An alarm suppression method and related device

Abstract

This specification provides an alarm suppression method and related equipment, applied to the alarm components of a system. The method includes: acquiring alarm information from the system; determining whether the alarm information matches an alarm type of a first alarm level among a plurality of preset alarm levels; if a match is found, recording the alarm information in a first alarm suppression list for the first alarm level; and determining whether the alarm information recorded in the first alarm suppression list is associated with alarm information recorded in a second alarm suppression list for a second alarm level; wherein the alarm suppression list is used to record alarm information to be suppressed; the alarm priority of the second alarm level is higher than that of the first alarm level; if an association exists, alarm suppression processing is performed on the alarm information recorded in the first alarm suppression list.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of alarm suppression technology, and in particular to an alarm suppression method and related equipment. Background Technology

[0002] The system's alarm component continuously tracks various system performance metrics, such as CPU utilization, memory usage, disk space, disk I / O, and network traffic. When a system failure occurs, such as when CPU utilization or memory usage exceeds limits, the alarm component sends corresponding alarm messages to relevant maintenance personnel to promptly resolve the system failure and ensure the safe and stable operation of the system.

[0003] However, a single fault typically triggers multiple alarms. Some faults have a wider impact, potentially generating even more diverse alarms. This is especially true in large or complex systems, where a single fault can trigger a large number of alarms, often stemming from the same underlying cause. Failure to inhibit less important alarms can lead to an "alarm storm"—an excessive number of alarms generated in a short period, making it difficult for maintenance personnel to focus on truly critical issues. This can result in prolonged system failures, severely impacting system stability and security. Summary of the Invention

[0004] In view of this, one or more embodiments of this specification provide an alarm suppression method and related equipment.

[0005] Firstly, this specification provides an alarm suppression method applied to the alarm component of a system, the method comprising:

[0006] Obtain the alarm information of the system;

[0007] Determine whether the alarm information matches the alarm type of the first alarm level among a plurality of preset alarm levels;

[0008] If a match is found, the alarm information is recorded in the first alarm suppression list of the first alarm level; and,

[0009] Determine whether the alarm information recorded in the first alarm suppression list is related to the alarm information recorded in the second alarm suppression list of the second alarm level; wherein, the alarm suppression list is used to record alarm information to be suppressed; the alarm priority of the second alarm level is higher than that of the first alarm level;

[0010] If a correlation exists, alarm suppression processing is performed on the alarm information recorded in the first alarm suppression list.

[0011] Secondly, this specification provides an alarm suppression device applied to the alarm components of a system, the device comprising:

[0012] The acquisition unit is used to acquire alarm information of the system;

[0013] The first determining unit is used to determine whether the alarm information matches the alarm type of the first alarm level among a plurality of preset alarm levels;

[0014] A recording unit is configured to, if a match is found, record the alarm information in a first alarm suppression list of the first alarm level; and,

[0015] The second determining unit is used to determine whether there is a correlation between the alarm information recorded in the first alarm suppression list and the alarm information recorded in the second alarm suppression list of the second alarm level; wherein, the alarm suppression list is used to record alarm information to be suppressed; the alarm priority of the second alarm level is higher than that of the first alarm level;

[0016] An alarm suppression unit is used to perform alarm suppression processing on the alarm information recorded in the first alarm suppression list if a correlation exists.

[0017] Accordingly, this specification also provides a computing device, including: a memory and a processor; the memory stores a computer program / instructions executable by the processor; when the processor executes the computer program / instructions, it performs the alarm suppression method described in the first aspect above.

[0018] Accordingly, this specification also provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, performs the alarm suppression method as described in the first aspect above.

[0019] Accordingly, this specification also provides a computer program product comprising a computer program / instruction, which, when executed by a processor, performs the alarm suppression method as described in the first aspect above.

[0020] In summary, if a system-generated alarm matches a lower-priority alarm type, it can be recorded in a lower-level alarm suppression list for later suppression. Furthermore, if an alarm recorded in this lower-level suppression list is associated with an alarm recorded in a higher-priority suppression list, the lower-level alarm can be suppressed. Thus, by identifying and suppressing lower-priority alarms associated with higher-priority alarms, unimportant alarms caused by known or minor issues can be filtered out, reducing alarm noise. This allows the operations team to focus on more urgent and critical alarms, enabling faster identification of the most pressing root causes of current system failures. This facilitates faster fault diagnosis and repair, shortens the system's mean time to recovery, and ensures the safe and stable operation of the system. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of a system architecture for alarm suppression provided in an exemplary embodiment;

[0022] Figure 2 This is a flowchart illustrating an alarm suppression method provided in an exemplary embodiment;

[0023] Figure 3 This is a flowchart illustrating a step-by-step suppression method for associated alarms provided in an exemplary embodiment;

[0024] Figure 4 This is a schematic diagram of the structure of an alarm suppression device provided in an exemplary embodiment;

[0025] Figure 5 This is a schematic diagram of the structure of a computing device provided in an exemplary embodiment. Detailed Implementation

[0026] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0027] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0028] It should be noted that "multiple" as used in this application refers to two or more.

[0029] Furthermore, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. The collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0030] This manual provides a technical solution that, by identifying and suppressing alarms with related relationships, can reduce some unnecessary alarms with lower priority, allowing maintenance personnel to focus more on higher-priority, more important, and more urgent alarms in order to resolve system failures in a timely manner.

[0031] In implementation, the system's alarm component first acquires the system's alarm information. Then, it determines whether the alarm information matches the alarm type of the first alarm level among a set of preset alarm levels. If a match is found, the alarm information is recorded in the first alarm suppression list of the first alarm level. Further, the alarm component can determine whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level. The alarm suppression list records alarm information to be suppressed, with the second alarm level having a higher priority than the first alarm level. If the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in the second alarm suppression list of the second alarm level, alarm suppression processing can be performed on the alarm information recorded in the first alarm suppression list.

[0032] In the above technical solution, if the alarm information generated by the system matches an alarm type with a lower priority, the alarm information can be recorded in a low-level alarm suppression list for later suppression. Furthermore, if the alarm information recorded in the low-level alarm suppression list is associated with alarm information recorded in a high-level alarm suppression list, the alarm information recorded in the low-level list can be suppressed. In this way, by identifying and suppressing low-priority alarm information associated with high-priority alarm information, unimportant alarms caused by known or minor issues can be filtered out, thereby reducing alarm noise. This allows the operations and maintenance team to focus on more urgent and important alarms, enabling them to more quickly identify the most pressing root cause of the current system failure, accelerating fault diagnosis and repair, shortening the system's mean recovery time, and ensuring the safe and stable operation of the system.

[0033] Please see Figure 1 , Figure 1 This is a schematic diagram of a system architecture for alarm suppression provided in an exemplary embodiment. For example... Figure 1 As shown, the system architecture may include system 10 and alarm component 20. System 10 may be one or more server clusters, containing multiple servers, such as server 100a and server 100b, or it may be a single machine, such as containing only server 100a; this specification does not specify a particular limitation. Alarm component 20 may be implemented through software, hardware, or a combination of both; this specification does not specify a particular limitation.

[0034] In one illustrated embodiment, the alarm component 20 may be an alarm component integrated within system 10, or it may be any third-party provided alarm component; this specification does not impose any specific limitations on this. In one illustrated embodiment, system 10 may be a database system, and alarm component 20 may be an alarm component integrated within the database system, or it may be a component integrated into database middleware; this specification does not impose any specific limitations on this.

[0035] In one illustrated embodiment, when a failure occurs in system 10, a series of alarms are triggered. The alarm component 20 can first obtain all the current alarm information of system 10. For example, the alarm information may include various alarms such as "network interruption", "insufficient disk space", "CPU utilization exceeded", "memory utilization exceeded", "process interruption", and "service unavailable", which are not specifically limited in this specification.

[0036] Furthermore, the alarm component 20 can determine whether the acquired alarm information matches the alarm type of a first alarm level among a plurality of preset alarm levels. The plurality of alarm levels have different alarm priorities, and the first alarm level can be any one of the plurality of alarm levels. In one illustrated embodiment, the alarm component 20 can start from the alarm level with the highest alarm priority among the plurality of alarm levels, and perform alarm type matching and subsequent alarm suppression level by level, as detailed below. Figure 2 and Figure 3 The description of the corresponding embodiments will not be repeated here.

[0037] In one illustrated implementation, if the alarm information matches the alarm type (or alarm name) of the first alarm level, the alarm information can be recorded in the first alarm suppression list of the first alarm level.

[0038] For example, assuming that the alarm information obtained by the alarm component 20 is "process interruption", and the alarm type of the first alarm level also includes "process interruption", then the alarm information "process interruption" can be recorded in the first alarm suppression list of the first alarm level.

[0039] Furthermore, the alarm component 20 can determine whether the alarm information recorded in the first alarm suppression list is related to the alarm information recorded in the second alarm suppression list of the second alarm level. The second alarm level can be an alarm level with a higher priority than the first alarm level among a set of preset alarm levels; that is, the alarm priority of the second alarm level is higher than that of the first alarm level. For example, the alarm information recorded in the second alarm suppression list of the second alarm level could be "insufficient disk space," which is a critical alarm indicating the root cause of a system failure and may trigger secondary alarms such as "process interruption," therefore its alarm priority is higher than "process interruption."

[0040] It should be noted that the terms "first" and "second" in "first alarm level", "second alarm level", "first alarm suppression list" and "second alarm suppression list" in this manual are only used to distinguish different objects and do not directly limit their order or priority.

[0041] In one illustrated implementation, if the alarm information recorded in the first alarm suppression list is related to the alarm information recorded in the second alarm suppression list of the second alarm level (e.g., they both belong to the same cluster or the same IP address), the alarm component 20 can perform alarm suppression processing on the alarm information recorded in the first alarm suppression list, that is, it will not send alarm messages related to the alarm information to the operation and maintenance personnel. For details, please refer to the following... Figure 2 and Figure 3 The description of the corresponding embodiments will not be repeated here.

[0042] Therefore, this manual takes into account that a single system failure may trigger multiple alarms, and these alarms often have certain correlations, such as topological relationships, direct correlations, or indirect correlations. Based on this correlation, this manual first presets multiple alarm levels corresponding to different alarm priorities. Then, by identifying and suppressing low-priority alarms associated with high-priority alarm information, it filters out unimportant alarms caused by known or minor issues, generating only high-priority, important alarms that indicate the root cause of the failure. This reduces the number of alarms when a system failure occurs, decreases false alarms, and allows the operations team to focus on more urgent and important alarms. This enables faster identification of the most pressing root cause of the current system failure, facilitating faster fault diagnosis and repair, and ensuring the safe and stable operation of the system.

[0043] It should be understood that Figure 1 The system architecture shown is for illustrative purposes only. In some possible implementations, the alarm suppression system architecture described in this specification may include more advanced features than [previous examples]. Figure 1 This manual does not specify whether there are more or fewer devices as shown.

[0044] Please see Figure 2 , Figure 2 This is a flowchart illustrating an alarm suppression method provided in an exemplary embodiment. This method can be applied to... Figure 1 The system architecture shown can be specifically applied to Figure 1 The alarm components are shown. (As shown in the image.) Figure 2 As shown, the method may specifically include the following steps S201-S205.

[0045] Step S201: Obtain system alarm information.

[0046] In one illustrated implementation, when a system failure occurs, a series of alarms are triggered, and the alarm component can acquire all current alarm information of the system. For example, the alarm information may include various alarms such as "network interruption," "insufficient disk space," "CPU utilization exceeding limits," "memory utilization exceeding limits," "process interruption," and "service unavailable," etc., which are not specifically limited in this specification.

[0047] In one illustrated embodiment, the alarm status of these alarm messages can include "alarm in progress," "masked," and "suppressed," which are not specifically limited in this specification. Alarms in progress generate alarm messages and are sent to relevant maintenance personnel; a masked alarm status can be a form of manual intervention to prevent the generation of alarm messages; a suppressed alarm status can be an automatically identified alarm status, and suppressed alarms also do not generate alarm messages. In other words, this specification not only suppresses alarms associated with alarms in progress but also further suppresses alarms associated with masked and suppressed alarms, thereby greatly improving alarm suppression effectiveness and reducing the number of unnecessary alarms.

[0048] Step S202: Determine whether the alarm information matches the alarm type of the first alarm level among a set of preset alarm levels.

[0049] As mentioned above, this manual predefines multiple alarm levels corresponding to different alarm priorities based on the correlation between alarms. Among them, alarms with higher priority are often important alarms that indicate the root cause of the failure and are urgent alarms that need to be resolved immediately, such as "network interruption" and "insufficient disk space". Alarms with lower priority are often secondary problems caused by the root cause of the failure, such as "process interruption" and "service unavailable". This manual does not make specific limitations on these.

[0050] In one illustrated embodiment, after acquiring alarm information from the system, the alarm component can determine whether the alarm information matches the alarm type of a first alarm level among a plurality of preset alarm levels. The first alarm level can be any one of the plurality of alarm levels. In another illustrated embodiment, the alarm component can start from the alarm level with the highest alarm priority among the plurality of alarm levels and perform alarm type matching and subsequent alarm suppression level by level.

[0051] Specifically, in one of the illustrated embodiments, the alarm component can first obtain a pre-configured alarm suppression rule, which may include a multi-level alarm type list (which may be denoted as an alarm_types list) corresponding to the above-mentioned multiple alarm levels. Each level of the multi-level alarm type list is used to record several alarm types corresponding to its alarm level.

[0052] In one illustrated embodiment, after obtaining alarm information from the system, the alarm component can sequentially traverse each level of the multi-level alarm type list, starting from the first level alarm type list. For the currently traversed i-th level alarm type list, it can determine whether the obtained alarm information matches the alarm type contained in that i-th level alarm type list. Here, the alarm type of the first alarm level can be any alarm type contained in the currently traversed i-th level alarm type list.

[0053] In one illustrated implementation, the pre-configured alarm suppression rules may be text data, so the text data needs to be deserialized first to obtain alarm suppression rules in a recursive data structure so that the alarm component can read them.

[0054] Step S203: If a match is found, the alarm information is recorded in the first alarm suppression list of the first alarm level.

[0055] In one illustrated embodiment, if an alarm message matches an alarm type of a first alarm level, the alarm component may record the alarm message in a first alarm suppression list of the first alarm level.

[0056] The alarm suppression list (which can be denoted as the inhibit_alarms list) can be used to record alarm information to be suppressed. It is easy to understand that not all of these alarm information to be suppressed will eventually be suppressed, but the alarm information that will eventually be suppressed will definitely belong to these alarm information to be suppressed.

[0057] In one illustrated implementation, taking the currently traversed list of level i alarm types as an example, if the alarm information matches the alarm type contained in the list of level i alarm types, the alarm component can record the alarm information in the list of level i alarm suppression corresponding to the list of level i alarm types.

[0058] In one illustrated implementation, if all the alarm information obtained does not match the alarm types contained in the alarm type list of the i-th level, the alarm suppression of the i-th level can be terminated, and the process can continue to traverse the alarm type list of the (i+1)-th level to determine whether the obtained alarm information matches the alarm types contained in the alarm type list of the (i+1)-th level.

[0059] Step S204: Determine whether the alarm information recorded in the first alarm suppression list is related to the alarm information recorded in the second alarm suppression list of the second alarm level; wherein, the alarm suppression list is used to record alarm information to be suppressed; the alarm priority of the second alarm level is higher than that of the first alarm level.

[0060] Furthermore, the alarm component can determine whether the alarm information recorded in the first alarm suppression list is related to the alarm information recorded in the second alarm suppression list of the second alarm level. The alarm priority of the second alarm level is higher than that of the first alarm level.

[0061] In one illustrated implementation, taking the currently traversed i-th level alarm type list as an example, the alarm component can determine whether the alarm information recorded in the i-th level alarm suppression list is related to the alarm information recorded in the (i-1)-th level alarm suppression list. Correspondingly, the second alarm suppression list for the second alarm level can be this (i-1)-th level alarm suppression list. It is easy to understand that the alarm information recorded in the (i-1)-th level alarm type list is the alarm information that matches the alarm types contained in the (i-1)-th level alarm type list. Here, i = 2, 3, ..., N, and N is an integer greater than 1.

[0062] It should be noted that this specification does not specifically limit the particular implementation method for determining whether the alarm information recorded in the i-th level alarm suppression list is related to the alarm information recorded in the (i-1)-th level alarm suppression list. In one illustrated embodiment, the correlation between two alarm messages can be determined based on whether they originate from the same machine or the same cluster.

[0063] In one illustrated implementation, the alarm information may include attribute values ​​for at least one alarm attribute, or at least one dimension of information. For example, alarm attributes may include any combination of one or more attributes shown below: the IP address corresponding to the alarm, region, cluster, and network communication channel, etc., which are not specifically limited herein.

[0064] Based on this, when determining whether the alarm information recorded in the i-th level alarm suppression list is related to the alarm information recorded in the (i-1)-th level alarm suppression list, it can specifically include: first determining whether the alarm information recorded in the i-th level alarm suppression list contains the same target alarm attribute as the alarm information recorded in the (i-1)-th level alarm suppression list; then, further determining whether the attribute value of the target alarm attribute contained in the alarm information recorded in the i-th level alarm suppression list is the same as the attribute value of the target alarm attribute contained in the alarm information recorded in the (i-1)-th level alarm suppression list.

[0065] For example, the alarm information recorded in the i-th level alarm suppression list may contain the attribute values ​​of two alarm attributes: cluster and IP address. The alarm information recorded in the (i-1)-th level alarm suppression list may contain the attribute value of one alarm attribute: IP address. In this case, the same target alarm attribute is the cluster attribute.

[0066] In one illustrated embodiment, this specification may further standardize and store the attribute values ​​of these alarm attributes in the alarm information in labels, where labels are a key-value Map structure. Correspondingly, the pre-configured alarm suppression rules may also include a multi-level alarm attribute list (which can be denoted as a label key list) corresponding to the multi-level alarm type list. The i-th level alarm attribute list can be used to record at least one i-th level alarm attribute contained in alarm information that matches the alarm type in the i-th level alarm type list.

[0067] For example, the alarm types recorded in the Level 1 alarm type list may include "network interruption" and the alarm attributes recorded in the corresponding Level 1 alarm attribute list may include region and cluster, or may only include cluster, etc. This specification does not make specific limitations on this.

[0068] For example, the alarm types recorded in the Level 2 alarm type list may include "insufficient disk space" and "CPU utilization exceeded limit", and the alarm attributes recorded in the corresponding Level 2 alarm attribute list may include cluster and IP address, or may only include IP address, etc. This specification does not make specific limitations on this.

[0069] For example, the alarm types recorded in the Level 3 alarm type list may include "process interruption" and "service unavailable", and the alarm attributes recorded in the corresponding Level 3 alarm attribute list may include IP address. This specification does not make specific limitations on this.

[0070] In one illustrated embodiment, based on the multi-level alarm attribute list defined in the alarm suppression rules above, when the alarm component determines that the alarm information recorded in the i-th level alarm suppression list contains the same target alarm attribute as the alarm information recorded in the (i-1)-th level alarm suppression list, it may specifically include: obtaining at least one i-th level alarm attribute contained in the i-th level alarm attribute list and at least one (i-1)-th level alarm attribute contained in the (i-1)-th level alarm attribute list; further, determining that the at least one i-th level alarm attribute is the same target alarm attribute as the at least one (i-1)-th level alarm attribute.

[0071] In one illustrated embodiment, after matching alarm information with alarm types recorded in the i-th level alarm attribute list to obtain the i-th level alarm suppression list, the alarm information recorded in the i-th level alarm suppression list can be further grouped and aggregated. Specifically, the alarm information recorded in the i-th level alarm suppression list can be divided into at least one i-th level alarm group according to at least one i-th level alarm attribute recorded in the i-th level alarm attribute list. Wherein, all alarm information within each i-th level alarm group contains the same attribute value for the at least one i-th level alarm attribute.

[0072] For example, taking Level 2 as an example, the alarm information recorded in the Level 2 alarm suppression list may include "Disk space A is insufficient", "Disk space B is insufficient", and "CPU utilization exceeds the limit", etc. The alarm attributes recorded in the Level 2 alarm attribute list may include cluster and IP address. Among them, the cluster for alarm information "Disk space A is insufficient" is cluster A, and the IP address is IP-1; the cluster for alarm information "Disk space B is insufficient" is cluster A, and the IP address is IP-1; the cluster for alarm information "CPU utilization exceeds the limit" is cluster A, and the IP address is IP-2.

[0073] In this way, alarm messages “Disk space A is insufficient” and “Disk space B is insufficient” can be grouped (or aggregated) into the same Level 2 alarm group (which can be denoted as Level 2 alarm group-21) according to the cluster and IP address of multiple alarm messages, and alarm message “CPU utilization exceeds limit” can be grouped into another Level 2 alarm group (which can be denoted as Level 2 alarm group-22).

[0074] For example, taking Level 3 as an example, the alarm information recorded in the Level 3 alarm suppression list may include "Service A is unavailable", "Service B is unavailable", "Service C is unavailable" and "Service D is unavailable", etc. The alarm attributes recorded in the Level 3 alarm attribute list may include IP addresses, where the IP address of alarm information "Service A is unavailable" is IP-1, the IP address of alarm information "Service B is unavailable" is IP-2, the IP address of alarm information "Service C is unavailable" is IP-3, and the IP address of alarm information "Service D is unavailable" is IP-3.

[0075] In this way, alarm messages “Service A unavailable” and “Service B unavailable” can be grouped into the same Level 3 alarm group (which can be denoted as Level 3 alarm group-31) according to the IP address of multiple alarm messages, alarm message “Service C unavailable” can be grouped into another Level 3 alarm group (which can be denoted as Level 3 alarm group-32), and alarm message “Service D unavailable” can be grouped into yet another Level 3 alarm group (which can be denoted as Level 3 alarm group-33).

[0076] In one illustrated embodiment, based on the above-described grouping and aggregation of alarm information recorded in each level of alarm suppression list, when the alarm component determines whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the (i-1)-th level alarm suppression list, it can use the alarm combination as the associated alarm suppression unit to determine whether there is an association between the i-th level alarm combination and the (i-1)-th level alarm combination.

[0077] Specifically, for at least one level-i-1 alarm combination obtained by aggregating alarm information recorded in the level-i-1 alarm suppression list, the alarm component may first obtain at least one attribute value of the target alarm attribute contained in the at least one level-i-1 alarm combination.

[0078] Furthermore, for at least one level i alarm combination obtained by aggregating alarm information recorded in the level i alarm suppression list, the alarm component can determine whether the attribute value of the target alarm attribute contained in any target level i alarm combination is the same as any attribute value of at least one attribute value of the target alarm attribute contained in the at least one (i-1) level alarm combination.

[0079] For example, still using the Level 2 and Level 3 examples described above, at least one Level i-1 alarm combination may include the Level 2 alarm combination-21 and Level 2 alarm combination-22, and at least one Level i alarm combination may include the Level 3 alarm combination-31, Level 3 alarm combination-32, and Level 3 alarm combination-33. The common target alarm attribute in both Level 2 and Level 3 is the IP address. Accordingly, the alarm component can first obtain the IP addresses contained in Level 2 alarm combination-21 and Level 2 alarm combination-22, which are IP-1 and IP-2 respectively. Further, the alarm component can determine whether the IP address contained in Level 3 alarm combination-31 is the same as either IP-1 or IP-2, and the same applies to Level 3 alarm combination-31 and Level 3 alarm combination-33.

[0080] Step S205: If a correlation exists, alarm suppression processing is performed on the alarm information recorded in the first alarm suppression list.

[0081] In one illustrated implementation, if the alarm information recorded in the first alarm suppression list is related to the alarm information recorded in the second alarm suppression list of the second alarm level (e.g., they both belong to the same cluster or the same IP address), the alarm component can perform alarm suppression processing on the alarm information recorded in the first alarm suppression list, that is, it will not send alarm messages related to the alarm information to the operation and maintenance personnel.

[0082] In one of the illustrated implementations, if there is no correlation, there is no need to suppress the alarm information, and the alarm message can be sent directly to the maintenance personnel.

[0083] In one illustrated implementation, taking the currently traversed list of alarm types at level i as an example, if the alarm information recorded in the level i-th alarm suppression list is related to the alarm information recorded in the (i-1)th level alarm suppression list, for example, if the attribute value of the target alarm attribute (such as cluster or IP address) contained in the alarm information recorded in the level i-th alarm suppression list is the same as the attribute value of the target alarm attribute contained in the alarm information recorded in the (i-1)th level alarm suppression list, then the alarm component can perform alarm suppression processing on the alarm information recorded in the level i-th alarm suppression list.

[0084] In one illustrated embodiment, as described above, if the aggregated alarm combination is used as the associated alarm suppression unit, and if the attribute value of the target alarm attribute contained in any target i-th level alarm combination in the at least one i-th level alarm combination is the same as any attribute value of at least one attribute value of the target alarm attribute contained in the at least one (i-1)-th level alarm combination, then alarm suppression processing can be performed on all alarm information contained in the target i-th level alarm combination.

[0085] For example, taking the Level 2 and Level 3 examples as described above, where the IP addresses contained in Level 2 alarm combination-21 and Level 2 alarm combination-22 are IP-1 and IP-2 respectively, and the IP address contained in Level 3 alarm combination-31 is IP-1, then the alarm component can perform alarm suppression processing on all alarm messages in Level 3 alarm combination-31 (i.e., alarm messages "Service A is unavailable" and "Service B is unavailable"); the IP address contained in Level 3 alarm combination-32 is... If the IP address is IP-2, the alarm component can suppress all alarm messages in the Level 3 alarm combination - 32 (i.e., alarm message "C service unavailable"). However, if the IP address in the Level 3 alarm combination - 33 is IP-3 (which is different from both IP-1 and IP-2), the alarm component does not need to suppress the alarm messages in the Level 3 alarm combination - 33 (i.e., alarm message "D service unavailable"). In other words, the alarm message "D service unavailable" can be sent normally to the operation and maintenance personnel.

[0086] It should be noted that if the (i-1)th level alarm suppression list is empty and does not contain any alarm information, it means that there is no alarm information in the current alarm information of the system that matches the alarm type recorded in the (i-1)th level alarm type list. Furthermore, it also means that there is no alarm information in the (i-1)th level that is associated with the alarm information in the i-th level. Therefore, the alarm information in the i-th level does not need to be suppressed and can be directly sent to the operation and maintenance personnel.

[0087] Alternatively, in some possible implementations, if the (i-1)th level alarm suppression list is empty, the alarm component can further check the (i-2)th level alarm suppression list. If the (i-2)th level alarm suppression list is not empty, it can further confirm whether there is a correlation between the alarm information recorded in the (i-2)th level alarm suppression list and the alarm information recorded in the (i)th level alarm suppression list.

[0088] For example, suppose the alarm information recorded in the Level 1 alarm suppression list includes "Network Interruption", and the alarm attributes recorded in the Level 1 alarm attribute list include cluster and IP address, where the cluster for the alarm information "Network Interruption" is cluster A, and the IP address is IP-1. Furthermore, suppose the Level 2 alarm suppression list is empty, but the Level 3 alarm suppression list still contains the aforementioned alarm information "Service A Unavailable", "Service B Unavailable", "Service C Unavailable", and "Service D Unavailable". Thus, although the Level 2 alarm suppression list is empty, the IP address of the alarm information "Network Interruption" recorded in the Level 1 alarm suppression list is the same as the IP address of the alarm information "Service A Unavailable" and the alarm information "Service B Unavailable"—both are IP-1. Therefore, the alarm component can also perform alarm suppression processing for the alarm information "Service A Unavailable" and the alarm information "Service B Unavailable". This specification does not specifically limit this.

[0089] In one of the illustrated implementations, please refer to Figure 3 , Figure 3 This is a flowchart illustrating a step-by-step suppression method for associated alarms, provided in an exemplary embodiment. The following will combine... Figure 3 This manual describes the step-by-step suppression method for associated alarms.

[0090] like Figure 3 As shown, the alarm component first obtains the alarm set, which can contain all alarm information of the current system, including alarms in progress, alarms that have been masked, and alarms that have been suppressed.

[0091] Furthermore, such as Figure 3As shown, the alarm component first matches the acquired alarm information with the first-level alarm type list in the pre-configured alarm suppression rules. If the alarm information matches an alarm type recorded in the first-level alarm type list, the alarm information is recorded in the first-level alarm suppression list (first recursion). If none of the acquired alarm information matches an alarm type recorded in the first-level alarm type list, the matching continues from the second level.

[0092] Furthermore, such as Figure 3 As shown, the alarm information recorded in the Level 1 alarm suppression list is grouped and aggregated according to the alarm attributes recorded in the Level 1 alarm attribute list, resulting in Level 1 alarm combination-11, Level 1 alarm combination-12, etc. (second recursion). The information contained in Level 1 alarm combination-11 and Level 1 alarm combination-12 (such as the attribute values ​​of each alarm attribute) can be passed to the next level (i.e., Level 2) for associated alarm suppression.

[0093] It is understandable that the alarm types recorded in the first-level alarm type list of the multi-level alarm type list are usually alarm types caused by the most fundamental fault cause, i.e. root cause alarms. Therefore, alarm information that matches the alarm type in the first-level alarm type list will not be suppressed after being recorded in the first-level alarm suppression list. Alarm suppression in this manual starts from the second level.

[0094] Furthermore, such as Figure 3 As shown, the acquired alarm information is matched against the pre-configured alarm suppression rules in the Level 2 alarm type list. If the alarm information matches an alarm type recorded in the Level 2 alarm type list, the alarm information is recorded in the Level 2 alarm suppression list (first recursion). Similarly, if none of the acquired alarm information matches an alarm type recorded in the Level 2 alarm type list, the matching continues from Level 3.

[0095] Furthermore, such as Figure 3 As shown, the alarm information recorded in the Level 2 alarm suppression list is grouped and aggregated according to the alarm attributes recorded in the Level 2 alarm attribute list to obtain Level 2 alarm combination-21 and Level 2 alarm combination-22, etc. (second recursion).

[0096] Furthermore, such as Figure 3As shown, it is determined whether there is a correlation (i.e., whether there are identical attribute values) between the Level 2 alarm combination -21 and the previous Level 1 alarm combination -11 or Level 12. If a correlation exists, alarm suppression processing can be performed on the alarm information contained in Level 2 alarm combination -21, and the same applies to Level 2 alarm combination -22. The information contained in Level 2 alarm combination -21 and Level 2 alarm combination -22 (i.e., the attribute values ​​of each attribute) can also be passed to the next level (i.e., Level 3) to continue correlated alarm suppression, and so on, until the final Nth level is reached.

[0097] Thus, by using the step-by-step suppression method for related alarms provided in this manual, not only can alarms directly related to the root cause alarm be identified, but this relationship can also be propagated to identify a large number of other alarms indirectly related to the root cause alarm. This greatly improves the alarm suppression effect, filters out unimportant alarms caused by known or minor issues, reduces alarm noise, and allows the operations and maintenance team to focus on more urgent and important alarms. This enables them to identify the most urgent root cause of the current system failure more quickly, which helps to speed up the diagnosis and repair of the failure, thereby shortening the average recovery time of the system and ensuring the safe and stable operation of the system.

[0098] Corresponding to the above method and process implementation, the embodiments of this specification also provide an alarm suppression device. Please refer to... Figure 4 , Figure 4 This is a schematic diagram of an alarm suppression device provided in an exemplary embodiment. The device 40 can be applied to… Figure 1 The system architecture shown can be specifically applied to Figure 1 The alarm components are shown. (As shown in the image.) Figure 4 As shown, the device 40 includes:

[0099] Acquisition unit 401 is used to acquire alarm information of the system;

[0100] The first determining unit 402 is used to determine whether the alarm information matches the alarm type of the first alarm level among a plurality of preset alarm levels;

[0101] Recording unit 403 is configured to, if a match is found, record the alarm information into a first alarm suppression list of the first alarm level; and,

[0102] The second determining unit 404 is used to determine whether the alarm information recorded in the first alarm suppression list is related to the alarm information recorded in the second alarm suppression list of the second alarm level; wherein, the alarm suppression list is used to record alarm information to be suppressed; the alarm priority of the second alarm level is higher than that of the first alarm level;

[0103] The alarm suppression unit 405 is used to perform alarm suppression processing on the alarm information recorded in the first alarm suppression list if there is a correlation.

[0104] In one illustrated embodiment, the first determining unit 402 is specifically used for:

[0105] Obtain pre-configured alarm suppression rules, which include a list of multi-level alarm types corresponding to multiple preset alarm levels;

[0106] Starting from the first-level alarm type list in the multi-level alarm type list, each level alarm type list is traversed sequentially. For the currently traversed i-th level alarm type list, it is determined whether the alarm information matches the alarm type contained in the i-th level alarm type list; wherein, the alarm type of the first alarm level is the alarm type contained in the i-th level alarm type list.

[0107] In one illustrated embodiment, the recording unit 403 is specifically used for:

[0108] The alarm information is recorded in the i-th level alarm suppression list corresponding to the i-th level alarm type list;

[0109] The second determining unit 404 is specifically used for:

[0110] Determine whether the alarm information recorded in the i-th level alarm suppression list is related to the alarm information recorded in the (i-1)-th level alarm suppression list; wherein, the (i-1)-th level alarm suppression list corresponding to the (i-1)-th level alarm type list is the second alarm suppression list of the second alarm level; i=2,3,...,N, N is an integer greater than 1.

[0111] In one illustrated embodiment, the alarm information includes the attribute value of at least one alarm attribute; the second determining unit 404 is specifically used for:

[0112] Determine that the alarm information recorded in the i-th level alarm suppression list has the same target alarm attribute as the alarm information recorded in the (i-1)-th level alarm suppression list;

[0113] Determine whether the attribute value of the target alarm attribute contained in the alarm information recorded in the i-th level alarm suppression list is the same as the attribute value of the target alarm attribute contained in the alarm information recorded in the (i-1)-th level alarm suppression list.

[0114] In one illustrated embodiment, the alarm suppression rule further includes a multi-level alarm attribute list corresponding to the multi-level alarm type list; wherein, the i-th level alarm attribute list is used to record at least one i-th level alarm attribute contained in alarm information that matches the alarm type in the i-th level alarm type list.

[0115] The second determining unit 404 is specifically used for:

[0116] Obtain at least one level i alarm attribute contained in the level i alarm attribute list, and at least one level i-1 alarm attribute contained in the (i-1) level alarm attribute list;

[0117] Identify the target alarm attribute that is the same as the at least one i-th level alarm attribute and the at least one (i-1)th level alarm attribute.

[0118] In one illustrated embodiment, the second determining unit 404 is specifically used for:

[0119] According to the i-th level alarm attribute list, the alarm information recorded in the i-th level alarm suppression list is divided into at least one i-th level alarm combination; wherein, the attribute values ​​of the at least one i-th level alarm attribute contained in all alarm information within each i-th level alarm combination are the same.

[0120] Obtain at least one attribute value of the target alarm attribute contained in at least one (i-1)th level alarm combination;

[0121] Determine whether the attribute value of the target alarm attribute contained in any target level i alarm combination in the at least one level i alarm combination is the same as any attribute value among the at least one attribute values.

[0122] In one illustrated embodiment, the alarm suppression unit 405 is specifically used for:

[0123] If the attribute value of the target alarm attribute included in the target level i alarm combination is the same as any of the at least one attribute value, then alarm suppression processing is performed on all alarm information included in the target level i alarm combination.

[0124] In one illustrated implementation, the alarm attributes include any combination of one or more of the following attributes: the IP address, region, cluster, and network communication channel corresponding to the alarm.

[0125] In one illustrated embodiment, the system is a database system.

[0126] In one illustrated embodiment, the alarm component is a component integrated into the database middleware.

[0127] The specific implementation process of the functions and roles of each unit in the aforementioned device 40 is detailed in the description of the above embodiments and will not be repeated here. It should be understood that the aforementioned device 40 can be implemented through software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor (CPU) of the device loading the corresponding computer program instructions into memory for execution. From a hardware perspective, in addition to the CPU and memory, the device typically includes other hardware such as chips for wireless signal transmission and reception, and / or other hardware such as boards for implementing network communication functions.

[0128] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the units or modules can be selected to achieve the purpose of the solution described in this specification, depending on actual needs. Those skilled in the art can understand and implement this without any inventive effort.

[0129] The devices, units, and modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, in-vehicle computer, or any combination of these devices.

[0130] Corresponding to the above method embodiments, embodiments of this specification also provide a computing device. Please refer to... Figure 5 , Figure 5 This is a schematic diagram of the structure of a computing device provided in an exemplary embodiment. The computing device may be equipped with... Figure 1 The computing device for the alarm component in the system architecture shown. For example... Figure 5 As shown, the computing device includes a processor 1001 and a memory 1002, and may further include an input device 1004 (e.g., a keyboard) and an output device 1005 (e.g., a display). The processor 1001, memory 1002, input device 1004, and output device 1005 can be connected via a bus or other means. Figure 5As shown, the memory 1002 includes a computer-readable storage medium 1003 storing a computer program executable by the processor 1001. The processor 1001 may be a CPU, a microprocessor, or an integrated circuit for controlling the execution of the above method embodiments. When the processor 1001 runs the stored computer program, it can execute various steps of the alarm suppression method in the embodiments of this specification, including: acquiring alarm information of the system; determining whether the alarm information matches the alarm type of a first alarm level among a plurality of preset alarm levels; if they match, recording the alarm information in a first alarm suppression list of the first alarm level; and determining whether the alarm information recorded in the first alarm suppression list is associated with the alarm information recorded in a second alarm suppression list of the second alarm level; wherein the alarm suppression list is used to record alarm information to be suppressed; the alarm priority of the second alarm level is higher than that of the first alarm level; if an association exists, alarm suppression processing is performed on the alarm information recorded in the first alarm suppression list, etc. For a detailed description of each step of the alarm suppression method described above, please refer to the previous content, which will not be repeated here.

[0131] Corresponding to the above-described method embodiments, this specification also provides a computer-readable storage medium storing computer programs that, when run by a processor, execute the various steps of the alarm suppression method described in this specification. Please refer to the description of the above embodiments for details, which will not be repeated here.

[0132] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

[0133] In a typical configuration, a terminal device includes one or more CPUs, input / output interfaces, network interfaces, and memory.

[0134] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0135] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data.

[0136] Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0137] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0138] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of computer program products implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. An alarm suppression method, characterized in that, The method, applied to an alarm component of a system, includes: Obtain the alarm information of the system; the alarm status of the alarm information includes: alarm in progress, masked, and suppressed; Determine whether the alarm information matches the alarm type of the i-th alarm level among a plurality of preset alarm levels; If a match is found, the alarm information is recorded in the i-th level alarm suppression list of the i-th alarm level; and, If the (i-1)th level alarm suppression list is not empty, determine whether the alarm information recorded in the (i-1)th level alarm suppression list is related to the alarm information recorded in the (i-1)th level alarm suppression list; wherein, the alarm suppression list is used to record the alarm information to be suppressed; the alarm priority of the (i-1)th level alarm is higher than the alarm priority of the i-th level alarm. If the (i-1)th level alarm suppression list is empty and the (i-2)th level alarm suppression list is not empty, determine whether the alarm information recorded in the (i-1)th level alarm suppression list is related to the alarm information recorded in the (i-2)th level alarm suppression list; the alarm priority of the (i-2)th level alarm is higher than the alarm priority of the (i-1)th level alarm; i = 3, 4, ..., N, where N is an integer greater than 1; If a correlation exists, alarm suppression processing is performed on the alarm information recorded in the i-th level alarm suppression list.

2. The method according to claim 1, characterized in that, Determining whether the alarm information matches the alarm type of the i-th alarm level among a plurality of preset alarm levels includes: Obtain pre-configured alarm suppression rules, which include a list of multi-level alarm types corresponding to multiple preset alarm levels; Starting from the first-level alarm type list in the multi-level alarm type list, each level alarm type list is traversed sequentially. For the currently traversed i-th level alarm type list, it is determined whether the alarm information matches the alarm type contained in the i-th level alarm type list; wherein, the alarm type of the i-th alarm level is the alarm type contained in the i-th level alarm type list.

3. The method according to claim 2, characterized in that, The step of recording the alarm information into the i-th level alarm suppression list of the i-th alarm level includes: The alarm information is recorded in the i-th level alarm suppression list corresponding to the i-th level alarm type list.

4. The method according to claim 3, characterized in that, The alarm information contains at least one attribute value for an alarm attribute; determining whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the (i-1)-th level alarm suppression list includes: Determine that the alarm information recorded in the i-th level alarm suppression list has the same target alarm attribute as the alarm information recorded in the (i-1)-th level alarm suppression list; Determine whether the attribute value of the target alarm attribute contained in the alarm information recorded in the i-th level alarm suppression list is the same as the attribute value of the target alarm attribute contained in the alarm information recorded in the (i-1)-th level alarm suppression list.

5. The method according to claim 4, characterized in that, The alarm suppression rule also includes a multi-level alarm attribute list corresponding to the multi-level alarm type list; wherein, the i-th level alarm attribute list is used to record at least one i-th level alarm attribute contained in alarm information that matches the alarm type in the i-th level alarm type list. The step of determining that the alarm information recorded in the i-th level alarm suppression list has the same target alarm attribute as the alarm information recorded in the (i-1)-th level alarm suppression list includes: Obtain at least one level i alarm attribute contained in the level i alarm attribute list, and at least one level i-1 alarm attribute contained in the (i-1) level alarm attribute list; Identify the target alarm attribute that is the same as the at least one i-th level alarm attribute and the at least one (i-1)th level alarm attribute.

6. The method according to claim 5, characterized in that, The step of determining whether the attribute value of the target alarm attribute contained in the alarm information recorded in the i-th level alarm suppression list is the same as the attribute value of the target alarm attribute contained in the alarm information recorded in the (i-1)-th level alarm suppression list includes: According to the i-th level alarm attribute list, the alarm information recorded in the i-th level alarm suppression list is divided into at least one i-th level alarm combination; wherein, the attribute values ​​of the at least one i-th level alarm attribute contained in all alarm information within each i-th level alarm combination are the same; Obtain at least one attribute value of the target alarm attribute contained in at least one (i-1)th level alarm combination; Determine whether the attribute value of the target alarm attribute contained in any target level i alarm combination in the at least one level i alarm combination is the same as any attribute value among the at least one attribute values.

7. The method according to claim 6, characterized in that, If a correlation exists, alarm suppression processing is performed on the alarm information recorded in the i-level alarm suppression list, including: If the attribute value of the target alarm attribute included in the target level i alarm combination is the same as any of the at least one attribute value, then alarm suppression processing is performed on all alarm information included in the target level i alarm combination.

8. The method according to claim 4, characterized in that, The alarm attributes include any combination of one or more of the following attributes: the IP address, region, cluster, and network communication channel corresponding to the alarm.

9. The method according to any one of claims 1-8, characterized in that, The system is a database system.

10. The method according to claim 9, characterized in that, The alarm component is a component integrated into the database middleware.

11. An alarm suppression device, characterized in that, An alarm component applied to a system, the device comprising: The acquisition unit is used to acquire alarm information of the system; the alarm status of the alarm information includes: alarm in progress, masked, and suppressed; The first determining unit is used to determine whether the alarm information matches the alarm type of the i-th alarm level among a plurality of preset alarm levels; A recording unit is configured to, if a match is found, record the alarm information into the i-th level alarm suppression list of the i-th alarm level; and, The second determining unit is configured to determine whether the alarm information recorded in the (i-1)th level alarm suppression list is associated with the alarm information recorded in the (i-1)th level alarm suppression list if the (i-1)th level alarm suppression list is not empty; wherein, the alarm suppression list is used to record alarm information to be suppressed; the alarm priority of the (i-1)th level alarm is higher than the alarm priority of the i-th level alarm; if the (i-1)th level alarm suppression list is empty and the (i-2)th level alarm suppression list is not empty, determine whether the alarm information recorded in the i-th level alarm suppression list is associated with the alarm information recorded in the (i-2)th level alarm; the alarm priority of the (i-2)th level alarm is higher than the alarm priority of the (i-1)th level alarm; i = 3, 4, ..., N, where N is an integer greater than 1; An alarm suppression unit is used to perform alarm suppression processing on the alarm information recorded in the i-th level alarm suppression list if a correlation exists.

12. A computing device, characterized in that, include: Memory and processor; The memory stores computer programs / instructions that can be executed by the processor; When the processor runs the computer program / instructions, it performs the method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, It stores a computer program / instruction thereon, which, when executed by a processor, implements the method as described in any one of claims 1 to 10.

14. A computer program product, characterized in that, The computer program product includes a computer program / instruction that, when executed by a processor, implements the method as described in any one of claims 1 to 10.

Images