A small AI model training method based on alarm log keywords

Abstract

The present invention discloses an AI small model training method based on alarm log keywords, which relates to the technical field of alarm monitoring, and comprises: obtaining keywords to be monitored, wherein the number of current keywords includes at least one; receiving abnormal information submitted for recording in the current log service, wherein the abnormal information includes at least a warning log and an error log; extracting keywords to be monitored based on the current abnormal information; defining relevant query statements for counting the number of entries containing the keywords within a specific time period; establishing corresponding monitoring rules based on the current query results; sending an alarm notification to relevant personnel when a corresponding alarm is triggered; and setting corresponding monitoring rules based on the keywords, so that the alarm information belonging to the same working module is divided and grouped, thereby enabling unified management of relevant alarms, and rapid identification and response to complex problems involving multiple systems or services through alarm grouping.

Description

Technical Field

[0001] The present invention relates to the field of alarm monitoring technology, and more specifically, to an AI small model training method based on alarm log keywords. Background Art

[0002] Keyword-based alarm log is a monitoring technology that allows users to search for specific keywords in logs and trigger alarms when these keywords appear. This technology is widely used to quickly perceive and locate problems in system operation, especially when the system is abnormal or wrong; In the context of increasingly complex systems, in actual application scenarios, the proliferation of alarm notifications has become a major problem faced by the work team. Too much alarm information not only increases the workload, but also may cause key alarms to be overwhelmed, thereby reducing the efficiency and accuracy of operation and maintenance response. In order to improve this situation, the existing alarm system should be optimized to reduce unnecessary alarm interference and ensure that key alarms can be quickly identified and processed, which is crucial to maintaining system stability and improving the efficiency of operation and maintenance work. Summary of the invention

[0003] To solve the above problems, the present invention provides an AI small model training method based on alarm log keywords.

[0004] The present invention provides an AI small model training method based on alarm log keywords, comprising: Get the keywords that need to be monitored, and the number of current keywords includes at least one; Receive the exception information of the submitted record in the current log service, where the exception information includes at least warning log and error log; Extract keywords that need to be monitored based on current abnormal information; Define relevant query statements to count the number of entries containing keywords within a specific time period; Establish corresponding monitoring rules based on the current query results; When the corresponding alarm is triggered, an alarm notification is sent to relevant personnel.

[0005] Preferably, the establishing of corresponding monitoring rules based on the current query results includes: Set the corresponding pre-trigger conditions in advance, specifically: This includes but is not limited to triggering an alarm when a specific keyword appears in a log, triggering an alarm when a keyword reaches a specified number of times, and triggering an alarm based on log line statistics.

[0006] Preferably, when the corresponding alarm is triggered, sending an alarm notification to relevant personnel includes the following steps, specifically: Alarms are grouped into business, modules, and teams according to different components of the platform to ensure that relevant alarm information can be notified to the corresponding person in charge in a timely manner; Alarm information belonging to the same working module is planned into the same group, specifically: Build a unified alarm management system to access and integrate the alarm information of various monitoring systems; Perform level planning for alarm notifications generated based on the importance of the alarm information; Aggregate related alert notifications and send them as a single message; Set up alarm silencing before sending alarm notifications to relevant personnel.

[0007] Preferably, when a corresponding alarm is triggered, before sending an alarm notification to relevant personnel, the process further includes: Plan alarm suppression rules to suppress low-priority alarm notifications when an alarm is triggered. Specifically: Get the priority of all alarm notifications when the current alarm notification is triggered; Determine whether there are overlapping related alarm notifications based on the priorities of all current alarm notifications; If there are related alarm notifications, the alarm notifications with related but low priority will be adjusted to the highest priority of the current alarm notifications, and the alarm notifications with low priority will be suppressed; If there is no associated alarm notification, relevant personnel will be notified according to the priority of the current alarm notification.

[0008] Preferably, if there is an associated alarm notification, the alarm notification with associated but low priority is adjusted to the highest priority of the current alarm notification, and the alarm notification with low priority is suppressed specifically as follows: Get the groups involved in the current alarm notification; When the alarm notification includes at least two groups, determining whether the current alarm notification has a subordinate level; When it is determined that there is a subsidiary level, the alarm notification that needs to be processed first is marked as the first level, and the alarm notification that needs to be processed later is marked as the second level; Get the priorities of the first and second levels; Adjust the priority of the first level to be greater than or equal to the second priority.

[0009] Preferably, the step of adjusting the priority of the first level to be greater than or equal to the second priority level is as follows: When the priority of the first level is greater than the priority of the second level, the priority of the first level is maintained unchanged; When the priority of the first level is lower than that of the second level, the priority of the first level is adjusted to be higher than that of the second level and notification is made.

[0010] Preferably, when the priority of the first level is lower than that of the second level, the step of adjusting the priority of the first level to be higher than that of the second level and before notifying includes: Get the specific alarm notification time of the second level; Obtain the specific alarm notification time of the first level, and determine the alarm response time after the first level obtains the specific alarm notification, and the two are collectively marked as the alarm processing time; Verify whether the first-level alarm processing time is completed before the second-level alarm notification time occurs; If the alarm processing time of the first level exceeds the time range of the specific alarm of the second level, the alarm notification time of the first level will be adjusted in advance until it is ensured that after the alarm of the first level is processed, its total time is still earlier than the specific occurrence time of the alarm of the second level. If there is a conflict with other alarm notifications after adjustment, they will be notified in parallel; If the first-level alarm processing time is within the time range of the second-level specific alarm, notification will be made normally according to the specific alarm time.

[0011] Preferably, if there is an associated alarm notification, the method further includes: Get the specific time when the current group handles the low-level alarm notification; Determine the specific time to handle high-level alarm notifications in other groups; Compare the specific times of the two; If the specific time for processing the low-level alarm notification is before the specific time for processing the high-level alarm notification, there is no need to adjust the level of the low-level alarm notification; If the specific time of processing the low-level alarm notification is after the specific time of processing the high-level alarm notification, the level of the low-level alarm notification is adjusted to be consistent with or greater than the level of the high-level alarm notification.

[0012] Preferably, when a corresponding alarm is triggered, sending an alarm notification to relevant personnel includes: Build a notification strategy based on the alarm information, specifically: After sending the alarm information, the receiver is required to confirm the alarm information to ensure that the alarm information is known to the receiver; If no feedback confirmation information is received within the preset time, the alarm notification will be automatically upgraded, the alarm information will be sent to the next level person in charge, and the receiver will be asked to confirm the alarm information again until feedback confirmation information is received; After the alarm is resolved, a notification is automatically sent to relevant personnel to inform them that the problem has been resolved.

[0013] Preferably, the aggregating related alarm notifications together as a single message and sending it specifically includes: Get the content information of the current alarm notification and mark it; Pre-set a similarity threshold; Classify the marked content information into similar information and dissimilar information. After comparing two or more pieces of information, if the repetitive part of the two or more pieces of information is greater than the similarity threshold, mark the two or more pieces of information as similar information and assign numbers to them. After comparing two or more pieces of information, if the repetitive part of the two or more pieces of information is less than or equal to the similarity threshold, mark the pieces of information whose repetitiveness is less than the similarity threshold as dissimilar information and assign numbers to them separately. Combine and aggregate similar information into a single piece of information; Treat each dissimilar message individually numbered as a single message.

[0014] Beneficial effects: 1. Set corresponding monitoring rules based on keywords to divide and group the alarm information belonging to the same work module, so that related alarms can be managed in a unified manner. Alarm grouping can quickly identify and respond to complex problems involving multiple systems or services, because all related alarms are aggregated together, which is convenient for related staff to view and handle at one time, making it easier to see the overall impact of the problem, improve the efficiency and accuracy of the response, and help diagnose and solve the problem faster.

[0015] 2. When the alarm notification includes at least two groups, further determine whether there is a subordinate level. After determining the existence of a subordinate level, judge the level of the alarm notification by determining the priority to determine whether it needs to be adjusted. On the one hand, it helps to avoid affecting the progress of other tasks due to the adjustment of the level. On the other hand, by matching the priorities between the two, it is helpful to prevent the subsequent work from being affected by the mismatch between the priorities of different groups. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of the training method of the present invention. DETAILED DESCRIPTION

[0017] Application scenario: With the increasing complexity of the system, the proliferation of alarm notifications has become a major problem faced by the work team. Too much alarm information not only increases the workload, but also may cause key alarms to be overwhelmed, thereby reducing the efficiency and accuracy of operation and maintenance response. In order to improve this situation, the existing alarm system should be optimized to reduce unnecessary alarm interference and ensure that key alarms can be quickly identified and processed, which is crucial to maintaining the stability of the system and improving the efficiency of operation and maintenance work.

[0018] like Figure 1 As shown: A small AI model training method based on alarm log keywords, including: A1: Obtain keywords that need to be monitored. The number of current keywords includes at least one. It should be noted that the keywords that need to be monitored are set in advance in the service system. Keywords include but are not limited to sentences, paragraphs, and single characters, etc., and can be set in advance based on needs.

[0019] A2: Receive the exception information of the submitted record in the current log service, and the exception information includes at least warning log and error log. It should be noted that when the warning log and error log appear, the alarm content in the current log service is highlighted, including but not limited to the background color, mark color, etc., and the current exception information is sent to the service system for analysis.

[0020] A3: extracting keywords to be monitored based on the current abnormal information; it should be noted that the content of the submitted abnormal information is analyzed to determine whether the pre-set keywords appear in the current abnormal information.

[0021] A4: Define relevant query statements to count the number of entries containing the keyword within a specific time period. It should be noted that by defining the query statement in the service system in advance, it is possible to quickly query whether the keyword exists in the current abnormal information, thereby reducing processing time.

[0022] It should be noted again that the query statement can be based on Alibaba Cloud Log Service (SLS). Alibaba Cloud Log Service (SLS) supports the use of unified query analysis syntax to query and define monitoring targets; Prometheus is an open source monitoring and alerting tool. Prometheus uses PromQL to query monitoring data and so on.

[0023] A5: When the corresponding alarm is triggered, an alarm notification is sent to relevant personnel; It should be noted that once the alarm condition is triggered, the system will send an alarm notification to relevant personnel through a preset notification method (such as email, SMS, instant messaging tools, etc.), and the alarm notification can quote the content in the original log to provide detailed alarm information to facilitate rapid response and problem location.

[0024] As an optional embodiment: the establishing of corresponding monitoring rules based on the current query result includes: Set the corresponding pre-trigger conditions in advance, specifically: Including but not limited to triggering an alarm when a specific keyword appears in the log, triggering an alarm when a keyword reaches a specified number of times, and triggering an alarm based on log line statistics; It should be noted that searching for keywords in logs in the service system helps to quickly perceive and locate problems; For example, within a certain time range, if the number of times a log keyword appears reaches a specified number, an alarm will be triggered. This method can achieve the effect of noise reduction, and only issue an alarm when the keyword appears frequently; For keywords that appear periodically, you can use the year-on-year and month-on-month functions to calculate the ratio of keyword appearances in the same time period on different dates and set alarms. For example, if the growth rate of keyword appearances in the current time period exceeds a certain ratio compared to the same time period yesterday, an alarm will be triggered.

[0025] As an optional embodiment: when the corresponding alarm is triggered, sending an alarm notification to relevant personnel includes the following steps, specifically: Alarms are grouped into business, modules, and teams according to different components of the platform to ensure that relevant alarm information can be notified to the corresponding person in charge in a timely manner. It should be noted that in the actual application process, if a large amount of alarm information appears, without unified alarm management, the alarm information is scattered in different systems, making it difficult to quickly associate related alarms, affecting the timely resolution of problems. Therefore, alarms are grouped according to business, module, and team. For example, database-related alarms are only notified to the database team (DBA), and network-related alarms are notified to the network work team, which helps ensure that relevant alarms can quickly reach the corresponding person in charge.

[0026] Alarm information belonging to the same working module is planned into the same group, specifically: Build a unified alarm management system to access and integrate the alarm information of each monitoring system; it should be noted that by selecting a suitable unified alarm management platform (management system), the selected platform should support the alarm access of multiple monitoring systems and ensure the compatibility and scalability of the system. Commonly used monitoring systems in enterprises include various cloud monitoring, Prometheus, Zabbix, Nagios, Nightingale, Open-Falcon, Grafana, ELK, etc. The unified alarm management platform should support the alarm access of these monitoring systems; clarify the functional requirements that the unified alarm management system needs to meet, including alarm access, processing, analysis, notification, etc. It needs to be determined based on the actual operation and maintenance situation of the enterprise and future development plans; The alarm information obtained through monitoring is processed in a unified manner, for example, by dividing the information so that the information in the same group is classified and integrated.

[0027] The alarm notification generated according to the importance of the alarm information is level-planned; it should be noted that after the alarm information is obtained, the current alarm notification content is level-planned according to the pre-set level, which helps to promptly notify the relevant person in charge of the high-level alarm notification for verification and processing.

[0028] Related alarm notifications are aggregated together and sent as a single message. It should be noted that when related alarm information is obtained, similar alarm information is classified and combined into one message for notification.

[0029] When a large number of alarm notifications appear, notifications of the same type and category are integrated, similar alarms are merged, and the number of alarms is reduced. For example, multiple occurrences of the same error within a certain period of time can be merged into one alarm event, and all of them are classified into the same information. Then the information of the same type and category are merged into a notification, which helps to reduce the number of alarm notifications that need to be displayed and reduce the occurrence of untimely processing due to filtering information.

[0030] By integrating and notifying similar information as above, it is helpful to realize the centralized display and processing of alarm information, making it convenient for relevant personnel to quickly view and process alarm information.

[0031] It should be noted that during the integration process, alarm information in different formats needs to be uniformly formatted to ensure that the information is accurate and readable.

[0032] Set the alarm silence before sending the alarm notification to the relevant personnel. It should be noted that after the information integration is completed, the alarm notification needs to be sent to the relevant personnel, but before that, in order to prevent certain operations (such as regular system upgrades) from triggering alarms, you can set the alarm silence in advance to avoid the interference of these alarms. However, you need to ensure that the silence is lifted in time after the maintenance is completed to avoid missing the real problem alarm.

[0033] As an optional embodiment: when the corresponding alarm is triggered, before sending the alarm notification to the relevant personnel, the method further includes: Plan alarm suppression rules to suppress low-priority alarm notifications when an alarm is triggered. Specifically: Get the priority of all alarm notifications when the current alarm notification is triggered; it should be noted that after the alarm notification is generated, the priority of each alarm notification is confirmed and sorted from high to low.

[0034] Based on the priorities of all current alarm notifications, it is determined whether there are overlapping related alarm notifications; it should be noted that after each alarm notification is generated, it is determined whether there are related notifications between each alarm notification; For example, corresponding alarm notifications are generated in the three groups. However, in the actual application process, the alarm notifications in two of the groups are interrelated. Group A has high-level alarm notifications that need to be processed, and Group B has low-level alarm notifications that need to be processed. However, when the high-level notifications of Group A need to be processed, Group B needs to process the low-level alarm notifications first before Group A can process the high-level alarm notifications. Therefore, there is a contradiction between the two.

[0035] If there are related alarm notifications, the alarm notifications with related but low priority will be adjusted to the highest priority of the current alarm notifications, and the alarm notifications with low priority will be suppressed; It should be noted that based on the above contradictions, we adopt the method of adjusting the priority to solve; For example, in the case of associated alarm notifications, we adjust the alarm notification with low priority to be consistent with the alarm notification with high priority. If the alarm notification of group A has high priority and the alarm notification of group B has low priority, but we need to process the alarm notification of group B before processing the alarm notification of group A, in order not to affect the alarm notification of group A, we adjust the alarm notification of group B to be equal to the alarm notification of group A, which helps to avoid the low priority of the alarm notification of group B affecting the processing effect of the high priority alarm notification of group A.

[0036] If there is no associated alarm notification, relevant personnel will be notified according to the priority of the current alarm notification; it should be noted that if there is no association, it can be handled according to the actual situation.

[0037] As an optional embodiment: if there is an associated alarm notification, the alarm notification with associated but low priority is adjusted to the highest priority of the current alarm notification, and the alarm notification with low priority is suppressed specifically as follows: Get the groups involved in the current alarm notification; it should be noted that after the alarm notification occurs, get the groups to which the alarm notification is sent.

[0038] When the alarm notification received includes at least two groups, determine whether the current alarm notification has a subordinate level. It should be noted that when the alarm notification received involves at least two groups, determine whether there is a vassal relationship. The vassal relationship specifically means that there are steps in sequence between the two, that is, only after one alarm notification is processed can another alarm notification be processed. If the above requirements are met, there is a subordinate level.

[0039] When it is determined that there is a subsidiary level, the alarm notification that needs to be processed first will be marked as the first level, and the alarm notification that needs to be processed later will be marked as the second level; it should be noted that after it is determined that there is a subsidiary level, the alarm notification that needs to be processed first will be marked as the first level, and the alarm notification that needs to be processed after the first level is processed will be marked as the second level, and so on. When there are the same levels, they are distinguished by assigning numbers, for example, the first level 1, the first level 2, the two are of the same level.

[0040] The priorities of the first level and the second level are obtained; it should be noted that the priority between the first level and the second level is determined, wherein the determination of the priority is pre-set in the system.

[0041] The priority of the first level is adjusted to be greater than or equal to the second priority. It should be noted that after the priority is determined, the priority of the first level that needs to be processed first is adjusted to be greater than or equal to the second priority.

[0042] As an optional embodiment: the step of adjusting the priority of the first level to be greater than or equal to the second priority level is as follows: When the priority of the first level is greater than the priority of the second level, the priority of the first level is maintained unchanged; it should be noted that if the priority of the first level itself is greater than or equal to the second priority, no adjustment is required.

[0043] When the priority of the first level is lower than that of the second level, the priority of the first level is adjusted to be greater than that of the second level and notification is made; it should be noted that if the priority of the first level is lower than that of the second level, the priority of the first level is adjusted to be greater than or equal to that of the second level, and relevant personnel are notified after the adjustment.

[0044] As an optional embodiment: when the priority of the first level is lower than that of the second level, the step of adjusting the priority of the first level to be higher than that of the second level and before notifying includes: Obtain the specific alarm notification time of the second level; it should be noted that the specific time of the second level alarm time is determined.

[0045] The specific alarm notification time of the first level is obtained, and the alarm response time after the first level obtains the specific alarm notification is determined, and the two are jointly marked as the alarm processing time; it should be noted that the specific alarm notification time of the first level is obtained, and the time required for processing after obtaining the alarm notification is further determined, which is marked as the alarm response time, and the specific alarm notification time and the alarm response time are combined to form the alarm processing time; Assume that the specific alarm time of the first level is eight o'clock, and the response time required is half an hour, so the alarm processing time is half past eight.

[0046] Verify whether the first-level alarm processing time is completed before the second-level alarm notification time occurs; Specifically, after obtaining the first-level alarm processing time, compare it with the determined second-level alarm notification time to determine whether it is completed before the first-level alarm notification time; For example, based on the above, we take the first-level alarm processing time as 8:30 as an example. When the specific alarm time of the second level is determined to be 9 o'clock, after the first-level alarm processing time arrives, we can determine that the second-level alarm notification time has not yet arrived, so there is no conflict between the two, otherwise there is a conflict.

[0047] If the alarm processing time of the first level exceeds the time range of the specific alarm of the second level, the alarm notification time of the first level will be adjusted in advance until it is ensured that after the alarm is processed, its total time is still earlier than the specific occurrence time of the second level alarm. If there is a conflict with other alarm notifications after the adjustment, they will be notified in parallel. It should be noted that if the processing time of the second level has been exceeded after the alarm processing time of the first level is arrived, we still take the alarm processing time of the first level as 8:30 as an example, and the specific alarm notification time of the second level is 8:20. After the alarm processing time of the first level is arrived, the specific alarm time of the second level has been missed. Therefore, we need to adjust the alarm notification time of the first level forward so that the alarm processing time of the first level is completed before 8:20.

[0048] If the first-level alarm processing time is within the time range of the second-level specific alarm, notification will be made normally according to the specific alarm time; It should be noted that based on the above, we take the first-level alarm processing time as 8:30 as an example, and determine the specific alarm time of the second level as 9 o'clock. Therefore, after the first-level alarm processing time arrives, we can determine that the second-level alarm notification time has not yet arrived, so there is no conflict between the two. Therefore, we notify according to the normal notification time of the system.

[0049] As an optional embodiment: if there is an associated alarm notification, the method further includes: Get the specific time when the current group processes the low-level alarm notification; It should be noted that the above describes adjusting the alarm notification with associated but low priority to the highest priority of the current alarm notification. However, in the actual application process, based on practical considerations, it is not necessary to adjust the level every time. We explain this issue as follows; First, obtain the specific time of the low-level alarm notification in each group, such as 8 o'clock in the evening.

[0050] Determine the specific time for processing high-level alarm notifications in other groups; it should be noted that the specific time for processing high-level alarm notifications in other involved groups is obtained, for example, 8:30 p.m.

[0051] Compare the specific times of the two; specifically, compare the times of the two.

[0052] If the specific time for processing the low-level alarm notification is before the specific time for processing the high-level alarm notification, there is no need to adjust the level of the low-level alarm notification; it should be noted that, assuming that the low-level alarm notification can be processed at eight o'clock, it will not interfere with the high-level alarm notification. Therefore, there is no need to adjust the low-level level, which helps to avoid affecting the progress of other tasks due to level adjustment.

[0053] If the specific time of processing the low-level alarm notification is after the specific time of processing the high-level alarm notification, the level of the low-level alarm notification is adjusted to be consistent with or greater than the level of the high-level alarm notification; It should be noted that, based on the above, if the low-level alarm notification is at nine o'clock, it will affect the high-level alarm notification, so at this time it is necessary to adjust the level of the low-level alarm notification to be consistent with or greater than the level of the high-level alarm notification.

[0054] As an optional embodiment: when a corresponding alarm is triggered, sending an alarm notification to relevant personnel includes: Build a notification strategy based on the alarm information, specifically: After sending the alarm information, the recipient is required to confirm the alarm information to ensure that the alarm information is known to the recipient; it should be noted that after the alarm notification is triggered, in order to improve work efficiency and avoid work delays, the recipient is required to provide feedback confirmation within a certain time after receiving the information, so that he or she has been informed of the alarm notification.

[0055] If no feedback confirmation information is received within the preset time, the alarm notification will be automatically upgraded, and the alarm information will be sent to the person in charge at the next level, and the recipient will be asked to confirm the alarm information again until feedback confirmation information is received; it should be noted that if no feedback confirmation information is received, it is assumed that there is a possibility that no one will handle the alarm notification, so the system will automatically notify the person in charge at the next level and ask for confirmation again until feedback confirmation information is received; On the one hand, through the feedback confirmation mechanism, we can confirm that the alarm notification can be processed in a timely manner. On the other hand, through step-by-step feedback, we can avoid the occurrence of skipping levels.

[0056] It should be noted that when notifying the next level person in charge, time subtraction is required. That is, if the first feedback confirmation time is N minutes, after no feedback confirmation information is received, the time left for the second-level person in charge to feedback and confirm is Nn minutes, where n is a pre-set time, which can be 5 minutes. By decreasing in sequence, it is helpful to avoid delays in processing the current alarm notification.

[0057] After the alarm is resolved, a notification is automatically sent to relevant personnel to inform them that the problem has been resolved; It should be noted that after the alarm is resolved, problem resolution information is sent to all relevant personnel, including but not limited to text messages, voice messages, etc.

[0058] As an optional embodiment: the aggregating related alarm notifications together as a single message and sending it specifically includes: The content information of the current alarm notification is obtained and marked; it should be noted that when obtaining the content of the notification, the key information is marked.

[0059] Pre-set a similarity threshold; Classify the marked content information into similar information and dissimilar information. After comparing two or more information contents in pairs, if the repeated part of the two or more information contents is greater than the similarity threshold, the current two or more information contents are uniformly marked as similar information and numbered. After comparing two or more information contents in pairs, if the repeated part of the two or more information contents is less than or equal to the similarity threshold, the information contents with the repetition degree less than the similarity threshold are marked as dissimilar information and numbered separately. It should be noted that by comparing the repetition degree of the notification content, it is determined whether it needs to be sent uniformly. For example, we mark the notification contents with a repetition degree of more than 70% as the same information, and when sending information to relevant users, they can be combined and sent as separate information. For example, there are four notifications A, B, C, and D. The content overlap between A and B exceeds 70%, so we determine that A and B are similar information, merge A and B into one information, mark it as Notification 1, and send an alarm notification to relevant personnel. The overlap between A and B and C and D does not exceed 70%, so C is marked as Notification 2 and D is marked as Notification 3 to send an alarm notification to relevant personnel.

[0060] Similar information is combined and aggregated into a single message; specifically, information with highly overlapping content is combined into a single message for notification.

[0061] Each dissimilar information with a separate number is treated as a single information. It should be noted that the dissimilar information is treated as a single information to generate an alarm notification.

[0062] How it works: By setting monitoring rules based on specific keywords, the alarm information belonging to the same work module can be effectively classified and organized, and the centralized management of related alarm information can be achieved. This alarm grouping strategy allows us to aggregate related alarms for complex problems involving multiple systems or services, so that staff can view and handle all related alarms at once. This approach not only simplifies the process of problem diagnosis, but also improves the efficiency and accuracy of alarm response, allowing staff to more fully understand the scope of the problem and take quick action to solve the problem. In short, alarm grouping makes alarm management more efficient, reduces the time and effort of alarm processing, and increases the speed of problem resolution.

[0063] The above are only preferred implementations of the present invention. The protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical staff in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of this template.

Claims

1. A small AI model training method based on alarm log keywords, characterized in that: include: Get the keywords that need to be monitored, and the number of current keywords includes at least one; Receive the exception information of the submitted record in the current log service, where the exception information includes at least warning log and error log; Extract keywords that need to be monitored based on current abnormal information; Define relevant query statements to count the number of entries containing keywords within a specific time period; Establish corresponding monitoring rules based on the current query results; When the corresponding alarm is triggered, an alarm notification is sent to relevant personnel.

2. According to the method for training an AI small model based on alarm log keywords in claim 1, it is characterized in that: The establishment of corresponding monitoring rules based on the current query results includes: Set the corresponding pre-trigger conditions in advance, specifically: This includes but is not limited to triggering an alarm when a specific keyword appears in a log, triggering an alarm when a keyword reaches a specified number of times, and triggering an alarm based on log line statistics.

3. According to claim 2, a method for training an AI small model based on alarm log keywords is characterized in that: When the corresponding alarm is triggered, sending the alarm notification to the relevant personnel includes the following steps, specifically: Alarms are grouped into business, modules, and teams according to different components of the platform to ensure that relevant alarm information can be notified to the corresponding person in charge in a timely manner; Alarm information belonging to the same working module is planned into the same group, specifically: Build a unified alarm management system to access and integrate the alarm information of various monitoring systems; Perform level planning for alarm notifications generated based on the importance of the alarm information; Aggregate related alert notifications and send them as a single message; Set up alarm silence before sending alarm notifications to relevant personnel.

4. According to claim 3, a method for training an AI small model based on alarm log keywords is characterized in that: When the corresponding alarm is triggered, before sending the alarm notification to the relevant personnel, the following steps are also included: Plan alarm suppression rules to suppress low-priority alarm notifications when an alarm is triggered. Specifically: Get the priority of all alarm notifications when the current alarm notification is triggered; Determine whether there are overlapping related alarm notifications based on the priorities of all current alarm notifications; If there are related alarm notifications, the alarm notifications with related but low priority will be adjusted to the highest priority of the current alarm notifications, and the alarm notifications with low priority will be suppressed; If there is no associated alarm notification, relevant personnel will be notified according to the priority of the current alarm notification.

5. According to claim 4, a method for training an AI small model based on alarm log keywords is characterized in that: If there is an associated alarm notification, the alarm notification with associated but low priority is adjusted to the highest priority of the current alarm notification, and the alarm notification with low priority is suppressed. Specifically: Get the groups involved in the current alarm notification; When the alarm notification includes at least two groups, determining whether the current alarm notification has a subordinate level; When it is determined that there is a subsidiary level, the alarm notification that needs to be processed first is marked as the first level, and the alarm notification that needs to be processed later is marked as the second level; Get the priorities of the first and second levels; Adjust the priority of the first level to be greater than or equal to the second priority.

6. The AI ​​small model training method based on alarm log keywords according to claim 5 is characterized in that: The step of adjusting the priority of the first level to be greater than or equal to the second priority level is as follows: When the priority of the first level is greater than the priority of the second level, the priority of the first level is maintained unchanged; When the priority of the first level is lower than that of the second level, the priority of the first level is adjusted to be higher than that of the second level and notification is made.

7. The AI ​​small model training method based on alarm log keywords according to claim 6 is characterized by: When the priority of the first level is lower than that of the second level, the method of adjusting the priority of the first level to be higher than that of the second level and before notifying includes: Get the specific alarm notification time of the second level; Obtain the specific alarm notification time of the first level, and determine the alarm response time after the first level obtains the specific alarm notification, and the two are collectively marked as the alarm processing time; Verify whether the first-level alarm processing time is completed before the second-level alarm notification time occurs; If the alarm processing time of the first level exceeds the time range of the specific alarm of the second level, the alarm notification time of the first level will be adjusted in advance until it is ensured that after the alarm of the first level is processed, its total time is still earlier than the specific occurrence time of the alarm of the second level. If there is a conflict with other alarm notifications after adjustment, they will be notified in parallel; If the first-level alarm processing time is within the time range of the second-level specific alarm, notification will be made normally according to the specific alarm time.

8. The AI ​​small model training method based on alarm log keywords according to claim 4 is characterized in that: If there is an associated alarm notification, the following further includes: Get the specific time when the current group handles the low-level alarm notification; Determine the specific time to handle high-level alarm notifications in other groups; Compare the specific times of the two; If the specific time for processing the low-level alarm notification is before the specific time for processing the high-level alarm notification, there is no need to adjust the level of the low-level alarm notification; If the specific time of processing the low-level alarm notification is after the specific time of processing the high-level alarm notification, the level of the low-level alarm notification is adjusted to be consistent with or greater than the level of the high-level alarm notification.

9. The AI ​​small model training method based on alarm log keywords according to claim 3 is characterized in that: When the corresponding alarm is triggered, sending an alarm notification to relevant personnel includes: Build a notification strategy based on the alarm information, specifically: After sending the alarm information, the receiver is required to confirm the alarm information to ensure that the alarm information is known to the receiver; If no feedback confirmation information is received within the preset time, the alarm notification will be automatically upgraded, the alarm information will be sent to the next level person in charge, and the receiver will be asked to confirm the alarm information again until feedback confirmation information is received; After the alarm is resolved, a notification is automatically sent to relevant personnel to inform them that the problem has been resolved.

10. The AI ​​small model training method based on alarm log keywords according to claim 7 is characterized in that: Aggregating related alarm notifications together and sending them as a single message specifically includes: Get the content information of the current alarm notification and mark it; Pre-set a similarity threshold; Classify the marked content information into similar information and dissimilar information. After comparing two or more pieces of information, if the repetitive part of the two or more pieces of information is greater than the similarity threshold, mark the two or more pieces of information as similar information and assign numbers to them. After comparing two or more pieces of information, if the repetitive part of the two or more pieces of information is less than or equal to the similarity threshold, mark the pieces of information whose repetitiveness is less than the similarity threshold as dissimilar information and assign numbers to them separately. Combine and aggregate similar information into a single piece of information; Treat each dissimilar message individually numbered as a single message.

Images