Alarm information management method and device, electronic equipment and storage medium

Abstract

The invention discloses an alarm information management method and device, electronic equipment and a storage medium, and relates to the field of financial science and technology, and the method comprises the steps: obtaining an effective data field of each piece of alarm information in an alarm record; wherein the effective data field comprises an application name, event content, first triggering time and current triggering time; deleting repeated alarm information in the alarm record according to the effective data field; according to the event content, obtaining an event type of each piece of alarm information; and displaying an alarm statistical result of the alarm record according to the event type and the application name. According to the technical scheme of the embodiment of the invention, the display and management of the multi-dimensional alarm information are realized, the display effect of the alarm statistical information is improved, meanwhile, the interference of repeated alarm information on the alarm statistical result is avoided, and the accuracy of the alarm statistical result is ensured.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular to an alarm information management method, device, electronic device and storage medium. Background Art

[0002] With the continuous development of computer technology, the monitoring functions of various applications in business systems are also constantly improving, which has brought about a large number of monitoring alarms. How to count and manage monitoring alarms in business systems has become a focus of attention.

[0003] In the prior art, monitoring alarm management in business systems is usually based on a single dimension (eg, the number of alarms), which counts alarm information of various applications within a certain period of time and then displays it in a bar chart or other common chart formats.

[0004] However, with this display method, business personnel can only obtain the alarm data of the application in a single dimension, but cannot obtain the specific alarm information. The information display effect is poor. At the same time, there is often a lot of interference information in the alarm information, and the above statistical method has a large statistical error. Summary of the invention

[0005] The present invention provides an alarm information management method, device, electronic device and storage medium to solve the problem that the alarm information statistics method is single and the information display effect is poor.

[0006] According to one aspect of the present invention, there is provided an alarm information management method, comprising:

[0007] Obtain the valid data fields of each alarm information in the alarm record; wherein the valid data fields include application name, event content, first trigger time and current trigger time;

[0008] Deleting duplicate alarm information in the alarm record according to the valid data field;

[0009] According to the event content, obtaining the event type of each of the alarm information;

[0010] According to the event type and the application name, the alarm statistics of the alarm record are displayed.

[0011] The method of displaying the alarm statistics of the alarm record according to the event type and the application name includes: obtaining a first quantity change curve of the alarm information of the first event type in the first application name, and a second quantity change curve of the alarm information of the second event type in the first application name; if it is determined that there is a second line segment in the second quantity change curve that matches the first line segment in the first quantity change curve, correcting the number of alarm information in the second line segment according to the number of alarm information in the first line segment; wherein the first line segment and the second line segment are equal in duration, have the same change trend, and have a first time threshold interval between starting times; and displaying the alarm statistics of the alarm record according to the corrected number of alarm information.

[0012] The method of displaying the alarm statistics of the alarm record according to the event type and the application name includes: obtaining a third quantity change curve of the alarm information of the third event type in the second application name, and a fourth quantity change curve of the alarm information of the third event type in the third application name; if it is determined that there is a fourth line segment in the fourth quantity change curve that matches the third line segment in the third quantity change curve, correcting the number of alarm information of the fourth line segment according to the number of alarm information of the third line segment; wherein the fourth line segment is equal to the third line segment in duration, has the same change trend, and has a starting time interval of a second time threshold; and displaying the alarm statistics of the alarm record according to the corrected number of alarm information.

[0013] The alarm statistics of the alarm record are displayed according to the event type and the application name, including: obtaining the risk level of each application under different event types according to the number of alarm information and alarm days of each application under different event types.

[0014] The acquiring the event type of each alarm information according to the event content includes: acquiring event keywords in the event content through regular expressions, and acquiring the event type of the current alarm information according to the event keywords.

[0015] The method of obtaining the event keywords in the event content by using a regular expression includes: obtaining each event keyword in the event content in turn according to a first regular expression; wherein the first regular expression includes a plurality of matching strings; if the downstream event keyword is not obtained within a specified number of characters after the current event keyword, the downstream event keyword is configured as a null value, and other event keywords are continued to be obtained; and the event content is traversed again by using a second regular expression that matches the downstream event keyword to obtain the downstream event keyword; wherein the second regular expression includes a matching string.

[0016] According to another aspect of the present invention, there is provided an alarm information management device, comprising:

[0017] The data field acquisition module is used to obtain the valid data fields of each alarm information in the alarm record; wherein the valid data fields include the application name, event content, first trigger time and current trigger time;

[0018] An alarm information deletion module, used to delete duplicate alarm information in the alarm record according to the valid data field;

[0019] An event type acquisition module, used to acquire the event type of each alarm information according to the event content;

[0020] The statistical result acquisition module is used to display the alarm statistical results of the alarm record according to the event type and the application name.

[0021] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0022] at least one processor; and

[0023] a memory communicatively connected to the at least one processor; wherein,

[0024] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm information management method described in any embodiment of the present invention.

[0025] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm information management method described in any embodiment of the present invention when executed.

[0026] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the alarm information management method according to any embodiment of the present invention is implemented.

[0027] The technical solution of the embodiment of the present invention first obtains the valid data fields of each alarm information in the alarm record, then deletes the duplicate alarm information in the alarm record according to the valid data fields, and then obtains the event type of each alarm information according to the event content, and finally obtains the alarm statistics of the alarm record according to the event type and application name; in this way, multi-dimensional display and management of alarm information are realized through event type and application name, the display effect of alarm statistics information is improved, and at the same time, interference of duplicate alarm information on alarm statistics results is avoided, thereby ensuring the accuracy of alarm statistics results.

[0028] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 is a flow chart of an alarm information management method provided according to Embodiment 1 of the present invention;

[0031] Figure 2 is a flow chart of another alarm information management method provided according to Embodiment 2 of the present invention;

[0032] Figure 3 is a flowchart of another alarm information management method provided according to Embodiment 3 of the present invention;

[0033] Figure 4 is a structural diagram of an alarm information management device provided according to a fourth embodiment of the present invention;

[0034] Figure 5 It is a structural schematic diagram of an electronic device for implementing the alarm information management method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] Embodiment 1

[0038] Figure 1 This is a flowchart of an alarm information management method provided in the first embodiment of the present invention. This embodiment can be applied to display alarm records through multi-dimensional alarm statistics. The method can be executed by the alarm information management device in any embodiment of the present invention. The alarm information management device can be implemented in the form of hardware and / or software. The alarm information management device can be configured in electronic devices such as servers. Figure 1 As shown, the method includes:

[0039] S101. Acquire valid data fields of each alarm information in the alarm record; wherein the valid data fields include application name, event content, first trigger time and current trigger time.

[0040] An alarm record is a collection of alarm information obtained by the monitoring system over a period of time in the past. For example, in units of "weeks", the monitoring system sends last week's alarm records to the server at dawn every Monday. The alarm information in the alarm record can exist in the form of data rows, and one or more data rows represent one alarm message. The alarm information includes multiple different fields. After obtaining the alarm record, the server extracts the application name field, event content field, first trigger time field, and current trigger time field in each alarm message.

[0041] The application name indicates the name of the application that issued the alarm information, that is, the source of the alarm information; the event content describes the specific alarm content of the alarm information; among them, for one alarm content, the application may issue multiple alarm messages continuously, and the above multiple alarm messages are actually issued by the current application for the same alarm content, but based on the different alarm mechanisms of each application (for example, the preset alarm cycle), multiple alarm messages are issued continuously or at intervals; the first trigger time indicates the triggering time of the first alarm message of the multiple alarm messages to which the current alarm message belongs; the current trigger time indicates the triggering time of the current alarm message.

[0042] If the first triggering time of an alarm message is the same as the current triggering time, it means that there is no other alarm message that is repeatedly issued for this alarm message, or this alarm message is the first message among multiple alarm messages that are repeatedly issued; if the first triggering time of an alarm message is different from the current triggering time, it means that there is other alarm message that is repeatedly issued for this alarm message, and this alarm message is not the first message among multiple alarm messages that are repeatedly issued.

[0043] S102: Delete duplicate alarm information in the alarm record according to the valid data field.

[0044] If the application names, event contents and first triggering times of multiple alarm messages are all the same, it means that the above-mentioned multiple alarm messages are repeated alarm messages, and the alarm message whose first triggering time is the same as the current triggering time among the above-mentioned multiple alarm messages will be taken as the first alarm message, that is, the alarm message with the earliest triggering time among the above-mentioned multiple alarm messages will be taken as the first alarm message. Only the first alarm message will be retained, and the other alarm messages among the above-mentioned multiple alarm messages will be deleted as duplicate messages.

[0045] For example, the valid data fields of each alarm information in the alarm record can be added to the data table of the database (for example, Oracle database), and each alarm information can be grouped according to the application name, event content and first trigger time. In the alarm information group with a count greater than 1, only the alarm information with the smallest value in "Rownum" is retained, and the remaining duplicate information is deleted according to "Rownum"; wherein, "Rownum" is a pseudo data column in the Oracle database, which is used to represent the row sequence number in the current display result.

[0046] S103: Acquire the event type of each alarm information according to the event content.

[0047] The event type is the type of alarm event in the alarm information, and is also the basis for classifying the alarm information. It can be pre-divided into different types based on business requirements and system configurations. For example, the availability of the application can be monitored from the perspective of whether the remaining available resources of the application meet the business processing requirements, and the alarm information issued by the monitoring system is an availability alarm. The specified type of business (for example, transaction business) can also be monitored from the perspective of business type, and the alarm issued by the monitoring system is a transaction alarm.

[0048] Identification and classification of event content can be performed through a pre-configured text classification model to determine the event type to which the current alarm information belongs based on the event content; wherein the text classification model is constructed based on an artificial neural network (ANN) and is pre-trained through labeled training samples to enable it to have text recognition and classification functions; the text classification model can include an XLNet model, an ERNIE model, a BPT model, and a NABoE model, etc.; in the embodiment of the present invention, the structure of the text classification model is not specifically limited; in addition, keywords extracted from the event content can also be matched with keywords under different event types through keyword matching, and the matching event type can be determined based on the keyword hit results.

[0049] Optionally, in an embodiment of the present invention, obtaining the event type of each alarm message according to the event content includes: obtaining event keywords in the event content through a regular expression, and obtaining the event type of the current alarm message according to the event keywords.

[0050] Specifically, a regular expression describes one or more strings (i.e., event keywords) to be matched when searching for text. For example, when traversing to the string "resource utilization rate includes", the following 20 characters are extracted as the event keywords under this field. Thus, based on the one or more event keywords extracted from the event content and the hit results of the keywords under different event types, the event type of the current alarm information can be obtained, thereby simplifying the process of obtaining the event type and improving the efficiency of obtaining the event type.

[0051] S104: Display the alarm statistics of the alarm record according to the event type and the application name.

[0052] After obtaining the event type, the event content can be replaced by the event type to facilitate statistical summary of the alarm information while reducing the amount of data in the valid data field; then, the event type is used as the basis for sorting to obtain the number of alarm information of different applications under each event type, or the application is used as the basis for sorting to obtain the number of alarm information of different event types under each application; the sorting results of the obtained alarm information are displayed in a pre-configured chart display method; optionally, in an embodiment of the present invention, the specific display method of the chart display method is not limited.

[0053] In addition, the alarm information results can be predicted by drawing a curve of changes in the number of alarm messages for each application under different event types, or a curve of changes in the number of alarm messages for each event type under different applications; wherein the horizontal axis of the above data change curve is the time scale, and the vertical axis is the quantity scale, so as to predict the statistical results of the alarm information in a future period of time based on the number of changes in the alarm information in each unit time, and provide this as reference information to the operation and maintenance personnel.

[0054] Optionally, in an embodiment of the present invention, the alarm statistics of the alarm record are displayed based on the event type and the application name, including: obtaining the risk level of each application under different event types based on the number of alarm messages and alarm days for each application under different event types.

[0055] Specifically, if an application has at least one alarm message under an event type on the same day, then that day will be used as the next alarm day for that event type. Based on the number of alarm messages and alarm days for an application under an event type, as well as the weight values ​​corresponding to the number of alarm messages and alarm days, a weighted calculation is used to obtain a risk score for the current event type. The higher the risk score, the higher the risk level. The risk level obtained based on the number of alarm messages and alarm days reflects both the number of alarms for each application under different event types and the alarm frequency for each application under different event types, thereby improving the accuracy of the prediction results.

[0056] The technical solution of the embodiment of the present invention first obtains the valid data fields of each alarm information in the alarm record, then deletes the duplicate alarm information in the alarm record according to the valid data fields, and then obtains the event type of each alarm information according to the event content, and finally obtains the alarm statistics of the alarm record according to the event type and application name; in this way, multi-dimensional display and management of alarm information are realized through event type and application name, the display effect of alarm statistics information is improved, and at the same time, interference of duplicate alarm information on alarm statistics results is avoided, thereby ensuring the accuracy of alarm statistics results.

[0057] Embodiment 2

[0058] Figure 2 This is a flowchart of an alarm information management method provided by Embodiment 2 of the present invention. The relationship between this embodiment and the above embodiment is that a curve of the number of alarm information of different event types in an application is drawn, or a curve of the number of alarm information of the same event type in different applications is drawn. Figure 2 As shown, the method includes:

[0059] S201. Acquire valid data fields of each alarm information in the alarm record; wherein the valid data fields include application name, event content, first trigger time and current trigger time.

[0060] S202: Delete duplicate alarm information in the alarm record according to the valid data field.

[0061] S203: Acquire the event type of each alarm information according to the event content.

[0062] S204: Acquire a first quantity change curve of alarm information of a first event type in a first application name, and a second quantity change curve of alarm information of a second event type in the first application name.

[0063] There may be a certain correlation between the alarm information of different event types in the same application. For example, as the system resources available to the trading program continue to decrease, the availability alarm of the trading program will be triggered; and when the system available resources are reduced to the point where the trading program cannot meet the trading business needs, or causes the trading program to experience business processing delays, the trading alarm of the trading program will be triggered; obviously, the generation of the above-mentioned trading alarm is not caused by the trading program itself, but by the system application; based on this, the quantity change curves of the alarm information of different event types in an application are drawn separately.

[0064] S205. If it is determined that there is a second line segment in the second quantity change curve that matches the first line segment in the first quantity change curve, the number of alarm information in the second line segment is corrected according to the number of alarm information in the first line segment; wherein the first line segment and the second line segment are equal in duration, have the same change trend, and have a starting time interval of a first time threshold.

[0065] The first quantity change curve and the second quantity change curve both use time as the horizontal coordinate (for example, using daily or hourly as the unit time span), and use the number of alarm messages as the vertical coordinate; when the first line segment in the first quantity change curve is equal to the second line segment in the second quantity change curve in duration, and the starting times of the two are separated by a first time threshold, if the first line segment and the second line segment have the same quantity change trend, it means that the two have a certain correlation, that is, the first line segment with an earlier starting time causes a quantity change in the second line segment with a later starting time, and thus the starting time of each line segment is used as the starting point for calculation, and the number of alarm messages of the second event type in the second line segment is subtracted from the number of alarm messages of the first event type in the first line segment at the corresponding time; wherein, the quantity change trend is related to the slope of the quantity change curve, and the quantity change trend can be obtained based on the numerical calculation of the slope.

[0066] S206. Display the alarm statistics of the alarm record according to the corrected number of alarm messages.

[0067] According to the number of alarm messages of the first event type in the first line segment, the number of alarm messages of the second event type in the second line segment is corrected, thereby avoiding the incorrect statistical value of the number of alarm messages under a specific event type in the application due to the influence of internal factors of the application, ensuring that each alarm message is generated independently, and improving the accuracy of the alarm data statistical results.

[0068] Optionally, in an embodiment of the present invention, the display of the alarm statistics of the alarm record based on the event type and the application name includes: obtaining a third quantity change curve of the alarm information of the third event type in the second application name, and a fourth quantity change curve of the alarm information of the third event type in the third application name; if it is determined that there is a fourth line segment in the fourth quantity change curve that matches the third line segment in the third quantity change curve, correcting the number of alarm information of the fourth line segment based on the number of alarm information of the third line segment; wherein the fourth line segment is equal to the third line segment in duration, has the same change trend, and has a starting time interval of a second time threshold; and displaying the alarm statistics of the alarm record based on the corrected number of alarm information.

[0069] Specifically, the alarm information of the same event type between different applications often has a certain correlation. For example, in the business chain, when the business processing of the upstream application fails, it cannot send the processing results to the downstream application in time. After the upstream application issues a task processing failure alarm, after a period of time, the downstream application may also issue a related waiting alarm because it has not obtained the pending tasks issued by the upstream application. Obviously, the alarm information generated by the downstream application is not caused by itself, but by the upstream application. Based on this, the quantity change curves of the alarm information of the same event type in different applications are drawn separately.

[0070] The third quantity change curve and the fourth quantity change curve also use time as the horizontal coordinate (for example, using daily or hourly as the unit time span) and the number of alarm messages as the vertical coordinate; when the third line segment in the third quantity change curve is equal to the fourth line segment in the fourth quantity change curve in duration, and their starting times are separated by a second time threshold, if the third line segment and the fourth line segment have the same quantity change trend, it means that the two have a certain correlation, that is, the third line segment with an earlier starting time causes a quantity change in the fourth line segment with a later starting time, and thus, the starting time of each line segment is used as the starting point for calculation, and the number of alarm messages of the third event type in the fourth line segment is subtracted from the number of alarm messages of the third event type in the third line segment at the corresponding time.

[0071] According to the number of alarm messages of the third event type in the third line segment, the number of alarm messages of the fourth event type in the fourth line segment is corrected, thereby avoiding the incorrect statistical value of the number of alarm messages under a specific event type in the application due to the influence of an external application, ensuring the independent generation of each alarm message, and improving the accuracy of the alarm data statistical results.

[0072] The technical solution of the embodiment of the present invention amends the number of alarm messages of the second event type in the second line segment according to the number of alarm messages of the first event type in the first line segment, and amends the number of alarm messages of the fourth event type in the fourth line segment according to the number of alarm messages of the third event type in the third line segment. This avoids the incorrect statistical value of the number of alarm messages under a specific event type in the application due to the influence of internal factors of the application and external applications, ensures the independent generation of each alarm message, and improves the accuracy of the alarm data statistical results.

[0073] Embodiment 3

[0074] Figure 3This is a flowchart of an alarm information management method provided by Embodiment 3 of the present invention. The relationship between this embodiment and the above embodiment is that event keywords are obtained in sequence through a first regular expression including multiple matching strings and a second regular expression including one matching string. Figure 3 As shown, the method includes:

[0075] S301. Acquire valid data fields of each alarm information in the alarm record; wherein the valid data fields include application name, event content, first trigger time and current trigger time.

[0076] S302: Delete duplicate alarm information in the alarm record according to the valid data field.

[0077] S303: According to the first regular expression, sequentially obtain each event keyword in the event content.

[0078] The first regular expression is composed of multiple matching strings, each matching string extracts an event keyword respectively. According to the arrangement order of each event keyword, the arrangement order of each matching string is pre-configured, and then all event keywords in the current event content are obtained in sequence through the first regular expression.

[0079] S304: If the downstream event keyword is not obtained within the specified number of characters after the current event keyword, the downstream event keyword is configured as a null value, and other event keywords are continuously obtained.

[0080] If a matching string in the first regular expression is written incorrectly and the matching event keyword cannot be obtained through it, other matching strings after the matching string will also be ineffective. This is because the first regular expression will always obtain the corresponding event keyword based on the current matching string until the current event content is completely traversed; at this time, the corresponding traversal range can be configured between each matching string.

[0081] For example, a specified number of characters are configured between event keyword A and event keyword B as the traversal range. If event keyword A is obtained by matching string A, and if event keyword B is obtained by matching string B within the above specified number of characters, other event keywords will continue to be obtained according to matching string C; if event keyword B is not obtained by matching string B within the above specified number of characters, event keyword B will be configured as a null value, and event keyword B will be skipped, and event keyword C will continue to be traversed by matching string C, starting from the position where the specified number of characters end.

[0082] S305. Traverse the event content again through a second regular expression that matches the downstream event keyword to obtain the downstream event keyword; wherein the second regular expression includes a matching string.

[0083] The second regular expression consists of only one matching string and is used to extract an event keyword. Different event keywords correspond to different second regular expressions. In particular, the second regular expression is constructed differently from the matching string in the first regular expression. Therefore, when the event keyword cannot be obtained through the matching string in the first regular expression, the event keyword can continue to be obtained through the second regular expression.

[0084] S306: Acquire the event type of the current alarm information according to the event keyword.

[0085] S307: Display the alarm statistics of the alarm record according to the event type and the application name.

[0086] The technical solution of the embodiment of the present invention temporarily configures the corresponding event keyword as a null value when the first regular expression is not used to obtain the corresponding event keyword in time, and then obtains the event keyword through the matching second regular expression, thereby ensuring that the complete event keyword is obtained and avoiding the phenomenon that the event keyword cannot be obtained normally due to the incorrect construction method of the first regular expression.

[0087] Embodiment 4

[0088] Figure 4 : is a structural block diagram of an alarm information management device provided by Embodiment 4 of the present invention, the device specifically comprises:

[0089] The data field acquisition module 401 is used to acquire the valid data fields of each alarm information in the alarm record; wherein the valid data fields include the application name, event content, first trigger time and current trigger time;

[0090] An alarm information deletion module 402, used to delete duplicate alarm information in the alarm record according to the valid data field;

[0091] An event type acquisition module 403 is used to acquire the event type of each alarm information according to the event content;

[0092] The statistical result acquisition module 404 is used to display the alarm statistical result of the alarm record according to the event type and the application name.

[0093] The technical solution of the embodiment of the present invention first obtains the valid data fields of each alarm information in the alarm record, then deletes the duplicate alarm information in the alarm record according to the valid data fields, and then obtains the event type of each alarm information according to the event content, and finally obtains the alarm statistics of the alarm record according to the event type and application name; in this way, multi-dimensional display and management of alarm information are realized through event type and application name, the display effect of alarm statistics information is improved, and at the same time, interference of duplicate alarm information on alarm statistics results is avoided, thereby ensuring the accuracy of alarm statistics results.

[0094] Optionally, the statistical result acquisition module 404 is specifically used to obtain a first quantity change curve of alarm information of the first event type in the first application name, and a second quantity change curve of alarm information of the second event type in the first application name; if it is determined that there is a second line segment in the second quantity change curve that matches the first line segment in the first quantity change curve, the number of alarm information in the second line segment is corrected according to the number of alarm information in the first line segment; wherein the first line segment and the second line segment are equal in duration, have the same change trend, and have a starting time interval of a first time threshold; and the alarm statistical results of the alarm record are displayed according to the corrected number of alarm information.

[0095] Optionally, the statistical result acquisition module 404 is also used to obtain a third quantity change curve of the alarm information of the third event type in the second application name, and a fourth quantity change curve of the alarm information of the third event type in the third application name; if it is determined that there is a fourth line segment in the fourth quantity change curve that matches the third line segment in the third quantity change curve, the number of alarm information in the fourth line segment is corrected according to the number of alarm information in the third line segment; wherein the fourth line segment is equal to the third line segment in duration, has the same change trend, and has a starting time interval of a second time threshold; and according to the corrected number of alarm information, the alarm statistical results of the alarm record are displayed.

[0096] Optionally, the statistical result acquisition module 404 is further used to obtain the risk level of each application under different event types according to the number of alarm information and the number of alarm days of each application under different event types.

[0097] Optionally, the event type acquisition module 403 is further configured to acquire event keywords in the event content through a regular expression, and acquire the event type of the current alarm information according to the event keywords.

[0098] Optionally, the event type acquisition module 403 is also used to obtain each event keyword in the event content in turn according to a first regular expression; wherein the first regular expression includes multiple matching strings; if the downstream event keyword is not obtained within a specified number of characters after the current event keyword, the downstream event keyword is configured as a null value, and other event keywords are continued to be obtained; through a second regular expression that matches the downstream event keyword, the event content is traversed again to obtain the downstream event keyword; wherein the second regular expression includes a matching string.

[0099] The above device can execute the alarm information management method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not described in detail in this embodiment, please refer to the alarm information management method provided by any embodiment of the present invention.

[0100] Embodiment 5

[0101] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, electronic devices, blade electronic devices, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0102] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0103] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0104] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the alarm information management method.

[0105] In some embodiments, the alarm information management method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on a heterogeneous hardware accelerator via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by a processor, one or more steps of the alarm information management method described above may be performed. Alternatively, in other embodiments, the processor may be configured to perform the alarm information management method in any other appropriate manner (e.g., by means of firmware).

[0106] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0107] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or electronic device.

[0108] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0109] To provide interaction with a user, the systems and techniques described herein may be implemented on a heterogeneous hardware accelerator having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) through which a user can provide input to the heterogeneous hardware accelerator. Other types of devices may also be used to provide interaction with a user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0110] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data electronic device), or a computing system that includes middleware components (e.g., an application electronic device), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0111] The computing system may include a client and an electronic device. The client and the electronic device are generally remote from each other and usually interact through a communication network. The relationship between the client and the electronic device is generated by computer programs running on corresponding computers and having a client-electronic device relationship with each other. The electronic device may be a cloud electronic device, also known as a cloud computing electronic device or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0112] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0113] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for managing alarm information, characterized in that: include: Obtain the valid data fields of each alarm information in the alarm record; wherein the valid data fields include application name, event content, first trigger time and current trigger time; Deleting duplicate alarm information in the alarm record according to the valid data field; According to the event content, obtaining the event type of each of the alarm information; According to the event type and the application name, the alarm statistics of the alarm record are displayed.

2. The method according to claim 1, characterized in that The displaying of the alarm statistics of the alarm record according to the event type and the application name includes: Acquire a first quantity change curve of alarm information of a first event type in a first application name, and a second quantity change curve of alarm information of a second event type in the first application name; If it is determined that there is a second line segment in the second quantity change curve that matches the first line segment in the first quantity change curve, the number of alarm information in the second line segment is corrected according to the number of alarm information in the first line segment; wherein the first line segment and the second line segment are equal in duration, have the same change trend, and have a start time interval of a first time threshold; According to the corrected number of alarm messages, the alarm statistics of the alarm record are displayed.

3. The method according to claim 1, characterized in that The displaying of the alarm statistics of the alarm record according to the event type and the application name includes: Acquire a third quantity change curve of alarm information of a third event type in the second application name, and a fourth quantity change curve of alarm information of the third event type in the third application name; If it is determined that there is a fourth line segment in the fourth quantity change curve that matches the third line segment in the third quantity change curve, the number of alarm information in the fourth line segment is corrected according to the number of alarm information in the third line segment; wherein the fourth line segment is equal to the third line segment in duration, has the same change trend, and has a start time interval of a second time threshold; According to the corrected number of alarm messages, the alarm statistics of the alarm record are displayed.

4. The method according to claim 1, characterized in that: The displaying of the alarm statistics of the alarm record according to the event type and the application name includes: According to the number of alarm messages and alarm days of each application under different event types, the risk level of each application under different event types is obtained.

5. The method according to claim 1, characterized in that The acquiring the event type of each alarm information according to the event content includes: The event keywords in the event content are obtained through regular expressions, and the event type of the current alarm information is obtained according to the event keywords.

6. The method according to claim 5, characterized in that The obtaining event keywords in the event content by using a regular expression includes: According to a first regular expression, each event keyword in the event content is obtained in sequence; wherein the first regular expression includes multiple matching character strings; If the downstream event keyword is not obtained within the specified number of characters after the current event keyword, the downstream event keyword is configured as a null value, and other event keywords are continuously obtained; The event content is traversed again by a second regular expression matching the downstream event keyword to obtain the downstream event keyword; wherein the second regular expression includes a matching string.

7. An alarm information management device, characterized in that: include: The data field acquisition module is used to obtain the valid data fields of each alarm information in the alarm record; wherein the valid data fields include the application name, event content, first trigger time and current trigger time; An alarm information deletion module, used to delete duplicate alarm information in the alarm record according to the valid data field; An event type acquisition module, used to acquire the event type of each alarm information according to the event content; The statistical result acquisition module is used to display the alarm statistical results of the alarm record according to the event type and the application name.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm information management method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm information management method according to any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the alarm information management method according to any one of claims 1 to 6 is implemented.

Images