Alarm event processing method and device, equipment, medium and product

Abstract

The invention provides an alarm event processing method and device, equipment, a medium and a product, and the method comprises the steps: responding to a received first alarm event, and determining at least one piece of first alarm information related to the first alarm event and a first aggregation rule corresponding to the first alarm event; sending the at least one piece of first alarm information and a prompt word corresponding to the first aggregation rule to a language model, and receiving alarm event analysis information output by the language model; and displaying the alarm event analysis information. In the method, the same aggregation rule corresponds to the same analysis thought, alarm analysis is carried out in combination with the characteristics of the aggregation rule, and meanwhile, targeted analysis is carried out on alarm information related to an alarm event, so that alarm event analysis information for accurately describing the alarm event can be generated; the accuracy and pertinence of alarm event analysis information are improved, and then the efficiency of subsequent alarm processing is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device, computer-readable storage medium, and computer program product for processing an alarm event. Background Art

[0002] With the continuous development of computer technology, operation and maintenance products for fault detection have emerged. Operation and maintenance products, also known as observable platforms, can detect the operating status of Internet technology (IT) infrastructure equipment such as network equipment (such as switches, routers, etc.), computer room equipment, and conference room equipment to ensure safe operation.

[0003] The operation and maintenance product can detect alarm information, aggregate the alarm information based on aggregation rules, generate alarm events, and present alarm event analysis information related to the alarm events to users (such as security operations personnel).

[0004] Generally, alarm events generated based on the same aggregation rule present the same alarm event analysis information. However, in the above method, it is difficult for users to understand the specific situation of the alarm event through the alarm event analysis information, which affects the efficiency and accuracy of alarm handling. Summary of the invention

[0005] The present application provides a method for processing an alarm event. The method can generate alarm event analysis information that accurately describes the alarm event, thereby improving the accuracy and pertinence of the alarm event analysis information. The present application also provides a device, an electronic device, a computer-readable storage medium, and a computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides a method for processing an alarm event, the method comprising:

[0007] In response to receiving a first alarm event, determining at least one first alarm information related to the first alarm event and a first aggregation rule corresponding to the first alarm event;

[0008] Sending the at least one first alarm information and the prompt word corresponding to the first aggregation rule to a language model, and receiving alarm event analysis information output by the language model;

[0009] Display the alarm event analysis information.

[0010] In a second aspect, the present application provides a device for processing an alarm event, the device comprising:

[0011] a determination module, configured to determine, in response to receiving a first alarm event, at least one first alarm information related to the first alarm event and a first aggregation rule corresponding to the first alarm event;

[0012] An analysis module, configured to send the at least one first alarm information and the prompt word corresponding to the first aggregation rule to a language model, and receive alarm event analysis information output by the language model;

[0013] The display module is used to display the alarm event analysis information.

[0014] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory so that the electronic device executes the method for processing an alarm event in the first aspect or any implementation of the first aspect.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and the instructions instruct an electronic device to execute the method for processing an alarm event described in the first aspect or any one of the implementations of the first aspect.

[0016] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the method for processing an alarm event as described in the first aspect or any one of the implementations of the first aspect.

[0017] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0018] It can be seen from the above technical solutions that this application has the following advantages:

[0019] The present application provides a method for processing an alarm event. In response to receiving a first alarm event, the method determines at least one first alarm message related to the first alarm event and a first aggregation rule corresponding to the first alarm event, then sends the at least one first alarm message and a prompt word corresponding to the first aggregation rule to a language model, receives alarm event analysis information output by the language model, and displays the alarm event analysis information.

[0020] In this method, the natural language processing capability of the language model is used to generate alarm event analysis information. Since different aggregation rules correspond to different prompt words, the language model can analyze the alarm information of different alarm events in combination with the prompt words corresponding to the aggregation rules. On the one hand, the same aggregation rules correspond to the same analysis ideas, and alarm analysis is performed in combination with the characteristics of the aggregation rules. On the other hand, targeted analysis is performed on the alarm information related to the alarm event. In this way, alarm event analysis information that accurately describes the alarm event is generated, the accuracy and pertinence of the alarm event analysis information are improved, and the efficiency of subsequent alarm handling is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0022] Figure 1 A flowchart of a method for processing an alarm event provided in an embodiment of the present application;

[0023] Figure 2 A flowchart of a method for processing an alarm event provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of an architecture of a method for processing an alarm event provided in an embodiment of the present application;

[0025] Figure 4A and Figure 4B A schematic diagram of a configuration interface provided in an embodiment of the present application;

[0026] FIG. 5A to FIG. 5C A schematic diagram of a display interface for alarm event analysis information provided in an embodiment of the present application;

[0027] Figure 6 A schematic diagram of the structure of a device for processing an alarm event provided in an embodiment of the present application;

[0028] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0030] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0031] With the continuous development of computer technology, operation and maintenance products for fault detection and ensuring the safe operation of IT infrastructure equipment (such as switches, routers and other network equipment, computer room equipment, conference room equipment) have emerged. Operation and maintenance products, also known as observability platforms, can be used to detect, manage and maintain different types of IT infrastructure equipment to improve the stability, security and efficiency of the IT environment.

[0032] In some examples, the operation and maintenance product can collect operating data of IT infrastructure equipment (for example, operation log data). When there are abnormalities in the operating data of the IT infrastructure equipment, the alarm information in the operating data of the IT infrastructure equipment is determined, and the alarm information is aggregated based on aggregation rules to generate an alarm event.

[0033] In other examples, the operation and maintenance product may also be connected to an external system (eg, an external detection system related to IT infrastructure equipment). When an alarm event is generated by the external system, the operation and maintenance product may automatically access the alarm event generated by the external system.

[0034] The aggregation rule can be understood as a rule for aggregating related alarm information to generate alarm events. After the operation and maintenance product obtains the alarm event, it can present the alarm event analysis information related to the alarm event to the user (for example, the network operation and maintenance personnel), and inform the user of the generation of the alarm event so that the user can quickly respond to the alarm event and handle the alarm.

[0035] Normally, alarm events generated based on the same aggregation rule present the same alarm event analysis information. For example, aggregation rule A is "if at least one of alarm information A, alarm information B, or alarm information C is detected within 5 minutes, an alarm event is generated." In the first time period, alarm information A and alarm information B are detected, and alarm event 1 is generated. In the second time period, alarm information B and alarm information C are detected, and alarm event 2 is generated. In the third time period, alarm information A is detected, and alarm event 3 is generated. Since alarm event 1, alarm event 2, and alarm event 3 are all generated based on aggregation rule A, when the alarm event analysis information is displayed to the user, the alarm event analysis information corresponding to alarm event 1, alarm event 2, and alarm event 3 is the same.

[0036] For example, alarm information A may be high memory utilization, alarm information B may be high central processing unit (CPU) utilization, and alarm information C may be high network bandwidth utilization. At this time, the alarm event analysis information corresponding to alarm event 1, alarm event 2, and alarm event 3 are all "high resource utilization".

[0037] However, in actual application scenarios, since the same aggregation rule can aggregate different alarm information, the same aggregation rule can aggregate alarm information of different quantities and contents, and the alarm events generated based on the same aggregation rule can represent different fault scenarios and reflect different severity levels of the event. The alarm events generated based on the same aggregation rule and presented with the same alarm event analysis information can only distinguish the types of alarm events, and it is difficult to flexibly and accurately define the alarm event analysis information of the alarm event, and it is difficult for users to understand the specific situation of the alarm event through the alarm event analysis information.

[0038] In some operation and maintenance products, it is supported to define alarm event analysis information through variable methods, so as to realize dynamic generation of alarm event analysis information. Specifically, the operation and maintenance product predefines variables related to alarm events, such as time, location, equipment and other variables. After an alarm event is generated, the variable values ​​corresponding to each variable can be extracted from the alarm information of the alarm event, and the alarm event analysis information can be generated based on the variable values. In this way, the alarm event analysis information can include the variable values ​​related to the alarm event.

[0039] However, in the above method, developers need to predefine variables for different alarm events. Since the number of variables is usually large and the variables are usually complex, developers need to reference more variables in the development code and write more "if-else" judgment statements, which results in high configuration costs. At the same time, the alarm event analysis information only includes the variable values ​​related to the alarm event, which still makes it difficult to accurately describe the alarm event, and has poor flexibility and applicability.

[0040] In view of this, the present application provides a method for processing alarm events. In response to receiving a first alarm event, the method determines at least one first alarm message related to the first alarm event and a first aggregation rule corresponding to the first alarm event, then sends at least one first alarm message and a prompt word corresponding to the first aggregation rule to a language model, receives alarm event analysis information output by the language model, and displays the alarm event analysis information.

[0041] In this method, the natural language processing capability of the language model is used to generate alarm event analysis information. Since different aggregation rules correspond to different prompt words, the language model can analyze the alarm information of different alarm events in combination with the prompt words corresponding to the aggregation rules. On the one hand, the same aggregation rules correspond to the same analysis ideas, and alarm analysis is performed in combination with the characteristics of the aggregation rules. On the other hand, targeted analysis is performed on the alarm information related to the alarm event. In this way, alarm event analysis information that accurately describes the alarm event is generated, the accuracy and pertinence of the alarm event analysis information are improved, and the efficiency of subsequent alarm handling is improved.

[0042] To facilitate understanding of the technical solution provided by the embodiments of the present application, it will be described below with reference to the accompanying drawings.

[0043] See also Figure 1 The flowchart of a method for processing an alarm event provided in an embodiment of the present application is shown, and the method specifically includes:

[0044] S101: In response to receiving a first alarm event, determining at least one first alarm information related to the first alarm event and a first aggregation rule corresponding to the first alarm event.

[0045] In the embodiment of the present application, the first alarm event (incident) may be any alarm event received by the operation and maintenance product, for example, the first alarm event may be a failure that causes service interruption or quality degradation of IT equipment or operating environment, or the first alarm event may be a failure of a configuration item or service component of a key service. The first alarm event may be an alarm event generated after the operation and maintenance product collects operating data of IT infrastructure equipment, or may be an alarm event received after the operation and maintenance product is connected to an external system.

[0046] The first alarm information can be understood as information used to describe the alarm. In some embodiments, the first alarm information may include multiple alarm fields and corresponding alarm field values, such as alarm name, alarm level, alarm status, fault data, alarm trigger time, name of the entity where the alarm occurs, and multiple alarm fields and corresponding alarm field values. In the embodiment of the present application, the first alarm information is the alarm information that generates the first alarm event. In other words, the first alarm information is associated with the first alarm event, and the first alarm event is generated based on the first alarm information.

[0047] The first aggregation rule can be understood as an aggregation rule for generating the first alarm event. The aggregation rule generally refers to a rule for aggregating alarm information into an alarm event. For example, the aggregation rule can be described for the type of alarm information, the number of alarm information, the generation time of the alarm information, etc. When the alarm information hits the type of alarm information, the number of alarm information, the generation time of the alarm information, etc. described in the aggregation rule, a corresponding alarm event is generated.

[0048] In a specific implementation, the first alarm event may be generated through the following steps: continuously receiving alarm information, and generating the first alarm event in response to at least one first alarm information in the alarm information hitting the first aggregation rule.

[0049] For example, the first aggregation rule corresponding to the first alarm event can be "alarm information A and alarm information B are detected within 10 minutes, or alarm information B and alarm information C are detected within 10 minutes". By continuously receiving alarm information, when alarm information A and alarm information B are detected within 10 minutes, the first alarm event is generated. Alternatively, when alarm information B and alarm information C are detected within 10 minutes, the first alarm event is generated.

[0050] That is to say, in an embodiment of the present application, the continuously received alarm information is matched with different aggregation rules. When at least one first alarm information hits the first aggregation rule, it indicates that at least one first alarm information received satisfies the aggregation rule for generating a first alarm event, thereby generating a first alarm event.

[0051] S102: Send at least one first alarm information and a prompt word corresponding to a first aggregation rule to a language model, and receive alarm event analysis information output by the language model.

[0052] The alarm event analysis information can be used to inform the user of the occurrence of the first alarm event. In other words, the alarm event analysis information can be understood as information presented on the front end, and the user can learn about the occurrence of the first alarm event by viewing the alarm event analysis information, and be reminded to handle the first alarm event.

[0053] In an embodiment of the present application, the alarm event analysis information can be understood as information that describes the first alarm event in relatively concise language, that is, the alarm event analysis information is used to summarize the first alarm event so that the user can have a preliminary understanding of the first alarm event by viewing the alarm event analysis information. Therefore, under normal circumstances, the alarm event analysis information will not include the specific content of at least one first alarm message, that is, the alarm event analysis information will not list at least one first alarm message. The user can view at least one first alarm message in a display area different from the display area of ​​the alarm event analysis information, or the user can view at least one first alarm message by triggering an alarm information viewing operation.

[0054] In some embodiments, the alarm event analysis information may include: the name of the alarm event, and / or the description information of the alarm event, wherein the name of the alarm event may be used to identify the alarm event, and the description information of the alarm event may be used to summarize the alarm event.

[0055] That is to say, by viewing the name of the alarm event and the description information of the alarm event, the user can capture the key information and overview of the alarm event, and quickly understand the fault without having to carefully view the first alarm information, so as to perform efficient alarm handling later.

[0056] A language model can have natural language processing capabilities, understand the meaning of natural language, and handle different types of natural language tasks. For example, a language model can be a deep learning model trained using text data.

[0057] In an embodiment of the present application, since at least one first alarm message related to the first alarm event usually involves the natural language content of multiple alarm fields such as the alarm name, alarm level, alarm status, alarm trigger time, and the name of the entity where the alarm occurs, the at least one first alarm message is identified and analyzed with the help of the natural language processing capability of the language model to realize the automatic generation of alarm event analysis information.

[0058] The language model can generate alarm event analysis information based on prompt learning. Among them, prompt words can be used to guide the language model to perform specific outputs in generative tasks (such as text generation tasks, question-answering tasks, and dialogue tasks). By configuring prompt words, the language model can understand the background and requirements of the task, and the language model can handle different types of natural language processing tasks without retraining the language model, thereby increasing the scalability and flexibility of the language model.

[0059] In the embodiment of the present application, the prompt word may correspond to the aggregation rule. In other words, different aggregation rules correspond to different prompt words, and when generating the alarm event analysis information of the first alarm event with the help of the language model, the prompt word corresponding to the first aggregation rule of the first alarm event is selected.

[0060] Since different aggregation rules usually correspond to different types of alarm events, by configuring the prompt words of the aggregation rule granularity, different types of alarm events can correspond to different prompt words. Different types of alarm events have different generation requirements. In this way, according to the type of alarm event, alarm event analysis information is generated in a targeted and focused manner. At the same time, considering that different aggregation rules usually have different alarm event analysis ideas, the prompt words of the aggregation rule granularity are configured in combination with the characteristics of the aggregation rules, and the same alarm event analysis ideas are configured for the same type of alarm events, so as to unify the alarm analysis ideas and avoid large analysis deviations.

[0061] In order to facilitate the language model to perform natural language processing, at least one first alarm message can be input into the language model in the form of structured data. In specific implementation, the structured data consisting of the alarm field and the alarm field value is extracted from the at least one first alarm message, and the at least one first alarm message, the structured data, and the prompt word corresponding to the first aggregation rule are sent to the language model, and the alarm event analysis information output by the language model is received. Among them, the alarm event analysis information includes at least one structured data.

[0062] For example, the alarm field values ​​corresponding to the alarm fields such as the alarm name, alarm level, alarm status, alarm trigger time, and the name of the entity where the alarm occurred are extracted from at least one first alarm information, and then structured data is generated, and the generated structured data is sent to the language model. The structured data can be used in the prompt word corresponding to the first aggregation rule (that is, filled in the placeholder in the prompt word corresponding to the first aggregation rule), or the structured data can also be used in the alarm event analysis information. In this way, the generated alarm event analysis information is more in line with the first alarm event and can describe the first alarm event in a detailed and accurate manner.

[0063] In an embodiment of the present application, the prompt word corresponding to the first aggregation rule may include content indicating that the language model generates alarm event analysis information based on at least one first alarm information. Specifically, the prompt word corresponding to the first aggregation rule may indicate that the language model generates at least one of the following information: attribute information of the first alarm event, the scope of influence of the first alarm event, the severity of the first alarm event, structured data in at least one first alarm information, the cause of the first alarm event, the analysis steps of the first alarm event, or the handling method of the first alarm event.

[0064] Among them, the attribute information of the first alarm event can be understood as information that describes the first alarm event from different dimensions, such as the triggering time of the first alarm event, the location of the occurrence of the first alarm event, etc. The impact scope of the first alarm event can be understood as the IT equipment or operating environment affected after the first alarm event is generated, such as IT equipment A, site B, etc. The severity of the first alarm event can be used to describe the severity of the first alarm event, such as P0 level, P1 level, etc. The structured data in at least one first alarm information can be structured data extracted from the first alarm information, consisting of an alarm field and an alarm field value. The cause of the first alarm event can be used to describe the cause of the first alarm event, such as abnormal communication between controllers, etc. The analysis step of the first alarm event can be used to describe the steps of alarm analysis, such as the steps of determining the handling priority of the first alarm event. The handling method of the first alarm event can be used to describe the steps of alarm handling, such as the standard operating procedure (SOP) process corresponding to the type of the first alarm event.

[0065] By configuring the above content in the prompt word, the generated alarm event analysis information can include corresponding information, such as attribute information of the first alarm event, the impact scope of the first alarm event, the severity of the first alarm event, structured data in at least one first alarm information, the cause of the first alarm event, the analysis steps of the first alarm event, the handling method of the first alarm event, etc., thereby enriching the information volume of the alarm event analysis information and more accurately describing the first alarm event.

[0066] In the embodiment of the present application, user-defined configuration of prompt words is supported. In specific implementation, a prompt word configuration operation is received, wherein the prompt word configuration operation includes a target aggregation rule selection operation and a target prompt word input operation, and then, the target prompt word of the target aggregation rule is determined according to the prompt word configuration operation.

[0067] That is to say, the user can configure prompt words based on the aggregation rule as the granularity, configure different prompt words for different aggregation rules, and then configure different generation requirements for different types of alarm events.

[0068] The target prompt word input by the user can be represented in natural language, that is, the user can describe the need for alarm event analysis information in the form of natural language in the prompt word. In some embodiments, the target prompt word can be "If alarm information A appears, it means that the cause of the alarm event is B, please use C as the name of the alarm event", and in other embodiments, the target prompt word can be "If the number of alarm information exceeds D, a major accident may occur, please indicate in the name of the alarm event that the alarm event is a major accident".

[0069] Furthermore, the embodiment of the present application also supports the user to configure prompt words in a more fine-grained manner. Specifically, the input operation of the target prompt word may include: the input operation of the target prompt word related to the name of the alarm event and the input operation of the target prompt word related to the description information of the alarm event. In other words, the user can customize the prompt word for the name and description information of the alarm event respectively, so that the user can more accurately configure the generation requirements of the alarm event analysis information.

[0070] In this way, by configuring prompt words by users, the personalized generation needs of different users and different business scenarios are met, and alarm event analysis information that meets user expectations is generated. Compared with the same aggregation rules generating the same alarm event analysis information, after applying the method provided in the embodiment of the present application, it is possible to generate alarm event analysis information including multiple dimensions and richer.

[0071] S103: Display alarm event analysis information.

[0072] After the language model outputs the alarm event analysis information, the alarm event analysis information can be displayed to the user. In some possible implementations, the alarm event analysis information can be displayed in the form of a message card. In other words, the alarm event analysis information can be pushed to the user in the form of a message card. For example, the name of the alarm event is displayed in the title part of the message card, and the description information of the alarm event is displayed in the message summary part of the message card.

[0073] In some embodiments, the operation and maintenance product may be associated with an office automation (OA) system. The OA system, which may also be referred to as a business system or a business platform, includes multiple functional modules that provide different functions, such as an instant messaging module, a form module, a task management module, a meeting module, a schedule module, etc. For example, the operation and maintenance product may be used as a functional module in the OA system, or the operation and maintenance product may be used as an independent software system to establish a communication connection with the OA system.

[0074] In this case, the alarm event analysis information can be pushed to the instant messaging module in the OA system in the form of a message card, and pushed in the form of an instant messaging message. In this way, the user is notified of the generation of the first alarm event in a timely manner.

[0075] In this method, the natural language processing capability of the language model is used to generate alarm event analysis information. Since different aggregation rules correspond to different prompt words, the language model can analyze the alarm information of different alarm events in combination with the prompt words corresponding to the aggregation rules. On the one hand, the same aggregation rules correspond to the same analysis ideas, and alarm analysis is performed in combination with the characteristics of the aggregation rules. On the other hand, targeted analysis is performed on the alarm information related to the alarm event. In this way, alarm event analysis information that accurately describes the alarm event is generated, the accuracy and pertinence of the alarm event analysis information are improved, and the efficiency of subsequent alarm handling is improved.

[0076] The foregoing describes the process of generating the alarm event analysis information of the first alarm event. In an embodiment of the present application, it also supports continuously aggregating the alarm information within an alarm aggregation cycle, thereby updating the alarm event analysis information.

[0077] like Figure 2As shown, the user configures the aggregation rules through the front end, and configures the corresponding prompt words for each aggregation rule. The operation and maintenance product continuously obtains alarm information, aggregates the alarm information based on the first aggregation rule, generates a first alarm event, determines at least one first alarm information related to the first alarm event and the prompt word corresponding to the first aggregation rule, and sends at least one first alarm information and the prompt word corresponding to the first aggregation rule to the language model. The language model generates alarm event analysis information, and returns the alarm event analysis information to the operation and maintenance product to display the alarm event analysis information and inform the user of the occurrence of the first alarm event.

[0078] Next, the operation and maintenance product determines whether the alarm aggregation period of the first alarm event has ended. The alarm aggregation period can be understood as a time period for continuously aggregating alarm information to generate an alarm event. When the alarm aggregation period of the first alarm event has not ended, in response to receiving at least one second alarm message in the alarm aggregation period of the first alarm event, the alarm event analysis information is updated according to at least one first alarm message and at least one second alarm message. The second alarm message is alarm information related to the first alarm event, that is, the second alarm message is alarm information that generates the first alarm event, and the second alarm message is generated after the first alarm message.

[0079] That is to say, within the same alarm aggregation cycle, if the alarm information that generates the alarm event is continuously aggregated, as the alarm information increases and the alarm situation changes, the alarm event analysis information will also be dynamically updated, so that the alarm event analysis information can reflect the real-time fault situation.

[0080] Similar to the alarm event analysis information generated for the first alarm event, the updated alarm event analysis information can also be generated with the help of a language model. In specific implementation, at least one first alarm information, at least one second alarm information, a prompt word corresponding to the first aggregation rule, and the alarm event analysis information are sent to the language model, and the updated alarm event analysis information output by the language model is received.

[0081] In other words, after a new alarm event is generated within the same alarm aggregation cycle, the language model uses the prompt capability of the prompt word corresponding to the first aggregation rule to perform aggregation identification and aggregation analysis on at least one first alarm message, at least one second alarm message and the current alarm event analysis information, and updates the alarm event analysis information. In this way, the updated alarm event analysis information can comprehensively describe multiple alarm events generated within an alarm aggregation cycle, and inform the user of the latest status of the alarm event in real time.

[0082] The method for processing alarm events provided in the embodiment of the present application can be executed collaboratively by multiple services. Figure 3As shown, through the interaction between the front end and the configuration service, the aggregation rules and the prompt words corresponding to different aggregation rules are configured. The configured aggregation rules and prompt words can be stored in the relational database service (RDS). When an alarm event is generated, the alarm event management service sends the alarm information of the alarm event and the prompt words corresponding to the aggregation rules to the generative artificial intelligence (AI) service. The language model in the generative AI service generates alarm event analysis information, interacts with the streaming output service, and outputs the alarm event analysis information in the form of streaming output. In addition, the generative AI service can also interact with the notification service to display the alarm event analysis information.

[0083] The following describes the method for processing an alarm event provided by the embodiment of the present application in conjunction with a specific application scenario. Figure 4A and Figure 4B ,exist Figure 4A In the configuration interface 400, the user can configure the aggregation rules. Specifically, the user can choose to create an alarm event for each individual alarm information, or choose to aggregate the alarm information into one alarm event. Further, the user can select different tags (such as data source and alarm priority) to configure the aggregation rules, and configure the alarm aggregation period, such as aggregating the alarm information according to the static event window for 10 minutes, or continuously aggregating the alarm information into the same alarm event until all the alarm information is restored.

[0084] After completing the configuration of the aggregation rules, the user can also configure the relevant content of the alarm event analysis information in the configuration interface 400. When the alarm event analysis information includes the name of the alarm event and the description information of the alarm event, the user can select AI to generate the alarm event name or manually enter the alarm event name, and select AI to generate the alarm event description information or manually enter the alarm event description information. When the user selects AI to generate the alarm event name or AI to generate the alarm event description information, the prompt word configuration control 401 can be triggered to configure the prompt word.

[0085] like Figure 4B As shown, after the prompt word configuration control 401 is triggered, a prompt word configuration window 402 is presented in the configuration interface 400, and the user can enter the prompt word in the prompt word configuration window 402. In addition, the embodiment of the present application also supports online testing of the input prompt word, so that the user can modify the prompt word based on the test result, so that the prompt word is more in line with the actual generation demand.

[0086] FIG. 5A to FIG. 5C This is a schematic diagram of the display interface for alarm event analysis information. Figure 5AIn the display interface 500, the display area 501 for alarm event analysis information and the display area 502 for alarm information are displayed in the form of a list. In the display area 501 for alarm event analysis information, the name of the alarm event displayed is "Abnormal light attenuation of interface A", and the description of the alarm event is "On July 3, 2024, from 15:26 to 16:10, multiple abnormal light attenuation alarms of interface A occurred in different locations, including A, B and C, and the abnormal light attenuation values ​​ranged from -40.0dBm to -5.99dBm". It can be seen that the key information of the alarm event is summarized in the alarm event analysis information, which helps users quickly understand the fault.

[0087] exist Figure 5B In the display interface 500, the display interface 500 includes a display area 503 for alarm event analysis information and a display area 504 for alarm information. In the display area 504 for alarm information, multiple alarm information are displayed in the form of a list. Figure 5B The corresponding prompt word is the prompt word configured by the user, and the user requires the site code to be stated in the name of the alarm event in the prompt word. In the display area 503 of the alarm event analysis information, the name of the alarm event displayed is "Abnormal optical attenuation of interface A at site A", and the description information of the alarm event is "On July 3, 2024, from 15:26 to 16:10, multiple abnormal optical attenuation alarms of interface A at site A occurred, and the abnormal optical attenuation values ​​ranged from -40.0dBm to -5.99dBm". Figure 5A compared to, Figure 5B The name of the alarm event contains the site code to meet the user's personalized generation needs.

[0088] exist Figure 5C In the display interface 500, the display interface 500 includes a display area 505 for alarm event analysis information and a display area 506 for alarm information. In the display area 505 for alarm information, multiple alarm information are displayed in the form of a list. Figure 5C The corresponding prompt word is the prompt word configured by the user, and the user requires in the prompt word that the handling method of the alarm event be explained in the description information of the alarm event. In the display area 505 of the alarm event analysis information, the name of the alarm event displayed is "A cluster status error", and the description information of the alarm event is "An event involving the loss of the A cluster heartbeat occurred at location A. The affected entities are entity A and entity B, and the root cause may be abnormal communication between controllers. To troubleshoot the problem, please follow the steps below: Step A, Step B, ..., Step N". In this way, through the prompt words configured by the user, the generated alarm event analysis information meets different business needs.

[0089] Combination of the above Figure 1Referring to FIG5 , a method for processing an alarm event provided in an embodiment of the present application is introduced in detail. The following will introduce the apparatus and device provided in the embodiment of the present application in conjunction with the accompanying drawings.

[0090] See also Figure 6 The schematic diagram of the structure of the alarm event processing device shown in FIG. 60 includes:

[0091] A determination module 601 is configured to, in response to receiving a first alarm event, determine at least one first alarm information related to the first alarm event and a first aggregation rule corresponding to the first alarm event;

[0092] An analysis module 602 is used to send the at least one first alarm information and the prompt word corresponding to the first aggregation rule to a language model, and receive alarm event analysis information output by the language model;

[0093] The display module 603 is used to display the alarm event analysis information.

[0094] In some possible implementations, the alarm event analysis information includes: the name of the alarm event, and / or description information of the alarm event.

[0095] In some possible implementations, the analysis module 602 is specifically configured to:

[0096] Extracting structured data consisting of an alarm field and an alarm field value from the at least one first alarm information;

[0097] The at least one first alarm information, the structured data and the prompt word corresponding to the first aggregation rule are sent to a language model, and alarm event analysis information output by the language model is received; wherein the alarm event analysis information includes at least one of the structured data.

[0098] In some possible implementations, the apparatus 60 further includes a configuration module, and the configuration module is configured to:

[0099] receiving a prompt word configuration operation, wherein the prompt word configuration operation includes a target aggregation rule selection operation and a target prompt word input operation;

[0100] According to the prompt word configuration operation, a target prompt word of the target aggregation rule is determined.

[0101] In some possible implementations, the target prompt word input operation includes: an input operation of a target prompt word related to the name of the alarm event and an input operation of a target prompt word related to the description information of the alarm event.

[0102] In some possible implementations, the apparatus 60 further includes an updating module, and the updating module is configured to:

[0103] In response to receiving at least one second alarm message in the alarm aggregation period of the first alarm event, the alarm event analysis information is updated according to the at least one first alarm message and the at least one second alarm message; wherein the second alarm information is alarm information related to the first alarm event.

[0104] In some possible implementations, the update module is specifically used to:

[0105] The at least one first alarm information, the at least one second alarm information, the prompt word corresponding to the first aggregation rule, and the alarm event analysis information are sent to the language model, and the updated alarm event analysis information output by the language model is received.

[0106] In some possible implementations, the prompt word corresponding to the first aggregation rule indicates the generation of at least one of the following information:

[0107] The attribute information of the first alarm event, the impact scope of the first alarm event, the severity of the first alarm event, the structured data in the at least one first alarm information, the cause of the first alarm event, the analysis steps of the first alarm event, or the handling method of the first alarm event.

[0108] In some possible implementations, the display module 603 is specifically used to:

[0109] The alarm event analysis information is displayed in the form of a message card.

[0110] In some possible implementations, the first alarm event is generated by the following steps:

[0111] Continuously receive warning information;

[0112] In response to at least one first alarm information in the alarm information hitting a first aggregation rule, a first alarm event is generated.

[0113] The alarm event processing device 60 according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the alarm event processing device 60 are respectively to achieve Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0114] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 6The functions of the device 60 for processing alarm events in the illustrated embodiment.

[0115] Figure 7 A schematic diagram of the structure of an electronic device 700 is provided. Figure 7 As shown, the electronic device 700 includes a bus 701, a processor 702, a communication interface 703 and a memory 704. The processor 702, the memory 704 and the communication interface 703 communicate with each other via the bus 701.

[0116] The bus 701 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0117] The processor 702 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0118] The communication interface 703 is used for communicating with the outside. For example, the communication interface 703 can be used for communicating with a terminal.

[0119] The memory 704 may include a volatile memory, such as a random access memory (RAM). The memory 704 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0120] The memory 704 stores executable codes, and the processor 702 executes the executable codes to perform the aforementioned method for processing the alarm event.

[0121] Specifically, in implementing Figure 6 In the case of the embodiment shown, and Figure 6When each module or unit of the alarm event processing device 60 described in the embodiment is implemented by software, the execution Figure 6 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 704. The processor 702 executes the program code corresponding to each unit stored in the memory 704 to perform the aforementioned method for processing the alarm event.

[0122] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned method for processing an alarm event of the processing device 60 applied to the alarm event.

[0123] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0124] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0125] When the computer program product is executed by a computer, the computer executes any of the aforementioned methods for processing alarm events. The computer program product may be a software installation package, and when any of the aforementioned methods for processing alarm events is required, the computer program product may be downloaded and executed on a computer.

[0126] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0127] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0128] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0129] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0130] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0131] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0132] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0133] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0134] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing an alarm event, characterized in that: The method comprises: In response to receiving a first alarm event, determining at least one first alarm information related to the first alarm event and a first aggregation rule corresponding to the first alarm event; Sending the at least one first alarm information and the prompt word corresponding to the first aggregation rule to a language model, and receiving alarm event analysis information output by the language model; Display the alarm event analysis information.

2. The method according to claim 1, characterized in that The alarm event analysis information includes: the name of the alarm event, and / or description information of the alarm event.

3. The method according to claim 1, characterized in that The sending the at least one first alarm information and the prompt word corresponding to the first aggregation rule to a language model, and receiving the alarm event analysis information output by the language model, includes: Extracting structured data consisting of an alarm field and an alarm field value from the at least one first alarm information; The at least one first alarm information, the structured data and the prompt word corresponding to the first aggregation rule are sent to a language model, and alarm event analysis information output by the language model is received; wherein the alarm event analysis information includes at least one structured data.

4. The method according to claim 1, characterized in that: The method further comprises: receiving a prompt word configuration operation, wherein the prompt word configuration operation includes a target aggregation rule selection operation and a target prompt word input operation; According to the prompt word configuration operation, a target prompt word of the target aggregation rule is determined.

5. The method according to claim 4, characterized in that The input operation of the target prompt word includes: an input operation of the target prompt word related to the name of the alarm event and an input operation of the target prompt word related to the description information of the alarm event.

6. The method according to claim 1, characterized in that The method further comprises: In response to receiving at least one second alarm message in the alarm aggregation period of the first alarm event, the alarm event analysis information is updated according to the at least one first alarm message and the at least one second alarm message; wherein the second alarm information is alarm information related to the first alarm event.

7. The method according to claim 6, characterized in that The updating of the alarm event analysis information according to the at least one first alarm information and the at least one second alarm information includes: The at least one first alarm information, the at least one second alarm information, the prompt word corresponding to the first aggregation rule, and the alarm event analysis information are sent to the language model, and the updated alarm event analysis information output by the language model is received.

8. The method according to claim 1, characterized in that The prompt word corresponding to the first aggregation rule indicates the generation of at least one of the following information: The attribute information of the first alarm event, the impact scope of the first alarm event, the severity of the first alarm event, the structured data in the at least one first alarm information, the cause of the first alarm event, the analysis steps of the first alarm event, or the handling method of the first alarm event.

9. The method according to claim 1, characterized in that: The displaying of the alarm event analysis information includes: The alarm event analysis information is displayed in the form of a message card.

10. The method according to any one of claims 1 to 9, characterized in that: The first alarm event is generated by the following steps: Continuously receive warning information; In response to at least one first alarm information in the alarm information hitting a first aggregation rule, a first alarm event is generated.

11. A device for processing an alarm event, characterized in that: The device comprises: a determination module, configured to determine, in response to receiving a first alarm event, at least one first alarm information related to the first alarm event and a first aggregation rule corresponding to the first alarm event; An analysis module, configured to send the at least one first alarm information and the prompt word corresponding to the first aggregation rule to a language model, and receive alarm event analysis information output by the language model; The display module is used to display the alarm event analysis information.

12. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 10.

Images