Alarm information processing method and device, electronic equipment and storage medium

Abstract

The invention provides an alarm information processing method and device, electronic equipment and a storage medium. The alarm information processing method comprises the following steps: firstly, obtaining alarm information of a target system; wherein the target system comprises an association system, a root cause system and an influence system. Performing key alarm sorting on the alarm information of the associated system to obtain a first key alarm sequence; performing key alarm sorting on the alarm information of the root cause system and the influence system to obtain a second key alarm sequence; and finally, generating a final key alarm sequence based on the first key alarm sequence and the second key alarm sequence. Therefore, by utilizing the method provided by the invention, analysis is carried out in combination with the alarm data of each target system, the key alarm information can be screened out, invalid alarms and noise alarms are removed from massive alarms, and the alarm accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for processing alarm information. Background Art

[0002] With the rapid advancement of cloud-native technologies such as microservices, containerization, and cloud computing, banking business systems are also gradually increasing their business continuity levels, and have the ability to maintain business continuity in disaster recovery situations including information technology failures, external service terminals, man-made damage, and natural disasters. In this context, business system equipment will frequently go online, relocate, expand capacity, and go offline, and a large number of alarms may be generated in the process.

[0003] In the prior art, all alarms are usually notified to various clients, and it is impossible to filter the alarms and identify the key alarms. Summary of the invention

[0004] In view of this, the present application provides a method, device, electronic device and storage medium for processing alarm information to solve the problem in the prior art that alarms cannot be filtered and key alarms cannot be identified.

[0005] To achieve the above objectives, this application provides the following technical solutions:

[0006] The first aspect of the present application discloses a method for processing alarm information, comprising:

[0007] Obtaining alarm information of a target system; wherein the target system includes a related system, a root cause system, and an impact system;

[0008] Sorting the alarm information of the associated system into key alarms to obtain a first key alarm sequence;

[0009] Sorting the alarm information of the root cause system and the influencing system into critical alarms to obtain a second critical alarm sequence;

[0010] A final critical alarm sequence is generated based on the first critical alarm sequence and the second critical alarm sequence.

[0011] Optionally, in the above method, the step of sorting the alarm information of the associated system into key alarms to obtain a first key alarm sequence includes:

[0012] Counting the correlation between the configuration item corresponding to each alarm information of the associated system and the root cause system and the influencing system;

[0013] Each alarm information of the associated system is sorted according to the association degree to obtain the first key alarm sequence.

[0014] Optionally, in the above method, the step of performing critical alarm sorting on the alarm information of the root cause system and the influencing system to obtain a second critical alarm sequence includes:

[0015] Filter out alarm information with a duration of M from the alarm information of the root cause system and the alarm information of the impact system;

[0016] Input the filtered alarm information into a pre-built clustering model for clustering to obtain a clustering result; wherein the clustering result is time series data that maps the alarm information based on the cluster number;

[0017] The clustering result is divided into windows to obtain the second key alarm sequence.

[0018] Optionally, the above method further includes:

[0019] For each alarm information in the final critical alarm sequence, matching the alarm mode of the current alarm information through a pre-built alarm mode set;

[0020] An alarm is issued for the current alarm information based on the alarm mode.

[0021] The second aspect of the present application discloses a device for processing alarm information, comprising:

[0022] An acquisition unit, used to acquire alarm information of a target system; wherein the target system includes a related system, a root cause system, and an impact system;

[0023] A first sorting unit, configured to sort the alarm information of the associated system into key alarms to obtain a first key alarm sequence;

[0024] A second sorting unit is used to sort the alarm information of the root cause system and the influencing system into key alarms to obtain a second key alarm sequence;

[0025] A generating unit is configured to generate a final critical alarm sequence based on the first critical alarm sequence and the second critical alarm sequence.

[0026] Optionally, in the above device, the first sorting unit includes:

[0027] A statistical subunit, used to count the correlation between the configuration item corresponding to each alarm information of the associated system and the root cause system and the influencing system;

[0028] The sorting subunit is used to sort each alarm information of the associated system according to the association degree to obtain the first key alarm sequence.

[0029] Optionally, in the above device, the second sorting unit includes:

[0030] A screening subunit, configured to screen out the alarm information with a duration of M from the alarm information of the root cause system and the alarm information of the impact system;

[0031] A clustering subunit, used for inputting the screened alarm information into a pre-built clustering model for clustering to obtain a clustering result; wherein the clustering result is time series data for mapping the alarm information based on the cluster number;

[0032] The partitioning subunit is used to perform window partitioning on the clustering result to obtain the second key alarm sequence.

[0033] Optionally, the above device further includes:

[0034] A matching unit, configured to match the alarm mode of the current alarm information through a pre-built alarm mode set for each alarm information in the final critical alarm sequence;

[0035] An alarm unit is used to issue an alarm for the current alarm information based on the alarm mode.

[0036] The third aspect of the present application discloses an electronic device, comprising:

[0037] one or more processors;

[0038] a storage device having one or more programs stored thereon;

[0039] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of the first aspects of the present invention.

[0040] A fourth aspect of the present application discloses a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in any one of the first aspects of the present invention is implemented.

[0041] It can be seen from the above technical scheme that in a method for processing alarm information provided by the present application, the alarm information of the target system is first obtained; wherein the target system includes an associated system, a root cause system and an influencing system. Then, the alarm information of the associated system is sorted by key alarms to obtain a first key alarm sequence. Then, the alarm information of the root cause system and the influencing system is sorted by key alarms to obtain a second key alarm sequence. Finally, based on the first key alarm sequence and the second key alarm sequence, a final key alarm sequence is generated. It can be seen that by using the method of the present application and combining the alarm data of each target system for analysis, it is possible to screen out key alarm information, remove invalid alarms and noise alarms from massive alarms, and improve the accuracy of alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 A flowchart of a method for processing alarm information disclosed in an embodiment of the present application;

[0044] Figure 2 This is a flowchart of an implementation of step S103 disclosed in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of a method and device for processing alarm information disclosed in an embodiment of the present application;

[0046] Figure 4 A schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0049] Furthermore, in this document, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0050] From the background technology, we can see that with the rapid advancement of cloud-native technologies such as microservices, containerization, and cloud computing, banking business systems are also gradually increasing their business continuity levels, and have business continuity capabilities in disaster recovery situations including information technology failures, external service terminals, man-made damage, and natural disasters. In this context, business system equipment will frequently go online, relocate, expand capacity, and go offline.

[0051] The monitoring system must be able to quickly and accurately identify the impact on the business system and the scope of faults, and use big data, streaming computing and artificial intelligence technology to reduce invalid alarms, noise alarms, etc., reduce the number of alarms, and analyze the real source of alarms that are hidden from the massive alarms as much as possible. Providing timely, accurate, and comprehensive alarm notifications and important alarm identification methods and devices for various systems of the bank is the technical problem to be solved by this application.

[0052] In view of this, the present application provides a method, device, electronic device and storage medium for processing alarm information to solve the above problems.

[0053] The first aspect of the present application provides a method for processing alarm information, such as Figure 1 As shown, specifically including:

[0054] S101. Acquire alarm information of a target system; wherein the target system includes a related system, a root cause system, and an impact system.

[0055] It should be noted that the alarm information generated by the target system is first obtained, wherein the target system includes the associated system, the root cause system and the impact system, and other business systems can also be added according to actual needs.

[0056] S102: Sort the alarm information of the associated system into key alarms to obtain a first key alarm sequence.

[0057] It should be noted that after the alarm information of the target system is obtained, the alarm information of the associated system is sorted by key alarms to obtain a first key alarm sequence. In the first alarm sequence, the alarm information is sorted according to the correlation between the configuration items corresponding to the alarm information and the root cause system and the affected system.

[0058] Optionally, in another embodiment of the present application, an implementation of the above step S102 may include:

[0059] Statistics are collected to show the correlation between the configuration item corresponding to each alarm information of the associated system and the root cause system and the affected system.

[0060] Each alarm information of the associated system is sorted according to the correlation degree to obtain a first key alarm sequence.

[0061] It should be noted that the correlation between the configuration items corresponding to each alarm information of the associated system and the root cause system and the affected system is first counted, and each alarm information of the associated system is sorted according to the correlation. The higher the correlation, the higher the ranking. If there are alarm information with the same correlation, the alarm information with the same correlation is sorted according to the time sequence relationship. The earlier the time, the higher the ranking. In this way, the first key alarm sequence is obtained.

[0062] S103: sort the alarm information of the root cause system and the affected system into key alarms to obtain a second key alarm sequence.

[0063] It should be noted that after the alarm information of the target system is obtained, the alarm information of the root cause system and the influencing system is sorted into key alarms to obtain a second key alarm sequence. In the second alarm sequence, the alarm information is sorted by cluster analysis.

[0064] Optionally, in another embodiment of the present application, an implementation of step S103 is as follows: Figure 2 As shown, this may include:

[0065] S201. Filter out alarm information with a duration of M from the alarm information of the root cause system and the alarm information of the affected system.

[0066] It should be noted that, firstly, the alarm information with a duration of M is screened out from the alarm information of the root cause system and the affected system, wherein M can be set according to the actual situation.

[0067] S202: Input the screened alarm information into a pre-built clustering model for clustering to obtain a clustering result; wherein the clustering result is time series data that maps the alarm information based on the cluster number.

[0068] It should be noted that the filtered alarm information is input into a pre-constructed clustering model for clustering to obtain a clustering result. The clustering model is a clustering model constructed based on the K-means algorithm. Among them, the clustering result will carry a clustering number. For example, clustering number 1 is a normal alarm, and the clustering result is time-series data obtained by mapping the alarm information based on the clustering number.

[0069] S203. Perform window partitioning on the clustering result to obtain the second critical alarm sequence.

[0070] It should be noted that if an alarm appears many times within a window time but rarely appears in other time windows, then this alarm is very important during this period. The importance degree of each type of alarm is calculated using the following formula. Therefore, perform window partitioning on the clustering result to obtain the second critical alarm sequence. For example, partition the time-series data with a duration of M into K windows with a duration of N (N < M), and perform sorting of critical alarms. The formula is as follows:

[0071]

[0072] Among them, the first half represents alarm K i The frequency of occurrence in window w j The second half represents alarm K i The universality, including the fewer windows containing alarm K i The larger this value is, indicating that the alarm has good discrimination ability (correlation).

[0073] S104. Generate the final critical alarm sequence based on the first critical alarm sequence and the second critical alarm sequence.

[0074] It should be noted that after obtaining the first critical alarm sequence and the second critical alarm sequence, the alarm information of the associated system is given priority, and the alarm information of the root cause system and the impact system is used as a supplement to generate the final critical alarm sequence. First, calculate the similarity between the alarm information in the first critical alarm sequence and each alarm information in the second critical alarm sequence. If there is alarm information with a similarity greater than the preset threshold, then use the alarm information in the first critical alarm sequence as the standard and put the alarm information in the first critical alarm sequence into the final critical alarm sequence. If there is no alarm information with a similarity not greater than the preset threshold, then put the alarm information in the first critical alarm sequence and the second critical alarm sequence into the final critical alarm sequence, thereby generating the final critical alarm sequence. Among them, the threshold can be set according to the actual situation, such as 0.9.

[0075] Optionally, in another embodiment of the present application, the above method for processing alarm information may further include:

[0076] For each alarm information in the final critical alarm sequence, the alarm mode of the current alarm information is matched through the pre-built alarm mode set.

[0077] Alert the current alarm information based on the alarm mode.

[0078] It should be noted that for each alarm information in the final key alarm sequence, the alarm pattern of the current alarm information is matched through the pre-built alarm pattern set. Among them, the alarm pattern set is obtained by pre-processing the historical alarm data, such as stop word processing, word segmentation processing, variable identification, variable elimination, etc., and then clustering the pre-processed historical alarm data. Alarm patterns include but are not limited to SMS alarms, email alarms, telephone alarms, etc.

[0079] Based on the similarity between the current alarm information in the final key alarm sequence and each data in the alarm pattern set, the alarm pattern of the current alarm information is matched, and then the current alarm information is alarmed through the matched alarm pattern. If the alarm pattern is not matched, a new alarm model is generated and the new alarm pattern is used for alarming.

[0080] In a method for processing alarm information provided by an embodiment of the present application, the alarm information of a target system is obtained; wherein the target system includes an associated system, a root cause system, and an impact system; the alarm information of the associated system is sorted by key alarms to obtain a first key alarm sequence; the alarm information of the root cause system and the impact system is sorted by key alarms to obtain a second key alarm sequence; based on the first key alarm sequence and the second key alarm sequence, a final key alarm sequence is generated. It can be seen that by using the method of the present application and combining the alarm data of each target system for analysis, it is possible to filter out key alarm information, remove invalid alarms and noise alarms from massive alarms, and improve the accuracy of alarms.

[0081] Another embodiment of the present application also discloses a device for processing alarm information, such as Figure 3 As shown, specifically including:

[0082] The acquisition unit 301 is used to acquire the alarm information of the target system; wherein the target system includes the associated system, the root cause system and the impact system.

[0083] The first sorting unit 302 is used to sort the alarm information of the associated system into key alarms to obtain a first key alarm sequence.

[0084] The second sorting unit 303 is used to sort the alarm information of the root cause system and the impact system into key alarms to obtain a second key alarm sequence;

[0085] The generating unit 304 is configured to generate a final critical alarm sequence based on the first critical alarm sequence and the second critical alarm sequence.

[0086] In this embodiment, the specific execution process of the acquisition unit 301, the first sorting unit 302, the second sorting unit 303 and the generation unit 304 can be referred to the corresponding Figure 1 The content of the method embodiment will not be repeated here.

[0087] In an alarm information processing device provided by an embodiment of the present application, an acquisition unit 301 acquires the alarm information of a target system; wherein the target system includes an associated system, a root cause system, and an impact system; a first sorting unit 302 performs key alarm sorting on the alarm information of the associated system to obtain a first key alarm sequence; a second sorting unit 303 performs key alarm sorting on the alarm information of the root cause system and the impact system to obtain a second key alarm sequence; a generation unit 304 generates a final key alarm sequence based on the first key alarm sequence and the second key alarm sequence. It can be seen that by using the method of the present application and analyzing the alarm data of each target system, it is possible to screen out key alarm information, remove invalid alarms and noise alarms from massive alarms, and improve the accuracy of alarms.

[0088] Optionally, in another embodiment of the present application, an implementation of the first sorting unit 302 includes:

[0089] The statistics subunit is used to count the correlation between the configuration item corresponding to each alarm information of the associated system and the root cause system and the affected system.

[0090] The sorting subunit is used to sort each alarm information of the associated system according to the correlation degree to obtain a first key alarm sequence.

[0091] In this embodiment, the specific execution process of the statistical subunit and the sorting subunit can be found in the corresponding method embodiment described above, and will not be repeated here.

[0092] Optionally, in another embodiment of the present application, an implementation of the second sorting unit 303 includes:

[0093] The screening subunit is used to screen out the alarm information with a duration of M from the alarm information of the root cause system and the alarm information of the affected system.

[0094] The clustering subunit is used to input the screened alarm information into a pre-built clustering model for clustering to obtain a clustering result; wherein the clustering result is time series data that maps the alarm information based on the cluster number.

[0095] The partitioning subunit is used to partition the clustering result into windows to obtain a second key alarm sequence.

[0096] In this embodiment, the specific execution process of the screening subunit, the clustering subunit and the partitioning subunit can be found in the corresponding Figure 2 The content of the method embodiment will not be repeated here.

[0097] Optionally, in another embodiment of the present application, the above-mentioned warning information processing device may further include:

[0098] The matching unit is used to match the alarm mode of the current alarm information through a pre-built alarm mode set for each alarm information in the final key alarm sequence.

[0099] The alarm unit is used to issue an alarm for the current alarm information based on the alarm mode.

[0100] In this embodiment, the specific execution process of the matching unit and the alarm unit can refer to the corresponding method embodiment described above, which will not be repeated here.

[0101] Another embodiment of the present application further provides an electronic device, such as Figure 4 As shown, specifically including:

[0102] One or more processors 401 .

[0103] The storage device 402 stores one or more programs.

[0104] When one or more programs are executed by one or more processors 401 , the one or more processors 401 implement any one of the methods in the above embodiments.

[0105] Another embodiment of the present application further provides a computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, any one of the methods in the above embodiments is implemented.

[0106] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0107] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0108] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing alarm information, characterized in that: include: Obtaining alarm information of a target system; wherein the target system includes a related system, a root cause system, and an impact system; Sorting the alarm information of the associated system into key alarms to obtain a first key alarm sequence; Sorting the alarm information of the root cause system and the influencing system into critical alarms to obtain a second critical alarm sequence; A final critical alarm sequence is generated based on the first critical alarm sequence and the second critical alarm sequence.

2. The method according to claim 1, characterized in that The step of performing critical alarm sorting on the alarm information of the associated system to obtain a first critical alarm sequence includes: Counting the correlation between the configuration item corresponding to each alarm information of the associated system and the root cause system and the influencing system; Each alarm information of the associated system is sorted according to the association degree to obtain the first key alarm sequence.

3. The method according to claim 1, characterized in that: The step of performing critical alarm sorting on the alarm information of the root cause system and the impact system to obtain a second critical alarm sequence includes: Filter out alarm information with a duration of M from the alarm information of the root cause system and the alarm information of the impact system; Input the filtered alarm information into a pre-built clustering model for clustering to obtain a clustering result; wherein the clustering result is time series data that maps the alarm information based on the cluster number; The clustering result is divided into windows to obtain the second key alarm sequence.

4. The method according to claim 1, characterized in that: Also includes: For each alarm information in the final critical alarm sequence, matching the alarm mode of the current alarm information through a pre-built alarm mode set; An alarm is issued for the current alarm information based on the alarm mode.

5. A device for processing alarm information, characterized in that: include: An acquisition unit, used to acquire alarm information of a target system; wherein the target system includes a related system, a root cause system, and an impact system; A first sorting unit, configured to sort the alarm information of the associated system into key alarms to obtain a first key alarm sequence; A second sorting unit is used to sort the alarm information of the root cause system and the influencing system into key alarms to obtain a second key alarm sequence; A generating unit is configured to generate a final critical alarm sequence based on the first critical alarm sequence and the second critical alarm sequence.

6. The device according to claim 5, characterized in that The first sorting unit comprises: A statistical subunit, used to count the correlation between the configuration item corresponding to each alarm information of the associated system and the root cause system and the influencing system; The sorting subunit is used to sort each alarm information of the associated system according to the association degree to obtain the first key alarm sequence.

7. The device according to claim 5, characterized in that The second sorting unit comprises: A screening subunit, configured to screen out the alarm information with a duration of M from the alarm information of the root cause system and the alarm information of the impact system; A clustering subunit, used for inputting the screened alarm information into a pre-built clustering model for clustering to obtain a clustering result; wherein the clustering result is time series data for mapping the alarm information based on the cluster number; The partitioning subunit is used to perform window partitioning on the clustering result to obtain the second key alarm sequence.

8. The device according to claim 5, characterized in that Also includes: A matching unit, configured to match the alarm mode of the current alarm information through a pre-built alarm mode set for each alarm information in the final critical alarm sequence; An alarm unit is used to issue an alarm for the current alarm information based on the alarm mode.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 4.

10. A computer storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images