Alarm information processing method and device, equipment, storage medium and program product

Abstract

The invention provides an alarm information processing method and device, equipment, a storage medium and a program product, and relates to the technical field of computers. The method comprises the following steps: determining a system blood relationship map corresponding to an abnormal system in an alarm resource pool, and determining an associated system having a blood relationship with the abnormal system according to the system blood relationship map; the alarm resource pool comprises a plurality of pieces of alarm information, and the abnormal system is a system with the alarm information; generating an alarm time sequence set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system; determining root cause alarm information and associated alarm information according to the alarm time sequence set and the blood relationship graph; and executing an exception handling program matched with the root cause alarm information and the associated alarm information. According to the invention, the alarm information processing efficiency can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an alarm information processing method, device, equipment, storage medium and program product. Background Art

[0002] With the construction and popularization of cloud computing, microservices, data bases, data middle platforms, etc., the degree of interaction between application systems is becoming increasingly complex. The calls of services between and within systems have evolved from point-to-point to network-like. The data processing links have become longer and the processing dependencies have become more complex.

[0003] In the above context, access between systems is becoming increasingly complex. Thousands of processes and services may be running within and between clouds, and service calls have evolved from traditional point-to-point and point-to-multipoint to a mesh.

[0004] Currently, when an alarm message appears in the above system, it can only be manually checked by operation and maintenance developers. This process requires the knowledge and experience of the operation and maintenance developers, is inefficient, and cannot quickly and accurately locate the cause of the abnormality. Summary of the invention

[0005] The present application provides an alarm information processing method, device, equipment, storage medium and program product, which can effectively improve the efficiency of alarm information processing.

[0006] In a first aspect, the present application provides a method for processing alarm information, the method comprising:

[0007] Determine the system blood relationship map corresponding to the abnormal system in the alarm resource pool, and determine the associated system that has a blood relationship with the abnormal system according to the system blood relationship map; the above-mentioned alarm resource pool includes multiple alarm information collected within a preset time period, and the above-mentioned abnormal system is a system with alarm information;

[0008] Generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the above-mentioned associated system;

[0009] According to the above alarm time series set and blood relationship map, determine the root cause alarm information and related alarm information;

[0010] Execute the exception handling procedure that matches the above root cause alarm information and the associated alarm information.

[0011] In a possible implementation, the above-mentioned determination of the system blood relationship map corresponding to the abnormal system in the alarm resource pool includes:

[0012] Obtaining configuration information of multiple resource configuration items of the abnormal system from a configuration management database (CMDB); the multiple resource configuration items include at least two of a system server, an operating system, a database, a middleware, and a network device;

[0013] Obtain the interface call relationship between various interfaces of the abnormal system from the interface management platform;

[0014] Determine the online transaction and / or data service transaction that has occurred in the abnormal system, and obtain system resource configuration information in the data link corresponding to the online transaction and / or data service transaction;

[0015] Based on the above configuration information, interface call relationship and system resource configuration information, the above system blood relationship map is determined.

[0016] In a possible implementation, determining the system blood relationship map based on the configuration information, the interface call relationship, and the system resource configuration information includes:

[0017] Determine a first relationship between each resource configuration item according to the above configuration information, and save the first relationship in a graphic database; the first relationship includes at least one of a physical relationship, a real-time communication relationship, a non-real-time communication relationship, or a dependency relationship;

[0018] According to the interface call relationship, determine the full-link interface association relationship corresponding to the abnormal system, and save the full-link interface association relationship in the graphic database;

[0019] Saving the above system resource configuration information to a graphic database;

[0020] Based on the above-mentioned graph database, a system blood relationship map is generated.

[0021] In a possible implementation, the generating of the alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system includes:

[0022] Add the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system to the alarm information collection;

[0023] Based on the occurrence time of each piece of alarm information in the alarm information set, each piece of alarm information in the alarm information set is arranged to obtain an alarm time sequence set.

[0024] In a possible implementation manner, the above-mentioned determining the root cause alarm information and the associated alarm information according to the alarm time series set and the blood relationship map includes:

[0025] Attribution analysis is performed based on the alarm time series set and blood relationship map to determine the root cause alarm information, related alarm information, and the derived dependency relationship of the related alarm information.

[0026] In a possible implementation, the above-mentioned execution of an exception handling program matching the root cause alarm information and the associated alarm information includes:

[0027] Determine the alarm elements of the root cause alarm information and the alarm elements of the associated alarm information;

[0028] Determine the exception handling procedure that matches the alarm element;

[0029] According to the derived dependency relationship between the root cause alarm information and the associated alarm information, the exception handling programs matching the root cause alarm information and the associated alarm information are executed in sequence.

[0030] In a second aspect, the present application provides an alarm information processing device, the device comprising:

[0031] A determination module is used to determine the system blood relationship map corresponding to the abnormal system in the alarm resource pool, and determine the associated system that has a blood relationship with the abnormal system based on the system blood relationship map; the above-mentioned alarm resource pool includes multiple alarm information, and the above-mentioned abnormal system is a system that has alarm information.

[0032] The first processing module is used to generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the above-mentioned associated system.

[0033] The second processing module is used to determine the root cause alarm information and the associated alarm information according to the above alarm time series set and blood relationship map.

[0034] The execution module is used to execute the exception handling program that matches the above-mentioned root cause alarm information and the associated alarm information.

[0035] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0036] The memory stores computer-executable instructions;

[0037] The processor executes the computer-executable instructions stored in the memory to implement the alarm information processing method provided in the first aspect.

[0038] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the alarm information processing method provided in the first aspect.

[0039] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the alarm information processing method provided in the first aspect.

[0040] The alarm information processing method, device, equipment, storage medium and program product provided in the present application provide for determining the system lineage relationship map and the alarm sequence set, and can analyze and diagnose the root cause alarm information and the related alarm information based on the system lineage relationship map and the alarm sequence set. By executing the exception handling program that matches the root cause alarm information and the related alarm information, the intelligent alarm diagnosis and automated alarm handling can be realized. Compared with the traditional technology that relies on manual troubleshooting by operation and maintenance developers, the efficiency of alarm information processing is effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] Figure 1 A flowchart of a method for processing alarm information provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of a process for determining a system blood relationship map provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of the structure of an alarm information processing system provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of a program module for alarm information processing provided in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0047] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0048] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0049] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0050] The following is an explanation of some of the terms involved in the embodiments of the present application:

[0051] 1. Systematic blood relationship map

[0052] The system lineage relationship map is a visual tool or map that can hierarchically display the relationship between resource instances within a single system or between two or more systems based on the key elements in the alarm information. This display can be based on multi-level resource information such as the business application layer, platform resource layer, virtual resource layer, and physical resource layer of the application system. When online transactions or data services occur, the system lineage relationship map can clearly depict the processing and consumption relationship of data between various resource instances.

[0053] 2. Blood relationship within the system

[0054] The intra-system blood relationship refers to the processing and consumption relationship between different resource instances within a system. This relationship describes the entire process of data from the source to the final application within the system, including data reading, processing, storage and transmission.

[0055] 3. Blood relationship between systems

[0056] The blood relationship between systems refers to the data processing and consumption relationship between two or more systems. This relationship describes the flow and conversion process of data between different systems, including the cross-system transmission, processing and application of data.

[0057] During system operation and maintenance, some alarm information is not generated in isolation. It is possible that alarm A triggers alarm B, and alarm B triggers alarm C. Alarms A, B, and C are interrelated, and the root cause occurs in alarm A. This chain alarm is associated from the root cause alarm A to the terminal alarm C.

[0058] The traditional alarm information processing method requires manual investigation by professional operation and maintenance developers, which is inefficient and unable to quickly and accurately locate the cause of the abnormality.

[0059] In view of the above technical problems, an alarm processing method is provided in an embodiment of the present application, which can realize intelligent alarm diagnosis and automated alarm handling, and effectively improve the efficiency of alarm information processing compared to manual investigation by operation and maintenance developers.

[0060] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0061] Reference Figure 1 , Figure 1 The following is a flow chart of a method for processing alarm information provided in an embodiment of the present application. In some embodiments of the present application, the method for processing alarm information includes:

[0062] S101. Determine a system blood relationship map corresponding to an abnormal system in an alarm resource pool, and determine associated systems that have a blood relationship with the abnormal system based on the system blood relationship map.

[0063] The alarm resource pool includes a plurality of alarm information, and the abnormal system is a system having the alarm information.

[0064] In some implementations, the monitoring center can monitor the operating status of each system in real time. When any system has an abnormality, the monitored abnormal information will be displayed and notified in the form of alarm information.

[0065] In some implementations, multiple alarm information collected by the monitoring center within a preset time period may be obtained, and the alarm resource pool may be established based on the obtained multiple alarm information.

[0066] Optionally, the above alarm information includes but is not limited to: alarm number, system number, system name, module name, alarm object, alarm resource, occurrence time, abnormal information description and other elements.

[0067] In some implementations, based on resource information such as the business application layer, platform resource layer, virtual resource layer, and physical resource layer of the application system, a system blood relationship map of the abnormal system in the alarm resource pool can be determined, thereby obtaining associated systems that have a blood relationship with the abnormal system.

[0068] Optionally, the business application layer includes:

[0069] Interface subscription relationship: includes how applications communicate and exchange data through the Application Programming Interface (API).

[0070] Link: This refers to the path along which data flows between applications or services, including the transmission and processing of data.

[0071] Channel: can refer to different paths in business logic or channels for data transmission.

[0072] Optionally, the platform resource layer includes:

[0073] Partitions: include operating system-level partitions, such as Linux partitions or Windows partitions, which are used to manage storage space and resource allocation.

[0074] Middleware: A set of software located between the operating system and application software, providing communication, transaction management, data processing and other services for the application. For example, Web servers (such as Nginx), application servers (such as WAS, i.e. WebSphere Application Server), etc.

[0075] Big data: refers to large-scale data sets and the tools and technologies used to process these data, such as Kafka (message queue), Zookeeper (distributed coordination service), Elasticsearch (search and analysis engine), etc.

[0076] Database: A software system used to store and manage data, such as Oracle (relational database), Redis (memory database), TDSql (distributed database), etc.

[0077] Optionally, the virtual resource layer includes:

[0078] Cloud cluster: A collection of cloud servers used to run and manage virtual resources such as virtual machines and containers.

[0079] Namespaces: In container orchestration platforms such as Kubernetes, namespaces are used to isolate resources in a cluster so that different teams or projects can work independently.

[0080] POD: It is the smallest deployment unit in Kubernetes (application software) and contains one or more containers.

[0081] Optionally, the physical resource layer includes:

[0082] Server: includes personal computer (PC) servers, mainframes, minicomputers, etc., used to run operating systems and application software.

[0083] Network switching equipment: such as switches and routers, used to transmit data between local area networks and wide area networks.

[0084] Storage: Hardware devices used to store data, such as hard disks, solid-state drives, etc.

[0085] Load balancing: refers to a load balancer, which is used to distribute network requests to multiple servers or virtual machines to improve the scalability and performance of the system.

[0086] S102: Generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system.

[0087] In some embodiments, the alarm information corresponding to the above-mentioned abnormal system and the alarm information corresponding to the above-mentioned associated system can be obtained in the alarm resource pool, and the obtained alarm information can be added to the alarm information set; based on the occurrence time of each alarm information in the alarm information set, each alarm information in the alarm information set is arranged to obtain the above-mentioned alarm timing set.

[0088] For example, assume that there are two systems: system A (abnormal system) and system B (related system). They generate the following alarm information respectively:

[0089] System A alarm 1: Occurrence time is 2023-10-01 10:00;

[0090] System B alarm 1: Occurrence time is 2023-10-01 10:15;

[0091] System A alarm 2: Occurrence time is 2023-10-01 10:30;

[0092] System B alarm 2: Occurrence time is 2023-10-01 11:00;

[0093] According to the above steps, the following alarm time series set can be generated:

[0094] {System A alarm 1, system B alarm 1, system A alarm 2, system B alarm 2}.

[0095] The above alarm time series set can clearly show the occurrence order of each alarm information, which is helpful for subsequent analysis and processing.

[0096] S103: Determine the root cause alarm information and related alarm information according to the alarm time series set and the blood relationship map.

[0097] In some implementations, the earliest alarm information can be found in the alarm sequence set, which is usually the starting point of the abnormal problem. Combined with the system lineage relationship map, analyze whether the alarm information is triggered or caused by other alarm information. If no other alarm information triggers it, then it is likely to be the root cause alarm information; if there are multiple possible root cause alarm information, it is necessary to further analyze the correlation and impact between them to determine the most likely root cause alarm information.

[0098] In the system blood relationship graph, we can start from the root cause alarm information and find all the associated alarm information along the edge. By analyzing the order and frequency of occurrence of these associated alarm information in the alarm time series set, we can determine the degree of association between them and the root cause alarm information.

[0099] In some implementations, attribution analysis may also be performed based on the alarm time series set and the blood relationship map to determine the root cause alarm information, associated alarm information, and derived dependencies of the associated alarm information.

[0100] In some implementations, the dual indicators provided by the above-mentioned system lineage relationship map and the alarm time series set can be used to perform attribution analysis to analyze and diagnose the derived dependency relationship of the root cause alarm information and the associated alarm information.

[0101] Exemplarily, the alarm sequence set can be used to construct a timeline of alarm information, analyze the time intervals and potential time dependencies between alarm information, and identify which alarm information occurs immediately after other alarm information in time, which may indicate a direct derivative relationship between them.

[0102] In the system lineage relationship map, starting from the initially screened root cause alarm information, the derived sources and dependencies of the alarm information are traced along the data flow, control flow or dependency path.

[0103] In some embodiments, the alarm information is evaluated comprehensively with dual indicators by combining the time information in the alarm time series set and the logical dependencies in the system lineage relationship map to evaluate the possibility of each alarm information being a root cause alarm information and the derived dependencies between it and other alarm information.

[0104] S104: Execute an exception handling program that matches the root cause alarm information and the associated alarm information.

[0105] Optionally, the above exception handling procedure includes: calling various operation and maintenance services provided by the orchestration operation and maintenance operation center according to the emergency manual or exception handling plan, and / or the exception handling procedure corresponding to the established exception.

[0106] The alarm information processing method, device, equipment, storage medium and program product provided in the present application can analyze and diagnose the root cause alarm information and related alarm information according to the system blood relationship map and alarm timing analysis by depicting the system blood relationship map, and can realize intelligent alarm diagnosis and automatic alarm handling by executing the exception handling program that matches the root cause alarm information and the related alarm information. Compared with the method that relies on manual investigation by operation and maintenance developers, the efficiency of alarm information processing is effectively improved.

[0107] Based on the contents described in the above embodiments, Figure 2 , Figure 2 A schematic diagram of a process for determining a system blood relationship map provided in an embodiment of the present application. In some embodiments of the present application, the system blood relationship map corresponding to the abnormal system in the alarm resource pool is determined, including:

[0108] S201. Obtain configuration information of multiple resource configuration items of an abnormal system from a CMDB.

[0109] Optionally, the above-mentioned multiple resource configuration items include at least two of system servers, operating systems, databases, middleware, and network devices.

[0110] In some implementations, a first relationship between resource configuration items may be determined based on the configuration information, and the first relationship may be saved in a graphic database; the first relationship may include at least one of a physical relationship, a real-time communication relationship, a non-real-time communication relationship, or a dependency relationship.

[0111] The relationship data generated by the analysis is imported into a graph database, in which each resource configuration item can be represented as a node, and the first relationship can be represented as an edge between the nodes.

[0112] S202: Obtain the interface call relationship between the interfaces of the abnormal system from the interface management platform.

[0113] In some implementations, the full-link interface association relationship corresponding to the abnormal system can be determined based on the interface call relationship, and the full-link interface association relationship can be saved in a graphic database.

[0114] In some implementations, based on the interface management platform, the upstream and downstream calling relationships between interfaces can be analyzed, the full-link interface association relationships of the generated systems (within a single system or between multiple systems) can be analyzed and saved in a graphic database.

[0115] S203: Determine the online transaction and / or data service transaction that has occurred in the abnormal system, and obtain system resource configuration information in the data link corresponding to the online transaction and / or data service transaction.

[0116] In some implementations, the online transaction and / or data service type transactions that have occurred and the data links in the online transaction and / or data service type transactions can be identified based on production materials such as system development manuals and system operation and maintenance manuals, and the system resource configuration information (such as data sources, data processing nodes, data storage nodes, etc.) in the data links can be obtained and imported into a graphic database.

[0117] S204. Determine a system blood relationship map based on the above configuration information, interface call relationship and system resource configuration information.

[0118] In some implementations, the above-mentioned system kinship map can be generated based on the above-mentioned graphic database.

[0119] In an embodiment of the present application, by generating the above-mentioned system blood relationship map, the association and dependency relationship between the components within the abnormal system and the flow path of data in the abnormal system can be clearly displayed.

[0120] In some embodiments, the above-mentioned execution of the exception handling program matching the root cause alarm information and the associated alarm information includes:

[0121] Determine the alarm elements of the root cause alarm information and the alarm elements of the associated alarm information; determine the exception handling program that matches the alarm element; and execute the exception handling programs that match the above-mentioned root cause alarm information and the associated alarm information in sequence according to the derived dependency relationship between the root cause alarm information and the associated alarm information.

[0122] For example, refer to Figure 3 , Figure 3 A schematic diagram of the structure of an alarm information processing system provided in an embodiment of the present application.

[0123] In some embodiments, the alarm information processing system includes: an application system, a monitoring platform, a diagnosis center, an operation and maintenance center, a scenario customization center, a scenario verification center, and an abnormal scenario execution control platform.

[0124] In some embodiments, the monitoring platform is used to monitor the operating status and performance indicators of the application system in real time. By collecting and analyzing logs, events and performance data from the application system, the monitoring platform can promptly detect anomalies or potential problems and generate alarm information.

[0125] In some embodiments, the above-mentioned diagnostic center can determine the system blood relationship map corresponding to the abnormal system in the alarm resource pool based on the alarm resource pool, and determine the associated system that has a blood relationship with the abnormal system according to the system blood relationship map; and generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system.

[0126] In some implementations, the scenario customization center may call various operation and maintenance services provided by the operation and maintenance center according to the emergency manual or exception handling plan, and formulate an exception handling strategy that matches the root cause alarm information and related alarm information.

[0127] In some implementations, the scenario verification center is used to match the corresponding abnormal handling scenario. Specifically, the scenario verification center can extract the alarm elements in the root cause alarm information and the associated alarm information, and query and verify the abnormal handling scenario matching the alarm information through the alarm model.

[0128] In some implementations, the above-mentioned abnormal scenario execution control platform can be used to sequentially execute abnormal handling scenarios matching the above-mentioned alarm information according to the derived dependency relationship of the root cause alarm and the associated alarm, thereby realizing intelligent diagnosis and handling of alarms.

[0129] In some implementations, the above-mentioned abnormal scenario execution control platform can be used to provide a unified scheduling control service for the execution of abnormal handling scenarios.

[0130] In this embodiment, by depicting the system blood relationship map, the derived dependency relationship of the root cause alarm and the related alarms is analyzed and diagnosed according to the blood relationship map and the alarm timing analysis, the corresponding exception handling scenario is matched through the scenario verification center, and the exception handling scenario execution control platform is used to execute the exception handling scenarios matching the alarms in sequence according to the derived dependency relationship of the root cause alarm and the related alarms, thereby realizing intelligent fault diagnosis and automated exception handling.

[0131] Based on the contents described in the above embodiments, an alarm information processing device is also provided in the embodiments of the present application. Figure 4 , Figure 4 This is a schematic diagram of a program module for alarm information processing provided in an embodiment of the present application. In some implementations, the alarm information processing device 40 includes:

[0132] Determination module 401 is used to determine the system blood relationship map corresponding to the abnormal system in the alarm resource pool, and determine the associated system that has a blood relationship with the abnormal system based on the system blood relationship map; the above-mentioned alarm resource pool includes multiple alarm information, and the above-mentioned abnormal system is a system with alarm information.

[0133] The first processing module 402 is used to generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the above-mentioned associated system.

[0134] The second processing module 403 is used to determine the root cause alarm information and the associated alarm information according to the above alarm time series set and the blood relationship map.

[0135] The execution module 404 is used to execute the exception handling program that matches the root cause alarm information and the associated alarm information.

[0136] The business data processing device provided in the present application can analyze and diagnose the root cause alarm information and the related alarm information according to the system blood relationship map and the alarm sequence analysis, and can realize intelligent alarm diagnosis and automatic alarm handling by executing the exception handling program that matches the root cause alarm information and the related alarm information. Compared with relying on manual investigation by operation and maintenance developers, the efficiency of alarm information processing is effectively improved.

[0137] In some embodiments, the determination module 401 is specifically used to:

[0138] Obtain configuration information of multiple resource configuration items of the abnormal system from the CMDB; the multiple resource configuration items include at least two of the system server, operating system, database, middleware, and network equipment;

[0139] Obtain the interface call relationship between various interfaces of the abnormal system from the interface management platform;

[0140] Determine the online transaction and / or data service transaction that has occurred in the abnormal system, and obtain system resource configuration information in the data link corresponding to the online transaction and / or data service transaction;

[0141] Based on the above configuration information, interface call relationship and system resource configuration information, the above system blood relationship map is determined.

[0142] In a possible implementation manner, the determination module 401 is specifically configured to:

[0143] Determine a first relationship between each resource configuration item according to the above configuration information, and save the first relationship in a graphic database; the first relationship includes at least one of a physical relationship, a real-time communication relationship, a non-real-time communication relationship, or a dependency relationship;

[0144] According to the interface call relationship, determine the full-link interface association relationship corresponding to the abnormal system, and save the full-link interface association relationship in the graphic database;

[0145] Saving the above system resource configuration information to a graphic database;

[0146] Based on the above-mentioned graph database, a system blood relationship map is generated.

[0147] In a possible implementation, the first processing module 402 is specifically configured to:

[0148] Add the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system to the alarm information collection;

[0149] Based on the occurrence time of each piece of alarm information in the alarm information set, each piece of alarm information in the alarm information set is arranged to obtain an alarm time sequence set.

[0150] In a possible implementation manner, the second processing module 403 is specifically configured to:

[0151] Attribution analysis is performed based on the alarm time series set and blood relationship map to determine the root cause alarm information, related alarm information, and the derived dependency relationship of the related alarm information.

[0152] In a possible implementation, the execution module 404 is specifically configured to:

[0153] Determine the alarm elements of the root cause alarm information and the alarm elements of the associated alarm information;

[0154] Determine the exception handling procedure that matches the alarm element;

[0155] According to the derived dependency relationship between the root cause alarm information and the associated alarm information, the exception handling programs matching the root cause alarm information and the associated alarm information are executed in sequence.

[0156] It should be noted that the specific contents and beneficial effects of the above-mentioned alarm information processing device can be found in the alarm information processing method described in the above-mentioned embodiment, which will not be described in detail here.

[0157] Furthermore, based on the contents described in the above embodiments, an electronic device is also provided in an embodiment of the present application, which includes at least one processor and a memory; wherein the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory to implement each step in the alarm information processing method described in the above embodiments.

[0158] In order to better understand the embodiments of the present application, refer to Figure 5 , Figure 5 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0159] like Figure 5 As shown, the electronic device 50 of this embodiment includes: a processor 501 and a memory 502; wherein:

[0160] Memory 502, used to store computer-executable instructions;

[0161] The processor 501 is used to execute the computer-executable instructions stored in the memory to implement the various steps in the alarm information processing method described in the above embodiment.

[0162] Optionally, the memory 502 may be independent or integrated with the processor 501 .

[0163] When the memory 502 is independently provided, the device further includes a bus 503 for connecting the memory 502 and the processor 501 .

[0164] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, each step in the alarm information processing method described in the above embodiment is implemented.

[0165] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the various steps in the alarm information processing method described in the above embodiment.

[0166] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0167] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0168] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0169] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present application.

[0170] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0171] The memory may include high-speed memory, and may also include non-volatile storage, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0172] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0173] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for processing alarm information, characterized in that: The method comprises: Determine a system blood relationship map corresponding to an abnormal system in an alarm resource pool, and determine an associated system having a blood relationship with the abnormal system according to the system blood relationship map; the alarm resource pool includes a plurality of alarm information, and the abnormal system is a system having the alarm information; Generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system; Determine root cause alarm information and associated alarm information according to the alarm time series set and the blood relationship map; Execute an exception handling program that matches the root cause alarm information and the associated alarm information.

2. The method according to claim 1, characterized in that The system blood relationship map corresponding to the abnormal system in the alarm resource pool is determined, including: Acquire configuration information of multiple resource configuration items of the abnormal system from a configuration management database CMDB; the multiple resource configuration items include at least two of a system server, an operating system, a database, a middleware, and a network device; Acquire the interface call relationship between the various interfaces of the abnormal system from the interface management platform; Determine the online transaction and / or data service transaction that has occurred in the abnormal system, and obtain system resource configuration information in the data link corresponding to the online transaction and / or data service transaction; The system blood relationship map is determined according to the configuration information, the interface call relationship and the system resource configuration information.

3. The method according to claim 2, characterized in that Determining the system blood relationship map according to the configuration information, the interface call relationship and the system resource configuration information includes: Determine, according to the configuration information, a first relationship between each of the resource configuration items, and save the first relationship in a graphic database; the first relationship includes at least one of a physical relationship, a real-time communication relationship, a non-real-time communication relationship, or a dependency relationship; Determine the full-link interface association relationship corresponding to the abnormal system according to the interface call relationship, and save the full-link interface association relationship in the graphic database; Saving the system resource configuration information to the graphic database; Based on the graphic database, the system kinship map is generated.

4. The method according to claim 1, characterized in that: The generating an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system includes: Adding the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system to the alarm information set; Based on the occurrence time of each piece of alarm information in the alarm information set, each piece of alarm information in the alarm information set is arranged to obtain the alarm timing set.

5. The method according to claim 1, characterized in that The determining the root cause alarm information and the associated alarm information according to the alarm time series set and the blood relationship map includes: Attribution analysis is performed based on the alarm time series set and the blood relationship map to determine the root cause alarm information, the associated alarm information, and the derived dependency relationship of the associated alarm information.

6. The method according to claim 5, characterized in that The executing an exception handling program that matches the root cause alarm information and the associated alarm information includes: Determining the alarm elements of the root cause alarm information and the alarm elements of the associated alarm information; Determining an exception handling procedure that matches the alarm element; According to the derived dependency relationship between the root cause alarm information and the associated alarm information, the exception handling programs matching the root cause alarm information and the associated alarm information are executed in sequence.

7. An alarm information processing device, characterized in that: The device comprises: A determination module is used to determine a system blood relationship map corresponding to an abnormal system in an alarm resource pool, and determine an associated system that has a blood relationship with the abnormal system according to the system blood relationship map; the alarm resource pool includes a plurality of alarm information, and the abnormal system is a system that has the alarm information; A first processing module, configured to generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system; A second processing module is used to determine the root cause alarm information and the associated alarm information according to the alarm time series set and the blood relationship map; An execution module is used to execute an exception handling program that matches the root cause alarm information and the associated alarm information.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the alarm information processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the alarm information processing method according to any one of claims 1 to 6.

10. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the alarm information processing method described in any one of claims 1 to 6.

Images