A standardized alarm process method, system, electronic device and storage medium

Abstract

The present invention discloses a standardized alarm process method, system, electronic device and storage medium, including obtaining alarm data indicators in alarm information; converting alarm data indicators into normalized indicators through a normalization algorithm; fusing normalized indicators with semi-structured data in corresponding alarm information to form a standardized alarm data structure; designing business tags based on systems or businesses, designing response tags based on notification methods and upgrade strategies, and adding business tags and response tags to standardized alarm data structures; receiving alarm event streams; filling business templates with data in alarm event streams based on tag matching rules; generating contextualized alarm data streams based on business templates. The present invention realizes a standardized alarm process method and system through multi-dimensional tool integration in multi-cloud and hybrid environments, and drives the deepening of alarm capabilities based on multi-algorithms, thereby improving the uniformity, efficiency and response speed of alarm management.

Description

Technical Field

[0001] The present invention relates to the technical field of alarm processes, and in particular to a standardized alarm process method, system, electronic equipment and storage medium. Background Art

[0002] As the scale of cloud-native business construction continues to expand, more and more core systems are being microserviced and deployed in complex environments. In order to effectively monitor multi-cloud and hybrid environment businesses, a heterogeneous monitoring system consisting of multiple professional tools is often used, such as Prometheus, Grafana, Zabbix, custom alarm components, and third-party data alarm components, in order to obtain more comprehensive and in-depth insights and ensure that the overall operating status and performance indicators of its technical architecture can be accurately grasped.

[0003] This diversified monitoring and alarm strategy is also accompanied by a series of challenges, such as the high degree of decentralization of alarm information, significant differences between architectures, and alarm response situations. There are significant differences between different cloud platforms and private cloud architectures, resulting in different ways of collecting and processing monitoring data, which makes the alarm information from different monitoring systems highly decentralized and complex. Each monitoring platform generates alarms independently according to its own logic, resulting in critical warning signals being scattered among different systems, making it difficult for enterprises to form a unified and clear view to fully grasp all potential problems currently existing. This not only increases the difficulty of quickly responding to emergencies, but also significantly increases the need for manual intervention, which brings additional pressure and complexity to the operation and maintenance team, affecting the overall operational efficiency and service quality.

[0004] In summary, it is particularly important to build a cross-platform integrated monitoring solution. By adopting a unified monitoring platform that can span multiple cloud services and private infrastructure, we can effectively integrate alarm information from various channels and realize centralized display and processing. Reduce the need for manual intervention and accelerate the problem location and repair process by providing consistent data analysis support. At the same time, use analytical tools such as automatic filtering of redundant or false alarms to ensure the effectiveness of the operation and maintenance team's alarms, thereby improving overall operation and maintenance efficiency and service quality.

[0005] The main challenges facing the existing multi-cloud hybrid environment alarm technology can be summarized into three aspects: First, due to the different alarm standards of cloud products, it is difficult to effectively integrate cross-system alarm information. When a failure occurs, it is impossible to quickly associate related alarms from different systems. At the same time, it is necessary to repeatedly configure alarm rules on multiple platforms, which increases the complexity of management. Secondly, in multi-cloud and hybrid cloud environments, the alarm mechanism under the heterogeneous monitoring system lacks uniformity, making the alarm information more scattered and complex, with duplication or conflict, greatly increasing the difficulty of management and response. Finally, although self-developed monitoring systems and customized event alarms provide greater flexibility, these solutions often find it difficult to achieve high availability and stability levels, posing potential risks to overall operation and maintenance efficiency. Summary of the invention

[0006] In view of the shortcomings existing in the above problems, the present invention provides a standardized alarm process method, system, electronic device and storage medium.

[0007] To achieve the above object, the present invention provides a standardized alarm process method, comprising: Get the alarm data indicators in the alarm information; Converting the alarm data indicator into a normalized indicator through a normalization algorithm; Merging the normalized index with the semi-structured data in the corresponding alarm information to form a standardized alarm data structure; Designing a service tag based on a system or service, designing a response tag based on a notification method and an upgrade strategy, and adding the service tag and the response tag to the standardized alarm data structure accordingly; Receive alarm event stream; Based on the label matching rule, the data in the alarm event stream is correspondingly filled into the business template; A contextualized alarm data stream is generated based on the business template.

[0008] Preferably, the step of converting the alarm data indicator into a normalized indicator by a normalization algorithm comprises: Obtaining the original value of each of the alarm data indicators, and calculating the mean and standard deviation of each of the alarm data indicators; A normalized value is obtained based on the mean and the standard deviation.

[0009] Preferably, the normalized indicators include CPU usage, memory usage, disk usage, network traffic indicators normalized for inbound / outbound traffic, response time indicators, error rate indicators, and health check indicators.

[0010] Preferably, the step of fusing the normalized index with the semi-structured data in the corresponding alarm information includes: Acquire an alarm field in the alarm event based on the normalized indicator; Map the alarm field to the defined standard field and normalize the value field; The normalized data is integrated into a data model.

[0011] Preferably, a mapping table is configured based on the alarm information, the mapping table includes alarm level, claim time, resolution time and notification channel, the alarm level is divided into five standard levels from P1 to P5, the P1 standard level is a blocking problem; the P2 standard level is a critical system problem that affects customer use; the P3 standard level is a performance problem that affects the main process; the P4 standard level is anomalies that do not affect use; and the P5 standard level is a warning problem that requires continuous attention.

[0012] Preferably, based on the tag matching rule, the step of filling the service template with the data in the alarm event stream includes: Obtain detailed information of the alarm event stream, including timestamp, environment, application name, alarm ID and description; The detailed information is obtained based on a regular expression to obtain matching data, the matching data is segmented, and the segmentation results are filled into the business template.

[0013] Preferably, the regular expression (?P <name>...) syntax is used to name capture groups.

[0014] Preferably, the alarm events are deduplicated based on a DBSCAN algorithm, and the specific steps include: Collect all alarm events; Extract key features from each of the alarm events, the key features including timestamp, alarm type, host name, and service name; Convert the key features into numerical vectors and select a distance metric; For each point, find all points in its ε neighborhood; Finding the core object in the ε neighborhood; Points that do not reach MinPts but are within the neighborhood of the core object are marked as boundary points, and points that are not within the neighborhood of any core object are marked as noise points; forming a plurality of clusters based on the boundary points and the noise points, each of the clusters comprising a group of similar alarm events; generating a new aggregate alarm event based on each of the clusters; Remove duplicate information in the aggregated alarm event.

[0015] This application also provides a standardized alarm process system, including: The acquisition module is used to obtain the alarm data indicators in the alarm information; A normalization module, used to convert the alarm data indicator into a normalized indicator through a normalization algorithm; A fusion module, used for fusing the normalized index with the semi-structured data in the corresponding alarm information to form a standardized alarm data structure; A label module, used to design a service label based on a system or a service, design a response label based on a notification method and an upgrade strategy, and add the service label and the response label to the standardized alarm data structure accordingly; A receiving module, used for receiving an alarm event stream; A matching module, used to fill the business template with the data in the alarm event stream according to the label matching rule; A generation module is used to generate a contextualized alarm data stream based on the business template.

[0016] The present invention also provides an electronic device, comprising at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes the above method.

[0017] The present invention also provides a storage medium storing a computer program executable by an electronic device, and when the program runs on the electronic device, the electronic device executes the above method.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The present invention integrates multi-dimensional tools in multi-cloud and hybrid environments, deepens alarm capabilities based on multi-algorithm-driven methods, implements standardized alarm process methods and systems, and improves the uniformity, efficiency, and response speed of alarm management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flow chart of the standardized alarm process method of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Reference Figure 1 The present invention provides a standardized alarm process method, comprising: Get the alarm data indicators in the alarm information; Convert the alarm data indicators into normalized indicators through a normalization algorithm; Specifically, traditional alarm information usually contains specific structured content, such as timestamp, alarm level, affected services or components, etc. This format design is mainly optimized for a single alarm source.

[0022] However, in multi-cloud and hybrid cloud environments, when data from different monitoring tools and platforms are aggregated, these originally independent and structured alarm information may have data format incompatibility issues, making information integration difficult.

[0023] Based on this, the normalization algorithm is integrated with semi-structured data to standardize the alarm information to ensure that alarm indicators from different sources and platforms can be managed and analyzed in a unified manner. Furthermore, a data normalization algorithm is used to convert alarm information of different formats and structures into a unified standard format. In order to eliminate the differences between different dimensions and value ranges, and enable the various dimensions of memory (such as size, upper limit, usage rate, etc.) to be identified by relative characteristics, it is necessary to introduce a normalization operation to process the data to achieve a unified representation. For example, if the object to be described is memory, its different data sources include (size, upper limit, usage rate, percentage, etc.), etc. The value of the size dimension may be 0M~32000M, while the upper limit range is 0G~32G, and the usage rate range is [0,100] or [0.00,1.00].

[0024] The two most important points of normalization are: first, to unify the origin position. From a geometric point of view, it is to transfer the size relationship of all dimensional values ​​to the size relative to the origin, that is, the center of each dimension is dragged to the origin; second, it is to change the values ​​of all dimensions from absolute size to relative size, that is, the numerical range is [0,1].

[0025] Specific algorithm process: Data collection and preprocessing: Obtain raw data that meets the requirements and ensure data quality.

[0026] Calculate statistics: Get the original value of each indicator, such as memory usage, and find its original value x. Calculate the mean and standard deviation of each indicator (using Z-score standardization). For indicators such as memory usage, calculate its mean μi and standard deviation σi.

[0027] The Z-score normalization formula is: ; Where x is the original value, μ i is the mean, σ i is the standard deviation, and x′ is the normalized value. Function: Convert the data to a standard normal distribution with a mean of 0 and a standard deviation of 1.

[0028] Verification and adjustment: Verify the normalization results: Check whether the normalized data meets expectations and ensure that all indicators are within the same dimension and value range.

[0029] Storing normalized data: Store the normalized data in a database or file for subsequent analysis and processing.

[0030] Through the above steps, all numerical values ​​of different dimensions are unified into an abstract feature space represented by the same dimension and value range, thereby eliminating the differences in dimension and scale, making the data comparable in all dimensions and improving the consistency and accuracy of data processing.

[0031] The normalized indicators are integrated with the semi-structured data in the corresponding alarm information to form a standardized alarm data structure; Specifically, semi-structured data is a type of data that is between fully structured data (such as tabular data in a relational database) and unstructured data (such as plain text or images). It does not specify a fixed schema or predefined data model, but contains some organizational structure, usually through tags or delimiters to mark different parts of the data.

[0032] Semi-structured data allows not only fixed tags (such as alarm name, alarm level, etc.) but also dynamically changing tags (such as the time when the alarm occurred, the business details involved, etc.) when recording alarm information. This structure makes alarm data more flexible and can adapt to different monitoring and alarm scenarios. At the same time, in the alarm indicator description, after the alarm indicator is normalized, the indicator data consistency ensures the comparability of the alarm indicator. Common normalized alarm indicators include: CPU usage, memory usage, disk usage, inbound / outbound traffic normalized network traffic indicators (network traffic is scaled to the [0, 1] interval, unit: bytes / second), response time indicators (in ms, scaled to the [0, 1] interval), error rate indicators, health check indicators (0: failure, 1: success), etc.

[0033] For example, the fusion of semi-structured data and normalized indicators of CPU usage requires extracting and converting the information in the semi-structured data into a standardized format, while ensuring that monitoring data from different sources and types can be compared and analyzed under the same standard.

[0034] Alarm data acquisition: Get JSON alarm A event: {"timestamp": "2024-12-05T10:00:00Z", "severity": "High", "type": "CPU Usage", "hostname": "server1.example.com", "value": 95, "threshold": 80}; Get XML alarm B event: <alert> <timestamp> 2024-12-05T10:05:00Z< / timestamp> <severity> Warning< / severity> <type> MemoryUsage< / type> <hostname>server2.example.com / hostname> <value> 85< / value> <threshold> 70< / threshold> < / hostname> < / alert> ; Field mapping: Map the extracted fields to predefined standard fields and normalize the value field. The ranges of CPU usage and memory usage are both [0, 1]. The definition of standard fields is shown in Table 1.

[0035] Table 1

[0036] For example, in the sample, label contains multiple alarm identifiers, severity indicates the importance of the alarm, details object contains relevant information about the specific indicator details of the alarm, timestamp indicates the time when the alarm occurred, description provides a brief description of the problem, tag expresses the ability to add tags, and details can provide more specific details. The specific values ​​in description are combined through the normalization algorithm to ensure the high consistency of alarm information.

[0037] [ {"label": { " <alertid> ": " <al-1234567890> ", " <labelname> ": " <labelvalue> ", " <severity> ": " <level> ", " <source> ": " <sourcename>", ...}, "details": {" <notifier> ": " <xxx>", ...}, "timestamp": "<ISO 8601>", "tag": {" <tagname> ": " <xxx>", ...}, "description": "< Memory usage 0.98 for more than 0.8>", ...}, ...] The normalized data is integrated into a unified data model and stored in the database.

[0038] Such a semi-structured data format enables a certain degree of information consistency to be maintained even in the case of multi-source alarms.

[0039] Design business tags based on the system or business, design response tags based on notification methods and upgrade strategies, and add business tags and response tags to the standardized alarm data structure accordingly; Receive alarm event stream; Specifically, the alarm platform provides access to standardized multi-source data formats and provides customized integration capabilities. Alarm data follows the JSON format specification. Through the label mapping function, users can accurately convert and adapt key elements in alarm information from different sources into a unified standardized alarm data structure, simplifying the integration process of multi-source heterogeneous systems.

[0040] like: { "masterIp": "clusterid34","host": 127.0.01,"notifier": "jack","namespace": "system-1","reason": "FailedScheduling","message": "0 / 6 nodes areavailable: 6 pod has unbound immediate PersistentVolumeClaims.","type": "Warning", "name":"app-management-svc","eventTime":"2024-11-26-14:05:10","uid": "bcbf6ec7"} Standardized conversion to semi-structured data is: [ {"label": {"alertId": "bcbf6ec7", "labelName": "app-management-svc", "severity": "Warning", "source": "FailedScheduling",...}, "timestamp": "2024-11-26 14:05:10", "description": "0 / 6 nodes are available: 6 pod has unbound immediatePersistentVolumeClaims.",}, ...] Based on the tag matching rules, the data in the alarm event stream is filled into the business template accordingly; Generate contextualized alarm data streams based on business templates.

[0041] In this embodiment, a semi-structured data format is used to unify and optimize the alarm processing logic through labels. Two or more core labels are used to identify the current alarm event flow: one is the system or business label (such as system, business), which specifies the specific business field or service component involved in the alarm, and helps determine which team or individual should be notified of the alarm; the other is the notification method and upgrade strategy label, which defines how to select the appropriate communication channel (such as email, SMS or phone) according to the urgency of the alarm and when to upgrade to a higher level of response measures. Such label settings help ensure that alarms can be handled promptly and accurately.

[0042] Label design principles include: Tag consistency principle: It is very important to keep business tags consistent across the organization. This includes consistency in tag naming and usage scenarios, to ensure that everyone understands the meaning of tags accurately and follows the same standards, and to avoid using two or more tag keys for the same resource.

[0043] The label consistency principle is implemented mainly through business communication and research: Identify key attributes, communicate and research with the business team, and confirm the current business situation.

[0044] Identify important attributes and form labels, such as environment (production PROD, test UAT), business standard name, version number (v1.x), etc.

[0045] Define the label hierarchy. Define the label hierarchy according to business needs to avoid generating multiple labels of the same type.

[0046] Label clarity principle: Each business label should have a clear definition to avoid ambiguity and differences in understanding. The labels of different businesses should clearly reflect the specific technical fields or business functions they represent.

[0047] The label in the label clarity principle is mainly implemented by real-time adjustment and annotation after business communication: Allows maintenance personnel to manually add or modify tags to meet specific needs or make temporary adjustments. (For example, the environment is described as testing, but the tests are divided into two categories: SIT and UAT, and adjustments are allowed).

[0048] Provides fields for users to add additional comments or notes to help better understand and handle the alert.

[0049] Tag minimization principle: Try to reduce the number of tags and keep only those tags that are critical to alarm processing and response. Too many tags may cause confusion and increase the difficulty of management and understanding, so only core tag values ​​should be retained and redundant tag values ​​should be deleted.

[0050] The label in the label minimization principle is mainly implemented by real-time adjustment after business communication and controlling the number of annotations: Allows operators to manually modify or delete tags to meet specific needs or make temporary adjustments.

[0051] Control the number of labels to within 5 labels.

[0052] Tag scalability: As the business grows and the technology stack changes, you may need to add new tags or adjust existing tags. Therefore, it is critical to consider the scalability of the system at the beginning of the design, such as adopting a hierarchical structure or presetting some common tag categories.

[0053] The label in the label scalability principle is mainly implemented by real-time adjustment after business communication: Allows operators to manually add, modify, or delete tags to meet specific needs or make temporary adjustments.

[0054] In this embodiment, the alarm management unifies the alarm levels in different systems by configuring a mapping table to ensure that all alarm information can be classified according to consistent standards. Specifically, different types of alarm levels (such as ERROR, L1, Critical, severe alarm, etc.) can be normalized into five standard levels from P1 to P5. For example, through the mapping table setting, the four different descriptions of ERROR, L1, Critical and "severe alarm" are uniformly mapped to P1 level alarms and sent to the corresponding notifiers. The mapping table is shown in Table 2.

[0055] Table 2

[0056] This approach not only simplifies the cross-system alarm processing process, but also enhances the consistency and efficiency of alarm response, allowing the operation and maintenance team to identify and respond to key issues more quickly and accurately. This approach effectively solves the management difficulties caused by inconsistent alarm level definitions between different monitoring systems and improves the overall operation and maintenance management level.

[0057] In this embodiment, after the self-developed alarms are connected to the alarm management system through custom integration, business tags are added to these alarms, a new alarm processing process is created, and the corresponding business tag rules are configured in the process, and finally the relevant template information is filled in. This ensures that all connected self-developed alarms can be efficiently managed and responded to according to the preset business logic.

[0058] Standardized matching rules The process of improving the alert content by adding additional contextual information, adding more data points and labels. The detailed process is as follows: Alert demand analysis and planning: Communicate with relevant teams (such as development and operation and maintenance) to clarify the information that is critical to understanding the alert.

[0059] Identify and collect contextual data: Obtain valuable information from existing CMDB platform systems and monitoring platforms (such as Prometheus and Grafana), and obtain relevant business environment such as detailed description of the business and other supplementary information.

[0060] Get the alarm information and understand the specific reasons for triggering the alarm.

[0061] Ensure that all tags follow the tag design principles and have consistent naming conventions and structures. For example, if the problem is caused by pvc unbound, you can add a standard describe tag to better understand the business indicators: describe:nodes are available:6 pod has unbound immediatePersistentVolumeClaims.

[0062] Add relevant business environment, operation data, alarm information description and other tags to the alarm content and send the alarm.

[0063] Create a dedicated alarm detail page to centrally display all relevant context information for easy viewing and processing by operation and maintenance personnel.

[0064] Integrating alarms with relevant business environments, operating data, system status, historical status, etc. provides a more comprehensive understanding context, helping the operation and maintenance team to identify the root cause of the alarm problem more quickly.

[0065] String extraction rules When obtaining an alarm event stream that uses a fixed format to name business indicators or alarms, you can parse these indicators using regular expressions or by configuring appropriate segmentation rules, and then fill the parsed information into the corresponding alarm tags. The detailed process is as follows: Get specific detailed alarm flow information: [2024-12-05T15:30:00Z] [production] [webapp] [ALERT-12345] - Serviceis not responding in: 2024-12-05T15:30:00Z is the timestamp production is the environment webapp is the application name (application) ALERT-12345 is the alert ID (alertId) - Service is not responding is a description Define regular expressions to segment data, perform regular matching on the above alarm streams, segment the data, and fill in alarm labels based on the parsing results.

[0066] $(?P <timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z)$ $(?P <environment> [^$]+)\] $(?P <application> [^$]+)\] $(?P <alertid> [^$]+)\] - (?P <description>.+) This regular expression (?P <name>...) syntax is used to name capture groups, making it easy to reference each matched part as a separate variable. See Table 3 for details.

[0067] Table 3

[0068] This ensures that the key information in the indicator name is accurately extracted and applied to the alarm label, thereby improving the efficiency and accuracy of alarm processing.

[0069] Linking contextualized data sources In the obtained alarm event stream, if only the alarm id is notified, it is necessary to query the database table, CMDB, Excel file or txt file to associate the system name, business responsible person, notification event and other detailed information. This can be achieved in parallel by importing these table data (Excel file import association) or setting customized association query (database query method), so as to enrich the content of the alarm label and make the alarm information more comprehensive and useful.

[0070] The specific implementation methods of database tables, CMDB, Excel files, etc. are as follows: Database Query If the alarm ID and detailed information are stored in a relational database, they can be directly associated through SQL queries. This is usually the most direct and effective method and is suitable for structured data.

[0071] There is a table called alerts that contains alert information, and a table called systems that contains system information.

[0072] Use the JOIN operation to join two tables.

[0073] SELECT s.system_name, s.business_owner, a.event_description FROMalerts a JOIN systems s ON a.system_id = s.id WHERE a.alertId = 'ALERT-1'; Excel file import For Excel files, you can use Python libraries such as pandas or openpyxl to read and process the data.

[0074] Use pandas to read the Excel file and find the corresponding record based on the alarm ID: import pandas as pd # Load Excel file df = pd.read_excel('alerts_info.xlsx') # Find detailed information for a specific alarm ID alert_info = df [ df['Alert ID'] == 'ALERT-12345'] print( alert_info [[ 'System Name', 'Business Owner' ]]) CMDB Query CMDB (Configuration Management Database) is an important tool for IT infrastructure management and change control. It usually contains detailed asset information and relationships. It is generally adopted by API calls: import requestsalert_id = "ALERT-12345" response = requests.get(f"https: / / cmdb.example.com / api / v1 / alerts / {alert_id}") data = response.json() print(data['system_name'], data['business_owner']).

[0075] In this embodiment, the silent strategy in alarm management can effectively converge alarms and significantly reduce the occurrence of alarm storms. Configure silent strategies such as silencing the same or similar alarms within a specified time period, and define silent matching rules to search for the same alarm ID and the same application to identify specific alarm events. If they already exist, no alarm will be issued. Once these rules are triggered, related alarm events will be automatically suppressed to prevent them from being captured and propagated by further notification strategies, ensuring that the team only receives the most critical and relevant alarm information.

[0076] Alarm Silencing Algorithm Time window rules engine The time window engine algorithm for silencing alarm event streams is a technology used to reduce alarm storms and duplicate alarms. By setting a time window, the same or similar alarms are silenced within the window, thus avoiding receiving a large number of duplicate or similar alarms in a short period of time.

[0077] Define time window: Set a fixed time window length.

[0078] When the system receives a new alarm event, it extracts its key information.

[0079] Generate a unique identifier (such as a hash value) based on the key information of the alarm (such as alarm ID, alarm type, label, etc.); Check if the unique identifier already exists in the data structure; Get last triggered time: If the unique identifier exists, get the last triggered time of the alarm.

[0080] Calculate time difference: Calculate the difference between the current time and the last trigger time. Determine whether it is within the time window: If the time difference is less than the preset time window length, the alarm is considered to be within the time window and the silent operation is triggered.

[0081] If the time difference is greater than or equal to the time window length, the alarm is considered to be outside the time window and notification is allowed.

[0082] If the alarm is not within the time window, or this is the first time the alarm is received, the record in the data structure is updated, and the last triggering time of the alarm is set to the current time.

[0083] Use the tags in the alarm rule expression: Directly use the tags carried in the alarm rule expression. These tags usually contain rich context information, which helps to quickly locate the problem. If the alarm has a specific business tag (such as "test environment"), silence the alarm.

[0084] Manually select contextualized tags: Select from a library of contextualized tags that have been deeply analyzed and correlated to provide more comprehensive and relevant alert information. For example, if a service is undergoing planned maintenance, silence all alerts for that service.

[0085] In this embodiment, the alarm deduplication mechanism provides two methods to ensure the accuracy and effectiveness of alarm information, and improves the alarm deduplication capability by combining algorithms with custom tags: DBSCAN algorithm (Density-Based Spatial Clustering of Applications withNoise) Duplicate alarm suppression based on density-based spatial clustering algorithm: Within the set time window, the system will automatically ignore duplicate alarm events from the same alarm rule, thereby reducing redundant information and ensuring that the operation and maintenance team only receives the first triggered alarm. The density-based spatial clustering algorithm is suitable for discovering clusters of arbitrary shapes and can effectively process noisy data.

[0086] The specific calculation method of DBSCAN algorithm is: Collect alarm events: Collect all alarm events within a period of time from the monitoring system.

[0087] Extract features: Extract key features from each alarm event, such as timestamp, alarm type, host name, service name, etc.

[0088] Feature vectorization: Convert the extracted features into numerical vectors. Choose a distance metric: Euclidean distance is usually used, but other distance metrics such as Manhattan distance or cosine similarity can also be selected according to specific circumstances.

[0089] Neighborhood search: For each point, find all points in its ε neighborhood. Neighborhood (ε-neighborhood) For a point p and a given radius ε, the ε-neighborhood of point p is the set of all points whose distance from p does not exceed ε.

[0090] formula: ; Where D is the data set, is the distance measure between points p and q (usually the Euclidean distance).

[0091] Core object judgment: If there are at least MinPts points in the ε-neighborhood of a point, then the point is marked as a core object. Core object (Core Point) If the ε-neighborhood of point p contains at least MinPts points, then p is a core object.

[0092] Marking border points and noise points: Points that do not reach MinPts but are in the neighborhood of a core object are marked as border points, and points that are not in the neighborhood of any core object are marked as noise points. Border Point, if point p is not a core object, but belongs to the ε-neighborhood of a core object, then p is a border point.

[0093] if And p is in a core object In the neighborhood, p is a boundary point; if And p is not in any core object In the neighborhood, p is a noise point.

[0094] Generate clusters: eventually multiple clusters are formed, each containing a group of similar alarm events. Mark noise points: points not included in any cluster are considered noise points. Starting from the core object, recursively expand the cluster.

[0095] Generate aggregate alarm: For each cluster, generate a new aggregate alarm event, such as time range, alarm type, number of related alarms, and detailed information of the alarm event.

[0096] Remove duplicate information: Remove duplicate information from aggregate events and retain key information.

[0097] Through the above steps, the DBSCAN algorithm can effectively aggregate multiple similar alarm events occurring in the same time period into one alarm event, thereby reducing redundant information and improving the efficiency and accuracy of alarm management.

[0098] Deduplication based on tag definitions: Through custom tags or preset tags, the system can identify and suppress alarms with the same tag combination, even if these alarms come from different rules. This approach allows for more fine-grained control, further improving the relevance of alarms and response efficiency.

[0099] In this embodiment, the alarm event management uses two advanced compression mechanisms by default to optimize alarm notifications, namely tag-based compression and time-based compression: Tag-based compression: When notifying, the system will intelligently compress the alarm events that meet the conditions according to the grouping strategy in the preset notification strategy. If multiple alarm events contain the same tag, these events will be automatically aggregated into a comprehensive alarm for notification, thereby reducing redundant information and improving the relevance and readability of the alarm.

[0100] Time-based compression: Each alarm event is recorded with its start time and end time. For alarm events with the same label, if their time intervals overlap or intersect, the system merges these events into a single alarm event. The start time and end time of the merged alarm event will be the union of the time intervals of these events, ensuring that all alarm information in the relevant time period is fully covered.

[0101] In this embodiment, by configuring notification policies and defining precise matching conditions for alarm events, when these conditions are triggered, the system will automatically send alarm information to designated processing personnel using a preset notification method (such as email, SMS, phone, or instant message). This ensures that alarm information can be accurately communicated to relevant responsible persons in real time, optimizes the alarm management process, and improves overall operation and maintenance efficiency and response speed.

[0102] This application also provides a standardized alarm process system, including: The acquisition module is used to obtain the alarm data indicators in the alarm information; A normalization module is used to convert the alarm data indicators into normalized indicators through a normalization algorithm; A fusion module is used to fuse the normalized indicators with the semi-structured data in the corresponding alarm information to form a standardized alarm data structure; The label module is used to design business labels based on the system or business, design response labels based on the notification method and upgrade strategy, and add business labels and response labels to the standardized alarm data structure; A receiving module, used for receiving an alarm event stream; The matching module is used to fill the business template with the data in the alarm event stream based on the tag matching rules; The generation module is used to generate contextualized alarm data streams based on business templates.

[0103] The present invention also provides an electronic device, comprising at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes the above method.

[0104] The present invention also provides a storage medium storing a computer program executable by an electronic device. When the program runs on the electronic device, the electronic device executes the above method.

[0105] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.< / name> < / description> < / alertid> < / application> < / environment> < / timestamp> < / xxx> < / tagname> < / xxx> < / notifier> < / sourcename> < / level> < / severity> < / labelvalue> < / labelname> < / al-1234567890> < / alertid> < / name>

Claims

1. A standardized alarm process method, characterized in that: include: Get the alarm data indicators in the alarm information; Converting the alarm data indicator into a normalized indicator through a normalization algorithm; Merging the normalized index with the semi-structured data in the corresponding alarm information to form a standardized alarm data structure; Designing a service tag based on a system or service, designing a response tag based on a notification method and an upgrade strategy, and adding the service tag and the response tag to the standardized alarm data structure accordingly; Receive alarm event stream; Based on the label matching rule, the data in the alarm event stream is correspondingly filled into the business template; A contextualized alarm data stream is generated based on the business template.

2. The standardized alarm process method according to claim 1, characterized in that: The step of converting the alarm data indicator into a normalized indicator by a normalization algorithm comprises: Obtaining the original value of each of the alarm data indicators, and calculating the mean and standard deviation of each of the alarm data indicators; A normalized value is obtained based on the mean and the standard deviation.

3. The standardized alarm process method according to claim 2, characterized in that: Normalized indicators include CPU usage, memory usage, disk usage, network traffic indicators normalized for inbound / outbound traffic, response time indicators, error rate indicators, and health check indicators.

4. The standardized alarm process method according to claim 3, characterized in that: The step of fusing the normalized index with the semi-structured data in the corresponding alarm information includes: Acquire an alarm field in the alarm event based on the normalized indicator; Map the alarm field to the defined standard field and normalize the value field; The normalized data is integrated into a data model.

5. The standardized alarm process method according to claim 4, characterized in that: A mapping table is configured based on the alarm information, and the mapping table includes alarm level, claim time, resolution time and notification channel. The alarm level is divided into five standard levels from P1 to P5. The P1 standard level is a blocking problem; the P2 standard level is a critical system problem that affects customer use; the P3 standard level is a performance problem that affects the main process; the P4 standard level is an anomaly that does not affect use; and the P5 standard level is a warning problem that requires continuous attention.

6. The standardized alarm process method according to claim 5, characterized in that: Based on the label matching rule, the step of filling the business template with the data in the alarm event stream includes: Obtain detailed information of the alarm event stream, including timestamp, environment, application name, alarm ID and description; The detailed information is obtained based on a regular expression to obtain matching data, the matching data is segmented, and the segmentation results are filled into the business template.

7. The standardized alarm process method according to claim 6, characterized in that: Deduplication of the alarm events is performed based on the DBSCAN algorithm. The specific steps include: Collect all alarm events; Extract key features from each of the alarm events, the key features including timestamp, alarm type, host name, and service name; Convert the key features into numerical vectors and select a distance metric; For each point, find all points in its ε neighborhood; Finding the core object in the ε neighborhood; Points that do not reach MinPts but are within the neighborhood of the core object are marked as boundary points, and points that are not within the neighborhood of any core object are marked as noise points; forming a plurality of clusters based on the boundary points and the noise points, each of the clusters comprising a group of similar alarm events; generating a new aggregate alarm event based on each of the clusters; Remove duplicate information in the aggregated alarm event.

8. A standardized alarm process system, characterized in that: include: The acquisition module is used to obtain the alarm data indicators in the alarm information; A normalization module, used to convert the alarm data indicator into a normalized indicator through a normalization algorithm; A fusion module, used for fusing the normalized index with the semi-structured data in the corresponding alarm information to form a standardized alarm data structure; A label module, used to design a service label based on a system or a service, design a response label based on a notification method and an upgrade strategy, and add the service label and the response label to the standardized alarm data structure accordingly; A receiving module, used for receiving an alarm event stream; A matching module, used to fill the business template with the data in the alarm event stream according to the label matching rule; A generation module is used to generate a contextualized alarm data stream based on the business template.

9. An electronic device, characterized in that: The method comprises at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes the method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: It stores a computer program executable by an electronic device, and when the program runs on the electronic device, the electronic device executes the method described in any one of claims 1 to 7.

Images