended.

[0039] Furthermore, in the above-mentioned alarm event convergence method, the predefined convergence rules are defined in a convergence rule definition module, and the predefined convergence rules at least include: product, project, indicator, computer room and IP of the event.

[0040] A second aspect of the present invention further provides an alarm event convergence device, comprising:

[0041] Receiving module: used to receive alarm event data using the Nginx cluster reverse proxy, which is a dynamically scalable distributed receiving data backend cluster;

[0042] Writing module: used to write the alarm event data into the RocketMQ distributed cluster;

[0043] Convergence calculation module: used for the convergence cluster to monitor the corresponding Topic of the RocketMQ distributed cluster. After receiving the current alarm event information pushed by the monitored RocketMQ, it performs convergence calculation on the current alarm event.

[0044] The convergence calculation module performs convergence calculation on the current alarm event, including:

[0045] Combination unit: used to combine different convergence dimension sets according to current alarm event information;

[0046] Matching unit: used to match predefined convergence rules using multi-threading technology according to different convergence dimension sets;

[0047] Convergence merging unit: used to query the existing alarm event information according to the matched pre-defined convergence rules, and converge and merge the current alarm event with the existing convergence alarm event according to the query result.

[0048] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor and a memory;

[0049] The processor is used to execute any one of the above alarm event convergence methods by calling the program or instruction stored in the memory.

[0050] In a fourth aspect of the present invention, a computer-readable storage medium is further proposed, wherein the computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute any one of the above alarm event convergence methods.

[0051] The beneficial effects of the present invention are as follows: by using distributed multi-threaded dynamic expansion technology, the present invention can ensure that when a large amount of alarm event data appears, the receiving service can receive and process it in time to avoid message blocking; the RocketMQ message queue is used to store the alarm event data received by the receiving end to buffer the impact of a large amount of alarm data on the convergence service; the multi-dimensional indicator convergence algorithm is used to perform multi-threaded calculation convergence on the alarm event, which can efficiently calculate the converged alarm event and avoid the interference of a large number of alarms on monitoring and operation and maintenance personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0053] Figure 1 A diagram of an alarm event convergence method provided by an embodiment of the present invention;

[0054] Figure 2 A method diagram for performing convergence calculation on a current alarm event provided by an embodiment of the present invention;

[0055] Figure 3 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 1 ;

[0056] Figure 4 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 2 ;

[0057] Figure 5 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 3 ;

[0058] Figure 6 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 4 ;

[0059] Figure 7 A diagram of an alarm event convergence device provided by an embodiment of the present invention;

[0060] Figure 8 A schematic block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.

[0062] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.

[0063] In the description of the present invention, the terms "first", "second", and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be internal communication between two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0064] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.

[0065] The present invention proposes an alarm event convergence method, device, electronic device and storage medium, which perform multi-threaded calculation convergence on alarm events and efficiently calculate converged alarm events, which not only reduces the impact of convergent calculation on the timeliness of alarm notification, but also avoids the interference of a large number of alarms to monitoring and operation and maintenance personnel through convergence.

[0066] Before introducing the embodiments of the present invention, professional terms involved in the present invention are first introduced.

[0067] RocketMQ: A message queue.

[0068] Method Embodiment

[0069] Figure 1 A diagram of an alarm event convergence method provided by an embodiment of the present invention.

[0070] In the first aspect of the present invention, a method for converging alarm events is proposed, combining Figure 1 , including three steps from S1 to S3:

[0071] S1: Use Nginx cluster reverse proxy to dynamically expand the distributed data receiving backend cluster to receive alarm event data.

[0072] Specifically, in the embodiment of the present invention, a dynamically expandable backend distributed cluster is implemented through the Nginx cluster reverse proxy to realize real-time and efficient reception of alarm data generated from various systems. Distributed multi-threaded dynamic capacity expansion technology is used here to ensure that when a large amount of alarm event data appears, the backend receiving service can receive and process it in time to avoid message blocking.

[0073] S2: Write the alarm event data to the RocketMQ distributed cluster.

[0074] Specifically, in the embodiment of the present invention, the alarm event data is written into the RocketMQ distributed cluster, and the RocketMQ distributed cluster is used to store the received alarm event data to buffer the impact of a large amount of alarm data on the convergence service.

[0075] S3: The convergence cluster monitors the corresponding Topic of the RocketMQ distributed cluster, and after receiving the current alarm event information pushed by the monitored RocketMQ, it performs convergence calculation on the current alarm event.

[0076] Specifically, in the embodiment of the present invention, a method for performing convergence calculation on the current alarm event is described in detail below.

[0077] Figure 2 A diagram of a method for performing convergence calculation on a current alarm event provided by an embodiment of the present invention.

[0078] Step S3 performs convergence calculation on the current alarm event, including three steps from S21 to S23:

[0079] S21: Combining different convergence dimension sets according to the current alarm event information.

[0080] Specifically, in the embodiment of the present invention, the alarm event information is arranged and combined according to information such as product project indicators, computer room IP, etc. to obtain different convergence dimension sets.

[0081] S22: Use multi-threading technology to match pre-defined convergence rules according to different convergence dimension sets.

[0082] Specifically, in the embodiment of the present invention, a multi-thread technology is used to query and match predefined convergence rules from Redis, and when one is matched, the predefined convergence rule is matched.

[0083] S23: querying existing alarm event information according to the matched predefined convergence rule, and performing convergence merging on the current alarm event and the existing convergence alarm event according to the query result.

[0084] Specifically, in an embodiment of the present invention, a method for querying existing alarm event information according to a matched predefined convergence rule and performing convergence merging of the current alarm event with the existing convergence alarm event according to the query result is described in detail below.

[0085] Furthermore, the above-mentioned alarm event convergence method further includes:

[0086] Use multi-threading technology to match pre-defined convergence rules according to different sets of convergence dimensions;

[0087] When no predefined convergence rule is matched, the default convergence rule is returned.

[0088] Figure 3 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 1 .

[0089] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, and the convergence rule is used to obtain the convergence rule of the alarm event. Figure 3 , including four steps from S31 to S34:

[0090] S31: According to the matching of the predefined convergence rule, query whether there is a current alarm event in the existing convergence alarm event information;

[0091] S32: If the query result is that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event;

[0092] S33: If the query result is that there is a convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the state of the current alarm event information is an alarm state;

[0093] S34: If the judgment result is that the state of the current alarm event information is an alarm state, the alarm count of the convergence alarm event details that is the same as the current alarm event in the existing alarm event information is updated by adding 1, and the alarm count of the existing convergence alarm event is updated by adding 1.

[0094] Specifically, in an embodiment of the present invention, when a current alarm event exists in existing convergence alarm event information, and convergence alarm event details identical to the current alarm event exist under the convergence alarm event and the state of the current alarm event information is an alarm state, the alarm number of the convergence alarm event details identical to the current alarm event in the existing alarm event information is updated by 1, the alarm number of the existing convergence alarm event is updated by 1, and the current alarm event is converged and merged into the existing convergence alarm event.

[0095] Figure 4 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 2 .

[0096] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, and the convergence rule is used to obtain the convergence rule of the alarm event. Figure 4 , including three steps from S41 to S43:

[0097] S41: According to the convergence rule that is matched to a predefined one, query whether there is a current alarm event in the existing convergence alarm event information;

[0098] S42: If the query result is that the current alarm event information does not exist in the existing convergence alarm event information, determine whether the state of the current alarm event information is an alarm state;

[0099] S43: If the judgment result is that the state of the current alarm event is an alarm state, generate new alarm event data based on the existing convergence alarm event information and push an alarm; if the judgment result is that the state of the current alarm event is a recovery state, end the convergence merge.

[0100] Specifically, in an embodiment of the present invention, when the current alarm event does not exist in the existing convergence alarm event information and the state of the current alarm event information is an alarm state, new alarm event data is generated in the existing convergence alarm event information and an alarm is pushed; when the current alarm event does not exist in the existing convergence alarm event information and the state of the current alarm event information is a recovery state, the convergence merge is terminated.

[0101] Figure 5 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 3 .

[0102] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, and the convergence rule is used to obtain the convergence rule of the alarm event. Figure 5 , including four steps from S51 to S54:

[0103] S51: According to the convergence rule that is matched to a predefined one, query whether there is a current alarm event in the existing convergence alarm event information;

[0104] S52: If the query result is that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event;

[0105] S53: If the query result is that there is no convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the state of the current alarm event information is an alarm state;

[0106] S54: If the judgment result is that the state of the current alarm event is an alarm state, the current alarm event is converged to the existing convergence alarm event, and the convergence event details are generated according to the current alarm event information, and the alarm count of the existing convergence alarm event is updated plus 1; if the judgment result is that the state of the current alarm event is not an alarm state, the convergence merge is terminated.

[0107] Specifically, in an embodiment of the present invention, if the current alarm event exists in the existing convergence alarm event information, and there are no convergence alarm event details identical to the current alarm event under the convergence alarm event, and the state of the current alarm event information is an alarm state, the current alarm event is converged to the existing convergence alarm event, and the convergence event details are generated according to the current alarm event information, and the alarm count of the existing convergence alarm event is updated by 1; if the current alarm event exists in the existing convergence alarm event information, and there are no convergence alarm event details identical to the current alarm event under the convergence alarm event, and the state of the current alarm event information is not an alarm state, the convergence merge is terminated.

[0108] Figure 6 A method for converging and merging current alarm events provided by an embodiment of the present invention Figure 4 .

[0109] Furthermore, in the above-mentioned alarm event convergence method, the existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event and the existing converged alarm event are converged and merged according to the query result, and the convergence rule is used to obtain the convergence rule of the alarm event. Figure 6 , including five steps from S61 to S65:

[0110] S61: According to the matching of the predefined convergence rule, query whether there is a current alarm event in the existing convergence alarm event information;

[0111] S62: If the query result is that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event;

[0112] S63: If the query result is that there is a convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the state of the current alarm event information is an alarm state;

[0113] S64: if the judgment result is that the state of the current alarm event information is not an alarm state, update the state of the convergence alarm event details to recovery, and judge whether the states of the convergence alarm event details under the existing convergence alarm events are all recovered;

[0114] S65: If the judgment result is that the convergence alarm event details state under the existing convergence alarm event, the existing convergence alarm event is updated to recovery, and the convergence merge is ended.

[0115] Specifically, in an embodiment of the present invention, when a current alarm event exists in existing convergence alarm event information, and convergence alarm event details identical to the current alarm event exist under the convergence alarm event and the status of the current alarm event information is not an alarm status, the convergence alarm event details status is updated to recovery, and it is determined whether the convergence alarm event details status under the existing convergence alarm events are all recovered; if the determination result is that the convergence alarm event details status under the existing convergence alarm events is the same, then the existing convergence alarm event is updated to recovery, and the convergence merge is terminated.

[0116] Furthermore, in the above-mentioned alarm event convergence method, the predefined convergence rules are defined in a convergence rule definition module, and the predefined convergence rules at least include: product, project, indicator, computer room and IP of the event.

[0117] Device Embodiment

[0118] Figure 7 A diagram of an alarm event convergence device provided in an embodiment of the present invention.

[0119] In a second aspect of the present invention, a device for converging alarm events is also provided, which is combined with Figure 8 ,include:

[0120] Receiving module 71: used to receive alarm event data using a dynamically scalable distributed data receiving backend cluster using an Nginx cluster reverse proxy.

[0121] Specifically, in the embodiment of the present invention, the receiving module 71 realizes real-time and efficient reception of alarm data generated from various systems through the dynamically expandable backend distributed cluster through the Nginx cluster reverse proxy. The distributed multi-threaded dynamic expansion technology is used here to ensure that when a large amount of alarm event data occurs, the backend receiving service can receive and process it in time to avoid message blocking.

[0122] Writing module 72: used to write the alarm event data into the RocketMQ distributed cluster.

[0123] Specifically, in the embodiment of the present invention, the writing module 82 writes the alarm event data into the RocketMQ distributed cluster, and uses the RocketMQ distributed cluster to store the received alarm event data to buffer the impact of a large amount of alarm data on the convergence service.

[0124] Convergence calculation module 73: used for the convergence cluster to monitor the corresponding Topic of the RocketMQ distributed cluster, and after receiving the current alarm event information pushed by the monitored RocketMQ, perform convergence calculation on the current alarm event;

[0125] The convergence calculation module 73 performs convergence calculation on the current alarm event, including:

[0126] Combination unit: used to combine different convergence dimension sets according to current alarm event information;

[0127] Matching unit: used to match predefined convergence rules using multi-threading technology according to different convergence dimension sets;

[0128] Convergence merging unit: used to query the existing alarm event information according to the matched pre-defined convergence rules, and converge and merge the current alarm event with the existing convergence alarm event according to the query result.

[0129] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor and a memory;

[0130] The processor is used to execute any one of the above alarm event convergence methods by calling the program or instruction stored in the memory.

[0131] In a fourth aspect of the present invention, a computer-readable storage medium is further proposed, wherein the computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute any one of the above alarm event convergence methods.

[0132] Figure 8 It is a schematic block diagram of an electronic device provided by an embodiment of the present invention.

[0133] like Figure 8As shown, the electronic device includes: at least one processor 801, at least one memory 802 and at least one communication interface 803. The various components in the electronic device are coupled together through a bus system 804. The communication interface 803 is used to transmit information between external devices. It can be understood that the bus system 804 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus system 804 .

[0134] It can be understood that the memory 802 in this embodiment can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0135] In some implementations, the memory 802 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system and application programs.

[0136] The operating system includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. A program that implements any method in an alarm event convergence method provided in an embodiment of the present invention can be included in the application.

[0137] In an embodiment of the present invention, the processor 801 calls a program or instruction stored in the memory 802, specifically, a program or instruction stored in an application, and the processor 801 is used to execute the steps of each embodiment of an alarm event convergence method provided in an embodiment of the present invention.

[0138] Use Nginx cluster reverse proxy to dynamically expand the distributed data receiving backend cluster to receive alarm event data;

[0139] Writing the alarm event data into the RocketMQ distributed cluster;

[0140] The convergence cluster monitors the corresponding Topic of the RocketMQ distributed cluster. After receiving the current alarm event information pushed by the monitored RocketMQ, it performs convergence calculation on the current alarm event.

[0141] The convergence calculation of the current alarm event includes:

[0142] Different convergence dimension sets are formed according to the current alarm event information;

[0143] Use multi-threading technology to match pre-defined convergence rules according to different sets of convergence dimensions;

[0144] The existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event is converged and merged with the existing convergence alarm event according to the query result.

[0145] Any method in the alarm event convergence method provided in an embodiment of the present invention can be applied to the processor 801, or implemented by the processor 801. The processor 801 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 801 or an instruction in the form of software. The above processor 801 can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0146] The steps of any method in the alarm event convergence method provided in the embodiment of the present invention can be directly embodied as being executed by a hardware decoding processor, or being executed by a combination of hardware and software units in the decoding processor. The software unit can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 802, and the processor 801 reads the information in the memory 802 and completes the steps of the method in combination with its hardware.

[0147] Those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present invention and to form different embodiments.

[0148] Those skilled in the art will appreciate that the description of each embodiment has its own emphasis, and for parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0149] Although the embodiments of the present invention are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope defined by the appended claims. The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of various equivalent modifications or substitutions within the technical scope disclosed by the present invention, and these modifications or substitutions should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

[0150] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for convergence of alarm events, characterized in that: include: Use Nginx cluster reverse proxy to dynamically expand the distributed data receiving backend cluster to receive alarm event data; Writing the alarm event data into the RocketMQ distributed cluster; The convergence cluster monitors the corresponding Topic of the RocketMQ distributed cluster. After receiving the current alarm event information pushed by the monitored RocketMQ, it performs convergence calculation on the current alarm event. The convergence calculation of the current alarm event includes: Different convergence dimension sets are formed according to the current alarm event information; Use multi-threading technology to match pre-defined convergence rules according to different sets of convergence dimensions; The existing alarm event information is queried according to the matched predefined convergence rule, and the current alarm event is converged and merged with the existing convergence alarm event according to the query result.

2. The alarm event convergence method according to claim 1, characterized in that: The method further comprises: Use multi-threading technology to match pre-defined convergence rules according to different sets of convergence dimensions; When no predefined convergence rule is matched, the default convergence rule is returned.

3. The alarm event convergence method according to claim 1, characterized in that: The querying of existing alarm event information according to the matched predefined convergence rule, and convergence merging of the current alarm event with the existing convergence alarm event according to the query result, includes: According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information; If the query result shows that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event; If the query result shows that there is a convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the status of the current alarm event information is an alarm status; If the judgment result is that the state of the current alarm event information is an alarm state, the alarm number of the converged event details that is the same as the current alarm event in the existing alarm event information is updated by adding 1, and the alarm number of the existing converged alarm event is updated by adding 1.

4. The alarm event convergence method according to claim 1, characterized in that: The querying of existing alarm event information according to the matched predefined convergence rule, and convergence merging of the current alarm event with the existing convergence alarm event according to the query result, includes: According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information; If the query result is that the current alarm event information does not exist in the existing convergence alarm event information, determine whether the state of the current alarm event information is an alarm state; If the judgment result is that the state of the current alarm event is an alarm state, new alarm event data is generated based on the existing convergence alarm event information, and an alarm is pushed; if the judgment result is that the state of the current alarm event is a recovery state, the convergence merge is terminated.

5. The alarm event convergence method according to claim 1, characterized in that: The querying of existing alarm event information according to the matched predefined convergence rule, and convergence merging of the current alarm event with the existing convergence alarm event according to the query result, includes: According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information; If the query result shows that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event; If the query result is that there is no convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the status of the current alarm event information is an alarm status; If the judgment result is that the status of the current alarm event is an alarm status, the current alarm event is converged to the existing convergence alarm event, and the convergence event details are generated according to the current alarm event information, and the alarm count of the existing convergence alarm event is updated by 1; if the judgment result is that the status of the current alarm event is not an alarm status, the convergence merge is terminated.

6. The alarm event convergence method according to claim 1, characterized in that: The querying of existing alarm event information according to the matched predefined convergence rule, and convergence merging of the current alarm event with the existing convergence alarm event according to the query result, includes: According to the convergence rules that are matched to the predefined rules, query whether there is a current alarm event in the existing convergence alarm event information; If the query result shows that the current alarm event exists in the existing convergence alarm event information, query whether there is a convergence alarm event detail that is the same as the current alarm event under the convergence alarm event; If the query result shows that there is a convergence alarm event detail identical to the current alarm event under the convergence alarm event, determine whether the status of the current alarm event information is an alarm status; If the judgment result is that the status of the current alarm event information is not an alarm status, the status of the convergence alarm event details is updated to recovery, and it is judged whether the status of the convergence alarm event details under the existing convergence alarm events is all recovered; If the judgment result is the convergence alarm event details status under the existing convergence alarm event, the existing convergence alarm event is updated to recovery, and the convergence merge is ended.

7. The alarm event convergence method according to claim 1, characterized in that: The predefined convergence rules are defined in a convergence rule definition module, and the predefined convergence rules at least include: product, project, indicator, computer room and IP of the event.

8. An alarm event convergence device, characterized in that: include: Receiving module: used to receive alarm event data using the Nginx cluster reverse proxy, which is a dynamically scalable distributed receiving data backend cluster; Writing module: used to write the alarm event data into the RocketMQ distributed cluster; Convergence calculation module: used for the convergence cluster to monitor the corresponding Topic of the RocketMQ distributed cluster. After receiving the current alarm event information pushed by the monitored RocketMQ, it performs convergence calculation on the current alarm event. The convergence calculation module performs convergence calculation on the current alarm event, including: Combination unit: used to combine different convergence dimension sets according to current alarm event information; Matching unit: used to match predefined convergence rules using multi-threading technology according to different convergence dimension sets; Convergence merging unit: used to query the existing alarm event information according to the matched pre-defined convergence rules, and converge and merge the current alarm event with the existing convergence alarm event according to the query result.

9. An electronic device, characterized in that: include: Processor and memory; The processor is used to execute the alarm event convergence method as described in any one of claims 1 to 7 by calling the program or instruction stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute the alarm event convergence method as claimed in any one of claims 1 to 7.

Images