Alarm information processing method and device, equipment, storage medium and program product

Abstract

The application provides an alarm information processing method and device, equipment, storage medium and program product, and relates to the technical field of computers. The method comprises the following steps: determining a system blood relationship graph corresponding to an abnormal system in an alarm resource pool, and determining a related system having a blood relationship with the abnormal system according to the system blood relationship graph. The alarm resource pool comprises a plurality of alarm information, and the abnormal system is a system having alarm information. An alarm time sequence set is generated based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the related system. Root cause alarm information and related alarm information are determined according to the alarm time sequence set and the blood relationship graph. An abnormal processing program matched with the root cause alarm information and the related alarm information is executed. The application can effectively improve the efficiency of alarm information processing.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an alarm information processing method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the development and popularization of cloud computing, microservices, data infrastructure, and data middleware, the degree of interaction between application systems is becoming increasingly complex. The calls between and within systems are evolving from point-like to network-like, and the data processing links are becoming longer and the processing dependencies are becoming more complex.

[0003] Against this backdrop, inter-system access is becoming increasingly complex. Thousands of processes and services may run within and between the clouds, and service calls have evolved from traditional point-to-point and point-to-multipoint to a mesh-like structure.

[0004] Currently, when alarm messages appear in the above systems, the only way to troubleshoot is through manual investigation by operations and maintenance developers. This process relies on the knowledge and experience of operations and maintenance developers, which is inefficient and cannot quickly and accurately locate the cause of the anomaly. Summary of the Invention

[0005] This application provides an alarm information processing method, apparatus, device, storage medium, and program product, which can effectively improve the efficiency of alarm information processing.

[0006] Firstly, this application provides an alarm information processing method, the method comprising:

[0007] Determine the system lineage graph corresponding to the abnormal system in the alarm resource pool, and based on the system lineage graph, determine the related systems that have a lineage relationship with the abnormal system; the alarm resource pool includes multiple alarm information collected within a preset time period, and the abnormal system is the system that has alarm information.

[0008] Based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the above-mentioned related systems, an alarm time sequence set is generated;

[0009] Based on the above alarm timing set and lineage diagram, the root cause alarm information and related alarm information are determined;

[0010] Execute the exception handling procedure that matches the root cause alarm information and related alarm information mentioned above.

[0011] In one possible implementation, the above-mentioned determination of the system lineage map corresponding to the abnormal systems in the alarm resource pool includes:

[0012] Retrieve configuration information for multiple resource configuration items of the abnormal system from the Configuration Management Database (CMDB); the multiple resource configuration items include at least two of the following: system server, operating system, database, middleware, and network device.

[0013] Obtain the interface call relationships between various interfaces of the abnormal system from the interface management platform;

[0014] Determine the online transaction and / or data service transactions that have occurred in the abnormal system, and obtain the system resource configuration information in the data link corresponding to the online transaction and / or data service transaction;

[0015] Based on the above configuration information, interface call relationships, and system resource configuration information, the above system lineage diagram is determined.

[0016] In one possible implementation, determining the system lineage graph based on configuration information, interface call relationships, and system resource configuration information includes:

[0017] Based on the above configuration information, determine the first relationship between each resource configuration item and save the first relationship to the graph database; the first relationship includes at least one of physical relationship, real-time communication relationship, non-real-time communication relationship or dependency relationship;

[0018] Based on the interface call relationship, determine the full-link interface association relationship corresponding to the abnormal system, and save the full-link interface association relationship to the graph database;

[0019] Save the above system resource configuration information to the graphical database;

[0020] Based on the aforementioned graphical database, a phylogenetic relationship map is generated.

[0021] In one possible implementation, the above-mentioned alarm sequence set is generated based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system, including:

[0022] Add the alarm information corresponding to the abnormal system and the alarm information corresponding to the related system to the alarm information set;

[0023] Based on the occurrence time of each alarm in the alarm information set, the alarm information in the alarm information set is arranged to obtain the alarm time sequence set.

[0024] In one possible implementation, determining the root cause alarm information and related alarm information based on the alarm timing set and lineage graph includes:

[0025] Attribution analysis was performed based on alarm time series sets and lineage graphs to identify root cause alarm information, related alarm information, and the derivation dependencies of related alarm information.

[0026] In one possible implementation, the above-mentioned execution of the exception handling procedure matching the root cause alarm information and the associated alarm information includes:

[0027] Determine the alarm elements of root cause alarm information and the alarm elements of related alarm information;

[0028] Determine the exception handling procedures that match the alarm elements;

[0029] Based on the derivation dependencies of root cause alarm information and related alarm information, execute the exception handling procedures that match the root cause alarm information and related alarm information in sequence.

[0030] Secondly, this application provides an alarm information processing device, which includes:

[0031] The determination module is used to determine the system lineage relationship map corresponding to the abnormal system in the alarm resource pool, and to determine the associated systems that have a lineage relationship with the abnormal system based on the system lineage relationship map; the alarm resource pool includes multiple alarm information, and the abnormal system is a system that has alarm information.

[0032] The first processing module is used to generate an alarm sequence set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the above-mentioned related systems.

[0033] The second processing module is used to determine the root cause alarm information and related alarm information based on the above alarm timing set and lineage graph.

[0034] The execution module is used to execute exception handling procedures that match the aforementioned root cause alarm information and related alarm information.

[0035] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0036] The aforementioned memory stores instructions executed by the computer;

[0037] The processor executes the computer execution instructions stored in the memory to implement the alarm information processing method provided in the first aspect.

[0038] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the alarm information processing method provided in the first aspect.

[0039] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the alarm information processing method as provided in the first aspect.

[0040] The alarm information processing method, apparatus, equipment, storage medium, and program products provided in this application provide a way to determine the system lineage graph and alarm timing set. Based on the system lineage graph and alarm timing set, the root cause alarm information and related alarm information can be analyzed and diagnosed. By executing an anomaly handling program that matches the root cause alarm information and related alarm information, intelligent alarm diagnosis and automated alarm handling can be achieved. Compared with the traditional method of relying on manual investigation by operation and maintenance developers, the efficiency of alarm information processing is effectively improved. Attached Figure Description

[0041] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0042] Figure 1 This is a flowchart illustrating an alarm information processing method provided in an embodiment of this application.

[0043] Figure 2 This is a schematic diagram of a process for determining a system kinship map provided in an embodiment of this application;

[0044] Figure 3 This is a schematic diagram of the structure of an alarm information processing system provided in the embodiments of this application;

[0045] Figure 4 This is a schematic diagram of a program module for alarm information processing provided in an embodiment of this application;

[0046] Figure 5 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application.

[0047] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0048] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0049] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0050] The following explains some of the terms used in the embodiments of this application:

[0051] 1. Systemic kinship chart

[0052] A system lineage graph is a visualization tool or diagram that hierarchically displays the resource instance relationships within a single system or between two or more systems based on key elements in alarm information. This display can be based on multi-layered resource information, including the application layer, platform resource layer, virtual resource layer, and physical resource layer of the application system. During online transactions or data services, the system lineage graph clearly depicts the processing and consumption relationships of data among various resource instances.

[0053] 2. Blood relations within the system

[0054] Intra-system lineage refers to the processing and consumption relationships of data among different resource instances within a system. This relationship describes the entire process of data moving within the system from its source to its final application, including all stages such as data reading, processing, storage, and transmission.

[0055] 3. Blood relations between systems

[0056] Inter-system lineage refers to the data processing and consumption relationship between two or more systems. This relationship describes the flow and transformation of data between different systems, including cross-system data transmission, processing, and application.

[0057] During system operation and maintenance, some alarms are not generated in isolation. Alarm A may trigger alarm B, which in turn triggers alarm C. Alarms A, B, and C are interconnected, with the root cause of the problem occurring in alarm A. This chain of alarms links from the root cause alarm A to the final alarm C.

[0058] Traditional alarm information processing methods rely on manual troubleshooting by various professional operation and maintenance developers, which is inefficient and cannot quickly and accurately locate the cause of the anomaly.

[0059] To address the aforementioned technical issues, this application provides an alarm processing method that enables intelligent alarm diagnosis and automated alarm handling. Compared to relying on manual troubleshooting by maintenance and development personnel, this method effectively improves the efficiency of alarm information processing.

[0060] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0061] Reference Figure 1 , Figure 1 This is a flowchart illustrating an alarm information processing method provided in an embodiment of this application. In some embodiments of this application, the alarm information processing method includes:

[0062] S101. Determine the system lineage map corresponding to the abnormal system in the alarm resource pool, and determine the related systems that have a lineage relationship with the abnormal system based on the system lineage map.

[0063] The alarm resource pool mentioned above includes multiple alarm messages, and the abnormal system mentioned above is the system that contains the alarm messages.

[0064] In some implementations, the monitoring center can monitor the operating status of each system in real time, and when any system experiences an anomaly, the detected anomaly information will be displayed and notified via alarm messages.

[0065] In some implementations, multiple alarm messages collected by the monitoring center within a preset time period can be acquired, and the aforementioned alarm resource pool can be established based on the acquired multiple alarm messages.

[0066] Optionally, the alarm information mentioned above may include, but is not limited to, elements such as: alarm number, system number, system name, module name, alarm object, alarm resource, occurrence time, and description of abnormal information.

[0067] In some implementations, the system lineage graph of abnormal systems in the alarm resource pool can be determined based on resource information such as the business application layer, platform resource layer, virtual resource layer, and physical resource layer of the application system, thereby obtaining the associated systems that have a lineage relationship with the abnormal systems.

[0068] Optionally, the above-mentioned business application layer includes:

[0069] Interface subscription relationship: This includes how applications communicate and exchange data through Application Programming Interfaces (APIs).

[0070] Link: can refer to the path through which data flows between applications or services, including the data transmission and processing processes.

[0071] Channel: can refer to different paths or data transmission channels in business logic.

[0072] Optionally, the above platform resource layer includes:

[0073] Partitions: These include operating system-level partitions, such as Linux partitions or Windows partitions, used to manage storage space and resource allocation.

[0074] Middleware: A set of software located between the operating system and application software, providing services such as communication, transaction management, and data processing for applications. Examples include web servers (such as Nginx) and application servers (such as WAS, i.e., WebSphere Application Server).

[0075] Big data refers to large-scale datasets and the tools and technologies used to process this data, such as Kafka (message queue), Zookeeper (distributed coordination service), and Elasticsearch (search and analytics engine).

[0076] Database: A software system used to store and manage data, such as Oracle (relational database), Redis (in-memory database), TDSql (distributed database), etc.

[0077] Optionally, the aforementioned virtual resource layer includes:

[0078] Cloud cluster: A collection of cloud servers used to run and manage virtual resources such as virtual machines and containers.

[0079] Namespaces: In container orchestration platforms such as Kubernetes, namespaces are used to isolate resources in a cluster so that different teams or projects can work independently.

[0080] POD: The smallest unit of deployment in Kubernetes (application software), containing one or more containers.

[0081] Optionally, the aforementioned physical resource layer includes:

[0082] Servers: including personal computer (PC) servers, mainframes, minicomputers, etc., are used to run operating systems and application software.

[0083] Network switching equipment, such as switches and routers, is used to transmit data between local area networks (LANs) and wide area networks (WANs).

[0084] Storage device: A hardware device used to store data, such as hard disks and solid-state drives.

[0085] Load balancing: refers to a load balancer, which is used to distribute network requests to multiple servers or virtual machines to improve the scalability and performance of a system.

[0086] S102. Based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system, generate an alarm sequence set.

[0087] In some implementations, alarm information corresponding to the abnormal system and alarm information corresponding to the associated system can be obtained from the alarm resource pool, and the obtained alarm information can be added to the alarm information set. Based on the occurrence time of each alarm information in the alarm information set, the alarm information in the alarm information set can be arranged to obtain the alarm time sequence set.

[0088] For example, suppose there are two systems: System A (the anomalous system) and System B (the related system). They each generated the following alarm messages:

[0089] System A Alarm 1: Occurred at 10:00 on October 1, 2023;

[0090] System B Alarm 1: Occurred at 10:15 on October 1, 2023;

[0091] System A Alarm 2: Occurred at 10:30 on October 1, 2023;

[0092] System B Alarm 2: Occurred at 11:00 on October 1, 2023;

[0093] Following the steps above, the following alarm sequence set can be generated:

[0094] {System A alarm 1, System B alarm 1, System A alarm 2, System B alarm 2}.

[0095] The alarm sequence set described above clearly shows the order in which each alarm message occurs, which is helpful for subsequent analysis and processing.

[0096] S103. Based on the alarm timing set and lineage diagram, determine the root cause alarm information and related alarm information.

[0097] In some implementations, the earliest alarm message can be found in the alarm sequence set, which is usually the starting point of the anomaly. Combined with the system lineage diagram, it can be analyzed whether the alarm message was triggered or caused by other alarm messages. If no other alarm message triggered it, then it is likely the root cause alarm message. If multiple possible root cause alarm messages exist, further analysis of their correlation and degree of influence is needed to determine the most likely root cause alarm message.

[0098] In the system lineage graph, starting from the root cause alarm information, all associated alarm information can be found along the edges. By analyzing the order and frequency of these associated alarm information in the alarm time series, the degree of association between them and the root cause alarm information can be determined.

[0099] In some implementations, attribution analysis can also be performed based on alarm timing sets and lineage graphs to determine root cause alarm information, related alarm information, and the derivation dependencies of related alarm information.

[0100] In some implementations, the dual indicators provided by the above-mentioned system lineage graph and alarm timing set can be used to perform attribution analysis, analyze and diagnose the root cause alarm information and the derivative dependency relationship of related alarm information.

[0101] For example, alarm sequence sets can be used to construct a timeline of alarm information, analyze the time intervals and potential time dependencies between alarm information, and identify which alarm information occurs immediately after other alarm information in time, which may indicate that there is a direct derivation relationship between them.

[0102] In the system lineage graph, starting from the root cause alarm information initially screened, the derivation source and dependency relationship of alarm information are traced along the data flow, control flow or dependency path.

[0103] In some implementations, alarm information is evaluated using a dual-indicator comprehensive assessment, combining the time information in the alarm timing set and the logical dependencies in the system lineage graph. This assessment evaluates the likelihood of each alarm information being a root cause alarm information, as well as its derivative dependencies with other alarm information.

[0104] S104. Execute the exception handling procedure that matches the root cause alarm information and related alarm information.

[0105] Optionally, the above-mentioned anomaly handling procedures include: invoking various operation and maintenance services provided by the orchestration and operation center, and / or the anomaly handling procedures corresponding to the established anomalies, according to the emergency manual or anomaly handling plan.

[0106] The alarm information processing method, apparatus, equipment, storage medium, and program products provided in this application, by depicting the system lineage diagram, can analyze and diagnose root cause alarm information and related alarm information based on the system lineage diagram and alarm timing analysis. By executing the anomaly handling program that matches the root cause alarm information and related alarm information, intelligent alarm diagnosis and automated alarm handling can be achieved. Compared with the method of relying on manual investigation by operation and maintenance developers, the efficiency of alarm information processing is effectively improved.

[0107] Based on the content described in the above embodiments, referring to Figure 2 , Figure 2 This is a flowchart illustrating a process for determining a system lineage graph as provided in an embodiment of this application. In some embodiments of this application, the process of determining the system lineage graph corresponding to the abnormal system in the alarm resource pool includes:

[0108] S201. Obtain configuration information for multiple resource configuration items of the abnormal system from the CMDB.

[0109] Optionally, the above resource configuration items include at least two of the following: system server, operating system, database, middleware, and network device.

[0110] In some implementations, a first relationship between each resource configuration item can be determined based on the above configuration information, and the first relationship can be saved to a graph database; the first relationship includes at least one of physical relationship, real-time communication relationship, non-real-time communication relationship or dependency relationship.

[0111] The generated relational data is imported into a graph database, where each resource configuration item can be represented as a node, and the first relation can be represented as an edge between nodes.

[0112] S202. Obtain the interface call relationships between various interfaces of the abnormal system from the interface management platform.

[0113] In some implementations, the full-link interface association relationship corresponding to the abnormal system can be determined based on the interface call relationship, and the full-link interface association relationship can be saved to a graphical database.

[0114] In some implementations, the upstream and downstream call relationships between interfaces can be analyzed based on the interface management platform, and the full-link interface association relationships of the generation system (within a single system or between multiple systems) can be analyzed and saved to a graphical database.

[0115] S203. Determine the online transaction and / or data service transactions that have occurred in the abnormal system, and obtain the system resource configuration information in the data link corresponding to the online transaction and / or data service transaction.

[0116] In some implementations, based on production data such as system development manuals and system operation and maintenance manuals, the online transaction and / or data service transactions that have occurred, as well as the data links in the online transaction and / or data service transactions, can be identified, and the configuration information of each system resource in the data link (such as data source, data processing node, data storage node, etc.) can be obtained and imported into a graphical database.

[0117] S204. Based on the above configuration information, interface call relationships, and system resource configuration information, determine the system lineage diagram.

[0118] In some implementations, the aforementioned kinship map can be generated based on the aforementioned graphical database.

[0119] In this embodiment of the application, by generating the above-mentioned system lineage map, the association and dependency relationships between various components within the abnormal system, as well as the data flow path within the abnormal system, can be clearly displayed.

[0120] In some embodiments, the execution of the exception handling procedure that matches the root cause alarm information and the associated alarm information includes:

[0121] Determine the alarm elements of the root cause alarm information and the alarm elements of the related alarm information; determine the exception handling procedure that matches the alarm element; and execute the exception handling procedure that matches the root cause alarm information and the related alarm information in sequence according to the derivation dependency relationship between the root cause alarm information and the related alarm information.

[0122] For example, refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of an alarm information processing system provided in the embodiments of this application.

[0123] In some implementations, the alarm information processing system includes: an application system, a monitoring platform, a diagnostic center, an operation and maintenance center, a scenario customization center, a scenario verification center, and an abnormal scenario execution control platform.

[0124] In some implementations, the aforementioned monitoring platform is used to monitor the operational status and performance metrics of application systems in real time. By collecting and analyzing logs, events, and performance data from application systems, the monitoring platform can promptly detect anomalies or potential problems and generate alarm information.

[0125] In some implementations, the diagnostic center can determine the system lineage graph corresponding to the abnormal system in the alarm resource pool based on the alarm resource pool, determine the associated systems that have a lineage relationship with the abnormal system based on the system lineage graph, and generate an alarm time series set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system.

[0126] In some implementations, the scenario customization center can, based on the emergency manual or anomaly handling plan, call various operation and maintenance services provided by the operation and maintenance center to formulate anomaly handling strategies that match the root cause alarm information and related alarm information.

[0127] In some implementations, the scenario verification center is used to match corresponding anomaly handling scenarios. Specifically, the scenario verification center can extract alarm elements from the root cause alarm information and related alarm information, and use the alarm model to query and verify anomaly handling scenarios that match the alarm information.

[0128] In some implementations, the above-mentioned abnormal scenario execution control platform can be used to sequentially execute abnormal handling scenarios that match the alarm information according to the derivation dependency relationship between the root cause alarm and the related alarm, thereby realizing intelligent diagnosis and handling of alarms.

[0129] In some implementations, the aforementioned abnormal scenario execution control platform can be used to provide unified scheduling and control services for the execution of abnormal handling scenarios.

[0130] In this embodiment, by depicting the system lineage graph, and based on the lineage graph and alarm timing analysis, the root cause alarm and the derived dependency relationship of related alarms are analyzed and diagnosed. The corresponding abnormal handling scenario is matched by the scenario verification center, and the abnormal scenario execution control platform executes the abnormal handling scenario that matches the alarm in sequence according to the derived dependency relationship of the root cause alarm and related alarms, thereby realizing intelligent fault diagnosis and automated abnormal handling.

[0131] Based on the content described in the above embodiments, this application also provides an alarm information processing device, referring to... Figure 4 , Figure 4 This is a schematic diagram of a program module for alarm information processing provided in an embodiment of this application. In some embodiments, the alarm information processing device 40 includes:

[0132] The determination module 401 is used to determine the system lineage relationship map corresponding to the abnormal system in the alarm resource pool, and to determine the associated systems that have a lineage relationship with the abnormal system based on the system lineage relationship map; the alarm resource pool includes multiple alarm information, and the abnormal system is a system that has alarm information.

[0133] The first processing module 402 is used to generate an alarm sequence set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the above-mentioned related system.

[0134] The second processing module 403 is used to determine the root cause alarm information and related alarm information based on the above alarm timing set and lineage graph.

[0135] The execution module 404 is used to execute an exception handling procedure that matches the aforementioned root cause alarm information and related alarm information.

[0136] The business data processing device provided in this application can analyze and diagnose root cause alarm information and related alarm information based on the system lineage diagram and alarm timing analysis. By executing the anomaly handling program that matches the root cause alarm information and related alarm information, it can realize intelligent alarm diagnosis and automated alarm handling. Compared with relying on manual investigation by operation and maintenance developers, it effectively improves the efficiency of alarm information processing.

[0137] In some embodiments, the determining module 401 is specifically used for:

[0138] Retrieve configuration information for multiple resource configuration items of the abnormal system from the CMDB; the multiple resource configuration items include at least two of the following: system server, operating system, database, middleware, and network device;

[0139] Obtain the interface call relationships between various interfaces of the abnormal system from the interface management platform;

[0140] Identify the online transaction and / or data service transactions that have occurred in the abnormal system, and obtain the system resource configuration information in the data link corresponding to the online transaction and / or data service transaction;

[0141] Based on the above configuration information, interface call relationships, and system resource configuration information, the above system lineage diagram is determined.

[0142] In one possible implementation, the determining module 401 is specifically used for:

[0143] Based on the above configuration information, determine the first relationship between each resource configuration item and save the first relationship to the graph database; the first relationship includes at least one of physical relationship, real-time communication relationship, non-real-time communication relationship or dependency relationship;

[0144] Based on the interface call relationship, determine the full-link interface association relationship corresponding to the abnormal system, and save the full-link interface association relationship to the graph database;

[0145] Save the above system resource configuration information to the graphical database;

[0146] Based on the aforementioned graphical database, a phylogenetic relationship map is generated.

[0147] In one possible implementation, the first processing module 402 is specifically used for:

[0148] Add the alarm information corresponding to the abnormal system and the alarm information corresponding to the related system to the alarm information set;

[0149] Based on the occurrence time of each alarm in the alarm information set, the alarm information in the alarm information set is arranged to obtain the alarm time sequence set.

[0150] In one possible implementation, the second processing module 403 is specifically used for:

[0151] Attribution analysis was performed based on alarm time series sets and lineage graphs to identify root cause alarm information, related alarm information, and the derivation dependencies of related alarm information.

[0152] In one possible implementation, execution module 404 is specifically used for:

[0153] Determine the alarm elements of root cause alarm information and the alarm elements of related alarm information;

[0154] Determine the exception handling procedures that match the alarm elements;

[0155] Based on the derivation dependencies of root cause alarm information and related alarm information, execute the exception handling procedures that match the root cause alarm information and related alarm information in sequence.

[0156] It should be noted that the specific content and beneficial effects of the alarm information processing device described above can be found in the alarm information processing method described in the above embodiments, and will not be repeated here.

[0157] Furthermore, based on the content described in the above embodiments, this application also provides an electronic device, which includes at least one processor and a memory; wherein the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory to implement the various steps in the alarm information processing method described in the above embodiments.

[0158] To better understand the embodiments of this application, please refer to... Figure 5 , Figure 5 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application.

[0159] like Figure 5 As shown, the electronic device 50 of this embodiment includes: a processor 501 and a memory 502; wherein:

[0160] Memory 502 is used to store instructions executed by the computer;

[0161] The processor 501 is configured to execute computer execution instructions stored in the memory to implement the various steps in the alarm information processing method described in the above embodiments.

[0162] Alternatively, the memory 502 can be either standalone or integrated with the processor 501.

[0163] When the memory 502 is set up independently, the device also includes a bus 503 for connecting the memory 502 and the processor 501.

[0164] This application provides a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the various steps of the alarm information processing method described in the above embodiments.

[0165] This application provides a computer program product, including a computer program that, when executed by a processor, implements the various steps of the alarm information processing method described in the above embodiments.

[0166] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0167] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0168] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0169] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0170] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0171] The memory may include high-speed memory, and may also include non-volatile memory, such as at least one disk storage device, and may also be a USB flash drive, portable hard drive, read-only memory, disk or optical disc, etc.

[0172] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0173] The aforementioned storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for processing alarm information, characterized in that, The method includes: A system lineage graph corresponding to the abnormal system in the alarm resource pool is determined, and related systems that have a lineage relationship with the abnormal system are determined based on the system lineage graph; the alarm resource pool includes multiple alarm information, and the abnormal system is the system that contains the alarm information; The process of determining the system lineage graph corresponding to the abnormal systems in the alarm resource pool includes: The configuration information of multiple resource configuration items of the abnormal system is obtained from the configuration management database CMDB; the multiple resource configuration items include at least two of the following: system server, operating system, database, middleware, and network device. Obtain the interface call relationships between the various interfaces of the abnormal system from the interface management platform; Determine the online transaction transactions and / or data service transactions that have occurred in the abnormal system, and obtain the system resource configuration information in the data link corresponding to the online transaction transactions and / or data service transactions; Based on the configuration information, the interface call relationships, and the system resource configuration information, the system lineage graph is determined; Based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system, an alarm time sequence set is generated; Attribution analysis is performed based on the alarm time series set and the kinship map to determine the root cause alarm information and related alarm information; Execute the exception handling procedure that matches the root cause alarm information and the associated alarm information.

2. The method according to claim 1, characterized in that, The step of determining the system lineage graph based on the configuration information, the interface call relationships, and the system resource configuration information includes: Based on the configuration information, a first relationship between each of the resource configuration items is determined, and the first relationship is saved to the graph database; the first relationship includes at least one of physical relationship, real-time communication relationship, non-real-time communication relationship, or dependency relationship. Based on the interface call relationship, determine the full-link interface association relationship corresponding to the abnormal system, and save the full-link interface association relationship to the graph database; The system resource configuration information is saved to the graphics database; Based on the graph database, a bloodline relationship map of the system is generated.

3. The method according to claim 1, characterized in that, The alarm time sequence set is generated based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system, including: Add the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system to the alarm information set; Based on the occurrence time of each alarm in the alarm information set, the alarm information in the alarm information set is arranged to obtain the alarm time sequence set.

4. The method according to claim 1, characterized in that, The step of determining root cause alarm information and associated alarm information based on the alarm time series set and the kinship graph includes: Attribution analysis is performed based on the alarm time series set and the lineage graph to determine the root cause alarm information, the associated alarm information, and the derivation dependency relationship of the associated alarm information.

5. The method according to claim 4, characterized in that, The execution of the exception handling procedure that matches the root cause alarm information and the associated alarm information includes: Determine the alarm elements of the root cause alarm information and the alarm elements of the associated alarm information; Determine the exception handling procedure that matches the alarm element; Based on the derivation dependency relationship between the root cause alarm information and the associated alarm information, the exception handling procedures that match the root cause alarm information and the associated alarm information are executed sequentially.

6. An alarm information processing device, characterized in that, The device includes: The determination module is used to determine the system lineage relationship map corresponding to the abnormal system in the alarm resource pool, and to determine the associated systems that have a lineage relationship with the abnormal system based on the system lineage relationship map; the alarm resource pool includes multiple alarm information, and the abnormal system is the system that contains the alarm information; The determining module is specifically used to obtain configuration information of multiple resource configuration items of the abnormal system from the configuration management database CMDB; the multiple resource configuration items include at least two of the following: system server, operating system, database, middleware, and network device; Obtain the interface call relationships between the various interfaces of the abnormal system from the interface management platform; Determine the online transaction transactions and / or data service transactions that have occurred in the abnormal system, and obtain the system resource configuration information in the data link corresponding to the online transaction transactions and / or data service transactions; Based on the configuration information, the interface call relationships, and the system resource configuration information, the system lineage graph is determined; The first processing module is used to generate an alarm sequence set based on the alarm information corresponding to the abnormal system and the alarm information corresponding to the associated system; The second processing module is used to determine the root cause alarm information and related alarm information based on the alarm timing set and the kinship graph. The execution module is used to execute an exception handling procedure that matches the root cause alarm information and the associated alarm information.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the alarm information processing method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the alarm information processing method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the alarm information processing method according to any one of claims 1-5.

Images