Automatic operation and maintenance intelligent alarm processing method and device, equipment and storage medium

Abstract

The embodiment of the invention provides an automatic operation and maintenance intelligent alarm processing method and device, equipment and a storage medium. The method comprises the steps of collecting state information of a preset node of a target system; preprocessing the state information of the preset node, identifying abnormal data in the preprocessed state information, and generating alarm information according to the identified abnormal data; filtering the generated alarm information, determining categories and priorities of different alarm information after filtering, and constructing an alarm information relation graph for the alarm information after the categories and the priorities are determined; and based on the alarm information relation graph, determining an alarm removal strategy, and automatically executing the alarm removal strategy, so that intelligent classification, duplicate removal, association analysis and priority ranking of massive operation and maintenance alarms are realized, key alarms can be automatically identified and quickly responded, alarm noise is effectively reduced, and false alarms and missing alarms are reduced.

Description

Technical Field

[0001] The present application relates to the field of big data analysis technology, and specifically, to an automated operation and maintenance intelligent alarm handling method, apparatus, computer equipment and storage medium. Background Art

[0002] With the rapid development of Internet technology and the acceleration of enterprise digital transformation, the alarm data generated by data centers and various IT systems has exploded. These alarm data are not only huge in quantity, but also diverse in types, covering hardware failures, software anomalies, network congestion and many other aspects. At the same time, it also brings problems such as the surge in the number of alarms, low efficiency of manual processing, limitations of single-item alarms and comprehensive-item alarms, lack of fault diagnosis functions, and low level of intelligent alarm processing to operation and maintenance.

[0003] The existing operation and maintenance methods are difficult to cope with the rapidly growing and complex operation and maintenance needs. The alarm information processing capabilities are limited: the traditional system mainly focuses on the alarm of a single matter and lacks the alarm capability for comprehensive matters, resulting in a single means of displaying alarm information and difficulty in fully reflecting the system status. In addition, the system does not have the ability to conduct a comprehensive analysis of alarm information and cannot extract comprehensive fault information from multiple alarm events, which affects the rapid location and resolution of faults. The root cause location effect is poor: the quality of the configuration management database is one of the key factors affecting the root cause location effect. The configuration management database may fail to update the system change information in a timely manner, resulting in inaccurate root cause location. The lack of intelligent reasoning mechanism based on big data and machine learning makes it impossible to automatically identify and locate the root cause of the fault from massive alarm data. Low degree of automation: often relying on a large amount of manual intervention to process alarm information, which not only increases the workload of operation and maintenance personnel, but also reduces operation and maintenance efficiency. It is impossible to realize automatic processing and response to alarm information, resulting in low operation and maintenance efficiency. Low level of intelligence: lack of intelligent decision support function, unable to provide accurate fault handling suggestions and decision support for operation and maintenance personnel. The system is deficient in visualizing alarm information, which makes it difficult to directly reflect the system status and the importance of alarm information. Insufficient fault response capability: In extreme weather or high system load, it may not be able to respond and process alarm information in a timely manner, resulting in the expansion of faults and increased losses. At the same time, the system lacks fault self-healing capabilities and cannot automatically recover from faults or reduce the impact of faults on the system. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, computer equipment and storage medium for handling intelligent alarms for automated operation and maintenance.

[0005] A first aspect of an embodiment of the present application provides an automated operation and maintenance intelligent alarm handling method, including:

[0006] Collect status information of preset nodes of the target system;

[0007] Preprocessing the status information of the preset node, identifying abnormal data in the preprocessed status information, and generating alarm information according to the identified abnormal data;

[0008] Filter the generated alarm information, determine the categories and priorities of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after the categories and priorities are determined;

[0009] Based on the alarm information relationship diagram, an alarm cancellation strategy is determined, and the alarm cancellation strategy is automatically executed.

[0010] In an optional embodiment of the present application, the collecting status information of a preset node of the target system includes:

[0011] Deploy a preset monitoring agent component on a preset node of the target system;

[0012] The monitoring agent components deployed on each preset node collect the status information of each preset node;

[0013] The collected status information of each preset node is sent to the preprocessing module, and the status information of the preset node is preprocessed by the information preprocessing module.

[0014] In an optional embodiment of the present application, before sending the collected status information of each preset node to the preprocessing module, the method includes:

[0015] Extracting feature vectors of status information of each preset node;

[0016] A state information sensitivity scoring model for each preset node is constructed to evaluate the state information sensitivity of each preset node and perform sensitivity classification. Based on the classification result, the sensitive data of the state information of each preset node is encrypting to send the encrypted state information to the preprocessing module. After the information preprocessing module receives the encrypted state information, the encrypted state information is decrypted and stored to preprocess the state information of each preset node.

[0017] In an optional embodiment of the present application, the preprocessing of the status information of the preset node includes:

[0018] Storing status information of preset nodes;

[0019] The stored state information of the preset node is cleaned, converted and formatted to obtain preprocessed state information.

[0020] In an optional embodiment of the present application, the identifying abnormal data in the preprocessed state information includes:

[0021] The pre-processed status information that exceeds the preset threshold or does not conform to the preset rules is regarded as abnormal data.

[0022] In an optional embodiment of the present application, filtering the generated alarm information, determining the categories and priorities of different filtered alarm information, and constructing an alarm information relationship diagram for the alarm information after the categories and priorities are determined, includes:

[0023] De-duplicate the generated alarm information and remove the false alarm information to obtain filtered alarm information;

[0024] Input each filtered alarm information into a pre-trained alarm classification model and an alarm priority prediction model to determine the categories and priorities of different filtered alarm information;

[0025] Based on the preset association relationship between the alarm information, an alarm information relationship diagram is constructed for the alarm information after the category and priority are determined.

[0026] In an optional embodiment of the present application, determining the alarm cancellation strategy based on the alarm information relationship diagram includes:

[0027] Determining target alarm information according to the alarm information relationship diagram, wherein the target alarm information is the alarm information corresponding to the root cause of the abnormal data;

[0028] Determine an alarm cancellation strategy corresponding to the target alarm information.

[0029] A second aspect of the embodiment of the present application provides an automated operation and maintenance intelligent alarm handling device, including:

[0030] A collection module, used to collect status information of preset nodes of the target system;

[0031] An identification module is used to pre-process the status information of the preset node, identify abnormal data in the pre-processed status information, and generate alarm information according to the identified abnormal data;

[0032] A filtering module is used to filter the generated alarm information, determine the categories and priorities of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after the categories and priorities are determined;

[0033] A determination module is used to determine an alarm cancellation strategy based on the alarm information relationship diagram and automatically execute the alarm cancellation strategy.

[0034] According to a third aspect of an embodiment of the present application, a computer device is provided, including: a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any of the above-mentioned automated operation and maintenance intelligent alarm handling methods are implemented.

[0035] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, characterized in that when the computer program is executed by a processor, the steps of any of the above methods for automated operation and maintenance intelligent alarm handling are implemented.

[0036] The above technical solution provided by the embodiment of the present application has at least some or all of the following advantages compared with the prior art:

[0037] The automated operation and maintenance intelligent alarm handling method described in the embodiment of the present application collects status information of preset nodes of the target system; pre-processes the status information of the preset nodes, identifies abnormal data in the pre-processed status information, and generates alarm information based on the identified abnormal data; filters the generated alarm information, determines the category and priority of different filtered alarm information, and constructs an alarm information relationship diagram for the alarm information after determining the category and priority; determines the alarm cancellation strategy based on the alarm information relationship diagram, and automatically executes the alarm cancellation strategy, overcomes the problems of low alarm management efficiency, slow response and high manual dependence in traditional operation and maintenance through automated and intelligent means, greatly improves the processing efficiency and accuracy of operation and maintenance alarms, realizes intelligent classification, deduplication, correlation analysis and priority sorting of massive operation and maintenance alarms, can automatically identify and quickly respond to key alarms, effectively reduce alarm noise, and reduce false alarms and missed alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0039] Figure 1 A flowchart of an automated operation and maintenance intelligent alarm handling method provided by an embodiment of the present application;

[0040] Figure 2 A flowchart of collecting status information of a preset node of a target system provided by an embodiment of the present application;

[0041] Figure 3 A flowchart of automatically executing the alarm cancellation strategy provided by an embodiment of the present application;

[0042] Figure 4 A schematic diagram of the structure of an automated operation and maintenance intelligent alarm handling device provided in one embodiment of the present application;

[0043] Figure 5 A schematic diagram of the computer device structure provided for one embodiment of the present application. DETAILED DESCRIPTION

[0044] See also Figure 1 The automated operation and maintenance intelligent alarm handling method provided in the embodiment of the present application includes the following steps 100 to 400:

[0045] Step 100: Collect status information of preset nodes of the target system;

[0046] Step 200: preprocessing the status information of the preset node, identifying abnormal data in the preprocessed status information, and generating alarm information according to the identified abnormal data;

[0047] Step 300: Filter the generated alarm information, determine the categories and priorities of the alarm information after filtering, and construct an alarm information relationship diagram for the alarm information after the categories and priorities are determined;

[0048] Step 400: Determine an alarm cancellation strategy based on the alarm information relationship diagram, and automatically execute the alarm cancellation strategy.

[0049] In an optional embodiment of the present application, see Figure 2 In step 100, the state information of the preset nodes of the target system is collected, including:

[0050] Deploy a preset monitoring agent component on a preset node of the target system, wherein the monitoring agent has the characteristics of high reliability and low resource consumption to ensure minimal impact on system performance;

[0051] The monitoring agent components deployed on each preset node collect the status information of each preset node, including the usage and performance indicators of key resources such as CPU, memory, disk, and network. The data collection frequency can be configured according to business needs, supporting high-frequency and high-precision collection;

[0052] The collected status information of each preset node is sent to the preprocessing module, and the status information of the preset node is preprocessed by the information preprocessing module.

[0053] In an optional embodiment of the present application, before sending the collected status information of each preset node to the preprocessing module, the method includes:

[0054] Extracting feature vectors of status information of each preset node;

[0055] A state information sensitivity scoring model for each preset node is constructed to evaluate the state information sensitivity of each preset node and perform sensitivity classification. Based on the classification result, the sensitive data of the state information of each preset node is encrypting to send the encrypted state information to the preprocessing module. After the information preprocessing module receives the encrypted state information, the encrypted state information is decrypted and stored to preprocess the state information of each preset node.

[0056] In an optional embodiment of the present application, a feature vector of the preprocessed running data is extracted by presetting an autoencoder network model.

[0057] In an optional embodiment of the present application, the construction of the application system information data sensitivity scoring model to evaluate the application system information data sensitivity and classify it refers to collecting historical application system information data and extracting historical feature vectors, calculating the mean of the historical feature vectors and setting them as the benchmark data vector;

[0058] Collect application system information data in real time and extract real-time feature vectors. Use the K-means clustering analysis algorithm to cluster the real-time feature vectors, and select the center point of each cluster as the reference data vector.

[0059] Combining the RBF kernel function with the integral, the cumulative similarity A(x) between the benchmark data vector and the feature vector of the application system information data is calculated. The formula is:

[0060]

[0061] Where x is the feature vector of application system information data, x0 is the reference data vector, and x i is the historical feature vector of the i-th application system information data;

[0062] Perform logarithmic transformation B(x) on the accumulated similarity A, the formula is:

[0063] B(x)=log(1+A(x));

[0064] The hyperbolic tangent function is introduced to smooth the accumulated similarity of the reference feature vector to obtain the accumulated similarity C(x) after smoothing. The formula is:

[0065]

[0066] Where M is the number of reference eigenvectors, x j is the jth reference eigenvector;

[0067] A sensitivity scoring model is constructed to evaluate the sensitivity score S(x) of the feature vector of application system information data. The formula is:

[0068]

[0069] Collect the sensitivity scores of historical application system information data and set an evaluation threshold. Compare the sensitivity scores of the application system information data feature vectors with the evaluation threshold. If the sensitivity score of the application system information data feature vector is greater than and equal to the evaluation threshold, it is determined to be sensitive data. If the sensitivity score of the application system information data feature vector is less than the evaluation threshold, it is determined to be ordinary data.

[0070] In an optional embodiment of the present application, encrypting the sensitive data of the application system information data based on the classification result refers to randomly generating a key K using a random number generator;

[0071] Use exponential function and sine function to perform nonlinear transformation on sensitive data to obtain the nonlinear transformation result H(x′), the formula is:

[0072]

[0073] Where x′ is sensitive data;

[0074] The sensitive data is transformed nonlinearly using logarithmic function and smooth inverse tangent function to obtain the multi-level nonlinear transformation result E(x′), the formula is:

[0075] E(x′)=tan -1 (x′ 2 k+log(x′+k));

[0076] Construct the encryption formula:

[0077] S(x′)=H(x′)+E(x′);

[0078] Bring sensitive data into the encryption formula for encryption.

[0079] In an optional embodiment of the present application, decrypting the exchanged data to store the application system information data refers to receiving the transmitted encrypted data and the corresponding key K;

[0080] Use the decryption formula to decrypt the received data and obtain the decrypted sensitive data O(S). The formula is:

[0081]

[0082] The collected application system information and sensitive data generated by the analysis are stored in the database, the application system information and sensitive data generated by the analysis in the database are backed up in the cloud, and the backup data are regularly checked for integrity.

[0083] In an optional embodiment of the present application, the preprocessing of the status information of the preset node includes:

[0084] The status information of the preset nodes is stored, wherein a distributed storage architecture is adopted to ensure high availability and scalability of data, and a high-performance data storage system is built to receive, store and manage the status information of the preset nodes;

[0085] The stored status information of the preset nodes is cleaned, converted and formatted to obtain pre-processed status information to meet the needs of subsequent analysis and processing. The data pre-processing process can be automated to reduce manual intervention.

[0086] In an optional embodiment of the present application, the preprocessing of the status information of the preset node further includes:

[0087] Data backup and recovery: Design a complete data recovery mechanism to cope with data loss or damage caused by unexpected situations, and regularly back up the status information of preset nodes to ensure the security and recoverability of the status information of preset nodes.

[0088] In an optional embodiment of the present application, the identifying abnormal data in the preprocessed state information includes:

[0089] The pre-processed status information that exceeds a preset threshold or does not conform to a preset rule is regarded as abnormal data, wherein the preset rule may be a rule based on a time pattern, etc.

[0090] In an optional embodiment of the present application, filtering the generated alarm information, determining the categories and priorities of different filtered alarm information, and constructing an alarm information relationship diagram for the alarm information after the categories and priorities are determined, includes:

[0091] Based on the preset filtering model, the generated alarm information is deduplicated and the false alarm information is removed to obtain the filtered alarm information, wherein the preset filtering model is obtained by training with historical data and real-time data, which can improve the filtering effect and accuracy;

[0092] Input each filtered alarm information into a pre-trained alarm classification model and an alarm priority prediction model to determine the categories and priorities of different filtered alarm information, wherein the alarm classification model classifies the filtered alarm information into categories according to dimensions such as severity, impact scope, and fault type;

[0093] Based on the preset correlation between alarm information, an alarm information relationship diagram is constructed for the alarm information after the category and priority are determined. Among them, the correlation between alarm information and the root cause of the alarm information are automatically identified, and functions such as alarm trend analysis and impact range analysis are realized. The alarm trend is analyzed, the possible fault evolution path is predicted, and a basis for decision-making is provided.

[0094] In an optional embodiment of the present application, after obtaining the filtered alarm information, the method further includes:

[0095] The filtered alarm information is displayed in the form of a list or chart to quickly understand the alarm situation.

[0096] In an optional embodiment of the present application, in step 400, determining the alarm cancellation strategy based on the alarm information relationship diagram includes:

[0097] Determining target alarm information according to the alarm information relationship diagram, wherein the target alarm information is the alarm information corresponding to the root cause of the abnormal data;

[0098] Determine an alarm cancellation strategy corresponding to the target alarm information.

[0099] In an optional embodiment of the present application, the determining the alarm cancellation strategy corresponding to the target alarm information includes:

[0100] Learn and analyze alarm information, and provide targeted handling suggestions based on the learning results, including fault location, repair solutions, preventive measures, etc.

[0101] Use prediction algorithms to predict the possible fault type, time, and impact range of alarm information, realize automatic warning, and help users prepare for fault response in advance;

[0102] Provides a visual decision support interface for viewing and understanding prediction results. The decision-making process may include automatically executing predefined response actions (such as restarting services, resource allocation), or recommending the best disposal plan to operation and maintenance personnel.

[0103] In an optional embodiment of the present application, see Figure 3 , the automatically executing the alarm cancellation strategy includes:

[0104] Provide automated scripts, connect to operation and maintenance automation tools or APIs, and automatically execute scripts, restart services, adjust resources, and other operations according to alarm resolution strategies. Automated scripts can automatically perform fault location, repair, and other operations to improve the efficiency of fault handling.

[0105] Provide custom processing flow configuration services to adapt to different business scenarios and fault types. The processing flow can include the execution and judgment logic of multiple automated scripts;

[0106] Provides situational awareness services and dynamically adjusts disposal strategies based on current operating status and resource conditions to minimize business impact. It also has built-in security mechanisms to ensure that automated disposal actions do not cause new security risks.

[0107] In an optional embodiment of the present application, the method further includes:

[0108] Interface design: Design an intuitive and easy-to-use visual interface to display the system's operating status, alarm information, and intelligent decision-making results;

[0109] Provide chart display service: the data, alarm information, analysis results and disposal decisions collected during the entire operation and maintenance process are displayed to the operation and maintenance personnel in a graphical interface, and the chart style and display content can be customized;

[0110] Provide interactive functions: query, filter, sort and other operations through the interface to help users deeply explore the reasons and patterns behind the data.

[0111] The following is the application process of the automated operation and maintenance intelligent alarm method of this application, including the following steps:

[0112] The first step is to collect and transmit status information: deploy monitoring agents on key nodes of the target system to ensure real-time collection of status information of key system resources, such as CPU, memory, disk, network, etc. Use message queues to buffer and asynchronously transmit the collected status information to ensure the reliability and efficiency of data transmission.

[0113] The second step is data information processing and storage: perform preliminary cleaning, format conversion, compression storage and other pre-processing operations on the collected status information to remove invalid or erroneous data. At the same time, use the preset filtering rules or machine learning models to filter the pre-processed data and identify potential alarm information.

[0114] The third step is alarm generation and filtering: according to the preset thresholds and rules, abnormal data is converted into alarm information. Intelligent filtering algorithms are applied, such as deduplication based on text similarity and false alarm identification based on historical data, to reduce alarm noise.

[0115] Step 4: Alarm classification and association analysis: Train machine learning models to classify alarms and divide them into different categories and priorities based on features such as alarm description, source, and historical data. Use graph databases and association rule learning algorithms to build a causal relationship diagram between alarms to help locate the root cause of the problem.

[0116] Step 5: Intelligent decision making: Based on alarm classification, historical handling cases and business impact assessment, the intelligent decision-making unit recommends or automatically formulates handling strategies through rule engines or more complex AI algorithms. At the same time, implementation risk assessment is performed to ensure the security and feasibility of the selected strategy.

[0117] Step 6: Automated Disposition Execution: Automatically execute preset scripts or operations based on decision results, such as resource adjustment, service restart, etc. Monitor and provide feedback on the execution process to ensure that the task is executed as expected, and record the execution results.

[0118] Step 7: Visual monitoring and reporting: Display alarm status, handling progress, system health indicators and other information through the Web interface, and use charts and dashboards for visualization. Implement customized reporting functions, support users to customize time ranges, alarm types, etc., generate operation and maintenance reports, and provide a basis for management decisions.

[0119] Step 8: Continuous optimization and learning: Collect disposal results and system feedback, and continuously optimize alarm rules, decision-making algorithms, and automation scripts. Through iterative training of machine learning models, the accuracy of alarm classification, root cause analysis, and decision-making is improved, forming a closed-loop continuous improvement mechanism.

[0120] The automated operation and maintenance intelligent alarm method of the present application spans hardware devices, operating systems and application software on different platforms, uniformly manages and analyzes alarm information from diverse data sources, and realizes operation and maintenance management from a global perspective. It uses reinforcement learning or deep learning technology to automatically optimize the identification, classification and priority sorting of alarms based on historical data and feedback from operation and maintenance personnel, reduce false alarms and missed alarms, and improve the accuracy and efficiency of alarm processing. It uses deep learning or graph algorithms and other technologies to automatically associate and analyze the causal relationship between alarms, quickly locate the root cause of the problem, rather than just staying on the surface symptoms, and predict possible problems in the future, to achieve forward-looking operation and maintenance decisions, and can dynamically adjust the alarm trigger conditions according to the system operation status, avoid over-sensitivity or insensitivity caused by fixed thresholds, ensure the effectiveness of alarms, and integrate an intelligent decision-making engine to automatically or recommend appropriate disposal measures based on the classification and analysis results of the alarms, and implement execution through APIs or automated scripts to reduce manual intervention.

[0121] The automated operation and maintenance intelligent alarm method of the present application uses a machine learning prediction model to conduct forward-looking analysis of faults, provide early warning of potential problems, realize predictive maintenance, and achieve comprehensive monitoring and intelligent analysis of operation and maintenance management data, thereby effectively reducing manual intervention, reducing false alarm rates, and improving the efficiency and response speed of operation and maintenance management. It significantly improves the speed and accuracy of alarm processing, optimizes the allocation of operation and maintenance resources, reduces the need for manual intervention, enhances the stability of IT systems and business continuity, and at the same time significantly reduces operation and maintenance costs and improves overall operation and maintenance efficiency and quality.

[0122] The automated operation and maintenance intelligent alarm method of this application integrates advanced artificial intelligence technology and algorithms to automatically identify and classify alarm information. It is a comprehensive system that integrates status information collection, alarm information processing, intelligent decision-making and automated disposal functions. The system can quickly analyze the source, type and impact range of alarm information, and provide accurate and timely alarm notifications and disposal suggestions for operation and maintenance personnel, aiming to improve operation and maintenance efficiency, reduce human errors, realize intelligent and automated operation and maintenance, and provide enterprises with more stable and reliable IT system support.

[0123] It should be understood that, although the various steps in the flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0124] See also Figure 4 An embodiment of the present application provides an automated operation and maintenance intelligent alarm handling device 400, comprising:

[0125] A collection module 410 is used to collect status information of preset nodes of a target system;

[0126] The identification module 420 is used to pre-process the status information of the preset node, identify abnormal data in the pre-processed status information, and generate alarm information according to the identified abnormal data;

[0127] The filtering module 430 is used to filter the generated alarm information, determine the categories and priorities of the alarm information after filtering, and construct an alarm information relationship diagram for the alarm information after the categories and priorities are determined;

[0128] The determination module 440 is used to determine the alarm cancellation strategy based on the alarm information relationship diagram and automatically execute the alarm cancellation strategy.

[0129] The automated operation and maintenance intelligent alarm handling device of the present application performs highly automated and intelligent processing of alarms, greatly improving the efficiency and accuracy of alarm processing, reducing manual intervention, accelerating fault location and recovery, while optimizing resource allocation, reducing operating costs, and ensuring business continuity. It also continuously optimizes itself through machine learning, providing deep insights and decision-making support for the operation and maintenance team, and bringing intelligent and efficient technological innovations to operation and maintenance management.

[0130] The automated operation and maintenance intelligent alarm handling device of the present application effectively reduces the number of alarms (i.e., reduces alarm storms) through intelligent filtering and aggregation mechanisms, ensures that the operation and maintenance team only focuses on the most critical and effective alarm information, improves the timeliness and accuracy of alarm handling, and realizes efficient alarm management. It uses advanced data analysis and machine learning algorithms to automatically classify, correlate and identify alarms, greatly shortens the time from alarm triggering to fault locating, improves the efficiency of fault handling, and quickly locates faults. Based on the results of intelligent analysis, it automatically executes or recommends the optimal handling strategy, reduces manual intervention, and continuously optimizes the handling strategy through a closed-loop feedback mechanism, thereby improving the automation level and decision-making quality of operation and maintenance, realizing automated handling and optimization, and the ability to respond quickly and efficiently solve problems, which helps to maintain and improve business continuity, reduce service interruption time, increase customer satisfaction and trust, and improve business continuity.

[0131] The automated operation and maintenance intelligent alarm handling device of the present application uses a machine learning prediction model, and the system can perform forward-looking analysis of faults and provide early warning of potential problems. This predictive maintenance capability helps operation and maintenance personnel take measures in advance to avoid the occurrence of faults or reduce the impact of faults on the system, thereby achieving predictive maintenance. By integrating multiple functions such as status information collection, cloud platform processing, alarm information filtering and classification analysis, the system can grasp the operating status of the system in real time, and conduct in-depth analysis of alarm information, providing strong support for operation and maintenance decisions, comprehensive monitoring and intelligent analysis, and realizing comprehensive monitoring and intelligent analysis of operation and maintenance management data. It automatically clusters similar alarms through intelligent algorithms, effectively reducing alarm storms and redundant information, allowing the operation and maintenance team to focus on the core alarms that really need attention, improve the efficiency of alarm processing, and efficiently manage alarms. It uses machine learning technology to analyze the correlation between alarms and automatically generate alarms. The causal relationship diagram between alarms helps operation and maintenance personnel to quickly locate the root cause of the fault, shorten the troubleshooting time, and accurately locate the problem. Through intelligent classification and priority sorting of alarm information, the system can allocate operation and maintenance resources more reasonably, give priority to key alarms, ensure stable operation of the system, and avoid unnecessary waste of resources. Resource optimization configuration, automatically execute preset repair scripts, resource allocation or rollback operations, reduce manual intervention, and improve problem solving speed. Automated response and execution, realize automatic response mechanism for specific types of alarms. The automated and intelligent operation and maintenance alarm handling system can reduce the additional costs caused by manual intervention and false alarms and omissions, and reduce operation and maintenance costs. By optimizing resource allocation and improving operation and maintenance efficiency, the system helps to reduce overall operation and maintenance costs.

[0132] For the specific definition of the above-mentioned device 400, please refer to the definition of the pseudo-random sequence generation method above, which will not be repeated here. Each module in the above-mentioned device 400 can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0133] In one embodiment, a computer device is provided, the internal structure diagram of which can be as follows: Figure 5As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a pseudo-random sequence generation method as described above is implemented. It includes: a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, any step in the pseudo-random sequence generation method as described above is implemented.

[0134] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any step in the above pseudo-random sequence generation method can be implemented.

[0135] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0136] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0137] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0138] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0139] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0140] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An automated operation and maintenance intelligent alarm handling method, characterized in that: include: Collect status information of preset nodes of the target system; Preprocessing the status information of the preset node, identifying abnormal data in the preprocessed status information, and generating alarm information according to the identified abnormal data; Filter the generated alarm information, determine the categories and priorities of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after the categories and priorities are determined; Based on the alarm information relationship diagram, an alarm cancellation strategy is determined, and the alarm cancellation strategy is automatically executed.

2. The method according to claim 1, characterized in that The state information of the preset nodes of the target system is collected, including: Deploy a preset monitoring agent component on a preset node of the target system; The monitoring agent components deployed on each preset node collect the status information of each preset node; The collected status information of each preset node is sent to the preprocessing module, and the status information of the preset node is preprocessed by the information preprocessing module.

3. The method according to claim 2, characterized in that Before sending the collected status information of each preset node to the preprocessing module, the method includes: Extracting feature vectors of status information of each preset node; A state information sensitivity scoring model for each preset node is constructed to evaluate the state information sensitivity of each preset node and perform sensitivity classification. Based on the classification result, the sensitive data of the state information of each preset node is encrypting to send the encrypted state information to the preprocessing module. After the information preprocessing module receives the encrypted state information, the encrypted state information is decrypted and stored to preprocess the state information of each preset node.

4. The method according to claim 1, characterized in that The preprocessing of the status information of the preset node includes: Storing status information of preset nodes; The stored state information of the preset node is cleaned, converted and formatted to obtain preprocessed state information.

5. The method according to claim 1, characterized in that The identifying abnormal data in the preprocessed state information includes: The pre-processed status information that exceeds the preset threshold or does not conform to the preset rules is regarded as abnormal data.

6. The method according to claim 1, characterized in that The generated alarm information is filtered, the categories and priorities of different filtered alarm information are determined, and an alarm information relationship diagram is constructed for the alarm information after the categories and priorities are determined, including: De-duplicate the generated alarm information and remove the false alarm information to obtain filtered alarm information; Input each filtered alarm information into a pre-trained alarm classification model and an alarm priority prediction model to determine the categories and priorities of different filtered alarm information; Based on the preset association relationship between the alarm information, an alarm information relationship diagram is constructed for the alarm information after the category and priority are determined.

7. The method according to claim 1, characterized in that The determining of the alarm cancellation strategy based on the alarm information relationship diagram includes: Determining target alarm information according to the alarm information relationship diagram, wherein the target alarm information is the alarm information corresponding to the root cause of the abnormal data; Determine an alarm cancellation strategy corresponding to the target alarm information.

8. An automated operation and maintenance intelligent alarm handling device, characterized in that: include: A collection module, used to collect status information of preset nodes of the target system; An identification module is used to pre-process the status information of the preset node, identify abnormal data in the pre-processed status information, and generate alarm information according to the identified abnormal data; A filtering module is used to filter the generated alarm information, determine the categories and priorities of different filtered alarm information, and construct an alarm information relationship diagram for the alarm information after the categories and priorities are determined; A determination module is used to determine an alarm cancellation strategy based on the alarm information relationship diagram and automatically execute the alarm cancellation strategy.

9. A computer device comprising: A memory and a processor, wherein the memory stores a computer program, and wherein the processor implements the steps of the automated operation and maintenance intelligent alarm handling method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the automated operation and maintenance intelligent alarm handling method described in any one of claims 1 to 7 are implemented.

Images