Alarm data processing method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses an alarm data processing method and device, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: for current network alarm data read from a current data table, determining at least one application host associated with network equipment generating the current network alarm data; for each application host, based on at least one application alarm rule pre-configured for the network equipment, performing application alarm tracking on the current application host within a set duration, and according to a tracking result, determining whether the current application host has a fault, and obtaining an application fault determination result corresponding to the current application host; under the condition that the current network alarm data is determined to be processed according to the application fault judgment results corresponding to the application hosts, the checking result of availability checking of the network equipment is obtained, the adopted alarm processing flow is determined according to the checking result, the alarm processing flow is executed, and the fault checking and processing efficiency is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a method, device, equipment and storage medium for processing alarm data. Background Art

[0002] Currently, in the fault diagnosis of network equipment, operation and maintenance personnel view the device status, network relationship and configuration information of various network devices based on the alarm data, then summarize the various information viewed and analyze the causes of the network equipment failures to handle the anomalies of the network equipment.

[0003] However, when processing the alarm data of network equipment, the above solution heavily relies on the operation and maintenance experience of the operation and maintenance personnel and various alarm data. When the network links involved are long and there are many devices, the manual processing method is time-consuming and labor-intensive, which leads to low efficiency in troubleshooting and handling, and cannot meet the requirements of rapid fault recovery. Summary of the invention

[0004] The embodiments of the present invention provide a method, device, equipment and storage medium for processing alarm data, so as to solve the problem of low efficiency of existing fault detection and disposal.

[0005] In a first aspect, an embodiment of the present invention provides a method for processing alarm data, including:

[0006] For the current network alarm data read from the current data table, determining at least one application host associated with the network device generating the current network alarm data;

[0007] For each application host, based on at least one application alarm rule pre-configured for the network device, the application alarm of the current application host is tracked within a set time period, and whether the current application host fails is determined according to the tracking result, and the application fault determination result corresponding to the current application host is obtained;

[0008] Determine whether to handle the current network alarm data according to the application fault judgment results corresponding to each application host;

[0009] When it is determined to process the current network alarm data, the inspection result of the availability check on the network equipment is obtained, the alarm processing process to be adopted is determined according to the inspection result, and the alarm processing process is executed.

[0010] In a second aspect, an embodiment of the present invention further provides a device for processing alarm data, the device comprising:

[0011] A host determination module, used to determine at least one application host associated with the network device generating the current network alarm data, based on the current network alarm data read from the current data table;

[0012] A fault determination module is used to track application alarms of the current application host within a set time period based on at least one application alarm rule pre-configured for the network device for each application host, determine whether the current application host has a fault according to the tracking result, and obtain an application fault determination result corresponding to the current application host;

[0013] A handling judgment module is used to determine whether to handle the current network alarm data according to the application fault judgment results corresponding to each application host;

[0014] The alarm handling module is used to obtain the inspection result of the availability check on the network equipment when determining to handle the current network alarm data, determine the alarm handling process to be adopted according to the inspection result, and execute the alarm handling process.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for processing alarm data as described in any one of the embodiments of the present invention is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for processing alarm data as described in any one of the embodiments of the present invention.

[0017] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements any method for processing alarm data as described in any of the embodiments of the present invention.

[0018] In the technical solution provided by the embodiment of the present invention, for the current network alarm data read from the current data table, at least one application host associated with the network device that generates the current network alarm data can be determined, and the source of the fault can be accurately located, thereby improving the accuracy of fault location; then for each application host, based on at least one application alarm rule pre-configured for the network device, the application alarm of the current application host can be tracked within a set time period, and according to the tracking result, it is determined whether the current application host has a fault, and the application fault determination result corresponding to the current application host is obtained, and then according to the application fault determination results corresponding to each application host, it is determined whether to deal with the current network alarm data, and when it is determined that the current network alarm data is to be dealt with, the inspection result of the availability check of the network device is obtained, and then based on The alarm handling process to be adopted is determined according to the inspection results, and the alarm handling process is executed, thereby realizing the handling function of the alarm data. By tracking the application alarms of the application hosts associated with the network devices that generate the network alarm data, the application fault judgment results corresponding to the application hosts are automatically determined, and the status changes of the application hosts can be monitored in real time, reducing the delay in fault discovery and alarm handling. Through the application fault judgment results corresponding to the application hosts, it is automatically determined whether to handle the network alarm data and the alarm handling process to be adopted, thereby realizing the automation and intelligence of alarm handling. There is no need to rely on manual troubleshooting and alarm handling, which saves time and cost, thereby improving the troubleshooting efficiency and handling efficiency, and solving the existing problem of low troubleshooting and handling efficiency, thereby meeting the requirements for rapid fault recovery and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A flowchart of a method for processing alarm data provided by an embodiment of the present invention;

[0021] Figure 2 Another flowchart of the method for processing alarm data provided by an embodiment of the present invention;

[0022] Figure 3 An example diagram of an alarm handling process provided by an embodiment of the present invention;

[0023] Figure 4 Another flowchart of the method for processing alarm data provided by an embodiment of the present invention;

[0024] Figure 5 An example diagram of updating a first storage tree provided by an embodiment of the present invention;

[0025] Figure 6 A schematic diagram of the structure of a device for processing alarm data provided by an embodiment of the present invention;

[0026] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0028] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing, etc. of data in the technical solution of the present invention comply with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of the present invention, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present invention, but it does not mean that the applicant has or must use the relevant content of the solution.

[0029] In the prior art, when processing the alarm data of network equipment, it is heavily dependent on the operation and maintenance experience of the operation and maintenance personnel and various alarm data. When the network links involved are long and there are many devices, the manual processing method is time-consuming and labor-intensive, which leads to low efficiency in troubleshooting and handling, and cannot meet the requirements of rapid fault recovery.

[0030] In response to the problems existing in the above-mentioned prior art, this embodiment tracks the application alarms of the application hosts associated with the network devices that generate the network alarm data, and automatically determines the application fault judgment results corresponding to the application hosts. This can monitor the status changes of the application hosts in real time, reducing the delay in fault discovery and alarm handling. Through the application fault judgment results corresponding to the application hosts, it is automatically determined whether to handle the network alarm data and the alarm handling process to be adopted, thereby realizing the automation and intelligence of alarm handling. There is no need to rely on manual troubleshooting and alarm handling, which saves time and cost, thereby improving the troubleshooting efficiency and handling efficiency, and solving the problem of low efficiency in existing troubleshooting and handling, thereby meeting the requirements for rapid fault recovery and improving the user experience.

[0031] The following describes in detail a method for processing alarm data provided by an embodiment of the present invention. Figure 1 A flowchart of a method for processing alarm data provided in an embodiment of the present invention is provided. This embodiment can be applied to scenarios where the alarm data of network equipment needs to be processed. The method can be executed by an alarm data processing device in an embodiment of the present invention, and the device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated in an electronic device, such as a user terminal device or a server. The following embodiments will be described by taking the device integrated in an electronic device as an example. Reference Figure 1 , the method may specifically include the following steps:

[0032] S110. For current network alarm data read from the current data table, determine at least one application host associated with the network device that generates the current network alarm data.

[0033] Among them, a data table is a structure for storing data, usually composed of rows (records) and columns (fields). In an embodiment of the present invention, a data table is used to store network alarm data of network devices; illustratively, a network alarm data may include fields such as alarm identifier, occurrence time, alarm source, device identifier, alarm level and alarm description; the alarm identifier is a unique identifier for network alarm data; the device identifier is a unique identifier for network devices.

[0034] A network device is a device on a network transmission path. A network transmission path can be a path for data transmission between any two application hosts. A network device is responsible for the transmission, forwarding and processing of network data. In an embodiment of the present invention, a network device is a source device that generates network alarm data. Exemplarily, a network device may include a router and a switch.

[0035] Network alarm data is alarm data generated by network devices in a network environment when some anomaly or potential problem is detected. It is used to notify operation and maintenance personnel or automation systems so that they can respond in a timely manner and take necessary measures. For example, network alarm data may include the alarm source (such as which type of network device generates the alarm), device identification (the device identification of the network device that generates the alarm), alarm time, alarm type, and alarm description.

[0036] The application host is a host device that runs a specific application program or service and is responsible for processing user requests, storing data, and executing computing tasks, etc. Exemplarily, the application host may include a physical server and a virtual machine, etc.

[0037] Specifically, when it is necessary to handle the alarm of the network equipment, for each data table used to store the network alarm data, one data table can be determined as the current data table, for example, any one data table is selected as the current data table, or the current data table is determined according to the reading order of each data table; then, each network alarm data is read from the current data table, for example, a network alarm data may include the contents corresponding to the fields such as alarm identifier, occurrence time, alarm source, device identifier, alarm level and alarm description; then, for each network alarm data read from the current data table, any network alarm data can be selected as the current network alarm data, and at least one application host associated with the network device that generates the current network alarm data is determined.

[0038] Specifically, the preset network device table can be queried based on the device identifier in the current network alarm data to obtain the network device corresponding to the device identifier, thereby determining the network device that generates the current network alarm data, and then using the application programming interface (Application Programming Interface, API) of the network management tool to obtain the association relationship between the network device and the application host. This association can be reflected in the form of IP address segments, VLAN divisions, and network topology diagrams; then, the application host associated with the network device is determined based on the association relationship obtained by analysis. At this time, the obtained application host can be one or more. Among them, the preset network device table is a pre-set relationship table used to store the mapping relationship between network devices and device identifiers, and one network device corresponds to one device identifier.

[0039] S120. For each application host, based on at least one application alarm rule pre-configured for the network device, track the application alarm of the current application host within a set time period, determine whether the current application host has a fault according to the tracking result, and obtain an application fault determination result corresponding to the current application host.

[0040] The application alarm rule is a rule that defines the conditions that trigger the application alarm, and is used to determine whether the application host triggers the application alarm. One or more application alarm rules can be configured for a network device. Optionally, the application alarm rule can be a multi-dimensional application alarm rule. Exemplarily, the multi-dimensional application alarm rule can be an alarm for 10 ping timeouts and five port down alarms within five minutes.

[0041] The set duration is a preset value, which specifies the duration of executing application alarm tracking to ensure that the abnormality of the application host can be fully observed and captured. The user can adjust and set the set duration according to actual usage, and the embodiment of the present invention does not specifically limit this. For example, the set duration can be 5 minutes.

[0042] The tracking result is all relevant information and data collected about the application alarm generated by the application host within the set time. The application fault judgment result is used to characterize whether the current application host has a fault; the application fault judgment result can include whether the current application host has a fault or not.

[0043] Specifically, after obtaining at least one application host associated with the network device that generates the current network alarm data, one or more application alarm rules pre-configured for the network device can be obtained. Then, for each application host, any application host can be selected as the current application host. Then, based on the application alarm rules, application alarm tracking is performed on the current application host within a set time period. For example, within the set time period, the performance indicators, log information, and system status of the current application host can be checked periodically or in real time to find any situations that may meet the application alarm rules, and collect application alarm data generated by the application host when the application alarm rules are met, so as to obtain the tracking results of the current application host.

[0044] Afterwards, it is possible to determine whether the current application host has a fault based on the tracking results of the current application host, and obtain the application fault determination result corresponding to the current application host. For example, the alarm time of each application alarm data in the collected tracking results can be analyzed, and based on the analysis results, it is determined whether the current application host continues to generate alarms, and then based on the determination result of whether the alarms continue to be generated, the application fault determination result corresponding to the current application host is obtained.

[0045] Afterwards, other application hosts may be selected as current application hosts, and the above process may be repeated to obtain application fault determination results corresponding to each application host.

[0046] S130: Determine whether to process the current network alarm data according to the application fault determination results corresponding to each application host.

[0047] Specifically, after obtaining the application fault judgment results corresponding to each application host, it can be determined whether to handle the current network alarm data based on the application fault judgment results corresponding to each application host. If it is determined to handle the current network alarm data, S140 can be executed; otherwise, S110 can be executed to continue to determine whether to handle other network alarm data in the current data table.

[0048] Specifically, the failed application host can be determined based on the application fault judgment results corresponding to each application host, and then the priority of the failed application host can be determined based on factors such as the severity of the failed application host, the scope of impact, and the business importance. That is, high-priority faults need to be handled immediately, while low-priority faults can be handled later or arranged according to resource conditions. If the failed application host is of high priority, it is determined that the current network alarm data will be processed; if the failed application host is of low priority, it is determined that the current network alarm data will not be processed. After that, corresponding fault prompt information can be generated based on the failed application host, and the fault prompt information can be displayed to notify the operation and maintenance personnel to take corresponding measures.

[0049] S140. When it is determined to process the current network alarm data, obtain the results of the availability check on the network device, determine the alarm processing procedure to be adopted according to the inspection result, and execute the alarm processing procedure.

[0050] Among them, the inspection result is the current status information of the network device obtained after performing an availability check (such as connection test and performance monitoring, etc.) on the network device; the inspection result may include whether the network device is online, whether the performance meets the standards, and whether there are any abnormalities or faults.

[0051] The alarm handling process is a series of orderly steps or procedures used to respond to and process network alarm data. It aims to quickly locate the root cause of the problem, assess the scope of impact, and develop and implement solutions to ensure the stability and security of the network environment.

[0052] Specifically, when it is determined to handle the current network alarm data, the inspection results of the availability check of the network equipment can be obtained. For example, the network equipment can be ping tested, port scanned, and performance monitored to determine the connectivity, response time, and performance indicators of the network equipment, and obtain the inspection results of the network equipment; then, the alarm handling process to be adopted can be determined based on the inspection results, such as restarting the device, updating the configuration, and repairing vulnerabilities, etc., and then the corresponding handling operations are performed according to the determined alarm handling process, and in the process of executing the alarm handling process, the status and performance of the network equipment are continuously monitored to ensure that the anomaly is effectively resolved.

[0053] In the technical solution provided by the embodiment of the present invention, for the current network alarm data read from the current data table, at least one application host associated with the network device that generates the current network alarm data can be determined, and the source of the fault can be accurately located, thereby improving the accuracy of fault location; then for each application host, based on at least one application alarm rule pre-configured for the network device, the application alarm of the current application host can be tracked within a set time period, and according to the tracking result, it is determined whether the current application host has a fault, and the application fault determination result corresponding to the current application host is obtained, and then according to the application fault determination results corresponding to each application host, it is determined whether to deal with the current network alarm data, and when it is determined that the current network alarm data is to be dealt with, the inspection result of the availability check of the network device is obtained, and then based on The alarm handling process to be adopted is determined according to the inspection results, and the alarm handling process is executed, thereby realizing the handling function of the alarm data. By tracking the application alarms of the application hosts associated with the network devices that generate the network alarm data, the application fault judgment results corresponding to the application hosts are automatically determined, and the status changes of the application hosts can be monitored in real time, reducing the delay in fault discovery and alarm handling. Through the application fault judgment results corresponding to the application hosts, it is automatically determined whether to handle the network alarm data and the alarm handling process to be adopted, thereby realizing the automation and intelligence of alarm handling. There is no need to rely on manual troubleshooting and alarm handling, which saves time and cost, thereby improving the troubleshooting efficiency and handling efficiency, and solving the existing problem of low troubleshooting and handling efficiency, thereby meeting the requirements for rapid fault recovery and improving the user experience.

[0054] Figure 2 Another flowchart of the method for processing alarm data provided by an embodiment of the present invention is shown in FIG. Figure 2 The method of this embodiment specifically includes the following steps:

[0055] S210: parsing the current network alarm data read from the current data table to obtain a device identifier of a network device generating the current network alarm data.

[0056] Specifically, when it is necessary to handle the alarm of the network equipment, for each data table used to store the network alarm data, one data table can be determined as the current data table, for example, any one data table is selected as the current data table, or the current data table is determined according to the reading order of each data table; then, each network alarm data is read from the current data table, for example, a network alarm data may include the contents corresponding to the fields such as alarm identifier, occurrence time, alarm source, device identifier, alarm level and alarm description; then, for each network alarm data read from the current data table, any network alarm data can be selected as the current network alarm data, and then the current network alarm data is parsed, and the device identifier in the current network alarm data is selected to obtain the device identifier of the network device that generates the current network alarm data.

[0057] S220: Search for an application host identifier corresponding to the device identifier in a preset association mapping table, and determine an application host corresponding to each of the found application host identifiers as at least one application host associated with the network device.

[0058] Among them, the association mapping table is a pre-set relationship table used to store the mapping relationship between the network device identifier and the application host identifier. One network device identifier can correspond to one or more application host identifiers; the association mapping table contains at least one mapping relationship between the network device identifier and the application host identifier; the application host identifier is the unique identifier of the application host.

[0059] Specifically, after obtaining the device identification of the network device that generates the current network alarm data, the pre-set association mapping table can be queried based on the device identification to obtain the application host identification corresponding to the device identification. At this time, the obtained application host identification can be one or more, and then the application host corresponding to each application host identification is determined as the application host associated with the network device, that is, based on each application host identification, the preset application host table is queried respectively to obtain the application host corresponding to each application host identification. Among them, the preset application host table is a pre-set relationship table used to store the mapping relationship between the application host and the application host identification.

[0060] S230. For each application host, based on at least one application alarm rule pre-configured for the network device, track the application alarm of the current application host within a set time period, determine whether the current application host has a fault according to the tracking result, and obtain an application fault determination result corresponding to the current application host.

[0061] Specifically, based on at least one application alarm rule pre-configured for the network device, application alarm tracking is performed on the current application host within a set period of time, and whether the current application host fails is determined according to the tracking result, including Sa1-Sa2:

[0062] Sa1. For each application alarm rule pre-configured for the network device, determine the event to be tracked based on the rule expression corresponding to the current application alarm rule, and periodically judge whether the event to be tracked occurs on the current application host within the set time period, and generate an application alarm data when it is judged that the event to be tracked occurs.

[0063] Among them, the rule expression is an expression used to represent the application alarm rule; optionally, the rule expression may include fields such as alert, expr, for, labels and annotations; the alert field defines the name of the application alarm rule; the expr field defines the PromQL (Prometheus Query Language) query statement for the alarm, that is, it defines the conditional expression of the application alarm rule; the for field defines the evaluation waiting time (Pending Duration), which is used to indicate that the alarm is sent only when the trigger condition lasts for a period of time, and the state of the newly generated alarm during the waiting period is pending; the labels field is a custom label used to mark the number of times the alarm occurs; the annotations field is used to store some additional information for the display of alarm information. Exemplarily, the rule expression corresponding to the application alarm rule can be {"alert":"Wait for the event for 5 minutes","expr":"Interface response time","compare:"greater than","for":"20 seconds","labels":0,"annotations":"Interface response time judgment rule"}.

[0064] The event to be tracked is a series of events or behaviors defined according to a regular expression and need to be checked regularly to see whether they occur on the current application host. For example, the event to be tracked may be that the interface response time is greater than 20 seconds.

[0065] Application alarm data is an alarm generated by an application host, that is, a data record generated by the application host when detecting an event to be tracked. Exemplarily, the application alarm data may include the occurrence time, the application host involved, the alarm type, the severity and description information, etc.

[0066] Specifically, for each application alarm rule pre-configured for the network device, any application alarm rule can be selected as the current application alarm rule, and then based on the template of the rule expression, the rule expression corresponding to the current application alarm rule is parsed to determine the matching pattern or condition defined by the current application alarm rule, and then based on the matching pattern or condition defined by the current application alarm rule, determine which events or conditions are events that need to be tracked periodically, so as to obtain the events to be tracked; thereafter, other application alarm rules can be selected as the current application alarm rule, and the above process can be repeated to obtain the events to be tracked corresponding to each application alarm rule.

[0067] Afterwards, for each application host, any application host can be selected as the current application host, and then application alarm tracking is performed on the current application host within the set time, and it is periodically determined within the set time whether an event to be tracked occurs on the current application host, that is, the state or behavior of the current application host is matched with the rule expression corresponding to the application alarm rule, to determine whether the event to be tracked corresponding to the application alarm rule occurs; when it is determined that the event to be tracked occurs on the current application host, application alarm data corresponding to the event to be tracked is generated, and the number of application alarm data is the same as the number of occurrences of the event to be tracked.

[0068] Sa2. Determine whether the current application host continues to generate alarms based on the application alarm data generated within the set time. If so, determine that the current application host has a fault; otherwise, determine that the current application host has not a fault.

[0069] Specifically, since the failure of the network device can lead to the failure of the application host, such as the interface timeout of the service network, it is possible to infer whether the failure of the network device has been restored by analyzing whether the application host is normal. Therefore, after generating the application alarm data, it is possible to determine whether the current application host continues to generate alarms based on the application alarm data generated within the set time period. If the current application host continues to generate alarms, it can be determined that the current application host has a fault, that is, the application fault judgment result of the current application host is that the current application host has a fault; if the current application host does not continue to generate alarms, it indicates that the current application host has not a fault, or the fault of the current application host has been restored within the set time period. At this time, it can be determined that the current application host has not a fault, that is, the application fault judgment result of the current application host is that the current application host has not a fault.

[0070] Afterwards, other application hosts may be selected as current application hosts, and Sa1 and Sa2 may be repeatedly executed to obtain application fault determination results corresponding to each application host.

[0071] For example, when the application hosts corresponding to the network device include application host 1, application host 2, and application host 3, and the rule expression corresponding to the current application alarm rule is {"alert":"wait for event for 5 minutes","expr":"interface response time","compare:"greater than","for":"20 seconds","labels":0,"annotations":"interface response time judgment rule"}, and the set time length is 5 minutes, it can be determined that the current application host is application host 1, and the rule expression corresponding to the current application alarm rule is used to determine the current application host. An event to be tracked is determined, that is, the interface response time is greater than 20 seconds, and then within 5 minutes, it is determined at regular intervals whether an event in which the interface response time is greater than 20 seconds occurs on application host 1, and when it is determined that an event in which the interface response time is greater than 20 seconds occurs on application host 1, an application alarm data is generated, and then, when it is determined that application host 1 continues to generate alarms based on the application alarm data generated within 5 minutes, it is determined that application host 1 has a fault, that is, the application fault judgment result of application host 1 is that application host 1 has a fault; thereafter, the above steps are repeated to determine the application fault judgment results corresponding to application host 2 and application host 3 respectively.

[0072] In the embodiment of the present invention, by applying alarm rules and their corresponding rule expressions, the events to be tracked corresponding to the application alarm rules can be actively tracked, thereby reducing the possibility of false alarms and missed alarms; and, by periodically judging whether the application host continues to generate application alarm data within a set time period, short-term, occasional or recovered faults can be screened out, and then the application host that continues to fail can be accurately identified, thereby improving the accuracy of the determination of the application fault judgment results, thereby providing an accurate basis for the subsequent determination of whether to handle the network alarm data.

[0073] S240: Determine whether to process the current network alarm data according to the application fault determination results corresponding to each application host.

[0074] Specifically, according to the application fault determination results corresponding to each application host, it is determined whether to process the current network alarm data, including Sb1-Sb3:

[0075] Sb1. Determine whether the application fault determination results corresponding to each application host are all that the current application host has no fault.

[0076] Specifically, if there is at least one application host corresponding to an application fault determination result indicating that the current application host has a fault, Sb2 is executed; otherwise, Sb3 may be executed.

[0077] Sb2. If there is at least one application host corresponding to an application fault determination result indicating that the current application host has a fault, determine to process the current network alarm data.

[0078] Specifically, when there is at least one application host corresponding to an application fault judgment result that the current application host has a fault, it indicates that there is a faulty application host in at least one application host corresponding to the network device. Therefore, it can be determined that there is a fault in the network device, and at this time, it can be determined to handle the current network alarm data.

[0079] Sb3. If the application fault determination results corresponding to each application host are all that the current application host has no fault, it is determined not to process the current network alarm data.

[0080] Specifically, when the application fault judgment results corresponding to each application host are all that the current application host has no fault, it indicates that there is no faulty application host among at least one application host corresponding to the network device. Therefore, it can be determined that the network device is normal or the fault of the network device has been restored. At this time, it can be determined that the current network alarm data will not be processed.

[0081] When it is determined to process the current network alarm data, S250 may be executed; otherwise, S210 may be executed to continue to determine whether to process other network alarm data in the current data table.

[0082] In an embodiment of the present invention, when there is at least one application host corresponding to an application fault determination result that the current application host has a fault, it is determined that the current network alarm data is to be processed, and whether the network alarm data is to be processed can be accurately determined, thereby improving the accuracy and efficiency of the alarm processing; when the application fault determination results corresponding to each application host are that the current application host has not a fault, it is determined not to process the current network alarm data, and the network alarm data at this time may be triggered based on certain non-fault factors (such as false alarms and environmental noise, etc.), which saves computing resources and reduces erroneous operations.

[0083] Optionally, the availability check of the network device and the application alarm tracking of the application host are performed in parallel, that is, for each application host, based on at least one application alarm rule pre-configured for the network device, when the application alarm tracking of the current application host is performed within a set time period, the availability check of the network device can be performed. For example, a script command can be automatically sent to the network device and other network devices in the device group to which the network device belongs, so that the network device executes the script command, thereby performing the availability check on the network device and other network devices in the device group to which the network device belongs. In the embodiment of the present invention, the availability check of the network device and the application alarm tracking of the application host are performed in parallel, which improves the determination efficiency of the alarm handling process and further improves the efficiency of the alarm handling.

[0084] For example, when the network device is a switch, it is possible to determine whether the switch and other network devices in the stacking group to which the switch belongs are normal and available, for example, to check whether the hardware status of the network device is normal, whether the power supply and fan of the network device are normal, and whether the performance capacity of the network device is normal.

[0085] S250: When it is determined to process the current network alarm data, obtain the result of the availability check on the network device.

[0086] Among them, the inspection results may include the inspection results of at least one inspection item corresponding to the network device and the inspection results of at least one inspection item corresponding to other network devices in the device group to which the network device belongs; the device group to which the network device belongs may be a master-slave device group or a stacked device group; the master-slave device group may include a master network device and a backup network device; the stacked device group may include multiple network devices, which are stacked by multiple network devices.

[0087] S260: Determine the abnormality type of the network device based on the inspection result of the availability inspection of the network device, and determine the alarm handling process to be adopted according to the abnormality type.

[0088] Among them, the abnormality types may include abnormal board status, abnormal hardware status and abnormal port status, etc.; abnormal board status refers to the failure or abnormality of the board (such as switch board and routing board, etc.) in the network device, which may cause problems such as performance degradation and failure of some functions of the network device; abnormal hardware status may include failure or abnormality of hardware components such as power supply, fan and hard disk of the network device, which may affect the stability and reliability of the network device; abnormal port status refers to abnormalities in the connection status and transmission rate of the network device port, which may cause network communication interruption or performance degradation.

[0089] Specifically, after obtaining the inspection results of the availability check on the network equipment, the abnormality type of the network equipment can be determined based on the inspection results of the availability check on the network equipment, that is, board status abnormality, hardware status abnormality, port status abnormality, etc., and then the alarm handling process adopted for handling the current network alarm data can be determined according to the abnormality type.

[0090] For example, Figure 3 FIG. 1 is an example diagram of an alarm handling process provided by an embodiment of the present invention. Figure 3 The alarm handling process corresponding to the abnormal board status is restarting the board, the alarm handling process corresponding to the abnormal hardware status is disabling and enabling the device, and the alarm handling process corresponding to the abnormal port status is port isolation.

[0091] S270: Calling a preset activity component, and triggering each execution node included in the alarm handling process to perform a corresponding handling operation through the preset activity component.

[0092] The preset activity component is a reusable, predefined workflow module that encapsulates a series of operations or steps and is used to automatically execute preset tasks or processes under specific conditions; in an embodiment of the present invention, the preset activity component may include all logic and execution nodes required to trigger the alarm handling process, and these execution nodes may perform various handling operations according to a predetermined order and conditions. Exemplarily, the preset activity component may be an Activity component.

[0093] The handling operation may include at least one of an information notification action, looping the current action and jumping out of the loop to continue to execute subsequent actions after a loop condition is met, and waiting for a preset time and continuing to execute subsequent actions after the preset time is reached.

[0094] Optionally, the alarm handling process data including each execution node may be configured in advance through a visual interface, and the data may be encapsulated into XML format data, and then the XML format data may be submitted to a preset activity component (eg, Activity component).

[0095] Specifically, after determining the alarm handling process to be adopted, the preset activity component can be called to determine the execution nodes included in the alarm handling process and the handling operations corresponding to the execution nodes, and the preset activity component can be used to trigger the execution nodes included in the alarm handling process to perform the corresponding handling operations; thereafter, when the execution node receives the trigger operation, it can obtain the script corresponding to the corresponding handling operation from the server, and complete the corresponding handling operation by executing the obtained script, for example, at least one of information notification actions (such as text messages and emails), looping the current action and jumping out of the loop to continue executing subsequent actions after the loop condition is met, and waiting for a preset time length and continuing to execute subsequent actions after the preset time length is reached.

[0096] Optionally, for the current network alarm data read from the current data table, it can be determined whether the current network alarm data is in the preset whitelist. If the current network alarm data is in the preset whitelist, S210 to S270 can be executed; if the current network alarm data is not in the preset whitelist, no processing is performed.

[0097] In the technical solution provided by the embodiment of the present invention, the current network alarm data read from the current data table can be parsed to obtain the device identification of the network device that generates the current network alarm data, and then the application host identification corresponding to the device identification can be found in a pre-set association mapping table, and the application hosts corresponding to each of the found application host identifications can be determined as at least one application host associated with the network device. This can ensure that the association between the network device and the application host is accurate, reduce false alarms or missed alarms caused by association errors, and avoid subsequent monitoring and alarms of irrelevant application hosts, so that the source of the fault can be located more accurately, and the handling process is optimized, thereby improving the accuracy and efficiency of fault detection, as well as the accuracy and efficiency of alarm handling.

[0098] Afterwards, while determining to handle the current network alarm data, the inspection result of the availability check on the network equipment can be obtained, and then the abnormal type of the network equipment can be determined based on the inspection result of the availability check on the network equipment, and the alarm handling process to be adopted can be determined according to the abnormal type, thereby realizing the determination function of the alarm handling process. By determining the abnormal type of the network equipment based on the inspection result of the availability check on the network equipment, it can reduce the incorrect handling caused by misjudgment, thereby improving the accuracy and efficiency of the determination of the alarm handling process, thereby improving the accuracy and effectiveness of the alarm handling, and ensuring the stability and security of the network environment; afterwards, the preset activity component can be called, and the preset activity component can be used to trigger each execution node included in the alarm handling process to perform the corresponding handling operation, which can realize the automation and standardization of alarm handling, thereby reducing manual intervention, thereby improving the rate, consistency and timeliness of alarm handling.

[0099] Figure 4 Another flowchart of the method for processing alarm data provided by an embodiment of the present invention, this embodiment is a detailed description of processing network alarm data before determining at least one application host associated with the network device that generates the current network alarm data for the current network alarm data read from the current data table. Figure 4 The method of this embodiment specifically includes the following steps:

[0100] S410: Obtain a network alarm data set.

[0101] The network alarm data set may include at least one network alarm data read from a search data analysis engine. Exemplarily, the search data analysis engine may be Elasticsearch (ES), which is used to store network alarm data.

[0102] Specifically, when network devices generate network alarm data, the monitoring platform can collect the newly generated network alarm data of network devices in real time and store it in Kafka. After that, the alarm information processing platform can obtain the newly generated network alarm data of network devices from Kafka and store the newly generated network alarm data of network devices in the search data analysis engine (such as ES). Among them, Kafka is a high-throughput distributed publish-subscribe messaging system.

[0103] Afterwards, the electronic device may read one or more newly stored network alarm data from the search data analysis engine to obtain a network alarm data set.

[0104] S420. Determine the alarm types corresponding to the network alarm data in the network alarm data set, and aggregate and store the network alarm data in the network alarm data set based on the alarm types, so that network alarm data of the same alarm type are stored in the same data table, and network alarm data of different alarm types are stored in different data tables.

[0105] The alarm type is the standard or basis for classifying network alarm data, which can be classified according to factors such as the nature, source, impact scope and severity of the alarm data; different alarm types represent different types of network problems or events. For example, the alarm type can include switch alarms and router alarms.

[0106] Specifically, after obtaining the network alarm data set, the current network alarm data can be parsed for each network alarm data in the network alarm data set to extract key information corresponding to the current network alarm data, such as alarm ID, occurrence time, alarm source, device ID, alarm level and alarm description, etc. Then, based on the key information in the current network alarm data, the alarm type corresponding to the current network alarm data can be determined. For example, it can be determined whether the current network alarm data is a switch alarm or a router alarm based on the alarm source, thereby obtaining the alarm type corresponding to each network alarm data in the network alarm data set.

[0107] Afterwards, the network alarm data in the network alarm data set can be classified based on the alarm type of each network alarm data, and the network alarm data of the same alarm type can be stored in the same data table, and the network alarm data of different alarm types can be stored in different data tables, so that the network alarm data in the network alarm data set can be clustered and stored based on each alarm type.

[0108] Exemplarily, the alarm type of network alarm data 1 is switch alarm, the alarm type of network alarm data 2 is switch alarm, the alarm type of network alarm data 3 is router alarm, the alarm type of network alarm data 4 is switch alarm, and the alarm type of network alarm data 5 is router alarm, then network alarm data 1, network alarm data 2, and network alarm data 4 are stored in data table 1 of the search data analysis engine, and network alarm data 3 and network alarm data 5 are stored in data table 2 of the search data analysis engine.

[0109] S430: Determine the priority of each alarm type, and determine the reading order of each data table according to the priority.

[0110] Specifically, determine the priority of each alarm type, including Sc1-Sc3:

[0111] Sc1. Obtain a first storage tree.

[0112] Among them, the first storage tree is an initial storage tree or an updated storage tree obtained by the last update, the initial storage tree only contains the root node, and the updated storage tree meets the preset conditions; the first storage tree is used to characterize the quantitative relationship between each alarm type.

[0113] The preset conditions may include: each node in the storage tree corresponds to a different alarm type, each node records the frequency of occurrence of network alarm data of the corresponding alarm type, and the frequency of occurrence recorded by nodes at the same layer is the same, and the frequency of occurrence recorded by nodes at the upper layer is greater than the frequency of occurrence recorded by nodes at the lower layer.

[0114] Specifically, if step S410 is the first time to obtain the network alarm data set, the first storage tree obtained by Sc1 is the initial storage tree, and if step S410 is not the first time to obtain the network alarm data set, the first storage tree obtained by Sc1 is the updated storage tree obtained by the last update. The nodes of the first storage tree are used to store the alarm type and the occurrence frequency of the corresponding network alarm data.

[0115] Sc2. Based on the quantity of network alarm data corresponding to each alarm type in the network alarm data set, the first storage tree is updated so that the second storage tree obtained after the update meets the preset condition.

[0116] Further, based on the number of network alarm data corresponding to each alarm type in the network alarm data set, the first storage tree is updated so that the updated second storage tree meets the preset conditions, including Sd1-Sd4:

[0117] Sd1. Search the first storage tree for nodes corresponding to each alarm type.

[0118] Specifically, for each alarm type, any alarm type can be selected as the current alarm type, and each node of the first storage tree can be searched based on the current alarm type. If the node corresponding to the current alarm type is found, Sd2 can be executed; if the node corresponding to the current alarm type is not found, Sd4 can be executed.

[0119] Afterwards, other alarm types may be selected as the current alarm type, and the above process may be repeated to search for nodes corresponding to each alarm type in the first storage tree, and corresponding steps may be executed according to the search result.

[0120] Sd2. For each node found, the occurrence frequency of the current node record is updated according to the number of network alarm data corresponding to the alarm type corresponding to the current node in the network alarm data set.

[0121] Specifically, if the node corresponding to the alarm type is found, then for each node found, any node can be selected as the current node, and the number of network alarm data corresponding to the alarm type corresponding to the current node in the network alarm data set is obtained, and then the occurrence frequency of the current node record is updated based on the number, that is, the occurrence frequency of the current node record is updated to the sum of the number and the occurrence frequency of the previous record of the current node.

[0122] Afterwards, other nodes can be selected as the current node and the above process can be repeated to update the occurrence frequency of each node record found.

[0123] Sd3. According to the occurrence frequency of the current record of each node in the first storage tree, the node position in the first storage tree is adjusted so that the second storage tree obtained after the adjustment meets the preset conditions.

[0124] The second storage tree is a storage tree obtained after updating the first storage tree, and the second storage tree meets a preset condition.

[0125] Specifically, after updating the occurrence frequency of each node record found, the position of each node in the first storage tree can be adjusted, that is, based on the occurrence frequency of the current record of each node in the first storage tree, each node is sorted, and then the position of each node in the first storage tree is adjusted according to the sorting result to obtain a second storage tree, and the occurrence frequency of node records at the same layer in the second storage tree is the same, and the occurrence frequency of node records at the upper layer is greater than the occurrence frequency of node records at the lower layer.

[0126] Sd4. If there is an alarm type for which the corresponding node is not found in the first storage tree, the node corresponding to the alarm type is used as a new node, and the position of the new node in the first storage tree is determined based on the number of network alarm data corresponding to the alarm type in the network alarm data set, and the new node is added to the second storage tree based on the position.

[0127] Specifically, if there is an alarm type for which the corresponding node is not found in the first storage tree, then the node of the first storage tree can be added. Specifically, the node corresponding to the alarm type can be used as a new node, and then the number of network alarm data corresponding to the alarm type in the network alarm data set is obtained, and the number is determined as the frequency of occurrence of the new node record. Then, based on the frequency of occurrence of the new node record, the position of the new node in the first storage tree is determined, that is, the node with the same frequency of occurrence as the record is located at the same layer, and then the new node is added to the first storage tree based on the position to obtain the second storage tree.

[0128] For example, Figure 5 FIG. 1 is an example diagram of updating a first storage tree provided by an embodiment of the present invention. Figure 5 The first storage tree in includes {alarm B: 3, alarm D: 2, alarm A: 2, alarm C: 1}; if the network alarm data set is {alarm A, alarm B, alarm A, alarm C, alarm E}, the process of updating the first storage tree to obtain the second storage tree can be: the nodes corresponding to each alarm type in the network alarm data set can be searched in the first storage tree, that is, the node corresponding to alarm A, the node corresponding to alarm B and the node corresponding to alarm C are found, but the node corresponding to alarm E is not found; then for each node found, the occurrence frequency of each node record found is updated, that is, the occurrence frequency of the node record corresponding to alarm B is updated to 4, the occurrence frequency of the node record corresponding to alarm A is updated to 4, and the occurrence frequency of the node record corresponding to alarm C is updated to The occurrence frequency is updated to 2, and the position of each node in the first storage tree is adjusted according to the occurrence frequency of each node currently recorded, to obtain the second storage tree; then for the alarm type for which the corresponding node is not found, that is, alarm E, the node corresponding to alarm E can be used as a new node, and the number corresponding to alarm E is determined to be 1 according to the network alarm data set, that is, the occurrence frequency of the new node record is 1, and then the position of the new node is determined according to the occurrence frequency 1 of the new node record, that is, the new node is located in the next layer of the node corresponding to alarm D and the node corresponding to alarm C, and the new node is inserted into the next layer of the node corresponding to alarm D and the node corresponding to alarm C, to obtain the second storage tree, that is, {alarm B: 4, alarm A: 4, alarm D: 2, alarm C: 2, alarm E: 1}.

[0129] In an embodiment of the present invention, according to the number of network alarm data corresponding to each alarm type in the network alarm data set, the occurrence frequency of each node record in the first storage tree is dynamically updated or a new node is added to obtain a second storage tree, thereby realizing the update function of the storage tree, reducing the implementation complexity, improving the computing efficiency, and ensuring that the second storage tree always reflects the real-time status of the network alarm data, thereby providing data support for the subsequent determination of the priority of each alarm type.

[0130] Sc3. Determine the priority of each alarm type based on the second storage tree.

[0131] Further, determining the priority of each alarm type based on the second storage tree includes: sorting each alarm type according to the node position of each alarm type in the second storage tree, and determining the priority of each alarm type according to the sorting result.

[0132] Specifically, after obtaining the second storage tree, each alarm type can be sorted according to its node position in the second storage tree, and then the priority of each alarm type can be determined according to the sorting result, that is, the priority of the alarm types corresponding to the nodes at the same layer in the second storage tree is the same, and the priority of the alarm types corresponding to the nodes at the upper layer is higher than the priority of the alarm types corresponding to the nodes at the lower layer, that is, the higher the frequency of occurrence of the alarm type, the higher the corresponding priority. In the embodiment of the present invention, the priority of each alarm type is determined by the position of each node in the second storage tree, so that the priority sorting becomes simpler and clearer, thereby reducing the implementation complexity of priority determination, improving calculation efficiency, and making the priority determination keep up with the changes in the network environment, thereby improving the accuracy and efficiency of priority determination.

[0133] For example, Figure 5 As shown, the second storage tree includes {alarm B: 4, alarm A: 4, alarm D: 2, alarm C: 2, alarm E: 1}, then according to the node position of each alarm type in the second storage tree, the priority order of each alarm type is determined as follows: the priority corresponding to alarm B is equal to the priority corresponding to alarm A, the priority corresponding to alarm D is equal to the priority corresponding to alarm C, the priority corresponding to alarm B (or the priority corresponding to alarm A) is greater than the priority corresponding to alarm D (or the priority corresponding to alarm C), and the priority corresponding to alarm D (or the priority corresponding to alarm C) is greater than the priority corresponding to alarm E.

[0134] In the embodiment of the present invention, by continuously updating the storage tree, the real-time status of the network alarm data can be reflected, so that the priority determination can keep pace with the changes in the network environment, be closer to the actual situation, reduce the error caused by subjective judgment, and more comprehensively evaluate the urgency and importance of each alarm type, thereby improving the accuracy of priority determination and providing a data basis for the subsequent determination of the reading order of each data table.

[0135] After determining the priority of each alarm type, the reading order of each data table can be determined according to the priority, that is, the higher the priority, the earlier the reading order of the corresponding data table.

[0136] Optionally, after determining the reading order of each data table according to the priority, each data table can be read in the determined reading order, that is, the data table corresponding to the high priority is read first, and then the data table corresponding to the low priority is read, which can ensure that important network alarm data is processed first.

[0137] In the technical solution provided by the embodiment of the present invention, a network alarm data set can be obtained, and then the alarm types corresponding to each network alarm data in the network alarm data set are determined, and the network alarm data in the network alarm data set are aggregated and stored based on each alarm type, so that the network alarm data of the same alarm type are stored in the same data table, and the network alarm data of different alarm types are stored in different data tables. By classifying the network alarm data, the operating status and potential problems of the network system can be more clearly understood, which provides strong support for subsequent troubleshooting and alarm handling. At the same time, the network alarm data is aggregated and stored, which is convenient for data management and analysis, and can significantly improve the efficiency of data processing; then the priority of each alarm type is determined, and the reading order of each data table is determined according to the priority, realizing the function of determining the reading order, which can ensure that important network alarm data is processed first, avoiding wasting too many resources on unimportant network alarm data, and then saving computer resources, thereby improving the efficiency of troubleshooting and alarm handling.

[0138] Figure 6 A schematic diagram of the structure of the alarm data processing device provided in an embodiment of the present invention. This embodiment can be applied to the scenario where the alarm data of the network device needs to be processed. The device can be implemented in software and / or hardware. The device can be integrated in an electronic device, such as Figure 6 As shown, the alarm data processing device specifically includes:

[0139] The host determination module 610 is used to determine at least one application host associated with the network device generating the current network alarm data for the current network alarm data read from the current data table;

[0140] The fault determination module 620 is used to track the application alarm of the current application host within a set time period based on at least one application alarm rule pre-configured for the network device for each application host, determine whether the current application host has a fault according to the tracking result, and obtain the application fault determination result corresponding to the current application host;

[0141] The processing judgment module 630 is used to determine whether to process the current network alarm data according to the application fault judgment results corresponding to each application host;

[0142] The alarm handling module 640 is used to obtain the inspection result of the availability check on the network equipment when it is determined to handle the current network alarm data, determine the alarm handling process to be adopted according to the inspection result, and execute the alarm handling process.

[0143] Optionally, the host determination module 610 is specifically configured to:

[0144] The current network alarm data is parsed to obtain the device identification of the network device that generates the current network alarm data; the application host identification corresponding to the device identification is searched in a pre-set association mapping table, and the application hosts corresponding to each application host identification found are determined as at least one application host associated with the network device; wherein the association mapping table contains at least one mapping relationship between a network device identification and an application host identification.

[0145] Optionally, the fault determination module 620 is specifically configured to:

[0146] For each application alarm rule pre-configured for the network device, determine the event to be tracked based on the rule expression corresponding to the current application alarm rule, and periodically judge whether the event to be tracked occurs on the current application host within the set time period, and generate an application alarm data when it is judged that the event to be tracked occurs; determine whether the current application host continues to generate alarms based on each application alarm data generated within the set time period, and if so, determine that the current application host has a fault; otherwise, determine that the current application host has not a fault.

[0147] Optionally, the disposal determination module 630 is specifically used for:

[0148] If there is at least one application host corresponding to the application fault judgment result that the current application host has a fault, it is determined that the current network alarm data is processed; if the application fault judgment results corresponding to each application host are all that the current application host has not a fault, it is determined not to process the current network alarm data.

[0149] Optionally, the alarm handling module 640 is specifically used for:

[0150] Obtaining the inspection result of the availability check on the network device; wherein the availability check on the network device and the application alarm tracking on the application host are performed in parallel, and the inspection result includes: the inspection result of at least one inspection item corresponding to the network device and the inspection result of at least one inspection item corresponding to other network devices in the device group to which the network device belongs; determining the abnormality type of the network device based on the inspection result of the availability check on the network device, and determining the alarm handling process to be adopted according to the abnormality type.

[0151] Furthermore, the device also includes:

[0152] A data processing module is used to obtain a network alarm data set before determining at least one application host associated with a network device that generates the current network alarm data for the current network alarm data read from the current data table; wherein the network alarm data set includes at least one network alarm data read from a search data analysis engine; determine the alarm type corresponding to each network alarm data in the network alarm data set, and aggregate and store the network alarm data in the network alarm data set based on each alarm type, so that network alarm data of the same alarm type are stored in the same data table, and network alarm data of different alarm types are stored in different data tables; determine the priority of each alarm type, and determine the reading order of each data table according to the priority.

[0153] Optionally, the data processing module is specifically used for:

[0154] Obtain a first storage tree; wherein the first storage tree is an initial storage tree or an updated storage tree obtained from a previous update, the initial storage tree only includes a root node, and the updated storage tree satisfies a preset condition; wherein the preset condition includes: each node in the storage tree corresponds to a different alarm type, each node records the frequency of occurrence of network alarm data of the corresponding alarm type, and the frequency of occurrence of node records at the same layer is the same, and the frequency of occurrence of node records at the upper layer is greater than the frequency of occurrence of node records at the lower layer; based on the number of network alarm data corresponding to each alarm type in the network alarm data set, the first storage tree is updated so that the second storage tree obtained after the update satisfies the preset condition; and the priority of each alarm type is determined based on the second storage tree.

[0155] Optionally, the data processing module is also used for:

[0156] Search the first storage tree for the nodes corresponding to each alarm type; for each node found, update the frequency of occurrence of the current node record according to the number of network alarm data corresponding to the alarm type corresponding to the current node in the network alarm data set; adjust the node position in the first storage tree according to the frequency of occurrence of the current record of each node in the first storage tree, so that the adjusted second storage tree meets the preset conditions.

[0157] Furthermore, the device also includes:

[0158] An insertion module is used to, if there is an alarm type for which a corresponding node is not found in the first storage tree, use the node corresponding to the alarm type as a new node, and determine the position of the new node in the first storage tree based on the number of network alarm data corresponding to the alarm type in the network alarm data set, and add the new node to the second storage tree based on the position.

[0159] Optionally, the data processing module is also used for:

[0160] Each alarm type is sorted according to its node position in the second storage tree, and the priority of each alarm type is determined according to the sorting result; wherein, the alarm types corresponding to the nodes at the same layer in the second storage tree have the same priority, and the alarm types corresponding to the nodes at the upper layer have higher priority than the alarm types corresponding to the nodes at the lower layer.

[0161] Optionally, the alarm handling module 640 is further configured to:

[0162] Call the preset activity component, and trigger the alarm handling process included in the preset activity component to perform corresponding handling operations on each execution node; wherein the execution node obtains the script corresponding to the corresponding handling operation from the server, and completes the corresponding handling operation by executing the obtained script; wherein the handling operation includes: information notification action, looping the current action and jumping out of the loop to continue to execute subsequent actions after the loop condition is met, and waiting for a preset time and continuing to execute subsequent actions after the preset time is reached. At least one of the following.

[0163] The alarm data processing device provided in the embodiment of the present invention can execute the alarm data processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0164] Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. Figure 7 A block diagram of an exemplary electronic device 7 suitable for use in implementing embodiments of the present invention is shown. Figure 7 The electronic device 7 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0165] like Figure 7 As shown, the electronic device 7 is in the form of a general purpose computing device. The components of the electronic device 7 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0166] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0167] The electronic device 7 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 7, including volatile and non-volatile media, removable and non-removable media.

[0168] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 7 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 7 not shown, usually called a "hard drive"). Although Figure 7 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0169] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0170] The electronic device 7 can also communicate with one or more external devices 14 (such as keyboards, pointing devices, displays 24, etc.), and can also communicate with one or more devices that enable users to interact with the electronic device 7, and / or communicate with any device that enables the electronic device 7 to communicate with one or more other computing devices (such as network cards, modems, etc.). This communication can be carried out through an input / output (I / O) interface 22. In addition, the electronic device 7 in this embodiment, the display 24 does not exist as an independent individual, but is embedded in the mirror surface. When the display surface of the display 24 is not displayed, the display surface of the display 24 and the mirror surface are visually integrated. In addition, the electronic device 7 can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs) and / or public networks, such as the Internet) through a network adapter 20. As shown in the figure, the network adapter 20 communicates with other modules of the electronic device 7 through a bus 18. It should be understood that although not shown in the figures, other hardware and / or software modules may be used in conjunction with the electronic device 7, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0171] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing an alarm data processing method provided by an embodiment of the present invention, including: for the current network alarm data read from the current data table, determining at least one application host associated with the network device that generates the current network alarm data; for each application host, based on at least one application alarm rule pre-configured for the network device, tracking the application alarm of the current application host within a set time period, determining whether the current application host fails according to the tracking result, and obtaining the application fault determination result corresponding to the current application host; determining whether to handle the current network alarm data according to the application fault determination results corresponding to each application host; in the case of determining to handle the current network alarm data, obtaining the inspection result of the availability check on the network device, determining the alarm handling process to be adopted according to the inspection result, and executing the alarm handling process.

[0172] Of course, those skilled in the art can understand that the processor can also implement the technical solution of the method for processing alarm data provided by any embodiment of the present invention.

[0173] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, a method for processing alarm data as provided in all the embodiments of the present invention is implemented, including: for current network alarm data read from a current data table, determining at least one application host associated with a network device that generates the current network alarm data; for each application host, based on at least one application alarm rule pre-configured for the network device, tracking the application alarm of the current application host within a set time period, determining whether the current application host fails according to the tracking result, and obtaining an application fault determination result corresponding to the current application host; determining whether to handle the current network alarm data according to the application fault determination results respectively corresponding to each application host; in the case of determining that the current network alarm data is to be handled, obtaining the inspection result of the availability check on the network device, determining the alarm handling process to be adopted according to the inspection result, and executing the alarm handling process.

[0174] Any combination of one or more computer-readable media can be used. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0175] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0176] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0177] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0178] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the method for processing alarm data provided by any embodiment of the present invention.

[0179] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0180] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for processing alarm data, characterized in that: include: For the current network alarm data read from the current data table, determining at least one application host associated with the network device generating the current network alarm data; For each of the application hosts, based on at least one application alarm rule pre-configured for the network device, application alarm tracking is performed on the current application host within a set time period, and whether the current application host fails is determined according to the tracking result, so as to obtain an application fault determination result corresponding to the current application host; Determine whether to process the current network alarm data according to the application fault determination results respectively corresponding to the application hosts; In the case of determining to process the current network alarm data, obtaining the inspection result of the availability inspection of the network device, determining the alarm processing process to be adopted according to the inspection result, and executing the alarm processing process.

2. The method according to claim 1, characterized in that The determining of at least one application host associated with the network device generating the current network alarm data comprises: Parsing the current network alarm data to obtain a device identifier of a network device that generates the current network alarm data; Searching for the application host identifier corresponding to the device identifier in a preset association mapping table, and determining the application host corresponding to each of the found application host identifiers as at least one application host associated with the network device; The association mapping table includes at least one mapping relationship between a network device identifier and an application host identifier.

3. The method according to claim 1, characterized in that The step of tracking the application alarm of the current application host within a set time period based on at least one application alarm rule preconfigured for the network device, and determining whether the current application host fails according to the tracking result, includes: For each application alarm rule pre-configured for the network device, determine the event to be tracked based on the rule expression corresponding to the current application alarm rule, and periodically judge whether the event to be tracked occurs on the current application host within a set time period, and generate an application alarm data when it is judged that the event to be tracked occurs; Determine whether the current application host continues to generate alarms based on the application alarm data generated within the set time period. If so, determine that the current application host has a fault; otherwise, determine that the current application host has not a fault.

4. The method according to claim 1, characterized in that The determining whether to process the current network alarm data according to the application fault determination results respectively corresponding to the application hosts includes: If there is at least one application host corresponding to the application fault determination result that the current application host has a fault, determining to process the current network alarm data; If the application fault determination results corresponding to the application hosts are all that the current application host has no fault, it is determined not to process the current network alarm data.

5. The method according to claim 1, characterized in that: The obtaining of the inspection result of the availability inspection of the network device and determining the alarm handling process to be adopted according to the inspection result includes: Obtaining an inspection result of an availability inspection of the network device; wherein the availability inspection of the network device is performed in parallel with application alarm tracking of the application host, and the inspection result includes: an inspection result of at least one inspection item corresponding to the network device and an inspection result of at least one inspection item corresponding to other network devices in the device group to which the network device belongs; The abnormality type of the network device is determined based on the inspection result of the availability inspection of the network device, and the alarm handling process to be adopted is determined according to the abnormality type.

6. The method according to any one of claims 1 to 5, characterized in that Before determining, for the current network alarm data read from the current data table, at least one application host associated with the network device generating the current network alarm data, the method further includes: Acquire a network alarm data set; wherein the network alarm data set includes at least one network alarm data read from a search data analysis engine; Determine the alarm types corresponding to the network alarm data in the network alarm data set, and aggregate and store the network alarm data in the network alarm data set based on the alarm types, so that the network alarm data of the same alarm type are stored in the same data table, and the network alarm data of different alarm types are stored in different data tables; Determine the priority of each of the alarm types, and determine the order of reading each of the data tables according to the priority.

7. The method according to claim 6, characterized in that The determining the priority of each of the alarm types includes: Obtain a first storage tree; wherein the first storage tree is an initial storage tree or an updated storage tree obtained by the last update, the initial storage tree only includes a root node, and the updated storage tree satisfies a preset condition; wherein the preset condition includes: each node in the storage tree corresponds to a different alarm type, each node records the occurrence frequency of network alarm data of the corresponding alarm type, and the occurrence frequencies of node records at the same layer are the same, and the occurrence frequencies of node records at the upper layer are greater than the occurrence frequencies of node records at the lower layer; Based on the number of network alarm data corresponding to each of the alarm types in the network alarm data set, the first storage tree is updated so that the second storage tree obtained after the update meets the preset condition; The priority of each of the alarm types is determined based on the second storage tree.

8. The method according to claim 7, characterized in that The updating of the first storage tree based on the number of network alarm data corresponding to each of the alarm types in the network alarm data set so that the updated second storage tree meets the preset condition includes: Searching the first storage tree for nodes corresponding to each of the alarm types; For each node found, update the occurrence frequency of the current node record according to the number of network alarm data corresponding to the alarm type corresponding to the current node in the network alarm data set; According to the occurrence frequency of the current record of each node in the first storage tree, the node position in the first storage tree is adjusted so that the second storage tree obtained after the adjustment meets the preset condition.

9. The method according to claim 8, characterized in that The method further comprises: If there is an alarm type for which a corresponding node has not been found in the first storage tree, the node corresponding to the alarm type is used as a new node, and the position of the new node in the first storage tree is determined based on the number of network alarm data corresponding to the alarm type in the network alarm data set, and the new node is added to the second storage tree based on the position.

10. The method according to claim 7, characterized in that The determining the priority of each of the alarm types based on the second storage tree includes: Sorting each of the alarm types according to the node position of each of the alarm types in the second storage tree, and determining the priority of each of the alarm types according to the sorting result; Among them, the priorities of the alarm types corresponding to the nodes at the same layer in the second storage tree are the same, and the priorities of the alarm types corresponding to the nodes at the upper layer are higher than the priorities of the alarm types corresponding to the nodes at the lower layer.

11. The method according to any one of claims 1 to 5, characterized in that: The execution of the alarm handling process includes: Calling a preset activity component, and triggering each execution node included in the alarm handling process to perform a corresponding handling operation through the preset activity component; wherein the execution node obtains a script corresponding to the corresponding handling operation from the server, and completes the corresponding handling operation by executing the obtained script; The handling operation includes at least one of: information notification action, looping the current action and jumping out of the loop to continue to execute subsequent actions after the loop condition is met, and waiting for a preset time and continuing to execute subsequent actions after the preset time is reached.

12. A device for processing alarm data, characterized in that: include: A host determination module, configured to determine, for current network alarm data read from a current data table, at least one application host associated with a network device generating the current network alarm data; A fault determination module is used to track application alarms of the current application host within a set time period based on at least one application alarm rule pre-configured for the network device for each of the application hosts, determine whether the current application host has a fault according to the tracking result, and obtain an application fault determination result corresponding to the current application host; A handling judgment module, used to determine whether to handle the current network alarm data according to the application fault judgment results corresponding to each application host; The alarm handling module is used to obtain the inspection result of the availability check on the network device when it is determined to handle the current network alarm data, determine the alarm handling process to be adopted according to the inspection result, and execute the alarm handling process.

13. The device according to claim 12, characterized in that The device also includes: A data processing module, configured to obtain a network alarm data set before determining at least one application host associated with a network device generating the current network alarm data for the current network alarm data read from the current data table; wherein the network alarm data set includes at least one network alarm data read from the search data analysis engine; Determine the alarm types corresponding to the network alarm data in the network alarm data set, and aggregate and store the network alarm data in the network alarm data set based on the alarm types, so that the network alarm data of the same alarm type are stored in the same data table, and the network alarm data of different alarm types are stored in different data tables; Determine the priority of each of the alarm types, and determine the order of reading each of the data tables according to the priority.

14. The device according to claim 13, characterized in that The data processing module is specifically used for: Obtain a first storage tree; wherein the first storage tree is an initial storage tree or an updated storage tree obtained by the last update, the initial storage tree only includes a root node, and the updated storage tree satisfies a preset condition; wherein the preset condition includes: each node in the storage tree corresponds to a different alarm type, each node records the occurrence frequency of network alarm data of the corresponding alarm type, and the occurrence frequencies of node records at the same layer are the same, and the occurrence frequencies of node records at the upper layer are greater than the occurrence frequencies of node records at the lower layer; Based on the number of network alarm data corresponding to each of the alarm types in the network alarm data set, the first storage tree is updated so that the updated second storage tree meets the preset condition; and the priority of each of the alarm types is determined based on the second storage tree.

15. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for processing alarm data as described in any one of claims 1 to 11 when executing the computer program.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for processing alarm data according to any one of claims 1 to 11 is implemented.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the method for processing alarm data according to any one of claims 1 to 11.

Images