Alarm aggregation method

Abstract

The invention discloses an alarm aggregation method, and relates to the field of information processing, and the method comprises the steps: obtaining a current storage level of a current-level storage object which does not report a native alarm, if the current storage level is not the lowest level, determining a target storage object based on a next-level storage object which does not report the native alarm in the current-level storage object, determining whether the current-level storage object is used as a to-be-aggregated storage object or not according to the number of the target storage objects, if not, updating the current-level storage object based on the target storage objects, and skipping to the step of obtaining the current storage level of the current-level storage object; if the current storage level is the lowest level, determining whether to take the current-level storage object as a to-be-aggregated storage object or not according to the number of unreported native alarms in the current-level storage object; the unreported original alarms in the to-be-aggregated storage object are aggregated and then reported, so that the number of reported alarms is reduced, and the difficulty of storage object management and operation and maintenance is reduced.

Description

Technical Field

[0001] The present invention relates to the field of information processing, and in particular to an alarm aggregation method. Background Art

[0002] With the development of computer science and technology, the data generated by society, enterprises, groups and even individuals has shown a geometric growth. Building large-scale clusters for data collection, storage, calculation and distribution has been widely used in various fields. The larger the scale of the cluster, the more complex the cluster management and maintenance.

[0003] Each device in a large-scale cluster will generate software, hardware, and resource usage alarms. The more devices in the cluster, the higher the probability of generating alarms, and the more alarms are generated. Especially when a node, cabinet, or network fails, the cluster will generate a large number of alarms in a short period of time, resulting in too many alarms and mixed alarms at all levels, making it difficult for operation and maintenance personnel to find key information in a large number of alarms in time, so as to formulate emergency response plans as soon as possible, increasing the difficulty of cluster management and maintenance.

[0004] Based on this, one way is to split a large-scale cluster into multiple small-scale clusters. Although the number of alarms generated by each cluster can be reduced to a certain extent, too many small-scale clusters will also cause management and maintenance difficulties. In addition, if the coupling between services is strong, it is not recommended to split the large-scale cluster built for the service into multiple small-scale clusters, which is easy to affect service performance. Another way is that after the alarm is reported, the alarm receiver integrates the alarm to reduce the number of alarms, but this has high technical requirements for the alarm receiver. It can be seen that how to actively integrate the alarms on the alarm reporting side to reduce the difficulty of cluster management and maintenance is a problem that technical personnel in this field need to solve. Summary of the invention

[0005] The purpose of the embodiment of the present invention is to provide an alarm aggregation method, which can reduce the number of reported alarms and the number of alarm reports by performing alarm aggregation on the alarm reporting side, thereby solving the problem of high difficulty in storage object management and operation and maintenance. The specific scheme is as follows:

[0006] In a first aspect, the present invention provides an alarm aggregation method, comprising:

[0007] Get the current storage level of the current level storage object that contains the unreported native alarm;

[0008] If the current storage level is not the preset minimum storage level, determine the next level storage object containing unreported native alarms from the current level storage objects to obtain the target storage object, and determine whether to determine the current level storage object as the storage object to be aggregated according to the total number of objects of the target storage object. If not, determine the target storage object as the new current level storage object, and jump again to the step of obtaining the current storage level of the current level storage object containing unreported native alarms;

[0009] If the current storage level is the preset minimum storage level, determining whether to determine the current storage object as a storage object to be aggregated according to the total number of alarms for which no native alarms are reported in the current storage object;

[0010] Alarm aggregation is performed on the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms.

[0011] Optionally, the storage level of each level of storage objects is positively correlated with the storage capacity of each level of storage objects;

[0012] The storage objects at each level include any one or a combination of cluster-level storage objects, pool-level storage objects, and node-level storage objects.

[0013] Optionally, before obtaining the current storage level of the current level storage object including the unreported native alarm, the following is further included:

[0014] Regularly check whether there are unreported native alarms in the top-level storage objects based on a preset time interval;

[0015] If there are unreported native alarms in the highest-level storage object, determining whether to trigger an alarm aggregation operation based on a magnitude relationship between the number of unreported native alarms in the highest-level storage object and a first preset number;

[0016] If the alarm aggregation operation is triggered, the highest-level storage object is determined as the current-level storage object.

[0017] Optionally, determining a next-level storage object including an unreported native alarm from the current-level storage object to obtain a target storage object includes:

[0018] Determine, from the current level storage objects, a next level storage object that includes an unreported native alarm;

[0019] If the number of the next-level storage objects is less than the second preset number, determining the next-level storage objects as target storage objects;

[0020] If the number of next-level storage objects is not less than a second preset number, a target storage object is determined from the next-level storage objects based on the number of unreported native alarms in the next-level storage objects.

[0021] Optionally, based on the number of unreported native alarms in the next-level storage objects, determining the target storage object from the next-level storage objects includes:

[0022] Determine the average number of alarms for the next-level storage objects according to the number of unreported native alarms in the current-level storage objects and the number of next-level storage objects;

[0023] Determine an object filter condition for a target storage object based on the average number of alarms;

[0024] Storage objects whose number of unreported native alarms meets the object screening condition are screened from the next-level storage objects to obtain the target storage object.

[0025] Optionally, after performing alarm aggregation on the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms, the method further includes:

[0026] Obtain the alarm levels of the unreported native alarms in the storage object to be aggregated, and determine the highest alarm level from the alarm levels;

[0027] If the alarm levels are consistent and the highest alarm level is not the preset highest level, the highest alarm level is upgraded, and the upgraded alarm level is determined as the alarm level of the target aggregate alarm;

[0028] If the alarm levels are inconsistent or the highest alarm level is the preset highest level, the highest alarm level is determined as the alarm level of the target aggregate alarm.

[0029] Optionally, after performing alarm aggregation on the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms, the method further includes:

[0030] Determine whether there is a reported aggregate alarm among the reported alarms;

[0031] If there is a reported aggregate alarm among the reported alarms, determine whether to report the target aggregate alarm based on the high-low relationship between the aggregation level of the reported aggregate alarm and the aggregation level of the target aggregate alarm; wherein the aggregation level of the aggregate alarm is a level determined based on the storage level of the aggregate storage object corresponding to the aggregate alarm;

[0032] If there is no reported aggregate alarm among the reported alarms, the target aggregate alarm is reported.

[0033] Optionally, determining whether to report the target aggregation alarm based on a high-low relationship between an aggregation level of the reported aggregation alarm and an aggregation level of the target aggregation alarm includes:

[0034] When there is a first reported aggregate alarm in the reported aggregate alarms, determine whether to release the first reported aggregate alarm based on the alarm duration of the first reported aggregate alarm, and determine whether to report the target aggregate alarm according to the alarm release status of the first reported aggregate alarm; the aggregation level of the first reported aggregate alarm is higher than the aggregation level of the target aggregate alarm;

[0035] When there is no first reported aggregate alarm in the reported aggregate alarm and there is a second reported aggregate alarm, determining whether to report the target aggregate alarm based on the first alarm information coverage between the second reported aggregate alarm and the target aggregate alarm; the aggregation level of the second reported aggregate alarm is equal to the aggregation level of the target aggregate alarm;

[0036] When the first reported aggregate alarm and the second reported aggregate alarm do not exist in the reported aggregate alarms and there is a third reported aggregate alarm, determine whether to cancel the third reported aggregate alarm and report the target aggregate alarm based on the coverage of the second alarm information between the target aggregate alarm and the third reported aggregate alarm; the aggregation level of the third reported aggregate alarm is lower than the aggregation level of the target aggregate alarm.

[0037] Optionally, determining whether to report the target aggregate alarm based on the first alarm information coverage between the second reported aggregate alarm and the target aggregate alarm includes:

[0038] If the first alarm information coverage situation indicates that the alarm information of the second reported aggregate alarm completely covers the alarm information of the target aggregate alarm, the alarm duration of the second reported aggregate alarm is reset, and the target aggregate alarm is released;

[0039] If the first alarm information coverage condition indicates that the alarm information of the second reported aggregate alarm does not completely cover the alarm information of the target aggregate alarm, the target aggregate alarm is reported.

[0040] Optionally, the alarm aggregation method of the present invention further includes:

[0041] If the current level storage object is determined as the storage object to be aggregated according to the total number of objects or the total number of alarms, or if the current level storage object is not determined as the storage object to be aggregated according to the total number of alarms, then the unaggregated native alarm is determined from the unreported native alarms;

[0042] When the fourth reported aggregate alarm does not exist in the reported aggregate alarm, a preset judgment operation is performed to judge whether to report the non-aggregated native alarm based on the coverage of the third alarm information between each reported native alarm and the non-aggregated native alarm; the alarm information of the fourth reported aggregate alarm completely covers the alarm information of the non-aggregated native alarm;

[0043] When there is a fourth reported aggregate alarm in the reported aggregate alarms, determine whether to cancel the fourth reported aggregate alarm based on the alarm duration of the fourth reported aggregate alarm, and determine whether to perform a preset judgment operation according to the alarm cancellation status of the fourth reported aggregate alarm.

[0044] In a second aspect, the present invention provides an alarm aggregation device, comprising:

[0045] A storage level acquisition module, used to acquire the current storage level of the current level storage object including the unreported native alarm;

[0046] A first object determination module is used for, if the current storage level is not a preset minimum storage level, determining a next-level storage object including unreported native alarms from the current-level storage objects to obtain a target storage object, and determining whether to determine the current-level storage object as a storage object to be aggregated according to the total number of objects of the target storage objects, and if not, determining the target storage object as a new current-level storage object, and jumping back to the step of obtaining the current storage level of the current-level storage object including unreported native alarms;

[0047] A second object determination module, configured to determine whether to determine the current level storage object as a storage object to be aggregated according to the total number of alarms for which no native alarms are reported in the current level storage object if the current storage level is a preset minimum storage level;

[0048] The alarm aggregation module is used to aggregate the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms.

[0049] In a third aspect, the present invention provides an electronic device, comprising:

[0050] Memory for storing computer programs;

[0051] A processor is used to execute a computer program to implement the aforementioned alarm aggregation method.

[0052] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the aforementioned alarm aggregation method when executed by a processor.

[0053] In the present invention, the current storage level of the current-level storage object including the unreported native alarm is obtained; if the current storage level is not the preset minimum storage level, the next-level storage object including the unreported native alarm is determined from the current-level storage object to obtain the target storage object, and according to the total number of objects of the target storage object, it is determined whether to determine the current-level storage object as the storage object to be aggregated; if not, the target storage object is determined as the new current-level storage object, and the process is jumped again to the step of obtaining the current storage level of the current-level storage object including the unreported native alarm; if the current storage level is the preset minimum storage level, according to the total number of alarms of the unreported native alarms in the current-level storage object, it is determined whether to determine the current-level storage object as the storage object to be aggregated; and alarm aggregation is performed on the unreported native alarms in the determined storage object to be aggregated to obtain the target aggregated alarm.

[0054] Beneficial effect: The present invention analyzes the storage objects containing unreported native alarms level by level, so as to determine the storage objects containing more next-level storage objects or more unreported native alarms as storage objects to be aggregated, and aggregates the unreported native alarms in the storage objects to be aggregated before reporting. In this way, compared with directly reporting native alarms, the present invention can greatly reduce the number of reported alarms and the number of alarm reports without splitting the storage objects by aggregating alarms on the alarm reporting side, making it easier for operation and maintenance personnel to find key information from the alarm information more quickly, thereby reducing the difficulty of storage object management and operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 A flow chart of an alarm aggregation method provided by an embodiment of the present invention;

[0057] Figure 2 A flow chart of aggregate alarm reporting provided by an embodiment of the present invention;

[0058] Figure 3 A native alarm reporting flow chart provided by an embodiment of the present invention;

[0059] Figure 4 A cluster-level alarm aggregation flow chart provided for an embodiment of the present invention

[0060] Figure 5 A pool-level and node-level alarm aggregation flow chart provided for an embodiment of the present invention;

[0061] Figure 6 A schematic diagram of the structure of an alarm aggregation device provided by an embodiment of the present invention;

[0062] Figure 7 A structural diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] If a cluster generates a large number of alarms in a short period of time, resulting in too many alarms and mixed alarms at various levels, it is easy for operation and maintenance personnel to find key information in a timely manner from a large number of alarms, so as to formulate emergency response plans as soon as possible, increasing the difficulty of cluster management and maintenance. To this end, the present invention provides an alarm aggregation method, which can greatly reduce the number of reported alarms and the number of alarm reports without splitting storage objects by performing alarm aggregation on the alarm reporting party, so as to facilitate operation and maintenance personnel to find key information from the alarm information more quickly, thereby reducing the difficulty of storage object management and operation and maintenance.

[0065] See also Figure 1 As shown, an embodiment of the present invention provides an alarm aggregation method, including:

[0066] Step S11: Obtain the current storage level of the current-level storage objects that do not report native alarms.

[0067] In the embodiment of the present invention, the storage level of storage objects at various levels is positively correlated with the storage capacity of storage objects at various levels; the positive correlation indicates that the storage capacity of storage objects at various levels and the storage level of storage objects at various levels have the same change direction, that is, the larger the storage capacity of the storage object, the higher the storage level of the storage object, or the smaller the storage capacity of the storage object, the lower the storage level of the storage object. Exemplarily, storage objects at various levels include any one or a combination of several of cluster-level storage objects, pool-level storage objects, and node-level storage objects; because the storage capacity of the cluster is greater than the storage capacity of the storage pool, which is greater than the storage capacity of the storage node, the storage level of the cluster-level storage object is higher than the storage level of the pool-level storage object, which is higher than the storage level of the node-level storage object.

[0068] Specifically, the application subject of the present invention is an alarm reporter or an alarm sender, through which the alarm reporter or the alarm sender periodically checks whether there are unreported native alarms in the highest-level storage object based on a preset time interval; the highest-level storage object is the storage object with the highest storage level among the storage objects at all levels. If there are unreported native alarms in the highest-level storage object, then based on the relationship between the number of unreported native alarms in the highest-level storage object and the first preset number, it is determined whether to trigger the alarm aggregation operation; if the alarm aggregation operation is prohibited, the unreported native alarms in the highest-level storage object are directly reported; if the alarm aggregation operation is triggered, the highest-level storage object is determined as the current-level storage object, and the current storage level of the current-level storage object is obtained, and the current storage level at this time is the preset highest storage level.

[0069] Furthermore, if there is no unreported native alarm in the highest-level storage object, the highest-level storage object is checked regularly based on a preset time interval to see if there is an unreported native alarm in the highest-level storage object. Native alarms refer to alarm information generated by software natively; the preset time interval can be set according to storage object management and maintenance requirements, for example, 10 seconds.

[0070] Regarding whether to trigger the alarm aggregation operation, if the number of unreported native alarms in the highest-level storage object is less than a first preset number, it is considered that the number of unreported native alarms in the highest-level storage object is too small, and alarm aggregation is not necessary, so triggering the alarm aggregation operation is prohibited; if the number of unreported native alarms in the highest-level storage object is greater than or equal to the first preset number, the alarm aggregation operation is triggered. The first preset number can be set according to the alarm aggregation requirement, for example, set to 10.

[0071] More specifically, the present invention can also periodically check whether the top-level storage object has unreported native alarms in a preset historical time period adjacent to the current time based on a preset time interval for checking unreported native alarms in the top-level storage object. The preset historical time period can also be set according to alarm aggregation requirements, for example, set to 60 seconds.

[0072] Step S12: If the current storage level is not the preset minimum storage level, determine the next-level storage object that contains unreported native alarms from the current-level storage objects to obtain the target storage object, and determine whether to determine the current-level storage object as the storage object to be aggregated based on the total number of objects of the target storage object. If not, determine the target storage object as the new current-level storage object, and jump again to the step of obtaining the current storage level of the current-level storage object that contains unreported native alarms.

[0073] In the embodiment of the present invention, after obtaining the current storage level of the current storage object, it is necessary to determine whether the current storage level of the current storage object is the preset minimum storage level. If the current storage level is not the preset minimum storage level, it indicates that there are still next-level storage objects in the current storage object, therefore, the next-level storage object containing unreported native alarms is determined from the current storage object, and the target storage object is determined based on the next-level storage object containing unreported native alarms; then, according to the total number of objects of the target storage object, it is determined whether to determine the current storage object as the storage object to be aggregated, if the current storage object is not determined as the storage object to be aggregated according to the total number of objects, the target storage object is determined as the new current storage object, and the process jumps back to the step of obtaining the current storage level of the current storage object containing unreported native alarms in step S11.

[0074] For the target storage object, it is specifically necessary to first determine the next-level storage object that contains the unreported native alarm from the current-level storage object, and determine whether the number of the next-level storage objects is less than a second preset number; wherein the second preset number can be set according to the alarm aggregation requirement, for example, set to 2. If the number of the next-level storage objects is less than the second preset number, the next-level storage object is directly determined as the target storage object; if the number of the next-level storage objects is greater than or equal to the second preset number, the target storage object is determined from the next-level storage objects based on the number of unreported native alarms in the next-level storage objects.

[0075] Specifically, if the number of next-level storage objects is greater than or equal to a second preset number, the average number of alarms for the next-level storage objects is determined based on the number of unreported native alarms in the current-level storage objects and the number of next-level storage objects, and the object filtering conditions for the target storage objects are determined based on the average number of alarms. Then, storage objects whose number of unreported native alarms meets the object filtering conditions are filtered from the next-level storage objects to obtain the target storage object.

[0076] Exemplarily, after determining the average number of alarms for the next-level storage object, the maximum value is determined from the preset minimum number of alarms and the preset ratio of the average number of alarms, so as to determine the object screening condition for the target storage object based on the maximum value; for example, the object screening condition may be that the number of unreported native alarms in the next-level storage object is greater than or equal to the maximum value. The preset minimum number of alarms and the preset ratio may be set according to the alarm aggregation requirements, for example, the preset minimum number of alarms may be set to 2, and the preset ratio may be set to one-half.

[0077] More specifically, after determining the object screening condition for the target storage object, the initial object quantity 0 is determined as the current object quantity, and any unanalyzed storage object is selected from the next-level storage objects containing unreported native alarms as the current storage object to be analyzed, and the current storage object to be analyzed is analyzed to determine whether the number of unreported native alarms in the current storage object to be analyzed meets the object screening condition. If the object screening condition is met, the current storage object to be analyzed is determined as the target storage object, and the current object quantity is incremented by one to obtain a new current object quantity, and then it is determined whether all the next-level storage objects containing unreported native alarms have been analyzed. If not all the analysis is completed, jump again to the step of selecting any unanalyzed storage object from the next-level storage objects containing unreported native alarms; if all the analysis is completed, the current object quantity is determined as the total number of objects of the target storage object. If the object screening condition is not met, it is further determined whether all the next-level storage objects containing unreported native alarms have been analyzed.

[0078] According to one of the embodiments, whether to determine the current-level storage object as the storage object to be aggregated can be determined by determining whether the total number of objects of the target storage object is less than the total number of preset objects, so as to determine whether to determine the current-level storage object as the storage object to be aggregated; wherein the total number of preset objects can be set according to the alarm aggregation requirement, for example, set to 2. If the total number of objects of the target storage object is not less than the total number of preset objects, the current-level storage object is determined as the storage object to be aggregated; if the total number of objects of the target storage object is less than the total number of preset objects, it is prohibited to determine the current-level storage object as the storage object to be aggregated.

[0079] Step S13: If the current storage level is the preset minimum storage level, determine whether to determine the current storage object as a storage object to be aggregated according to the total number of alarms for which no native alarms are reported in the current storage object.

[0080] In an embodiment of the present invention, after obtaining the current storage level of the current-level storage object, if the current storage level of the current-level storage object is a preset minimum storage level, that is, the current-level storage object is the lowest-level storage object among all levels of storage objects that contains unreported native alarms, then based on the total number of unreported native alarms in the current-level storage object, it is determined whether to determine the current-level storage object as the storage object to be aggregated.

[0081] Specifically, it is determined whether the total number of unreported native alarms in the current-level storage object is less than the total number of preset alarms to determine whether the current-level storage object is determined as the storage object to be aggregated; wherein the total number of preset alarms can be set according to the alarm aggregation requirement, for example, set to 5. If the total number of unreported native alarms in the current-level storage object is less than the total number of preset alarms, it indicates that the number of unreported native alarms in the current-level storage object is relatively small, so the current-level storage object is not determined as the storage object to be aggregated; if the total number of unreported native alarms in the current-level storage object is greater than or equal to the total number of preset alarms, it indicates that the number of unreported native alarms in the current-level storage object is relatively large, so the current-level storage object is determined as the storage object to be aggregated.

[0082] Step S14: Aggregate the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms.

[0083] In this embodiment, regardless of whether the current-level storage object is determined as the storage object to be aggregated based on the total number of objects of the target storage object, or the current-level storage object is determined as the storage object to be aggregated based on the total number of unreported native alarms in the current-level storage object, it is necessary to perform alarm aggregation on the unreported native alarms in the determined storage object to be aggregated to obtain the target aggregated alarm.

[0084] After obtaining the target aggregate alarm, it is also necessary to determine the alarm level of the target aggregate alarm. Specifically, obtain the alarm level of each unreported native alarm in the storage object to be aggregated, and determine the highest alarm level from each alarm level. If the alarm levels are consistent and the highest alarm level is not the preset highest level, the highest alarm level is upgraded, and the upgraded alarm level is determined as the alarm level of the target aggregate alarm; if the alarm levels are inconsistent or the highest alarm level is the preset highest level, the highest alarm level is determined as the alarm level of the target aggregate alarm. Among them, the upgrade operation can be an operation to increase the highest alarm level by one level.

[0085] It should be noted that the embodiment of the present invention can also control whether to start the alarm aggregation process for unreported native alarms by setting an alarm aggregation control switch. When the alarm aggregation control switch is turned off, the unreported native alarms in the storage objects at all levels are directly reported; when the alarm aggregation control switch is turned on, steps S11 to S14 are adopted to aggregate the unreported native alarms in the storage objects at all levels before reporting.

[0086] Further, such as Figure 2As shown, after obtaining the target aggregate alarm, the target aggregate alarm needs to be reported. The reporting logic of the aggregate alarm is: determine whether there is a reported aggregate alarm in the reported alarms; if there is no reported aggregate alarm in the reported alarms, report the target aggregate alarm. If there is a reported aggregate alarm in the reported alarms, determine whether to report the target aggregate alarm based on the high-low relationship between the aggregation level of the reported aggregate alarm and the aggregation level of the target aggregate alarm.

[0087] The aggregation level of the aggregate alarm is a level determined based on the storage level of the aggregate storage object corresponding to the aggregate alarm, for example, the storage level of the aggregate storage object corresponding to the aggregate alarm is determined as the aggregation level of the aggregate alarm. Accordingly, the aggregation level of the aggregate alarm is positively correlated with the storage level of the aggregate storage object; the positive correlation indicates that the aggregation level of the aggregate alarm and the storage level of the aggregate storage object have the same change direction, that is, the higher the storage level of the aggregate storage object, the higher the aggregation level of the aggregate alarm.

[0088] Determining whether to report the target aggregation alarm based on the high-low relationship between the aggregation level of the reported aggregation alarm and the aggregation level of the target aggregation alarm specifically includes the following steps:

[0089] When there is a first reported aggregate alarm in the reported aggregate alarms, based on the alarm duration of the first reported aggregate alarm, it is determined whether to cancel the first reported aggregate alarm, and according to the alarm cancellation status of the first reported aggregate alarm, it is determined whether to report the target aggregate alarm. The aggregation level of the first reported aggregate alarm is higher than the aggregation level of the target aggregate alarm.

[0090] Exemplarily, when there is a first reported aggregate alarm in the reported aggregate alarms, it is determined whether the alarm duration of the first reported aggregate alarm reaches a preset duration; if the alarm duration of the first reported aggregate alarm does not reach the preset duration, the first reported aggregate alarm is not cancelled, and the target aggregate alarm is not reported accordingly. If the alarm duration of the first reported aggregate alarm reaches the preset duration, the first reported aggregate alarm is cancelled, and the target aggregate alarm is reported.

[0091] When there is no first reported aggregate alarm in the reported aggregate alarms and there is a second reported aggregate alarm, it is determined whether to report the target aggregate alarm based on the first alarm information coverage between the second reported aggregate alarm and the target aggregate alarm, wherein the aggregation level of the second reported aggregate alarm is equal to the aggregation level of the target aggregate alarm.

[0092] Exemplarily, when there is no first reported aggregate alarm in the reported aggregate alarm and there is a second reported aggregate alarm, determine the first alarm information coverage between the second reported aggregate alarm and the target aggregate alarm. If the first alarm information coverage indicates that the alarm information of the second reported aggregate alarm completely covers the alarm information of the target aggregate alarm, reset the alarm duration of the second reported aggregate alarm, for example, reset the alarm duration of the second reported aggregate alarm to 0, and release the target aggregate alarm. If the first alarm information coverage indicates that the alarm information of the second reported aggregate alarm does not completely cover the alarm information of the target aggregate alarm, report the target aggregate alarm.

[0093] When the first reported aggregate alarm and the second reported aggregate alarm do not exist in the reported aggregate alarms and there is a third reported aggregate alarm, based on the coverage of the second alarm information between the target aggregate alarm and the third reported aggregate alarm, it is determined whether to cancel the third reported aggregate alarm and report the target aggregate alarm. The aggregation level of the third reported aggregate alarm is lower than the aggregation level of the target aggregate alarm.

[0094] Exemplarily, when the first reported aggregate alarm and the second reported aggregate alarm do not exist in the reported aggregate alarm and the third reported aggregate alarm exists, determine the second alarm information coverage between the target aggregate alarm and the third reported aggregate alarm. If the second alarm information coverage indicates that the alarm information of the target aggregate alarm completely covers the alarm information of the third reported aggregate alarm, the third reported aggregate alarm is released and the target aggregate alarm is reported. If the second alarm information coverage indicates that the alarm information of the target aggregate alarm does not completely cover the alarm information of the third reported aggregate alarm, the target aggregate alarm is directly reported.

[0095] In an embodiment of the present invention, if the current-level storage object is determined as the storage object to be aggregated according to the total number of objects, or the current-level storage object is determined as the storage object to be aggregated according to the total number of alarms, or the current-level storage object is not determined as the storage object to be aggregated according to the total number of alarms, then it is determined whether there are unaggregated native alarms in the unreported native alarms participating in the alarm aggregation this time; if so, the unaggregated native alarms are determined from the unreported native alarms participating in the alarm aggregation this time, and based on the reported aggregated alarms and the reported native alarms, the unaggregated native alarms are reported.

[0096] Specifically, Figure 3 As shown, the unaggregated native alarm is determined from the unreported native alarms participating in the alarm aggregation this time, and it is judged whether there is a fourth reported aggregate alarm in the reported aggregate alarms; wherein the alarm information of the fourth reported aggregate alarm completely covers the alarm information of the unaggregated native alarm.

[0097] When there is no fourth reported aggregate alarm in the reported aggregate alarms, a preset judgment operation is performed to determine whether to report the non-aggregated native alarm based on the coverage of the third alarm information between each reported native alarm and the non-aggregated native alarm. If the coverage of the third alarm information between any reported native alarm and the non-aggregated native alarm indicates that the alarm information of any reported native alarm completely covers the alarm information of the non-aggregated native alarm, the alarm duration of any reported native alarm is reset and the non-aggregated native alarm is released; if the coverage of the third alarm information between any reported native alarm and the non-aggregated native alarm indicates that the alarm information of any reported native alarm does not completely cover the alarm information of the non-aggregated native alarm, the non-aggregated native alarm is reported.

[0098] When there is a fourth reported aggregate alarm in the reported aggregate alarms, determine whether to cancel the fourth reported aggregate alarm based on the alarm duration of the fourth reported aggregate alarm, and determine whether to perform a preset judgment operation according to the alarm cancellation status of the fourth reported aggregate alarm.

[0099] That is, when there is a fourth reported aggregate alarm in the reported aggregate alarms, it is determined whether the alarm duration of the fourth reported aggregate alarm reaches the preset duration; if the alarm duration of the fourth reported aggregate alarm does not reach the preset duration, the fourth reported aggregate alarm is not cancelled, and the preset judgment operation is not performed accordingly, and the non-aggregated native alarm is not reported. If the alarm duration of the fourth reported aggregate alarm reaches the preset duration, the fourth reported aggregate alarm is cancelled and the preset judgment operation is performed.

[0100] In the embodiment of the present invention, each aggregate alarm corresponds to a data structure table, and the data structure table records the basic information of the aggregate alarm. The data structure table of the aggregate alarm includes the alarm serial number, alarm level, aggregation level, alarm details, alarm generation time, alarm reporting time, alarm duration and alarm release time of the aggregate alarm. Among them, the alarm serial number of the aggregate alarm is used to identify the aggregate alarm, and the alarm serial number of each aggregate alarm is different. The alarm details of the aggregate alarm include the storage objects at all levels involved in the aggregate alarm and the corresponding number of objects, the number of alarm categories and the number of alarms of the native alarm involved in the aggregate alarm; the number of alarm categories can be determined based on the alarm category identifier of the native alarm involved in the aggregate alarm, that is, the number of different category identifiers is determined based on the alarm category identifier of the native alarm involved in the aggregate alarm, as the number of alarm categories. The alarm duration of the aggregate alarm refers to the duration of the aggregate alarm after reporting.

[0101] Exemplarily, if the aggregate storage object corresponding to the aggregate alarm is a storage node, that is, the storage objects at all levels involved in the aggregate alarm include one storage node, then the alarm details of the aggregate alarm can be "x storage nodes generate a total of y native alarms of type z". If the aggregate storage object corresponding to the aggregate alarm is a storage pool, that is, the storage objects at all levels involved in the aggregate alarm include one storage pool and three storage nodes, then the alarm details of the aggregate alarm can be "m storage pools have a total of x storage nodes generating y native alarms of type z". If the aggregate storage object corresponding to the aggregate alarm is a cluster, that is, the storage objects at all levels involved in the aggregate alarm include one cluster, two storage pools and three storage nodes, then the alarm details of the aggregate alarm can be "m storage pools in n clusters have a total of x storage nodes generating y native alarms of type z".

[0102] Since the aggregate alarm is aggregated by multiple native alarms, in the process of clearing the alarm of the aggregate alarm, it is necessary to clear the multiple native alarms involved in the aggregate alarm in sequence from high to low alarm levels; accordingly, when clearing the native alarms involved in the aggregate alarm, the alarm level of the aggregate alarm can be continuously updated according to the uncleared native alarms involved in the aggregate alarm. For example, the highest alarm level of the uncleared native alarms involved in the aggregate alarm is determined as the alarm level of the reported aggregate alarm, thereby continuously updating the alarm level of the aggregate alarm to continuously reduce the alarm level of the aggregate alarm, so that the alarm level of the aggregate alarm is consistent with the clearance of the native alarms of the aggregate alarm.

[0103] Each native alarm in the embodiment of the present invention corresponds to a data structure table, and the data structure table records the basic information of the native alarm. The data structure table of the native alarm includes the alarm category identifier of the native alarm, the alarm serial number, the object name and object IP address (Internet Protocol Address) of the lowest level storage object involved in the alarm, the alarm generation time, the alarm reporting time, the alarm duration, the alarm release time, the alarm level, the aggregation identifier, and the alarm serial number of the aggregated alarm to which the native alarm belongs. Among them, the alarm category identifier of the native alarm is used to identify the alarm category of the native alarm, and different alarm category identifiers correspond to different alarm categories. The alarm serial number of the native alarm is used to identify the native alarm, and different native alarms correspond to different alarm serial numbers. The alarm reporting time of the native alarm refers to the duration of the native alarm after reporting. The aggregation identifier of the native alarm is used to identify whether the native alarm has been aggregated, including an aggregated identifier and a non-aggregated identifier, such as 1 and 0.

[0104] It should be noted that no matter it is the alarm duration of the aggregate alarm or the alarm duration of the native alarm, when the alarm duration reaches the preset duration, the corresponding alarm can be lifted. However, during the alarm reporting process, the alarm duration of the aggregate alarm and the alarm duration of the native alarm may be reset.

[0105] Beneficial effect: The present invention analyzes the storage objects containing unreported native alarms level by level, so as to determine the storage objects containing more next-level storage objects or more unreported native alarms as storage objects to be aggregated, and aggregates the unreported native alarms in the storage objects to be aggregated before reporting. In this way, compared with directly reporting native alarms, the present invention can greatly reduce the number of reported alarms and the number of alarm reports without splitting the storage objects by aggregating alarms on the alarm reporting side, making it easier for operation and maintenance personnel to find key information from the alarm information more quickly, thereby reducing the difficulty of storage object management and operation and maintenance.

[0106] like Figure 4 and Figure 5 As shown, taking storage objects at all levels including clusters, storage pools and storage nodes as an example, the alarm aggregation method of the embodiment of the present invention is described in detail, and the specific scheme is as follows:

[0107] The cluster is checked every 10 seconds to see whether there are any unreported native alarms in the last 60 seconds. If the cluster has any unreported native alarms in the last 60 seconds, it is determined whether the number of unreported native alarms in the cluster is not less than 10. If the number of unreported native alarms in the cluster is less than 10, the unreported native alarms in the cluster are directly reported.

[0108] If the number of unreported native alarms in the cluster is not less than 10, determine the storage pool containing unreported native alarms from the cluster, and determine whether the number of storage pools containing unreported native alarms in the cluster is not less than 2; if the number of storage pools containing unreported native alarms in the cluster is less than 2, take the storage pool containing unreported native alarms in the cluster as the target storage pool, and perform the preset pool-level aggregation judgment operation on the target storage pool.

[0109] If the number of storage pools in the cluster that do not report native alarms is not less than 2, then n=0 is initialized, and the storage pools in the cluster that do not report native alarms are analyzed pool by pool, so that any unanalyzed storage pool in the storage pools in the cluster that do not report native alarms is used as the current storage pool to be analyzed, and the current storage pool to be analyzed is analyzed to determine whether the number of unreported native alarms in the current storage pool to be analyzed is not less than the maximum value, the maximum value=max(2, average number of alarms per pool / 2); the average number of alarms per pool is the average value determined based on the number of unreported native alarms in the cluster and the number of storage pools in the cluster that do not report native alarms. If the number of unreported native alarms in the current storage pool to be analyzed is not less than the maximum value, then the current storage pool to be analyzed is determined as the target storage pool, and n=n+1 is updated, and then it is determined whether all storage pools in the cluster that do not report native alarms are analyzed. If not all are analyzed, jump back to the step of using any unanalyzed storage pool in the storage pools in the cluster that do not report native alarms as the current storage pool to be analyzed. If all analyses are completed, determine whether n is not less than 2; if n is not less than 2, perform cluster-level alarm aggregation on the unreported native alarms in the cluster to obtain the target aggregate alarm, and report the target aggregate alarm; if n is less than 2, perform the preset pool-level aggregation judgment operation on the target storage pool. If the number of unreported native alarms in the current storage pool to be analyzed is less than the maximum value, further determine whether all storage pools in the cluster that contain unreported native alarms have been analyzed.

[0110] During the process of performing the preset pool-level aggregation judgment operation on the target storage pool, the storage nodes containing unreported native alarms are determined from the target storage pool, and it is determined whether the number of storage nodes containing unreported native alarms in the target storage pool is not less than 2; if the number of storage nodes containing unreported native alarms in the target storage pool is less than 2, the storage nodes containing unreported native alarms in the target storage pool are used as target storage nodes, and the preset node-level aggregation judgment operation is performed on the target storage nodes.

[0111] If the number of storage nodes in the target storage pool that do not report native alarms is not less than 2, then nn=0 is initialized, and the storage nodes in the target storage pool that do not report native alarms are analyzed node by node, so that any unanalyzed storage node in the storage nodes in the target storage pool that do not report native alarms is used as the current storage node to be analyzed, and the current storage node to be analyzed is analyzed to determine whether the number of unreported native alarms in the current storage node to be analyzed is not less than the maximum value, the maximum value=max(2, average number of alarms per node / 2); the average number of alarms per node is the average value determined based on the number of unreported native alarms in the target storage pool and the number of storage nodes in the target storage pool that do not report native alarms. If the number of unreported native alarms in the current storage node to be analyzed is not less than the maximum value, then the current storage node to be analyzed is determined as the target storage node, and nn=nn+1 is updated, and then it is determined whether all storage nodes in the target storage pool that do not report native alarms have been analyzed. If all analyses are not completed, jump back to the step of taking any unanalyzed storage node in the target storage pool that contains storage nodes that do not report native alarms as the current storage node to be analyzed. If all analyses are completed, determine whether nn is not less than 2; if nn is not less than 2, perform pool-level alarm aggregation on the unreported native alarms in the target storage pool to obtain the target aggregated alarm, and report the target aggregated alarm; if nn is less than 2, perform a preset node-level aggregation judgment operation on the target storage node. If the number of unreported native alarms in the current storage node to be analyzed is less than the maximum value, further determine whether all storage nodes in the target storage pool that contain unreported native alarms have been analyzed.

[0112] In the process of performing the preset node-level aggregation judgment operation on the target storage node, it is judged whether the number of unreported native alarms in the target storage node is not less than 5; if the number of unreported native alarms in the target storage node is not less than 5, node-level alarm aggregation is performed on the unreported native alarms in the target storage node to obtain a target aggregate alarm, and the target aggregate alarm is reported. If the number of unreported native alarms in the target storage node is less than 5, node-level alarm aggregation is not performed on the unreported native alarms in the target storage node.

[0113] Beneficial effect: The present invention analyzes the cluster containing unreported native alarms step by step in the order of cluster, storage pool and storage node, so as to determine the storage objects containing more next-level storage objects or more unreported native alarms as storage objects to be aggregated, and aggregates the unreported native alarms in the storage objects to be aggregated before reporting. In this way, compared with directly reporting native alarms, the present invention can greatly reduce the number of reported alarms and the number of alarm reports without splitting the cluster by aggregating alarms on the alarm reporting side, making it convenient for operation and maintenance personnel to find key information from the alarm information more quickly, thereby reducing the difficulty of cluster management and operation and maintenance.

[0114] See also Figure 6 As shown, an embodiment of the present invention provides an alarm aggregation device, including:

[0115] The storage level acquisition module 11 is used to acquire the current storage level of the current level storage object including the unreported native alarm;

[0116] The first object determination module 12 is used for determining, if the current storage level is not the preset minimum storage level, a next-level storage object including unreported native alarms from the current-level storage objects to obtain a target storage object, and determining whether to determine the current-level storage object as a storage object to be aggregated according to the total number of objects of the target storage object, and if not, determining the target storage object as a new current-level storage object, and jumping back to the step of obtaining the current storage level of the current-level storage object including unreported native alarms;

[0117] The second object determination module 13 is used to determine whether to determine the current level storage object as a storage object to be aggregated according to the total number of alarms that have not reported native alarms in the current level storage object if the current storage level is the preset lowest storage level;

[0118] The alarm aggregation module 14 is used to aggregate the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms.

[0119] Since the embodiments of the device part correspond to the above embodiments, please refer to the description of the embodiments of the method part for the embodiments of the device part, and will not be repeated here.

[0120] Beneficial effect: The present invention analyzes the storage objects containing unreported native alarms level by level, so as to determine the storage objects containing more next-level storage objects or more unreported native alarms as storage objects to be aggregated, and aggregates the unreported native alarms in the storage objects to be aggregated before reporting. In this way, compared with directly reporting native alarms, the present invention can greatly reduce the number of reported alarms and the number of alarm reports without splitting the storage objects by aggregating alarms on the alarm reporting side, making it easier for operation and maintenance personnel to find key information from the alarm information more quickly, thereby reducing the difficulty of storage object management and operation and maintenance.

[0121] Furthermore, the present application also discloses an electronic device. Figure 7 It is a structural diagram of an electronic device according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input and output interface 25 and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the alarm aggregation method disclosed in any of the aforementioned embodiments. In addition, the electronic device in this embodiment may specifically be an electronic computer.

[0122] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0123] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0124] The operating system 221 is used to manage and control various hardware devices on the electronic device and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the alarm aggregation method performed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0125] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed alarm aggregation method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0126] Furthermore, the present application also discloses a computer program product, including a computer program / instruction; wherein the computer program / instruction, when executed by a processor, implements the aforementioned disclosed alarm aggregation method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0127] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0128] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0129] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0130] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0131] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An alarm aggregation method, characterized in that: include: Get the current storage level of the current level storage object that contains the unreported native alarm; If the current storage level is not the preset minimum storage level, determine the next level storage object containing unreported native alarms from the current level storage objects to obtain the target storage object, and determine whether to determine the current level storage object as the storage object to be aggregated according to the total number of objects of the target storage object, if not, determine the target storage object as the new current level storage object, and jump again to the step of obtaining the current storage level of the current level storage object containing unreported native alarms; If the current storage level is the preset minimum storage level, determining whether to determine the current storage object as a storage object to be aggregated according to the total number of alarms for which no native alarms are reported in the current storage object; Alarm aggregation is performed on the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms.

2. The alarm aggregation method according to claim 1, characterized in that: The storage level of each level of storage objects is positively correlated with the storage capacity of each level of storage objects; The storage objects at each level include any one or a combination of cluster-level storage objects, pool-level storage objects and node-level storage objects.

3. The alarm aggregation method according to claim 1, characterized in that: Before obtaining the current storage level of the current level storage object including the unreported native alarm, the method further includes: Regularly check whether there are unreported native alarms in the top-level storage objects based on a preset time interval; If there are unreported native alarms in the highest-level storage object, determining whether to trigger an alarm aggregation operation based on a size relationship between the number of unreported native alarms in the highest-level storage object and a first preset number; If the alarm aggregation operation is triggered, the highest-level storage object is determined as the current-level storage object.

4. The alarm aggregation method according to claim 1, characterized in that: The step of determining the next level storage object including the unreported native alarm from the current level storage object to obtain the target storage object includes: Determine, from the current level storage objects, a next level storage object that includes an unreported native alarm; If the number of the next-level storage objects is less than a second preset number, determining the next-level storage objects as target storage objects; If the number of the next-level storage objects is not less than a second preset number, a target storage object is determined from the next-level storage objects based on the number of unreported native alarms in the next-level storage objects.

5. The alarm aggregation method according to claim 4, characterized in that: The determining the target storage object from the next-level storage object based on the number of unreported native alarms in the next-level storage object includes: Determining an average number of alarms for the next-level storage objects according to the number of unreported native alarms in the current-level storage objects and the number of the next-level storage objects; Determining an object screening condition for the target storage object based on the average number of alarms; The storage objects whose number of unreported native alarms meets the object screening condition are screened from the next-level storage objects to obtain the target storage object.

6. The alarm aggregation method according to claim 1, characterized in that: After the alarm aggregation is performed on the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms, the method further includes: Obtaining the alarm levels of the unreported native alarms in the storage object to be aggregated, and determining the highest alarm level from the alarm levels; If the alarm levels are consistent and the highest alarm level is not the preset highest level, the highest alarm level is upgraded, and the upgraded alarm level is determined as the alarm level of the target aggregate alarm; If the alarm levels are inconsistent or the highest alarm level is a preset highest level, the highest alarm level is determined as the alarm level of the target aggregate alarm.

7. The alarm aggregation method according to any one of claims 1 to 6, characterized in that: After the alarm aggregation is performed on the unreported native alarms in the determined storage objects to be aggregated to obtain target aggregated alarms, the method further includes: Determine whether there is a reported aggregate alarm among the reported alarms; If the reported aggregate alarm exists in the reported alarms, determining whether to report the target aggregate alarm based on the high-low relationship between the aggregation level of the reported aggregate alarm and the aggregation level of the target aggregate alarm; wherein the aggregation level of the aggregate alarm is a level determined based on the storage level of the aggregate storage object corresponding to the aggregate alarm; If the reported aggregate alarm does not exist in the reported alarms, the target aggregate alarm is reported.

8. The alarm aggregation method according to claim 7, characterized in that: The determining whether to report the target aggregation alarm based on the high-low relationship between the aggregation level of the reported aggregation alarm and the aggregation level of the target aggregation alarm includes: When there is a first reported aggregation alarm in the reported aggregation alarms, determining whether to release the first reported aggregation alarm based on the alarm duration of the first reported aggregation alarm, and determining whether to report the target aggregation alarm according to the alarm release status of the first reported aggregation alarm; the aggregation level of the first reported aggregation alarm is higher than the aggregation level of the target aggregation alarm; When the first reported aggregate alarm does not exist in the reported aggregate alarm and a second reported aggregate alarm exists, determining whether to report the target aggregate alarm based on the first alarm information coverage between the second reported aggregate alarm and the target aggregate alarm; the aggregation level of the second reported aggregate alarm is equal to the aggregation level of the target aggregate alarm; When the first reported aggregate alarm and the second reported aggregate alarm do not exist in the reported aggregate alarms and there is a third reported aggregate alarm, determine whether to cancel the third reported aggregate alarm and report the target aggregate alarm based on the coverage of the second alarm information between the target aggregate alarm and the third reported aggregate alarm; the aggregation level of the third reported aggregate alarm is lower than the aggregation level of the target aggregate alarm.

9. The alarm aggregation method according to claim 8, characterized in that: The determining whether to report the target aggregate alarm based on the first alarm information coverage between the second reported aggregate alarm and the target aggregate alarm includes: If the first alarm information coverage situation indicates that the alarm information of the second reported aggregate alarm completely covers the alarm information of the target aggregate alarm, resetting the alarm duration of the second reported aggregate alarm and canceling the target aggregate alarm; If the first alarm information coverage situation indicates that the alarm information of the second reported aggregate alarm does not completely cover the alarm information of the target aggregate alarm, the target aggregate alarm is reported.

10. The alarm aggregation method according to any one of claims 1 to 6, characterized in that: Also includes: If the current-level storage object is determined as the storage object to be aggregated according to the total number of objects or the total number of alarms, or if the current-level storage object is not determined as the storage object to be aggregated according to the total number of alarms, determining the unaggregated native alarm from the unreported native alarms; When there is no fourth reported aggregate alarm in the reported aggregate alarm, a preset judgment operation is performed to judge whether to report the non-aggregated native alarm based on the coverage of the third alarm information between each reported native alarm and the non-aggregated native alarm; the alarm information of the fourth reported aggregate alarm completely covers the alarm information of the non-aggregated native alarm; When the fourth reported aggregate alarm exists in the reported aggregate alarms, determine whether to cancel the fourth reported aggregate alarm based on the alarm duration of the fourth reported aggregate alarm, and determine whether to perform the preset judgment operation according to the alarm cancellation status of the fourth reported aggregate alarm.

Images