Alarm suppression method and related equipment

Abstract

The invention provides an alarm suppression method and related equipment, which are applied to an alarm component of a system. The method comprises the following steps: acquiring alarm information of the system; determining whether the alarm information is matched with an alarm type of a first alarm level in a plurality of preset alarm levels; if yes, recording the alarm information into a first alarm suppression list of the first alarm level; determining whether the alarm information recorded in the first alarm suppression list has an association relationship with the alarm information recorded in a second alarm suppression list of a second alarm level; wherein the alarm suppression list is used for recording to-be-suppressed alarm information; the alarm priority of the second alarm level is higher than that of the first alarm level; and if the association relationship exists, performing alarm suppression processing on the alarm information recorded in the first alarm suppression list.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the technical field of alarm suppression, and in particular, to an alarm suppression method and related equipment. Background Art

[0002] The system's alarm component often continuously tracks various system performance indicators, such as CPU utilization, memory usage, disk space, disk I / O, and network traffic. When a system failure occurs, such as when the CPU utilization or memory usage exceeds the limit, the alarm component will send a corresponding alarm message to the relevant operation and maintenance personnel to solve the system failure in a timely manner and ensure the safe and stable operation of the system.

[0003] However, usually, a fault often triggers multiple alarms. Some faults have a wider impact range, which may generate more types of alarms. Especially when a large or complex system fails, a large number of alarms may be triggered, and these alarms are likely to come from the same root cause of the failure. If some unimportant alarms are not inhibited, it will lead to an "alarm storm" - too many alarms are generated in a short period of time, making it difficult for operation and maintenance personnel to focus on the real fundamental and important problems, which will lead to the delay in resolving system failures, seriously affecting the stability and security of the system. Summary of the invention

[0004] In view of this, one or more embodiments of the present specification provide an alarm suppression method and related devices.

[0005] In a first aspect, this specification provides an alarm suppression method, which is applied to an alarm component of a system, and the method includes: Obtaining alarm information of the system; Determining whether the alarm information matches an alarm type of a first alarm level among a plurality of preset alarm levels; If a match is found, recording the alarm information into a first alarm suppression list of the first alarm level; and, Determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record the alarm information to be suppressed; and the alarm priority of the second alarm level is higher than that of the first alarm level; If there is an association, alarm suppression processing is performed on the alarm information recorded in the first alarm suppression list.

[0006] In a second aspect, the present specification provides an alarm suppression device, which is applied to an alarm component of a system, and the device includes: An acquisition unit, used for acquiring alarm information of the system; A first determining unit, configured to determine whether the alarm information matches an alarm type of a first alarm level among a plurality of preset alarm levels; a recording unit, configured to record the alarm information into a first alarm suppression list of the first alarm level if a match is found; and A second determination unit is used to determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record the alarm information to be suppressed; and the alarm priority of the second alarm level is higher than the first alarm level; An alarm suppression unit is used to perform alarm suppression processing on the alarm information recorded in the first alarm suppression list if there is an association relationship.

[0007] Accordingly, the present specification also provides a computing device, comprising: a memory and a processor; the memory stores a computer program / instruction that can be executed by the processor; when the processor executes the computer program / instruction, it executes the alarm suppression method described in the first aspect above.

[0008] Accordingly, the present specification also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the alarm suppression method as described in the first aspect above is executed.

[0009] Accordingly, the present specification also provides a computer program product, which includes a computer program / instruction. When the computer program / instruction is executed by a processor, the alarm suppression method as described in the first aspect above is executed.

[0010] In summary, if the alarm information generated by the system matches an alarm type with a lower alarm priority, the alarm information can be first recorded in a low-level alarm suppression list for suppression. Furthermore, if the alarm information recorded in the low-level alarm suppression list is associated with the alarm information recorded in the high-level alarm suppression list, the alarm information recorded in the low-level alarm suppression list can be suppressed. In this way, by identifying and suppressing low-priority alarm information associated with high-priority alarm information, unimportant alarms caused by known problems or minor problems can be filtered out, thereby reducing alarm noise, allowing the operation and maintenance team to focus on more urgent important alarms, so as to more quickly identify the most urgent fundamental problems of the current system failure, which helps to speed up the diagnosis and repair of the failure, thereby shortening the average recovery time of the system and ensuring the safe and stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a schematic diagram of a system architecture for alarm suppression provided by an exemplary embodiment; Figure 2 is a flowchart of an alarm suppression method provided by an exemplary embodiment; Figure 3 It is a flowchart of a method for step-by-step suppression of associated alarms provided by an exemplary embodiment; Figure 4 is a structural schematic diagram of an alarm suppression device provided by an exemplary embodiment; Figure 5 It is a structural diagram of a computing device provided by an exemplary embodiment. DETAILED DESCRIPTION

[0012] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0013] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0014] It should be noted that the “plurality” mentioned in this application refers to two or more than two.

[0015] In addition, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0016] This specification provides a technical solution that can reduce some unnecessary alarms with lower alarm priorities by identifying alarms with related relationships and suppressing them, so that operation and maintenance personnel can focus more on more important and urgent alarms with higher priorities, so as to solve system failures in a timely manner.

[0017] During implementation, the alarm component of the system can first obtain the alarm information of the system. Then, it can be determined whether the alarm information matches the alarm type of the first alarm level among the preset multiple alarm levels; if it matches, the alarm information can be recorded in the first alarm suppression list of the first alarm level. Further, the alarm component can determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level. Among them, the alarm suppression list is used to record the alarm information to be suppressed, wherein the alarm priority of the second alarm level is higher than the first alarm level. If the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level, the alarm suppression processing can be performed on the alarm information recorded in the first alarm suppression list.

[0018] In the above technical solution, if the alarm information generated by the system matches an alarm type with a lower alarm priority, the alarm information can be first recorded in a low-level alarm suppression list to be suppressed. Furthermore, if the alarm information recorded in the low-level alarm suppression list is associated with the alarm information recorded in the high-level alarm suppression list, the alarm information recorded in the low-level alarm suppression list can be suppressed. In this way, by identifying and suppressing low-priority alarm information associated with high-priority alarm information, unimportant alarms caused by known problems or minor problems can be filtered out, thereby reducing alarm noise, allowing the operation and maintenance team to focus on more urgent important alarms, so as to more quickly identify the most urgent fundamental problems of the current system failure, which helps to speed up the diagnosis and repair of the failure, thereby shortening the average recovery time of the system and ensuring the safe and stable operation of the system.

[0019] See also Figure 1 , Figure 1 FIG. 1 is a schematic diagram of a system architecture for alarm suppression provided by an exemplary embodiment. Figure 1 As shown, the system architecture may include a system 10 and an alarm component 20. The system 10 may be one or more server clusters, including multiple servers, such as server 100a and server 100b, etc., or the system 10 may be a single machine, such as including only server 100a, which is not specifically limited in this specification. The alarm component 20 may be implemented by software, hardware, or a combination of software and hardware, which is not specifically limited in this specification.

[0020] In an illustrated embodiment, the alarm component 20 may be an alarm component installed inside the system 10, or an alarm component provided by any third party, and this specification does not specifically limit this. In an illustrated embodiment, the system 10 may be a database system, and the alarm component 20 may be an alarm component inside the database system, or may be a component installed in the database middleware, and this specification does not specifically limit this.

[0021] In an illustrated embodiment, when a failure occurs in the system 10, a series of alarms are triggered, and the alarm component 20 may first obtain all current alarm information of the system 10. Exemplarily, the alarm information may include various alarms such as "network interruption", "insufficient disk space", "CPU utilization rate exceeded", "memory usage rate exceeded", "process interruption" and "service unavailable", which are not specifically limited in this specification.

[0022] Furthermore, the alarm component 20 can determine whether the acquired alarm information matches the alarm type of the first alarm level among the preset multiple alarm levels. The alarm priorities of the multiple alarm levels are different, and the first alarm level can be any alarm level among the multiple alarm levels. In an illustrated embodiment, the alarm component 20 can start from the alarm level with the highest alarm priority among the multiple alarm levels, and perform the matching of alarm types and subsequent alarm suppression step by step. For details, please refer to the following Figure 2 and Figure 3 The description of the corresponding embodiments will not be repeated here.

[0023] In an illustrated implementation manner, if the alarm information matches an alarm type (or alarm name) of a first alarm level, the alarm information may be recorded in a first alarm suppression list of the first alarm level.

[0024] Exemplarily, assuming that the alarm information acquired by the alarm component 20 is "process interruption", and the alarm type of the first alarm level also includes "process interruption", the alarm information of "process interruption" can be recorded in the first alarm suppression list of the first alarm level.

[0025] Further, the alarm component 20 can determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level. Among them, the second alarm level can be an alarm level with an alarm priority higher than the first alarm level among the preset multiple alarm levels, that is, the alarm priority of the second alarm level is higher than the first alarm level. Exemplarily, the alarm information recorded in the second alarm suppression list of the second alarm level can be "insufficient disk space", which is an important alarm that can indicate the root cause of the system failure and may trigger secondary alarms such as "process interruption", so its alarm priority is higher than "process interruption".

[0026] It should be noted that the "first" and "second" in the "first alarm level", "second alarm level", "first alarm suppression list" and "second alarm suppression list" in this specification are only used to distinguish different objects, and do not directly limit their order or priority.

[0027] In an illustrated embodiment, if the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level (for example, they both belong to the same cluster or the same IP address), the alarm component 20 may perform alarm suppression processing on the alarm information recorded in the first alarm suppression list, that is, not sending an alarm message related to the alarm information to the operation and maintenance personnel. For details, please refer to the following Figure 2 and Figure 3 The description of the corresponding embodiments will not be repeated here.

[0028] Thus, this manual takes into account that a system failure may trigger multiple alarms, and there are often certain correlations between these alarms, such as topological relationships, direct associations, or indirect associations. Based on this correlation, this manual first presets multiple alarm levels corresponding to different alarm priorities, and then identifies and suppresses low-priority alarm information associated with high-priority alarm information, which can filter out unimportant alarms caused by known problems or minor problems, and only generates some important alarms with higher alarm priorities that can indicate the root cause of the fault, thereby reducing the number of alarms when the system fails and reducing false alarms, so that the operation and maintenance team can focus on more urgent important alarms, so as to more quickly identify the most urgent root problem of the current system failure, which helps to speed up the diagnosis and repair of the fault and ensure the safe and stable operation of the system.

[0029] It should be understood that Figure 1 The system architecture shown is only for illustrative purposes. In some possible implementations, the system architecture for alarm suppression in this specification may include: Figure 1There may be more or fewer devices shown, and this specification does not make any specific limitations on this.

[0030] See also Figure 2 , Figure 2 is a flowchart of an alarm suppression method provided by an exemplary embodiment. The method can be applied to Figure 1 The system architecture shown can be applied to Figure 1 The alarm components shown. Figure 2 As shown, the method may specifically include the following steps S201 to S205.

[0031] Step S201, obtaining system alarm information.

[0032] In an illustrated embodiment, when a system failure occurs, a series of alarms are triggered, and the alarm component can obtain all current alarm information of the system. Exemplarily, the alarm information may include various alarms such as "network interruption", "insufficient disk space", "CPU utilization rate exceeded", "memory usage rate exceeded", "process interruption" and "service unavailable", which are not specifically limited in this specification.

[0033] In one illustrated implementation, the alarm status of these alarm information may include alarming, blocked, and suppressed, and this specification does not specifically limit this. Among them, an alarm in alarm will generate an alarm message and send it to the relevant operation and maintenance personnel; the blocked alarm status can be a human intervention in the alarm so that it does not generate an alarm message; the suppressed alarm status can be an automatically identified alarm status, and the suppressed alarm will not generate an alarm message. In other words, this specification will not only suppress alarms associated with alarms in alarm, but also further suppress alarms associated with blocked and suppressed alarms, thereby greatly improving the alarm suppression effect and reducing the number of unnecessary alarms.

[0034] Step S202: Determine whether the alarm information matches an alarm type of a first alarm level among multiple preset alarm levels.

[0035] As mentioned above, this specification presets multiple alarm levels corresponding to different alarm priorities based on the correlation between alarms. Among them, alarms with higher alarm priorities are often important alarms that can indicate the root cause of the failure and are urgent alarms that need to be solved, such as "network interruption" and "insufficient disk space", etc., while alarms with lower alarm priorities are often secondary problems caused by the root cause of the failure, such as "process interruption" and "service unavailable", etc. This specification does not make specific restrictions on this.

[0036] In an illustrated embodiment, after obtaining the alarm information of the system, the alarm component can determine whether the alarm information matches the alarm type of the first alarm level among the preset multiple alarm levels. The first alarm level can be any alarm level among the multiple alarm levels. In an illustrated embodiment, the alarm component can match the alarm type and perform subsequent alarm suppression step by step, starting from the alarm level with the highest alarm priority among the multiple alarm levels.

[0037] Specifically, in an illustrated embodiment, the alarm component may first obtain a preconfigured alarm suppression rule, which may include a multi-level alarm type list (which may be recorded as an alarm_types list) corresponding to the above-mentioned multiple alarm levels, wherein each level of the alarm type list in the multi-level alarm type list is used to record several alarm types corresponding to its alarm level.

[0038] In an illustrated embodiment, after obtaining the alarm information of the system, the alarm component can start from the first level alarm type list in the multi-level alarm type list, traverse each level alarm type list in turn, and for the currently traversed i-th level alarm type list, determine whether the obtained alarm information matches the alarm type included in the i-th level alarm type list. The alarm type of the first alarm level can be the alarm type included in the currently traversed i-th level alarm type list.

[0039] In an illustrated implementation, the preconfigured alarm suppression rules may be text data, and therefore the text data needs to be deserialized first to obtain the alarm suppression rules in a recursive data structure so that the alarm component can read them.

[0040] Step S203: If there is a match, the alarm information is recorded in the first alarm suppression list of the first alarm level.

[0041] In an illustrated implementation, if the alarm information matches the alarm type of the first alarm level, the alarm component may record the alarm information into a first alarm suppression list of the first alarm level.

[0042] Among them, the alarm suppression list (which can be recorded as inhibit_alarms list) can be used to record the alarm information to be suppressed. It is not difficult to understand that these alarm information to be suppressed may not all be suppressed in the end, but the alarm information that is finally suppressed must belong to these alarm information to be suppressed.

[0043] In an illustrated embodiment, still taking the currently traversed i-th level alarm type list as an example, if the alarm information matches the alarm type contained in the i-th level alarm type list, the alarm component can record the alarm information in the i-th level alarm suppression list corresponding to the i-th level alarm type list.

[0044] In one illustrated embodiment, if all the alarm information obtained does not match the alarm type included in the i-th level alarm type list, the i-th level alarm suppression can be terminated and the i+1-th level alarm type list can be traversed to determine whether the alarm information obtained matches the alarm type included in the i+1-th level alarm type list.

[0045] Step S204, determining whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record the alarm information to be suppressed; and the alarm priority of the second alarm level is higher than that of the first alarm level.

[0046] Furthermore, the alarm component may determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level, wherein the alarm priority of the second alarm level is higher than the first alarm level.

[0047] In an illustrated implementation, still taking the currently traversed i-th level alarm type list as an example, the alarm component can determine whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1th level alarm suppression list. Correspondingly, the second alarm suppression list of the second alarm level mentioned above can be the i-1th level alarm suppression list. It is not difficult to understand that the alarm information recorded in the i-1th level alarm type list is the alarm information that matches the alarm type contained in the i-1th level alarm type list. Wherein, i=2, 3, ..., N, N is an integer greater than 1.

[0048] It should be noted that this specification does not specifically limit the specific implementation method for determining whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1-th level alarm suppression list. In an illustrated implementation, whether there is an associated relationship between two alarm information can be determined based on whether the two alarm information are from the same machine or the same cluster.

[0049] In an illustrated implementation, the alarm information may include at least one attribute value of an alarm attribute, or at least one dimension information. Exemplarily, the alarm attribute includes any one or more combinations of the following attributes: an IP address, region, cluster, and network communication channel corresponding to the alarm, etc., which are not specifically limited in this specification.

[0050] Based on this, when determining whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1-th level alarm suppression list, it can specifically include: first determining that the alarm information recorded in the i-th level alarm suppression list has the same target alarm attribute as the alarm information recorded in the i-1-th level alarm suppression list; then, further determining whether the attribute value of the target alarm attribute contained in the alarm information recorded in the i-th level alarm suppression list is the same as the attribute value of the target alarm attribute contained in the alarm information recorded in the i-1-th level alarm suppression list.

[0051] Exemplarily, the alarm information recorded in the i-th level alarm suppression list may include attribute values ​​of two alarm attributes, cluster and IP address, and the alarm information recorded in the i-1-th level alarm suppression list may include attribute value of one alarm attribute, IP address. Then the above-mentioned same target alarm attribute is the cluster attribute.

[0052] In an illustrated embodiment, the present specification may also standardize and store the attribute values ​​of these alarm attributes in the alarm information in labels, wherein labels is a key-value Map structure. Accordingly, the above-mentioned preconfigured alarm suppression rules may also include a multi-level alarm attribute list (which may be recorded as a label key list) corresponding to the multi-level alarm type list. Among them, the i-th level alarm attribute list may be used to record at least one i-th level alarm attribute contained in the alarm information that matches the alarm type in the i-th level alarm type list.

[0053] Exemplarily, the alarm types recorded in the level 1 alarm type list may include "network interruption" and the like, and the alarm attributes recorded in the corresponding level 1 alarm attribute list may include region and cluster, or may only include cluster, etc. This specification does not make any specific limitations on this.

[0054] Exemplarily, the alarm types recorded in the level 2 alarm type list may include "insufficient disk space" and "CPU utilization exceeds limit", etc., and the alarm attributes recorded in the corresponding level 2 alarm attribute list may include cluster and IP address, or may only include IP address, etc. This specification does not make any specific limitations on this.

[0055] Exemplarily, the alarm types recorded in the level 3 alarm type list may include "process interruption" and "service unavailable", etc., and the alarm attributes recorded in the corresponding level 3 alarm attribute list may include IP address, which is not specifically limited in this specification.

[0056] In an illustrated embodiment, based on the multi-level alarm attribute list defined in the above-mentioned alarm suppression rule, when the alarm component determines that the alarm information recorded in the i-th level alarm suppression list is the same as the target alarm attribute contained in the alarm information recorded in the i-1th level alarm suppression list, it can specifically include: obtaining at least one i-th level alarm attribute contained in the i-th level alarm attribute list, and at least one i-1th level alarm attribute contained in the i-1th level alarm attribute list; further, determining the target alarm attribute that is the same as the at least one i-th level alarm attribute and the at least one i-1th level alarm attribute.

[0057] In an illustrated embodiment, after matching the alarm information with the alarm type recorded in the i-th level alarm attribute list to obtain the i-th level alarm suppression list, the alarm information recorded in the i-th level alarm suppression list may be further grouped and aggregated. Specifically, the alarm information recorded in the i-th level alarm suppression list may be divided into at least one i-th level alarm combination according to at least one i-th level alarm attribute recorded in the i-th level alarm attribute list. The attribute values ​​of the at least one i-th level alarm attribute contained in all the alarm information in each i-th level alarm combination are the same.

[0058] Exemplarily, taking level 2 as an example, the alarm information recorded in the level 2 alarm suppression list may include "A disk space is insufficient", "B disk space is insufficient" and "CPU utilization exceeds the limit", etc., and the alarm attributes recorded in the level 2 alarm attribute list may include clusters and IP addresses, among which the cluster of the alarm information "A disk space is insufficient" is cluster A, and the IP address is IP-1, the cluster of the alarm information "B disk space is insufficient" is cluster A, and the IP address is IP-1, and the cluster of the alarm information "CPU utilization exceeds the limit" is cluster A, and the IP address is IP-2.

[0059] In this way, according to the clusters and IP addresses of multiple alarm information, the alarm information "A disk space is insufficient" and the alarm information "B disk space is insufficient" can be divided (or aggregated) into the same level 2 alarm combination (which can be recorded as level 2 alarm combination-21), and the alarm information "CPU utilization exceeds the limit" can be divided into another level 2 alarm combination (which can be recorded as level 2 alarm combination-22).

[0060] Exemplarily, taking level 3 as an example, the alarm information recorded in the level 3 alarm suppression list may include "Service A is unavailable", "Service B is unavailable", "Service C is unavailable" and "Service D is unavailable", etc., and the alarm attributes recorded in the level 3 alarm attribute list may include IP addresses, among which the IP address of the alarm information "Service A is unavailable" is IP-1, the IP address of the alarm information "Service B is unavailable" is IP-1, the IP address of the alarm information "Service C is unavailable" is IP-2, and the IP address of the alarm information "Service D is unavailable" is IP-3.

[0061] In this way, according to the IP addresses of multiple alarm messages, the alarm message "A service unavailable" and the alarm message "B service unavailable" can be divided into the same level 3 alarm combination (which can be recorded as level 3 alarm combination-31), the alarm message "C service unavailable" can be divided into another level 3 alarm combination (which can be recorded as level 3 alarm combination-32), and the alarm message "D service unavailable" can be divided into another level 3 alarm combination (which can be recorded as level 3 alarm combination-33).

[0062] In an illustrated embodiment, based on the above-mentioned grouping aggregation of the alarm information recorded in the alarm suppression lists at each level, when the alarm component determines whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1-th level alarm suppression list, the alarm combination can be used as an associated alarm suppression unit to determine whether there is an associated relationship between the i-th level alarm combination and the i-1-th level alarm combination.

[0063] Specifically, for at least one i-1th level alarm combination aggregated from the alarm information recorded in the i-1th level alarm suppression list, the alarm component may first obtain at least one attribute value of the target alarm attribute contained in the at least one i-1th level alarm combination.

[0064] Furthermore, for at least one i-th level alarm combination obtained by aggregating the alarm information recorded in the i-th level alarm suppression list, the alarm component can determine whether the attribute value of the target alarm attribute contained in any target i-th level alarm combination is the same as any attribute value of at least one attribute value of the target alarm attribute contained in the above-mentioned at least one i-1-th level alarm combination.

[0065] Exemplarily, still taking the above-mentioned level 2 and level 3 as an example, at least one i-1th level alarm combination may include the above-mentioned level 2 alarm combination-21 and level 2 alarm combination-22, and at least one i-th level alarm combination may include the above-mentioned level 3 alarm combination-31, level 3 alarm combination-31 and level 3 alarm combination-33. Among them, the same target alarm attribute in level 2 and level 3 is the IP address. Accordingly, the alarm component can first obtain the IP addresses contained in level 2 alarm combination-21 and level 2 alarm combination-22, which are IP-1 and IP-2 respectively. Further, the alarm component can determine whether the IP address contained in level 3 alarm combination-31 is the same as any of the IP addresses in the above-mentioned IP-1 and IP-2, and the same applies to level 3 alarm combination-31 and level 3 alarm combination-33.

[0066] Step S205: If there is an association relationship, alarm suppression processing is performed on the alarm information recorded in the first alarm suppression list.

[0067] In one illustrated embodiment, if the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level (for example, they both belong to the same cluster, or to the same IP address), the alarm component can perform alarm suppression processing on the alarm information recorded in the first alarm suppression list, that is, not sending an alarm message related to the alarm information to the operation and maintenance personnel.

[0068] In an illustrated implementation manner, if there is no association relationship, there is no need to suppress the alarm information, and the alarm message can be directly sent to the operation and maintenance personnel.

[0069] In an illustrated implementation, still taking the currently traversed i-th level alarm type list as an example, if the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1 level alarm suppression list, for example, the attribute value of the target alarm attribute (such as a cluster or IP address, etc.) contained in the alarm information recorded in the i-th level alarm suppression list is the same as the attribute value of the target alarm attribute contained in the alarm information recorded in the i-1 level alarm suppression list, then the alarm component can perform alarm suppression processing on the alarm information recorded in the i-th level alarm suppression list.

[0070] In an illustrated embodiment, as described above, if the aggregated alarm combination is used as the associated alarm suppression unit, if the attribute value of the target alarm attribute contained in any target i-th level alarm combination in the above-mentioned at least one i-th level alarm combination is the same as any attribute value of at least one attribute value of the target alarm attribute contained in the above-mentioned at least one i-1-th level alarm combination, then alarm suppression processing can be performed on all alarm information contained in the target i-th level alarm combination.

[0071] Exemplarily, still taking the above-mentioned level 2 and level 3 as an example, the IP addresses contained in the level 2 alarm combination-21 and the level 2 alarm combination-22 are IP-1 and IP-2 respectively, and the IP address contained in the level 3 alarm combination-31 is IP-1, then the alarm component can suppress all alarm information in the level 3 alarm combination-31 (that is, the alarm information "A service is unavailable" and the alarm information "B service is unavailable"); the IP address contained in the level 3 alarm combination-32 is If the IP address contained in the third-level alarm combination-33 is IP-3 (which is different from both IP-1 and IP-2), the alarm component does not need to suppress the alarm information in the third-level alarm combination-33 (that is, the alarm information "D service is unavailable"), that is, the alarm message of the alarm information "D service is unavailable" can be sent to the operation and maintenance personnel normally.

[0072] It should be noted that if the i-1th level alarm suppression list is an empty list and no alarm information is recorded in it, it indicates that there is no alarm information in the current alarm information of the system that matches the alarm type recorded in the i-1th level alarm type list. Furthermore, it also indicates that there is no alarm information in the i-1th level that is associated with the alarm information in the i-th level. Therefore, the alarm information in the i-th level does not need to be suppressed and the alarm message can be sent directly to the operation and maintenance personnel.

[0073] Alternatively, in some possible implementations, if the i-1 level alarm suppression list is an empty list, the alarm component may further check the i-2 level alarm suppression list. If the i-2 level alarm suppression list is not empty, it may further confirm whether there is a correlation between the alarm information recorded in the i-2 level alarm suppression list and the alarm information recorded in the i-level alarm suppression list.

[0074] Exemplarily, it is assumed that the alarm information recorded in the first-level alarm suppression list includes "network interruption", and the alarm attributes recorded in the first-level alarm attribute list include clusters and IP addresses, wherein the cluster of the alarm information "network interruption" is cluster A, and the IP address is IP-1. In addition, it is assumed that the second-level alarm suppression list is an empty list, and the third-level alarm suppression list still contains the above-mentioned alarm information "A service unavailable", "B service unavailable", "C service unavailable" and "D service unavailable". In this way, although the second-level alarm suppression list is an empty list, the IP address of the alarm information "network interruption" recorded in the first-level alarm suppression list is the same as the IP address of the alarm information "A service unavailable" and the alarm information "B service unavailable", both of which are IP-1. Therefore, the alarm component can also perform alarm suppression processing on the alarm information "A service unavailable" and the alarm information "B service unavailable", and this specification does not make specific limitations on this.

[0075] In one illustrated embodiment, see Figure 3 , Figure 3 This is a flowchart of a step-by-step suppression method for associated alarms provided by an exemplary embodiment. Figure 3 The step-by-step suppression method of associated alarms provided in this specification is described.

[0076] like Figure 3 As shown, the alarm component first obtains an alarm set, which may include all alarm information of the current system, including alarm information in the alarming, shielded, and suppressed states.

[0077] Furthermore, if Figure 3 As shown, the alarm component first matches the acquired alarm information with the first-level alarm type list in the preconfigured alarm suppression rules. If the alarm information matches the alarm type recorded in the first-level alarm type, the alarm information is recorded in the first-level alarm suppression list (first recursion). If all the acquired alarm information does not match the alarm type recorded in the first-level alarm type, the matching continues from the second level.

[0078] Furthermore, if Figure 3 As shown, the alarm information recorded in the first-level alarm suppression list is grouped and aggregated according to the alarm attributes recorded in the first-level alarm attribute list to obtain the first-level alarm combination-11 and the first-level alarm combination-12 (second recursion). Among them, the information contained in the first-level alarm combination-11 and the first-level alarm combination-12 (such as the attribute value of each alarm attribute) can be passed to the next level (i.e., the second level) for associated alarm suppression.

[0079] It can be understood that the alarm types recorded in the first-level alarm type list in the multi-level alarm type list are usually alarm types caused by the most fundamental causes of faults, that is, root alarms. Therefore, the alarm information matching the alarm types in the first-level alarm type list will not be suppressed after being recorded in the first-level alarm suppression list. The alarm suppression in this manual starts from the second level.

[0080] Furthermore, if Figure 3 As shown, the obtained alarm information is matched with the second-level alarm type list in the pre-configured alarm suppression rule. If the alarm information matches the alarm type recorded in the second-level alarm type, the alarm information is recorded in the second-level alarm suppression list (first recursion). Similarly, if all the obtained alarm information does not match the alarm type recorded in the second-level alarm type, the matching continues from the third level.

[0081] Furthermore, if Figure 3 As shown, the alarm information recorded in the second-level alarm suppression list is grouped and aggregated according to the alarm attributes recorded in the second-level alarm attribute list to obtain the second-level alarm combination-21 and the second-level alarm combination-22 (second recursion).

[0082] Furthermore, if Figure 3 As shown, it is determined whether there is an association relationship between the second-level alarm combination-21 and the first-level alarm combination-11 or the first-level alarm combination-12 of the previous level (i.e., whether there are the same attribute values). If there is an association relationship, the alarm information contained in the second-level alarm combination-21 can be suppressed, and the second-level alarm combination-22 is the same. Among them, the information contained in the second-level alarm combination-21 and the second-level alarm combination-22 (i.e., the attribute values ​​of each attribute) can also be passed to the next level (i.e., the third level) to continue to suppress the associated alarm, and so on, until recursively reaching the last Nth level.

[0083] In this way, through the step-by-step suppression method of associated alarms provided in this manual, not only can the alarms that are directly associated with the root alarms be identified, but this association can also be passed on to identify a large number of other alarms that are indirectly associated with the root alarms, thereby greatly improving the alarm suppression effect, filtering out unimportant alarms caused by known problems or minor problems, thereby reducing alarm noise, and allowing the operation and maintenance team to focus on more urgent important alarms, so as to more quickly identify the most urgent fundamental problems of the current system failure, which helps to speed up the diagnosis and repair of the failure, thereby shortening the system's average recovery time and ensuring the safe and stable operation of the system.

[0084] Corresponding to the implementation of the above method flow, the embodiment of this specification also provides an alarm suppression device. Figure 4 , Figure 4 is a schematic diagram of the structure of an alarm suppression device provided by an exemplary embodiment. The device 40 can be applied to Figure 1 The system architecture shown can be applied to Figure 1 The alarm components shown. Figure 4 As shown, the device 40 includes: The acquisition unit 401 is used to acquire the alarm information of the system; A first determining unit 402, configured to determine whether the alarm information matches an alarm type of a first alarm level among a plurality of preset alarm levels; a recording unit 403, configured to record the alarm information into a first alarm suppression list of the first alarm level if there is a match; and The second determination unit 404 is used to determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record the alarm information to be suppressed; the alarm priority of the second alarm level is higher than the first alarm level; The alarm suppression unit 405 is configured to perform alarm suppression processing on the alarm information recorded in the first alarm suppression list if there is an association relationship.

[0085] In an illustrated embodiment, the first determining unit 402 is specifically configured to: Obtaining a preconfigured alarm suppression rule, wherein the alarm suppression rule includes a multi-level alarm type list corresponding to a plurality of preset alarm levels; Starting from the first-level alarm type list in the multi-level alarm type list, traverse each level of the alarm type list in turn, and for the i-th level alarm type list currently traversed, determine whether the alarm information matches the alarm type included in the i-th level alarm type list; wherein the alarm type of the first alarm level is the alarm type included in the i-th level alarm type list.

[0086] In an illustrated embodiment, the recording unit 403 is specifically configured to: Recording the alarm information into the i-th level alarm suppression list corresponding to the i-th level alarm type list; The second determining unit 404 is specifically configured to: Determine whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1th level alarm suppression list; wherein the i-1th level alarm suppression list corresponding to the i-1th level alarm type list is the second alarm suppression list of the second alarm level; i=2, 3, ..., N, where N is an integer greater than 1.

[0087] In an illustrated implementation manner, the alarm information includes an attribute value of at least one alarm attribute; the second determining unit 404 is specifically configured to: Determine that the alarm information recorded in the i-th level alarm suppression list has the same target alarm attribute as the alarm information recorded in the i-1-th level alarm suppression list; It is determined whether an attribute value of the target alarm attribute included in the alarm information recorded in the i-th level alarm suppression list is the same as an attribute value of the target alarm attribute included in the alarm information recorded in the i-1th level alarm suppression list.

[0088] In an illustrated embodiment, the alarm suppression rule further includes a multi-level alarm attribute list corresponding to the multi-level alarm type list; wherein the i-th level alarm attribute list is used to record at least one i-th level alarm attribute included in the alarm information matching the alarm type in the i-th level alarm type list; The second determining unit 404 is specifically configured to: Obtain at least one level i alarm attribute included in the level i alarm attribute list, and at least one level i-1 alarm attribute included in the level i-1 alarm attribute list; Determine the target alarm attribute that is the same as the at least one i-th level alarm attribute and the at least one (i-1)-th level alarm attribute.

[0089] In an illustrated embodiment, the second determining unit 404 is specifically configured to: According to the i-th level alarm attribute list, the alarm information recorded in the i-th level alarm suppression list is divided into at least one i-th level alarm combination; wherein the attribute value of the at least one i-th level alarm attribute contained in all the alarm information in each i-th level alarm combination is the same; Obtaining at least one attribute value of the target alarm attribute included in at least one i-1th level alarm combination; Determine whether an attribute value of the target alarm attribute included in any target i-th level alarm combination in the at least one i-th level alarm combination is the same as any attribute value in the at least one attribute value.

[0090] In an illustrated embodiment, the alarm suppression unit 405 is specifically configured to: If the attribute value of the target alarm attribute included in the target i-th level alarm combination is the same as any attribute value of the at least one attribute value, alarm suppression processing is performed on all alarm information included in the target i-th level alarm combination.

[0091] In an illustrated embodiment, the alarm attribute includes a combination of any one or more of the following attributes: an IP address, a region, a cluster, and a network communication channel corresponding to the alarm.

[0092] In one illustrated embodiment, the system is a database system.

[0093] In an illustrated implementation manner, the alarm component is a component installed in database middleware.

[0094] The implementation process of the functions and effects of each unit in the above-mentioned device 40 is specifically described in the above-mentioned embodiment, and will not be repeated here. It should be understood that the above-mentioned device 40 can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor (CPU) of the device where it is located reading the corresponding computer program instructions into the memory and running them. From the hardware level, in addition to the CPU and memory, the device where the above-mentioned device is located usually also includes other hardware such as chips for wireless signal transmission and reception, and / or other hardware such as boards and cards for realizing network communication functions.

[0095] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the units or modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Those of ordinary skill in the art may understand and implement it without creative work.

[0096] The devices, units, and modules described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device, a vehicle-mounted computer, or a combination of any of these devices.

[0097] Corresponding to the above method embodiment, the embodiment of this specification also provides a computing device. Figure 5 , Figure 5 is a schematic diagram of a computing device provided by an exemplary embodiment. The computing device may be equipped with Figure 1 The computing device of the alarm component in the system architecture shown. Figure 5As shown, the computing device includes a processor 1001 and a memory 1002, and may further include an input device 1004 (such as a keyboard, etc.) and an output device 1005 (such as a display, etc.). The processor 1001, the memory 1002, the input device 1004, and the output device 1005 may be connected via a bus or other means. Figure 5 As shown, the memory 1002 includes a computer-readable storage medium 1003, which stores a computer program that can be run by the processor 1001. The processor 1001 can be a CPU, a microprocessor, or an integrated circuit for controlling the execution of the above method embodiment. When the processor 1001 runs the stored computer program, it can execute the various steps of the alarm suppression method in the embodiment of this specification, including: obtaining the alarm information of the system; determining whether the alarm information matches the alarm type of the first alarm level among the preset multiple alarm levels; if it matches, recording the alarm information in the first alarm suppression list of the first alarm level; and determining whether the alarm information recorded in the first alarm suppression list has an association relationship with the alarm information recorded in the second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record the alarm information to be suppressed; the alarm priority of the second alarm level is higher than the first alarm level; if there is an association relationship, the alarm information recorded in the first alarm suppression list is subjected to alarm suppression processing, and so on. For a detailed description of each step of the above alarm suppression method, please refer to the previous content and will not be repeated here.

[0098] Corresponding to the above method embodiment, the embodiment of this specification also provides a computer-readable storage medium, on which a computer program is stored, and when these computer programs are executed by a processor, the various steps of the alarm suppression method in the embodiment of this specification are executed. Please refer to the description of the above embodiment for details, which will not be repeated here.

[0099] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

[0100] In a typical configuration, a terminal device includes one or more CPUs, input / output interfaces, network interfaces, and memory.

[0101] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0102] Computer readable media include permanent and non-permanent, removable and non-removable media and can store information by any method or technology. The information can be computer readable instructions, data structures, program modules or other data.

[0103] Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may take the form of complete hardware embodiments, complete software embodiments or embodiments combining software and hardware. Moreover, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

Claims

1. An alarm suppression method, characterized in that: An alarm component applied to a system, the method comprising: Obtaining alarm information of the system; Determining whether the alarm information matches an alarm type of a first alarm level among a plurality of preset alarm levels; If a match is found, recording the alarm information into a first alarm suppression list of the first alarm level; and, Determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record the alarm information to be suppressed; and the alarm priority of the second alarm level is higher than that of the first alarm level; If there is an association, alarm suppression processing is performed on the alarm information recorded in the first alarm suppression list.

2. The method according to claim 1, characterized in that: The determining whether the alarm information matches an alarm type of a first alarm level among multiple preset alarm levels includes: Obtaining a preconfigured alarm suppression rule, wherein the alarm suppression rule includes a multi-level alarm type list corresponding to a plurality of preset alarm levels; Starting from the first-level alarm type list in the multi-level alarm type list, traverse each level of the alarm type list in turn, and for the i-th level alarm type list currently traversed, determine whether the alarm information matches the alarm type included in the i-th level alarm type list; wherein the alarm type of the first alarm level is the alarm type included in the i-th level alarm type list.

3. The method according to claim 2, characterized in that The recording the alarm information into the first alarm suppression list of the first alarm level includes: Recording the alarm information into the i-th level alarm suppression list corresponding to the i-th level alarm type list; The determining whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level includes: Determine whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1th level alarm suppression list; wherein the i-1th level alarm suppression list corresponding to the i-1th level alarm type list is the second alarm suppression list of the second alarm level; i=2, 3, ..., N, where N is an integer greater than 1.

4. The method according to claim 3, characterized in that The alarm information includes an attribute value of at least one alarm attribute; the determining whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the i-1-th level alarm suppression list includes: Determine that the alarm information recorded in the i-th level alarm suppression list has the same target alarm attribute as the alarm information recorded in the i-1-th level alarm suppression list; It is determined whether an attribute value of the target alarm attribute included in the alarm information recorded in the i-th level alarm suppression list is the same as an attribute value of the target alarm attribute included in the alarm information recorded in the i-1th level alarm suppression list.

5. The method according to claim 4, characterized in that The alarm suppression rule also includes a multi-level alarm attribute list corresponding to the multi-level alarm type list; wherein the i-th level alarm attribute list is used to record at least one i-th level alarm attribute contained in the alarm information matching the alarm type in the i-th level alarm type list; The step of determining that the alarm information recorded in the i-th level alarm suppression list has the same target alarm attribute as the alarm information recorded in the i-1-th level alarm suppression list. Obtain at least one level i alarm attribute included in the level i alarm attribute list, and at least one level i-1 alarm attribute included in the level i-1 alarm attribute list; Determine the target alarm attribute that is the same as the at least one i-th level alarm attribute and the at least one (i-1)-th level alarm attribute.

6. The method according to claim 5, characterized in that The determining whether the attribute value of the target alarm attribute included in the alarm information recorded in the i-th level alarm suppression list is the same as the attribute value of the target alarm attribute included in the alarm information recorded in the i-1th level alarm suppression list includes: According to the i-th level alarm attribute list, the alarm information recorded in the i-th level alarm suppression list is divided into at least one i-th level alarm combination; wherein the attribute value of the at least one i-th level alarm attribute contained in all the alarm information in each i-th level alarm combination is the same; Obtaining at least one attribute value of the target alarm attribute included in at least one i-1th level alarm combination; Determine whether an attribute value of the target alarm attribute included in any target i-th level alarm combination in the at least one i-th level alarm combination is the same as any attribute value in the at least one attribute value.

7. The method according to claim 6, characterized in that If there is an association relationship, performing alarm suppression processing on the alarm information recorded in the first alarm suppression list includes: If the attribute value of the target alarm attribute included in the target i-th level alarm combination is the same as any attribute value of the at least one attribute value, alarm suppression processing is performed on all alarm information included in the target i-th level alarm combination.

8. The method according to claim 4, characterized in that The alarm attributes include any one or more combinations of the following attributes: an IP address, a region, a cluster, and a network communication channel corresponding to the alarm.

9. The method according to any one of claims 1 to 8, characterized in that: The system is a database system.

10. The method according to claim 9, characterized in that The alarm component is a component installed in the database middleware.

11. An alarm suppression device, characterized in that: An alarm component applied to a system, the device comprising: An acquisition unit, used for acquiring alarm information of the system; A first determining unit, configured to determine whether the alarm information matches an alarm type of a first alarm level among a plurality of preset alarm levels; a recording unit, configured to record the alarm information into a first alarm suppression list of the first alarm level if a match is found; and A second determination unit is used to determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record the alarm information to be suppressed; and the alarm priority of the second alarm level is higher than the first alarm level; An alarm suppression unit is used to perform alarm suppression processing on the alarm information recorded in the first alarm suppression list if there is an association relationship.

12. A computing device, characterized in that: include: Memory and processor; The memory has stored thereon computer programs / instructions executable by the processor; When the processor runs the computer program / instructions, the method according to any one of claims 1 to 10 is performed.

13. A computer-readable storage medium, characterized in that: A computer program / instruction is stored thereon, and when the computer program / instruction is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

14. A computer program product, characterized in that The computer program product comprises a computer program / instruction, and when the computer program / instruction is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images