Alarm information processing method and device, equipment and medium

Abstract

The invention discloses an alarm information processing method and device, equipment and a medium. The method comprises the following steps: acquiring each piece of alarm information generated by each monitoring system, and storing each piece of alarm information after format unification into a preset storage position; the middle and low risk alarm information is filtered out; determining each group of similar alarm information, and determining each group of similar alarm information as an alarm work order to obtain a plurality of alarm work orders; determining a work order processing personnel identifier, a state and a work order grade of each alarm work order; updating the state and the work order level of each alarm work order; and determining the alarm work order of which the state is in the processing state and the work order level is the high-risk work order level in each alarm work order as an important alarm work order, and providing the important alarm work order to the corresponding work order processing personnel. According to the embodiment of the invention, alarm information which does not need to be processed by operation and maintenance personnel can be filtered out, similar alarm information is merged into one alarm work order, and important alarm work orders are provided for corresponding work order processing personnel.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an alarm information processing method, device, equipment and medium. Background Art

[0002] Enterprises usually have different types of monitoring systems. The monitoring systems installed in enterprises include but are not limited to server monitoring systems, network monitoring systems, line monitoring systems, computer room monitoring systems, and database monitoring systems. When each monitoring system detects an abnormality in a monitoring target, it will generate an alarm message describing the abnormal situation of the monitoring target.

[0003] In the related art, the commonly used alarm information processing scheme is: each alarm information generated by each monitoring system is determined as an alarm work order, and each alarm work order is provided to the operation and maintenance personnel for processing. The alarm information generated by each monitoring system will contain a large amount of alarm information that does not need to be processed by the operation and maintenance personnel and similar alarm information. The alarm information processing scheme in the related art cannot filter out the alarm information that does not need to be processed by the operation and maintenance personnel in the alarm information generated by each monitoring system, and cannot merge similar alarm information, resulting in the operation and maintenance personnel needing to manually filter out the alarm work orders that need to be urgently processed from a large number of alarm work orders for processing, and cannot quickly respond to important alarm information. Summary of the invention

[0004] The present invention provides an alarm information processing method, device, equipment and medium to solve the problem that the alarm information processing scheme in the related art cannot filter out the alarm information that does not need to be processed by operation and maintenance personnel in the alarm information generated by each monitoring system, and cannot merge similar alarm information, resulting in the operation and maintenance personnel needing to manually screen out the alarm work orders that need to be urgently processed from a large number of alarm work orders for processing, and cannot quickly respond to important alarm information.

[0005] According to one aspect of the present invention, there is provided a method for processing alarm information, comprising:

[0006] Acquire each alarm information generated by each monitoring system, unify the format of key description information in each alarm information acquired, and store each alarm information after unification in a preset storage location;

[0007] Filtering out the medium and low-risk warning information in each warning information in the preset storage location, and generating a filtering information line chart corresponding to the filtered medium and low-risk warning information;

[0008] Determine each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location, determine each group of similar alarm information as an alarm work order, and obtain multiple alarm work orders;

[0009] Determine the work order processing personnel ID, status and work order level of each alarm work order, and generate a timeline corresponding to each alarm work order;

[0010] According to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, the status and work order level of each alarm work order are updated;

[0011] The alarm work orders whose status is being processed and whose work order level is a high-risk work order level are determined as important alarm work orders. According to the work order processing personnel identification of the important alarm work order, the important alarm work order is provided to the work order processing personnel corresponding to the important alarm work order.

[0012] According to another aspect of the present invention, there is provided an alarm information processing device, comprising:

[0013] The information acquisition module is used to acquire each alarm information generated by each monitoring system, unify the format of key description information in each acquired alarm information, and store each alarm information after unification in a preset storage location;

[0014] An information filtering module, used to filter out the medium and low-risk warning information in each warning information in the preset storage location, and generate a filtering information line chart corresponding to the filtered medium and low-risk warning information;

[0015] A work order generation module, used to determine each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location, determine each group of similar alarm information as an alarm work order, and obtain multiple alarm work orders;

[0016] The work order information determination module is used to determine the work order processing personnel identification, status and work order level of each alarm work order, and generate a timeline corresponding to each alarm work order;

[0017] A work order information update module, used to update the status and work order level of each alarm work order according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order;

[0018] The work order processing module is used to determine the alarm work orders with a status of being processed and a work order level of high-risk work order among the alarm work orders as important alarm work orders, and provide the important alarm work orders to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0020] at least one processor;

[0021] and a memory communicatively coupled to the at least one processor;

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm information processing method described in any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm information processing method described in any embodiment of the present invention when executed.

[0024] The technical solution of the embodiment of the present invention obtains each alarm information generated by each monitoring system, and unifies the format of the key description information in each alarm information obtained, and stores each alarm information with the unified format in a preset storage location; then, the medium and low-risk alarm information in each alarm information in the preset storage location is filtered out, and a filtered information line chart corresponding to the filtered medium and low-risk alarm information is generated; according to the similarity between each alarm information in the preset storage location, each group of similar alarm information in the preset storage location is determined, each group of similar alarm information is determined as an alarm work order, and multiple alarm work orders are obtained; the work order of each alarm work order is determined The alarm work order is processed by the personnel identification, status and work order level, and a timeline corresponding to each alarm work order is generated; the status and work order level of each alarm work order are updated according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order; the alarm work orders with a status of being processed and a work order level of high-risk work order level in each alarm work order are determined as important alarm work orders, and the important alarm work orders are provided to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders, which solves the problem that the alarm information processing solutions in the related technologies cannot process unnecessary alarms in the alarm information generated by each monitoring system. The alarm information that needs to be processed by the operation and maintenance personnel is filtered out, and similar alarm information cannot be merged, resulting in the operation and maintenance personnel having to manually screen out the alarm work orders that need to be processed urgently from a large number of alarm work orders for processing, and being unable to quickly respond to important alarm information. The medium and low-risk alarm information in the alarm information generated by each monitoring system can be filtered out, thereby filtering out the alarm information that does not need to be processed by the operation and maintenance personnel in the alarm information generated by each monitoring system. Each group of similar alarm information in the alarm information generated by each monitoring system can be determined, and each group of similar alarm information can be determined as an alarm work order, thereby obtaining multiple alarm work orders, from By merging similar alarm information into one alarm work order, the important alarm work orders among the alarm work orders can be determined according to the status and work order level of each alarm work order, and the important alarm work orders can be provided to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders, so that the work order processing personnel can quickly process the important alarm work orders containing important alarm information that need to be processed urgently, and quickly respond to the important alarm information. There is no need for the work order processing personnel to screen out the alarm work orders that need to be processed urgently from a large number of alarm work orders for processing, which is more efficient.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 The present invention provides a flowchart of a method for processing alarm information.

[0028] Figure 2 A flowchart of an alarm information processing method provided in Embodiment 2 of the present invention.

[0029] Figure 3 A schematic diagram of the structure of an alarm information processing device provided in Embodiment 3 of the present invention.

[0030] Figure 4 A schematic diagram of the structure of an electronic device for implementing the alarm information processing method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "target", "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprise", "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1A flowchart of an alarm information processing method provided in the first embodiment of the present invention. This embodiment is applicable to the case where the alarm information generated by various monitoring systems set up in an enterprise is processed. The method can be executed by an alarm information processing device, which can be implemented in the form of hardware and / or software, and the alarm information processing device can be configured in an electronic device. The electronic device can be an electronic device set up in the enterprise for processing the alarm information generated by various monitoring systems set up in the enterprise. Figure 1 As shown, the method includes:

[0035] Step 101: Acquire each alarm information generated by each monitoring system, unify the format of key description information in each acquired alarm information, and store each alarm information after the unified format in a preset storage location.

[0036] Optionally, the monitoring system may be a computer system for monitoring a specified monitoring target. When the monitoring system detects that the monitoring target is abnormal, it will generate an alarm message for describing the abnormal situation of the monitoring target. The alarm message may be a text for describing the abnormal situation of the monitoring target.

[0037] Optionally, each monitoring system may be a plurality of monitoring systems set up in an enterprise for monitoring different monitoring targets. Each monitoring system includes, but is not limited to, a server monitoring system, a network monitoring system, a line monitoring system, a computer room monitoring system, and a database monitoring system set up in an enterprise. A server monitoring system may be a monitoring system for monitoring servers in an enterprise. The monitoring target of the server monitoring system is a server in an enterprise. When the server monitoring system detects that an abnormality occurs in a server in an enterprise, it will generate an alarm message for describing an abnormality of the server. A network monitoring system may be a monitoring system for monitoring a network in an enterprise. The monitoring target of the network monitoring system is a network in an enterprise. When the network monitoring system detects that an abnormality occurs in a network in an enterprise, it will generate an alarm message for describing an abnormality of the network. A line monitoring system may be a monitoring system for monitoring a line in an enterprise. The monitoring target of the line monitoring system is a line in an enterprise. When the line monitoring system detects that an abnormality occurs in a line in an enterprise, it will generate an alarm message for describing an abnormality of the line. A computer room monitoring system may be a monitoring system for monitoring a computer room in an enterprise. The monitoring target of the computer room monitoring system is a computer room in an enterprise. When the computer room monitoring system detects an abnormality in the computer room of an enterprise, it will generate alarm information for describing the abnormal situation of the computer room. The database monitoring system can be a monitoring system for monitoring the database in the enterprise. The monitoring target of the database monitoring system is the database in the enterprise. When the database monitoring system detects an abnormality in the database in the enterprise, it will generate alarm information for describing the abnormal situation of the database.

[0038] Optionally, obtaining each alarm information generated by each monitoring system includes: regularly obtaining each alarm information generated by each monitoring system within a preset time length before the current moment according to a preset time interval. The preset time interval may be a preset time interval. Exemplarily, the preset time interval is 5 minutes. The electronic device may perform an operation of obtaining each alarm information generated by each monitoring system within a preset time length before the current moment once at every preset time interval. The preset time length may be a preset time length. Exemplarily, the preset time length is 5 minutes.

[0039] Optionally, for each monitoring system, an alarm information file for storing alarm information generated by the monitoring system is provided in the monitoring system. Each alarm information generated by the monitoring system is stored in the alarm information file of the monitoring system. The alarm information includes the generation time of the alarm information. The generation time of the alarm information may be the time when the monitoring system generates the alarm information. The electronic device may extract each alarm information whose generation time is within a preset time length before the current moment from the alarm information files of each monitoring system, thereby obtaining each alarm information generated by each monitoring system within the preset time length before the current moment.

[0040] Optionally, the key descriptive information in each alarm message obtained is formatted in a unified format, and each alarm message after the unified format is stored in a preset storage location, including: unifying the event time, event level, event object, event description and trigger condition in each alarm message obtained, and storing each alarm message after the unified format in a preset storage location.

[0041] Optionally, each alarm message includes key description information. The key description information may be important information related to the abnormal situation described in the alarm message, which is included in the alarm message. The key description information may include event time, event level, event object, event description, and trigger condition. Event time may be text included in the alarm message that describes the time when the abnormal situation is detected. Event level may be text included in the alarm message that describes the importance of the detected abnormal situation. Event object may be text included in the alarm message that describes the monitoring target where the abnormal situation occurs. Event description may be text included in the alarm message that describes the abnormal situation that occurs. Trigger condition may be text included in the alarm message that describes the condition that triggers the monitoring system to generate an alarm message.

[0042] Optionally, the event time, event level, event object, event description and trigger condition in each alarm information obtained are formatted in a unified manner, including: performing the following operations for each alarm information obtained: updating the identification information of the event time in the alarm information to a first preset text; updating the identification information of the event level in the alarm information to a second preset text; updating the identification information of the event object in the alarm information to a third preset text; updating the identification information of the event description in the alarm information to a fourth preset text; and updating the identification information of the trigger condition in the alarm information to a fifth preset text. The identification information of the event time may be text contained in the alarm information for identifying the event time in the alarm information. The identification information of the event level may be text contained in the alarm information for identifying the event level in the alarm information. The identification information of the event object may be text contained in the alarm information for identifying the event object in the alarm information. The identification information of the event description may be text contained in the alarm information for identifying the event description in the alarm information. The identification information of the trigger condition may be text contained in the alarm information for identifying the trigger condition in the alarm information. The first preset text, the second preset text, the third preset text, the fourth preset text and the fifth preset text may be five different texts that are preset. Exemplarily, the first preset text is time, the second preset text is level, the third preset text is target, the fourth preset text is desc, and the fifth preset text is trigger. The electronic device may identify the identification information of the event time in each alarm message, and update the identification information of the event time in each alarm message to the first preset text. The electronic device may identify the identification information of the event level in each alarm message, and update the identification information of the event level in each alarm message to the second preset text. The electronic device may identify the identification information of the event object in each alarm message, and update the identification information of the event object in each alarm message to the third preset text. The electronic device may identify the identification information of the event description in each alarm message, and update the identification information of the event description in each alarm message to the fourth preset text. The electronic device may identify the identification information of the trigger condition in each alarm message, and update the identification information of the trigger condition in each alarm message to the fifth preset text.

[0043] Optionally, the event time, event level, event object, event description and trigger condition in each alarm information obtained are formatted in a unified manner, further comprising: filling the year, month, date, hours, minutes and seconds in the event time in the alarm information into the event time template to obtain the event time in the standard format, and updating the event time in the alarm information to the event time in the standard format. The event time includes the year, month, date, hours, minutes and seconds. The event time in the standard format may be the event time after formatting according to the enterprise requirements. The event time template may be an event time in the standard format that does not include the year, month, date, hours, minutes and seconds in the event time. The event time template includes a year filling position, a month filling position, a date filling position, an hour filling position, a minute filling position and a second filling position. The year filling position may be a position in the event time template for filling in the year. The month filling position may be a position in the event time template for filling in the month. The date filling position may be a position in the event time template for filling in the date. The hour filling position may be a position in the event time template for filling in the hour. The position for filling in minutes can be the position for filling in minutes in the event time template. The position for filling in seconds can be the position for filling in seconds in the event time template. After filling in the year, month, date, hours, minutes, and seconds in the event time into the year filling position, month filling position, date filling position, hours filling position, minutes filling position, and seconds filling position in the event time template respectively, the event time in the standard format can be obtained. For example, the year in the event time is 2024, the month is 11, the date is 1, the hours are 18, the minutes are 20, and the seconds are 36. The event time in the standard format is "2024-11-1 18:20:36". The electronic device can identify the event time in each alarm information, and fill in the year, month, date, hour, minute and second in the event time in each alarm information into the year filling position, month filling position, date filling position, hour filling position, minute filling position and second filling position in the event time template, to obtain the event time in the standard format, and update the event time in each alarm information to the event time in the standard format. The electronic device stores the event time template.

[0044] Optionally, the format of the event time, event level, event object, event description and trigger condition in each acquired alarm message is unified, and the method also includes: detecting whether the standard event level set contains a standard event level that is the same as the event level in the alarm information; wherein the standard event level set is composed of multiple standard event levels; if so, determining that the event level in the alarm information does not need to be processed; if not, determining the standard event level corresponding to the event level in the alarm information among each standard event level, and updating the event level in the alarm information to the standard event level corresponding to the event level in the alarm information.

[0045] Optionally, each standard event level can be a plurality of event levels that meet the needs of the enterprise. Exemplarily, the standard event level set consists of 6 standard event levels. The 6 standard event levels, sorted from low to high according to the described importance, are: recovery, general, medium risk, dangerous, serious, and fatal. The standard event level corresponding to the event level in the alarm information can be a standard event level that can be used to replace the event level in the alarm information. Determining the standard event level corresponding to the event level in the alarm information in each standard event level includes: determining the standard event level corresponding to the event level in the alarm information according to the corresponding relationship between the preset non-standard event level and the standard event level.

[0046] Optionally, the correspondence between the preset non-standard event level and the standard event level includes each non-standard event level and the standard event level corresponding to each non-standard event level. Each non-standard event level may be each alarm level that may appear in the alarm information and is not a standard event level. Exemplarily, each non-standard event level includes but is not limited to: high, medium, and low. The standard event level corresponding to each non-standard event level may be a standard event level that can be used to replace the non-standard event level. According to the correspondence between the preset non-standard event level and the standard event level, the standard event level corresponding to the event level in the alarm information is determined, including: querying the target non-standard event level that is the same as the event level in the alarm information in each non-standard event level in the correspondence between the preset non-standard event level and the standard event level; determining the standard event level corresponding to the target non-standard event level as the standard event level corresponding to the event level in the alarm information. The target non-standard event level is the same non-standard event level as the event level in the alarm information. The standard event level corresponding to the target non-standard event level is the standard event level corresponding to the event level in the alarm information. The electronic device stores a preset correspondence relationship between non-standard event levels and standard event levels.

[0047] Optionally, the event time, event level, event object, event description and trigger condition in each alarm information obtained are formatted in a unified manner, and the method further includes: obtaining identification information and Internet Protocol address of the monitoring system to which the alarm information belongs, determining the identification information and Internet Protocol address of the monitoring system to which the alarm information belongs as a new event object, and updating the event object in the alarm information to the new event object. The monitoring system to which the alarm information belongs is the monitoring system that generates the alarm information. The identification information of the monitoring system may be text for identifying the monitoring system. The electronic device may obtain the identification information and Internet Protocol address of the monitoring system to which the alarm information belongs from the monitoring system to which the alarm information belongs, determining the identification information and Internet Protocol address of the monitoring system to which the alarm information belongs as a new event object, and updating the event object in the alarm information to the new event object.

[0048] Optionally, the preset storage location may be an information pool or file preset to store various alarm information in a unified format.

[0049] Step 102: Filter out the medium and low-risk warning information in each warning information in the preset storage location, and generate a filtering information line graph corresponding to the filtered medium and low-risk warning information.

[0050] Optionally, after each alarm message with a unified format is stored in a preset storage location each time, the medium and low-risk alarm messages in the alarm messages in the preset storage location are filtered out, and a line graph of filtered information corresponding to the filtered medium and low-risk alarm messages is generated. Medium and low-risk alarm messages may refer to alarm messages that appear too frequently and on a daily basis and do not require processing by operation and maintenance personnel. The filtered medium and low-risk alarm messages are alarm messages that are determined to be medium and low-risk alarm messages. The line graph of filtered information corresponding to the filtered medium and low-risk alarm messages may be a line graph generated based on the filtered medium and low-risk alarm messages for displaying the filtered medium and low-risk alarm messages.

[0051] Optionally, filtering out the medium and low-risk warning information in each warning information in the preset storage location includes: performing the following operations for each warning information in the preset storage location: inputting the warning information into the information detection component to obtain the medium and low-risk warning information detection result of the warning information output by the information detection component; if the medium and low-risk warning information detection result of the warning information output by the information detection component is yes, then determining that the warning information is medium and low-risk warning information, and moving the warning information from the preset storage location to the medium and low-risk warning information file; if the medium and low-risk warning information detection result of the warning information output by the information detection component is no, then determining that the warning information is not medium and low-risk warning information, and retaining the warning information. The information detection component can be a component set in an electronic device for detecting whether the warning information is medium and low-risk warning information. The input of the information detection component is the warning information, and the output of the information detection component is the medium and low-risk warning information detection result of the warning information. The medium and low-risk warning information detection result of the warning information is information used to characterize whether the warning information is medium and low-risk warning information. The detection result of the medium and low risk alarm information of the alarm information is yes or no. The detection result of the medium and low risk alarm information of the alarm information is yes, indicating that the alarm information is medium and low risk alarm information. The detection result of the medium and low risk alarm information of the alarm information is no, indicating that the alarm information is not medium and low risk alarm information. For each alarm information, the electronic device can input the alarm information into the information detection component. The information detection component analyzes and detects the input alarm information, determines the detection result of the medium and low risk alarm information of the alarm information, and outputs the detection result of the medium and low risk alarm information of the alarm information. The electronic device can obtain the detection result of the medium and low risk alarm information of the alarm information output by the information detection component. The medium and low risk alarm information file can be a pre-set file for storing medium and low risk alarm information. The information detection component can be written by a technician and set in the electronic device.

[0052] Optionally, generating a filtering information line graph corresponding to the filtered medium and low risk warning information includes: inputting the filtered medium and low risk warning information into a line graph generation component, and obtaining a filtering information line graph corresponding to the filtered medium and low risk warning information output by the line graph generation component. The line graph generation component may be a component set in an electronic device for generating a filtering information line graph corresponding to the filtered medium and low risk warning information. The input of the line graph generation component is the filtered medium and low risk warning information, and the output of the line graph generation component is a filtering information line graph corresponding to the filtered medium and low risk warning information. The electronic device may obtain the filtered medium and low risk warning information from the medium and low risk warning information file, and input the filtered medium and low risk warning information into the line graph generation component. The line graph generation component generates a filtering information line graph corresponding to the filtered medium and low risk warning information according to the filtered medium and low risk warning information, and outputs a filtering information line graph corresponding to the filtered medium and low risk warning information. The electronic device can obtain the filtered information line graph corresponding to the filtered medium and low risk warning information output by the line graph generation component. The line graph generation component can be written by a technician and set in the electronic device.

[0053] Step 103: According to the similarity between each alarm information in the preset storage location, each group of similar alarm information in the preset storage location is determined, and each group of similar alarm information is determined as an alarm work order to obtain multiple alarm work orders.

[0054] Optionally, after filtering out the medium and low-risk alarm information in each alarm information in the preset storage location each time and generating a line graph of filtered information corresponding to the filtered medium and low-risk alarm information, the groups of similar alarm information in the preset storage location are determined according to the similarity between the alarm information in the preset storage location, and each group of similar alarm information is determined as an alarm work order, thereby obtaining multiple alarm work orders. The alarm work order can be information used to instruct the operation and maintenance personnel of the enterprise to handle a specified abnormal situation.

[0055] Optionally, based on the similarity between each alarm information in the preset storage location, each group of similar alarm information in the preset storage location is determined, including: generating replacement alarm information corresponding to each alarm information; determining the similarity between each alarm information based on the replacement alarm information corresponding to each alarm information and a preset similarity detection model; determining the alarm information having a similarity greater than a preset similarity threshold and containing the same event object as a group of similar alarm information, to obtain multiple groups of similar alarm information.

[0056] Optionally, the replacement alarm information corresponding to the alarm information is an alarm information in which the specified format information contained is updated to the information alias corresponding to the specified format information. The specified format information may include an Internet Protocol address and a numerical value. The information alias corresponding to the Internet Protocol address may be "IP". The information alias corresponding to the numerical value may be "NUM". The replacement alarm information corresponding to each alarm information is generated, including: performing the following operations for each alarm information in a preset storage location: copying the alarm information; updating the specified format information in the copied alarm information to the information alias corresponding to the specified format information, and obtaining the replacement alarm information corresponding to the alarm information. The electronic device can identify each Internet Protocol address in the alarm information, update each Internet Protocol address in the alarm information to the information alias corresponding to the Internet Protocol address, and can identify each numerical value in the alarm information, and update each numerical value in the alarm information to the information alias corresponding to the numerical value.

[0057] Optionally, according to the replacement alarm information corresponding to each alarm information and the preset similarity detection model, the similarity between each alarm information is determined, including: inputting each replacement alarm information into the preset similarity detection model to obtain the similarity between each replacement alarm information output by the preset similarity detection model and each replacement alarm information other than itself; determining the similarity between each replacement alarm information and each replacement alarm information other than itself as the similarity between the alarm information corresponding to each replacement alarm information and the alarm information corresponding to each replacement alarm information other than itself. The preset similarity detection model can be a model trained by a technician and set in an electronic device for detecting the similarity between each alarm information and each alarm information other than itself. The input of the preset similarity detection model is a plurality of alarm information, and the output of the preset similarity detection model is the similarity between each alarm information and each alarm information other than itself. The electronic device can input each replacement alarm information into the preset similarity detection model. The preset similarity detection model can analyze and detect each input replacement alarm information, calculate the similarity between each replacement alarm information and each replacement alarm information except itself, and output the similarity between each replacement alarm information and each replacement alarm information except itself. The electronic device can obtain the similarity between each replacement alarm information output by the preset similarity detection model and each replacement alarm information except itself, and determine the similarity between each replacement alarm information and each replacement alarm information except itself as the similarity between the alarm information corresponding to each replacement alarm information and the alarm information corresponding to each replacement alarm information except itself. Exemplarily, the first alarm information and the second alarm information are any two different alarm information in the preset storage location. The similarity between the replacement alarm information corresponding to the first alarm information and the replacement alarm information corresponding to the second alarm information is determined as the similarity between the first alarm information and the second alarm information.

[0058] Optionally, alarm information having a similarity greater than a preset similarity threshold and containing the same event object is determined as a group of similar alarm information, and multiple groups of similar alarm information are obtained, including: taking out an alarm information from a preset storage location as the currently processed alarm information; judging whether there is any alarm information remaining in the preset storage location that has a similarity greater than a preset similarity threshold with the currently processed alarm information and contains an event object that is the same as the event object contained in the currently processed alarm information; and if so, taking out all the alarm information remaining in the preset storage location that has a similarity greater than a preset similarity threshold with the currently processed alarm information and contains an event object that is the same as the event object contained in the currently processed alarm information. The alarm information with the same event object is determined as the alarm information similar to the currently processed alarm information, and the alarm information similar to the currently processed alarm information is taken out from the preset storage location, and the currently processed alarm information and the alarm information similar to the currently processed alarm information are determined as a group of similar alarm information, and then the operation of taking out an alarm information from the preset storage location as the currently processed alarm information is returned to be executed until there is no remaining alarm information in the preset storage location; if not, the currently processed alarm information is determined as a group of similar alarm information, and then the operation of taking out an alarm information from the preset storage location as the currently processed alarm information is returned to be executed until there is no remaining alarm information in the preset storage location. The preset similarity threshold can be a preset similarity threshold. Exemplarily, the preset similarity threshold is 0.5.

[0059] Generally, alarm information and alarm information whose similarity with the alarm information is greater than a preset similarity threshold and contains the same event object are similar alarm information. Similar alarm information requires a unified processing by an operation and maintenance personnel. If there is no alarm information whose similarity with the alarm information is greater than a preset similarity threshold and contains the same event object, it indicates that there is no other alarm information similar to the alarm information. Alarm information without similar other alarm information requires a separate processing by an operation and maintenance personnel.

[0060] Optionally, after determining each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location, each group of similar alarm information is determined as an alarm work order to obtain multiple alarm work orders. Each alarm work order may be composed of multiple similar alarm information that require a unified processing by an operation and maintenance personnel, or composed of alarm information without other similar alarm information that requires a separate processing by an operation and maintenance personnel.

[0061] Step 104: Determine the work order processing personnel identification, status, and work order level of each alarm work order, and generate a timeline corresponding to each alarm work order.

[0062] Optionally, the work order processing personnel identifier of the alarm work order may refer to the identifier of the work order processing personnel corresponding to the alarm work order. The work order processing personnel corresponding to the alarm work order may refer to the operation and maintenance personnel responsible for processing the alarm work order. The operation and maintenance personnel may be the technical personnel in the enterprise who are responsible for handling abnormal situations. The identifier of the operation and maintenance personnel may be a string used to uniquely identify the operation and maintenance personnel.

[0063] Optionally, determining the work order processing personnel identification of each alarm work order includes: performing the following operations for each alarm work order: extracting the processing personnel identification in any alarm information in the alarm work order, and determining the extracted processing personnel identification as the work order processing personnel identification of the alarm work order. The alarm information usually contains the processing personnel identification. The processing personnel identification in the alarm information may refer to the identification of the operation and maintenance personnel responsible for processing the alarm information. The electronic device can identify the processing personnel identification in the alarm information and extract the processing personnel identification in the alarm information.

[0064] Optionally, the status of the alarm work order can be information used to indicate whether the alarm work order has been processed. The status of the alarm work order can be To Be Assigned, Processing, Resolved, or Closed. If the status of the alarm work order is To Be Assigned, it means that the operation and maintenance personnel responsible for processing the alarm work order cannot be determined, and the alarm work order has not been processed. If the status of the alarm work order is Processing, it means that the alarm work order has not been processed. If the status of the alarm work order is Resolved, it means that the alarm work order has been processed. If the status of the alarm work order is Closed, it means that it has been determined that the alarm work order does not need to be processed.

[0065] Optionally, determining the status of each alarm work order includes: performing the following operations for each alarm work order: if the work order processing personnel identification of the alarm work order has been determined, setting the status of the alarm work order to being processed; if the work order processing personnel identification of the alarm work order cannot be determined, setting the status of the alarm work order to be assigned. The inability to determine the work order processing personnel identification of the alarm work order may refer to the processing personnel identification that cannot be extracted from the alarm information in the alarm work order. For alarm work orders with a status of to be assigned, the alarm work order can be sent to the terminal device of the target operation and maintenance personnel. The target operation and maintenance personnel may be the operation and maintenance personnel responsible for processing the alarm work orders with a status of to be assigned.

[0066] Optionally, the work order level of the alarm work order can be a text used to characterize the importance of the abnormal situation described by the alarm information in the alarm work order. The six work order levels, sorted from low to high according to the importance represented, are: recovery, general, medium-risk, dangerous, severe, and fatal. The work order level of the alarm work order is recovery, general, medium-risk, dangerous, severe, or fatal.

[0067] Optionally, determining the work order level of each alarm work order includes: performing the following operations for each alarm work order: determining whether any alarm information in the alarm work order contains alarm information with an event level of fatal; if any alarm information in the alarm work order contains alarm information with an event level of fatal, determining that the work order level of the alarm work order is fatal.

[0068] Optionally, after determining whether any alarm information in the alarm work order contains alarm information with an event level of fatal, it also includes: if any alarm information in the alarm work order does not contain alarm information with an event level of fatal, determining whether any alarm information in the alarm work order contains alarm information with an event level of serious; if any alarm information in the alarm work order contains alarm information with an event level of serious, determining that the work order level of the alarm work order is serious.

[0069] Optionally, after determining whether any alarm information in the alarm work order contains alarm information with a serious event level, it also includes: if no alarm information in the alarm work order contains alarm information with a serious event level, determining whether any alarm information in the alarm work order contains alarm information with a dangerous event level; if any alarm information in the alarm work order contains alarm information with a dangerous event level, determining that the work order level of the alarm work order is dangerous.

[0070] Optionally, after determining whether each alarm message in the alarm work order contains alarm messages with an event level of danger, it further includes: if each alarm message in the alarm work order does not contain alarm messages with an event level of danger, then determining whether each alarm message in the alarm work order contains alarm messages with an event level of medium danger; if each alarm message in the alarm work order contains alarm messages with an event level of medium danger and the number of alarm messages with an event level of medium danger is greater than a preset value, then determining that the work order level of the alarm work order is dangerous; if each alarm message in the alarm work order contains alarm messages with an event level of medium danger and the number of alarm messages with an event level of medium danger is less than or equal to a preset value, then determining that the work order level of the alarm work order is medium danger. The preset value can be a pre-set value. Exemplarily, the preset value is 5.

[0071] Optionally, after determining whether any alarm information in the alarm work order contains alarm information with a medium-risk event level, it also includes: if any alarm information in the alarm work order does not contain alarm information with a medium-risk event level, determining whether any alarm information in the alarm work order contains alarm information with a general event level; if any alarm information in the alarm work order contains alarm information with a general event level, determining that the work order level of the alarm work order is general; if any alarm information in the alarm work order does not contain alarm information with a general event level, determining that the work order level of the alarm work order is recovery.

[0072] Optionally, the timeline corresponding to each alarm work order can be a timeline for displaying the event time in the alarm information in each alarm work order and the merged time of each alarm work order. The merged time of each alarm work order can be the time when each alarm work order is obtained as recorded by the electronic device. Generating a timeline corresponding to each alarm work order includes: inputting each alarm work order and the merged time of each alarm work order into a timeline generation component, and obtaining a timeline corresponding to each alarm work order output by the timeline generation component. The timeline generation component can be a component set in an electronic device for generating a timeline corresponding to each alarm work order. The input of the timeline generation component is multiple alarm work orders and the merged time of each alarm work order, and the output of the line chart generation component is the timeline corresponding to each alarm work order. The electronic device can input each alarm work order and the merged time of each alarm work order into the timeline generation component. The timeline generation component analyzes and detects each alarm work order and the combined time of each alarm work order, generates a timeline corresponding to each alarm work order, and outputs the timeline corresponding to each alarm work order. The electronic device can obtain the timeline corresponding to each alarm work order output by the timeline generation component. The timeline generation component can be written by a technician and set in the electronic device.

[0073] Step 105: Update the status and work order level of each alarm work order according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order.

[0074] Optionally, after determining the work order processing personnel identification, status and work order level of each alarm work order, the status and work order level of each alarm work order can be updated according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order. For each alarm work order, the target time interval corresponding to the alarm work order may refer to a time interval with a target time length starting from the generation time of the alarm work order. The target time length may be a preset time length. Exemplarily, the target time length is 15 minutes. The recovery information corresponding to the alarm work order obtained within the target time interval corresponding to the alarm work order may refer to the text received by the electronic device within the target time interval corresponding to the alarm work order to characterize that the abnormal situation described by the alarm information in the alarm work order has been restored. The new alarm information corresponding to the alarm work order obtained within the target time interval corresponding to the alarm work order may refer to the alarm information obtained by the electronic device within the target time interval corresponding to the alarm work order that is the same as the alarm information in the alarm work order.

[0075] Optionally, based on the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, the status and work order level of each alarm work order are updated, including: performing the following operations for each alarm work order: if the recovery information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, the status of the alarm work order is updated to closed. Normally, if the recovery information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, it indicates that the abnormal situation described by the alarm information in the alarm work order has been restored, it can be determined that the alarm work order does not need to be processed, and the status of the alarm work order is updated to closed.

[0076] Optionally, the status and work order level of each alarm work order are updated according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, and the following is further included: if the work order level of the alarm work order is recovery, general or medium-risk, and no new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, the status of the alarm work order is updated to closed. Normally, if the work order level of the alarm work order is recovery, general or medium-risk, and no new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, it indicates that the abnormal situation described by the alarm information in the alarm work order has been restored, and it can be determined that the alarm work order does not need to be processed, and the status of the alarm work order is updated to closed.

[0077] Optionally, the status and work order level of each alarm work order are updated according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, and the following also includes: if the work order level of the alarm work order is recovery, general or medium-risk, and new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order and the recovery information corresponding to the alarm work order is not obtained, then the work order level of the alarm work order is upgraded. Normally, if the work order level of the alarm work order is recovery, general or medium-risk, and new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order and the recovery information corresponding to the alarm work order is not obtained, it indicates that the abnormal situation described by the alarm information in the alarm work order has not been restored and continues to trigger the monitoring system to generate alarm information, which requires urgent processing, and the work order level of the alarm work order can be upgraded.

[0078] Optionally, upgrading the work order level of the alarm work order includes: updating the work order level of the alarm work order to dangerous.

[0079] Step 106: Determine the alarm work orders whose status is being processed and whose work order level is a high-risk work order level as important alarm work orders, and provide the important alarm work orders to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders.

[0080] Optionally, an important alarm work order may refer to an alarm work order containing important alarm information that needs to be processed urgently. The level of a high-risk work order may be dangerous, serious, or fatal. Generally, an alarm work order with a status of being processed and a work order level of a high-risk work order is an important alarm work order.

[0081] Optionally, among each alarm work order, an alarm work order with a status of being processed and a work order level of a high-risk work order level is determined as an important alarm work order, and the important alarm work order is provided to the work order processing personnel corresponding to the important alarm work order based on the work order processing personnel identification of the important alarm work order, including: determining among each alarm work order an alarm work order with a status of being processed and a work order level of dangerous, serious or fatal as an important alarm work order, determining the work order processing personnel corresponding to the important alarm work order based on the work order processing personnel identification of the important alarm work order, and sending the important alarm work order to the work order processing personnel corresponding to the important alarm work order.

[0082] Optionally, the electronic device can determine the work order processing personnel corresponding to the important alarm work order according to the work order processing personnel identification of the important alarm work order, and then send the important alarm work order to the work order processing personnel corresponding to the important alarm work order. Sending the important alarm work order to the work order processing personnel corresponding to the important alarm work order includes: sending the important alarm work order to the terminal device of the work order processing personnel corresponding to the important alarm work order. The electronic device can also notify the work order processing personnel corresponding to the important alarm work order to pay attention to and handle the important alarm work order through email, text message, phone call, etc.

[0083] The technical solution of the embodiment of the present invention obtains each alarm information generated by each monitoring system, and unifies the format of the key description information in each alarm information obtained, and stores each alarm information with the unified format in a preset storage location; then, the medium and low-risk alarm information in each alarm information in the preset storage location is filtered out, and a filtered information line chart corresponding to the filtered medium and low-risk alarm information is generated; according to the similarity between each alarm information in the preset storage location, each group of similar alarm information in the preset storage location is determined, each group of similar alarm information is determined as an alarm work order, and multiple alarm work orders are obtained; the work order of each alarm work order is determined The alarm work order is processed by the personnel identification, status and work order level, and a timeline corresponding to each alarm work order is generated; the status and work order level of each alarm work order are updated according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order; the alarm work orders with a status of being processed and a work order level of high-risk work order level in each alarm work order are determined as important alarm work orders, and the important alarm work orders are provided to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders, which solves the problem that the alarm information processing solutions in the related technologies cannot process unnecessary alarms in the alarm information generated by each monitoring system. The alarm information that needs to be processed by the operation and maintenance personnel is filtered out, and similar alarm information cannot be merged, resulting in the operation and maintenance personnel having to manually screen out the alarm work orders that need to be processed urgently from a large number of alarm work orders for processing, and being unable to quickly respond to important alarm information. The medium and low-risk alarm information in the alarm information generated by each monitoring system can be filtered out, thereby filtering out the alarm information that does not need to be processed by the operation and maintenance personnel in the alarm information generated by each monitoring system. Each group of similar alarm information in the alarm information generated by each monitoring system can be determined, and each group of similar alarm information can be determined as an alarm work order, thereby obtaining multiple alarm work orders, from By merging similar alarm information into one alarm work order, the important alarm work orders among the alarm work orders can be determined according to the status and work order level of each alarm work order, and the important alarm work orders can be provided to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders, so that the work order processing personnel can quickly process the important alarm work orders containing important alarm information that need to be processed urgently, and quickly respond to the important alarm information. There is no need for the work order processing personnel to screen out the alarm work orders that need to be processed urgently from a large number of alarm work orders for processing, which is more efficient.

[0084] Embodiment 2

[0085] Figure 2This is a flowchart of a method for processing alarm information provided by Embodiment 2 of the present invention. This embodiment of the present invention can be combined with each optional solution in one or more of the above embodiments. Figure 2 As shown, the method includes:

[0086] Step 201: unify the formats of event time, event level, event object, event description and trigger condition in each alarm information obtained, and store each alarm information after unification in a preset storage location.

[0087] Step 202: Filter out the medium and low-risk warning information in each warning information in the preset storage location, and generate a filtering information line graph corresponding to the filtered medium and low-risk warning information.

[0088] Step 203: According to the similarity between each alarm information in the preset storage location, each group of similar alarm information in the preset storage location is determined, and each group of similar alarm information is determined as an alarm work order to obtain multiple alarm work orders.

[0089] Step 204: Determine the work order processing personnel identification, status and work order level of each alarm work order, and generate a timeline corresponding to each alarm work order.

[0090] Step 205: Update the status and work order level of each alarm work order according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order.

[0091] Step 206: Determine the alarm work orders whose status is being processed and whose work order level is dangerous, serious or fatal as important alarm work orders, determine the work order processing personnel corresponding to the important alarm work order based on the work order processing personnel identification of the important alarm work order, and send the important alarm work order to the work order processing personnel corresponding to the important alarm work order.

[0092] The technical solution of the embodiment of the present invention can unify the format of event time, event level, event object, event description and trigger condition in each alarm information generated by each monitoring system, and can determine the important alarm work order in each alarm work order according to the status and work order level of each alarm work order, and provide the important alarm work order to the work order processing personnel corresponding to the important alarm work order according to the work order processing personnel identification of the important alarm work order, so that the work order processing personnel can quickly process the important alarm work order, ensure that the work order processing personnel can quickly process the important alarm work order containing important alarm information that needs to be urgently processed, and quickly respond to the important alarm information. There is no need for the work order processing personnel to screen out the alarm work orders that need to be urgently processed from a large number of alarm work orders for processing, which is more efficient.

[0093] Embodiment 3

[0094] Figure 3 This is a schematic diagram of the structure of an alarm information processing device provided by Embodiment 3 of the present invention. The device can be configured in an electronic device. Figure 3 As shown, the device includes: an information acquisition module 301, an information filtering module 302, a work order generation module 303, a work order information determination module 304, a work order information update module 305 and a work order processing module 306.

[0095] Among them, the information acquisition module 301 is used to obtain various alarm information generated by various monitoring systems, and to unify the format of the key description information in each alarm information obtained, and store each alarm information with unified format in a preset storage location; the information filtering module 302 is used to filter out the medium and low-risk alarm information in each alarm information in the preset storage location, and generate a filtered information line chart corresponding to the filtered medium and low-risk alarm information; the work order generation module 303 is used to determine each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location, determine each group of similar alarm information as an alarm work order, and obtain multiple alarm work orders ; A work order information determination module 304 is used to determine the work order processing personnel identification, status and work order level of each alarm work order, and generate a timeline corresponding to each alarm work order; a work order information update module 305 is used to update the status and work order level of each alarm work order according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order; a work order processing module 306 is used to determine the alarm work orders whose status is being processed and whose work order level is a high-risk work order level as important alarm work orders, and provide the important alarm work orders to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders.

[0096] The technical solution of the embodiment of the present invention obtains each alarm information generated by each monitoring system, and unifies the format of the key description information in each alarm information obtained, and stores each alarm information with the unified format in a preset storage location; then, the medium and low-risk alarm information in each alarm information in the preset storage location is filtered out, and a filtered information line chart corresponding to the filtered medium and low-risk alarm information is generated; according to the similarity between each alarm information in the preset storage location, each group of similar alarm information in the preset storage location is determined, each group of similar alarm information is determined as an alarm work order, and multiple alarm work orders are obtained; the work order of each alarm work order is determined The alarm work order is processed by the personnel identification, status and work order level, and a timeline corresponding to each alarm work order is generated; the status and work order level of each alarm work order are updated according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order; the alarm work orders with a status of being processed and a work order level of high-risk work order level in each alarm work order are determined as important alarm work orders, and the important alarm work orders are provided to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders, which solves the problem that the alarm information processing solutions in the related technologies cannot process unnecessary alarms in the alarm information generated by each monitoring system. The alarm information that needs to be processed by the operation and maintenance personnel is filtered out, and similar alarm information cannot be merged, resulting in the operation and maintenance personnel having to manually screen out the alarm work orders that need to be processed urgently from a large number of alarm work orders for processing, and being unable to quickly respond to important alarm information. The medium and low-risk alarm information in the alarm information generated by each monitoring system can be filtered out, thereby filtering out the alarm information that does not need to be processed by the operation and maintenance personnel in the alarm information generated by each monitoring system. Each group of similar alarm information in the alarm information generated by each monitoring system can be determined, and each group of similar alarm information can be determined as an alarm work order, thereby obtaining multiple alarm work orders, from By merging similar alarm information into one alarm work order, the important alarm work orders among the alarm work orders can be determined according to the status and work order level of each alarm work order, and the important alarm work orders can be provided to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders, so that the work order processing personnel can quickly process the important alarm work orders containing important alarm information that need to be processed urgently, and quickly respond to the important alarm information. There is no need for the work order processing personnel to screen out the alarm work orders that need to be processed urgently from a large number of alarm work orders for processing, which is more efficient.

[0097] In an optional implementation of an embodiment of the present invention, optionally, the information acquisition module 301 is specifically used to: unify the format of the event time, event level, event object, event description and trigger condition in each alarm information obtained, and store each alarm information with a unified format in a preset storage location.

[0098] In an optional implementation of an embodiment of the present invention, optionally, when the work order generation module 303 performs the operation of determining each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location, it is specifically used to: generate replacement alarm information corresponding to each alarm information; determine the similarity between each alarm information according to the replacement alarm information corresponding to each alarm information and a preset similarity detection model; determine the alarm information having a similarity greater than a preset similarity threshold and containing the same event object as a group of similar alarm information, to obtain multiple groups of similar alarm information.

[0099] In an optional implementation of an embodiment of the present invention, optionally, the work order information update module 305 is specifically used to: perform the following operations for each alarm work order: if the recovery information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, the status of the alarm work order is updated to closed.

[0100] In an optional implementation of an embodiment of the present invention, optionally, the work order information update module 305 is specifically used for: if the work order level of the alarm work order is recovery, general or medium risk, and no new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, then the status of the alarm work order is updated to closed.

[0101] In an optional implementation of an embodiment of the present invention, optionally, the work order information update module 305 is specifically used for: if the work order level of the alarm work order is recovery, general or medium risk, and new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order and no recovery information corresponding to the alarm work order is obtained, then the work order level of the alarm work order is upgraded.

[0102] In an optional implementation of an embodiment of the present invention, optionally, the work order processing module 306 is specifically used to: determine the alarm work orders with a status of being processed and a work order level of dangerous, serious or fatal in each alarm work order as important alarm work orders, determine the work order processing personnel corresponding to the important alarm work order according to the work order processing personnel identification of the important alarm work order, and send the important alarm work order to the work order processing personnel corresponding to the important alarm work order.

[0103] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0104] The above-mentioned alarm information processing device can execute the alarm information processing method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the alarm information processing method.

[0105] Embodiment 4

[0106] Figure 4 The structure diagram of the electronic device 10 that can be used to implement the alarm information processing method of the embodiment of the present invention is shown. The components shown herein, their connections and relationships, and their functions are only for example, and are not intended to limit the implementation of the present invention described and / or required herein.

[0107] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program built from the storage unit 18 to the random access memory (RAM) 13. In the random access memory (RAM) 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the read-only memory (ROM) 12 and the random access memory (RAM) 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0108] A number of components in the electronic device 10 are connected to an input / output (I / O) interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, speakers, etc., a storage unit 18, such as a disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0109] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the alarm information processing method.

[0110] In some embodiments, the alarm information processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via a read-only memory (ROM) 12 and / or a communication unit 19. When the computer program is built into a random access memory (RAM) 13 and executed by the processor 11, one or more steps of the alarm information processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the alarm information processing method in any other appropriate manner (e.g., by means of firmware).

[0111] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0112] The computer program for implementing the alarm information processing method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed completely on the machine, partially on the machine, partially on the machine and partially on a remote machine as an independent software package, or completely on a remote machine or server.

[0113] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0114] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0115] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0116] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0117] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0118] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing alarm information, characterized in that: include: Acquire each alarm information generated by each monitoring system, unify the format of key description information in each alarm information acquired, and store each alarm information after unification in a preset storage location; Filtering out the medium and low-risk warning information in each warning information in the preset storage location, and generating a filtering information line chart corresponding to the filtered medium and low-risk warning information; Determine each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location, determine each group of similar alarm information as an alarm work order, and obtain multiple alarm work orders; Determine the work order processing personnel ID, status and work order level of each alarm work order, and generate a timeline corresponding to each alarm work order; According to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, the status and work order level of each alarm work order are updated; The alarm work orders whose status is being processed and whose work order level is a high-risk work order level are determined as important alarm work orders. According to the work order processing personnel identification of the important alarm work order, the important alarm work order is provided to the work order processing personnel corresponding to the important alarm work order.

2. The alarm information processing method according to claim 1, characterized in that: The key description information in each alarm information obtained is formatted uniformly, and each alarm information after the formatting is unified is stored in a preset storage location, including: The event time, event level, event object, event description and trigger condition in each acquired alarm information are formatted in a unified manner, and each alarm information after the unified format is stored in a preset storage location.

3. The alarm information processing method according to claim 1, characterized in that: Determining each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location includes: Generating replacement alarm information corresponding to each alarm information; Determining the similarity between each piece of alarm information according to the replacement alarm information corresponding to each piece of alarm information and a preset similarity detection model; The alarm information whose similarity is greater than a preset similarity threshold and contains the same event object is determined as a group of similar alarm information, so as to obtain multiple groups of similar alarm information.

4. The alarm information processing method according to claim 1, characterized in that: According to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, the status and work order level of each alarm work order are updated, including: Perform the following operations for each alarm ticket: If the recovery information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, the status of the alarm work order is updated to closed.

5. The method for processing alarm information according to claim 4, characterized in that: According to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, the status and work order level of each alarm work order are updated, and also include: If the work order level of the alarm work order is recovery, general or medium risk, and no new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order, the status of the alarm work order is updated to closed.

6. The method for processing alarm information according to claim 4, characterized in that: According to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order, the status and work order level of each alarm work order are updated, and also include: If the work order level of the alarm work order is recovery, general or medium-risk, and new alarm information corresponding to the alarm work order is obtained within the target time interval corresponding to the alarm work order and no recovery information corresponding to the alarm work order is obtained, the work order level of the alarm work order is upgraded.

7. The alarm information processing method according to claim 1, characterized in that: Determine the alarm work orders whose status is being processed and whose work order level is a high-risk work order level as important alarm work orders, and provide the important alarm work orders to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders, including: Among the alarm work orders, those with a status of being processed and a work order level of dangerous, serious or fatal are determined as important alarm work orders. According to the work order processing personnel identifier of the important alarm work order, the work order processing personnel corresponding to the important alarm work order is determined, and the important alarm work order is sent to the work order processing personnel corresponding to the important alarm work order.

8. An alarm information processing device, characterized in that: include: The information acquisition module is used to acquire each alarm information generated by each monitoring system, unify the format of key description information in each acquired alarm information, and store each alarm information after unification in a preset storage location; An information filtering module, used to filter out the medium and low-risk warning information in each warning information in the preset storage location, and generate a filtering information line chart corresponding to the filtered medium and low-risk warning information; A work order generation module, used to determine each group of similar alarm information in the preset storage location according to the similarity between each alarm information in the preset storage location, determine each group of similar alarm information as an alarm work order, and obtain multiple alarm work orders; The work order information determination module is used to determine the work order processing personnel identification, status and work order level of each alarm work order, and generate a timeline corresponding to each alarm work order; A work order information update module, used to update the status and work order level of each alarm work order according to the recovery information and new alarm information corresponding to each alarm work order obtained within the target time interval corresponding to each alarm work order; The work order processing module is used to determine the alarm work orders with a status of being processed and a work order level of high-risk work order among the alarm work orders as important alarm work orders, and provide the important alarm work orders to the work order processing personnel corresponding to the important alarm work orders according to the work order processing personnel identification of the important alarm work orders.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm information processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm information processing method according to any one of claims 1 to 7 when executed.

Images