Alarm management method, device, equipment and medium

Abstract

The invention provides an alarm management method and device, equipment and a medium, and relates to the technical field of information. An alarm template library is created through a user client; the user client provides an AK key and an SK key for the cloud manufacturer platform to perform identity authentication; the user client passing the identity authentication issues an alarm template to the cloud manufacturer platform, converts alarm rule content in the issued alarm template into alarm configuration corresponding to each resource in the cloud manufacturer platform to obtain a current alarm rule of each resource, and compares the current alarm rule with the current alarm rule of each resource; the user clients passing the identity authentication correct inconsistent current alarm rules to obtain final alarm rules and issue the final alarm rules to the cloud manufacturer platform; and performing alarm configuration on each resource by using the final alarm rule and applying the alarm configuration to each resource. The method ensures that all alarm rules are configured according to the optimal practice standard of the industry, and improves the accuracy and consistency of initial configuration.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to an alarm management method, device, equipment and medium. Background Art

[0002] With the rapid development of cloud computing technology, more and more companies are choosing to migrate their businesses to the cloud to take advantage of the flexibility, scalability and cost-effectiveness of cloud services. Ensuring the continuity and stability of cloud resources and businesses is the core goal of the cloud operation and maintenance team. In this process, the monitoring and alarm system plays an important role, which can help operation and maintenance personnel to promptly discover and respond to potential system anomalies and failures.

[0003] However, the existing cloud alarm management has the following problems: the alarm configuration is not standardized enough, which may lead to omissions or incorrect configurations of alarm settings based on personal experience. This is not only difficult to comply with industry best practices, but may also miss key security warnings. At the same time, unreasonable alarm threshold settings often cause excessive alarm noise, which not only distracts engineers and reduces the efficiency of troubleshooting, but also may cause response delays when real alarms occur. In addition, alarm noise is difficult to analyze and identify, and there is a lack of effective tools to quickly distinguish between valid and invalid alarms, which causes operation and maintenance personnel to spend a lot of time and energy on manual labeling. Summary of the invention

[0004] The present application provides an alarm management method, apparatus, device and medium to solve the above-mentioned problems existing in the existing cloud alarm management method.

[0005] In a first aspect, the present application proposes an alarm management method, the method comprising: Creating an alarm template library through a user client, the alarm template library includes different types of alarm templates, each alarm template includes: alarm triggering conditions, triggering frequency, alarm level, recovery conditions and alarm rule content of the alarm message; The user client provides the AK key and SK key to the cloud vendor platform for identity authentication; The user client that has passed the identity authentication sends the alarm template to the cloud vendor platform, and converts the alarm rule content in the sent alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource; Comparing the baseline alarm rules of each resource with the current alarm rules of each resource, wherein the baseline alarm rules include the alarm triggering conditions, alarm levels, and recovery conditions in the alarm template; The user client that has passed the identity authentication corrects the inconsistent current alarm rules, obtains the final alarm rules and sends them to the cloud vendor platform; The final alarm rule is used to configure alarms for various resources and applied to various resources.

[0006] Optionally, the method further includes: The cloud vendor platform feeds back the status of the final alarm rule issuance to the user client, and the status of the final alarm rule issuance includes: the number of rules that are successfully issued, the rules that fail to be issued, and the reasons for the failure to issue; Based on the status of the final alarm rule issuance, generate a rule issuance status list; The rule delivery status list is displayed on the user interface of the user client, and the rule delivery status list includes: the usage status, delivery time and applicable resources of each final alarm rule.

[0007] Optionally, the method further includes: For the final alarm rules that fail to be issued, the cloud vendor platform generates an exception notification; The cloud vendor platform sends the exception notification and the corresponding error log to the user client. The exception notification is used to prompt the user client to check the reason for the failure to send, and the error log is used for the user client to check the reason for the failure to send.

[0008] Optionally, the alarm rule content in the issued alarm template is converted into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource, including: The user client that has passed the identity authentication calls the cloud API to obtain all current resources of the cloud vendor platform and create a resource list; The user client that has passed the identity authentication traverses the resource list, calls the cloud API interface corresponding to each resource in the resource list, converts the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform, and obtains the current alarm rule of each resource.

[0009] Optionally, the method further includes: Receiving an alarm message through a monitoring module of a cloud vendor platform, wherein the alarm message is issued by each resource based on the configured final alarm rule, and the alarm message includes: alarm content and alarm level; Generate a unique identifier for each alarm message, the unique identifier including: resource ID, alarm type and timestamp; Based on the unique identifier of each alarm message, multiple alarm messages of the same resource and the same alarm type are merged into one alarm event; Convert alarm events that meet the alarm-to-work order rules into alarm work orders, where the alarm work orders include alarm details, time, and processing status; The content of the alarm work order is marked and analyzed to obtain an analysis result.

[0010] Optionally, the content of the alarm work order is marked and analyzed to obtain analysis results, including: Using a large language model to perform multi-dimensional tagging on the content of the alarm work order to obtain a tagging result, wherein the dimensions include: alarm validity, alarm item, alarm component object, and alarm type; Based on the marking result, the alarm work order is analyzed to generate an analysis result.

[0011] In a second aspect, the present application provides an alarm management device, the device comprising: A creation module, used to create an alarm template library through a user client, wherein the alarm template library includes different types of alarm templates, each alarm template includes: alarm triggering conditions, triggering frequency, alarm level, recovery conditions and alarm rule content of the alarm message; The identity authentication module is used by the user client to provide the AK key and SK key to the cloud vendor platform for identity authentication; The rule conversion module is used for the user client that has passed the identity authentication to send the alarm template to the cloud vendor platform, and convert the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource; A comparison module, used to compare the baseline alarm rules of each resource with the current alarm rules of each resource, wherein the baseline alarm rules include the alarm triggering conditions, alarm levels and recovery conditions in the alarm template; The correction module is used for the user client that has passed the identity authentication to correct the inconsistent current alarm rules, obtain the final alarm rules and send them to the user client; The application module is used to use the final alarm rule to configure alarms for various resources and apply them to various resources.

[0012] Optionally, the device further comprises: A feedback module is used for the cloud vendor platform to feed back the status of the final alarm rule issuance to the user client, and the status of the final alarm rule issuance includes: the number of rules that are successfully issued, the rules that fail to be issued, and the reasons for the failure to issue; A generating module, used for generating a rule issuing status list based on the status of the final alarm rule issuing; The rule display module is used to display the rule delivery status list on the user interface of the user client, and the rule delivery status list includes: the usage, delivery time and applicable resources of each final alarm rule.

[0013] In a third aspect of an embodiment of the present application, an electronic device is proposed, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the alarm management method described in any one of the first aspects above.

[0014] In a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the alarm management method described in any one of the first aspects above is implemented.

[0015] The present application includes the following advantages: The present application proposes an alarm management method, apparatus, device and medium, which creates an alarm template library through a user client, wherein the alarm template library includes different types of alarm templates, and each alarm template includes: alarm trigger conditions, trigger frequencies, alarm levels, recovery conditions and alarm rule contents of alarm messages; the user client provides an AK key and an SK key to the cloud vendor platform for identity authentication; then the user client that passes the identity authentication sends the alarm template to the cloud vendor platform, and converts the alarm rule contents in the sent alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource; the baseline alarm rules of each resource are compared with the current alarm rules of each resource, wherein the baseline alarm rules include the alarm trigger conditions, alarm levels and recovery conditions in the alarm template; the user client that passes the identity authentication corrects the inconsistent current alarm rules to obtain the final alarm rules and sends them to the cloud vendor platform; finally, the final alarm rules are used to configure alarms for each resource and apply them to each resource.

[0016] This method ensures that all alarm rules are configured in accordance with industry best practices by issuing standardized alarm templates. Standardized alarm configuration reduces errors caused by manual configuration and improves the accuracy and consistency of initial configuration. Through alarm rule checking, redundant or incorrectly configured alarm rules can be discovered and adjusted in a timely manner, reducing unnecessary alarm noise. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 It is a schematic diagram of the steps of an alarm management method proposed in an embodiment of the present application; Figure 2 It is a flowchart of an alarm management method proposed in an embodiment of the present application; Figure 3 It is a flowchart of a method for marking a work order in an alarm management method proposed in an embodiment of the present application; Figure 4 It is a functional module diagram of an alarm device proposed in an embodiment of the present application; Figure 5 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] Monitoring alarms are an important means to ensure the normal operation of cloud resources and services. The current cloud alarm management methods have the following problems: Non-standard alarm configuration: When operation and maintenance personnel configure alarms through the cloud console based on their personal experience, mismatches and omissions are inevitable, making it difficult to ensure that the alarm configuration complies with best practices. As a result, there is a potential risk of not being able to issue warnings in a timely manner.

[0021] Unreasonable alarm threshold: Unreasonable threshold alarm will lead to more alarm noise, which is not conducive to troubleshooting for engineers. Instead, it will cause them to be exhausted from dealing with various invalid alarms. When an alarm actually occurs, it is difficult to handle it in time.

[0022] Alarm noise analysis is difficult: When it is necessary to regularly retrospectively analyze the proportion of valid alarms, there is a lack of effective identification to quickly identify valid and invalid alarms. If it relies on manual labeling, it will be time-consuming and labor-intensive.

[0023] Based on this, an embodiment of the present application proposes an alarm management method, which aims to improve the accuracy and effectiveness of alarms, reduce alarm noise, and optimize the troubleshooting efficiency of operation and maintenance personnel.

[0024] In a first aspect, the present application embodiment provides an alarm management method, referring to Figure 1 , Figure 1 1 is a flowchart of a method for alarm management proposed in an embodiment of the present application, the method comprising the following steps: Step 101: Create an alarm template library through a user client.

[0025] The above alarm template library is created by the user client according to industry best practices. The industry best practices are the experience conditions in the alarm management methods actually used by engineers, such as the most reasonable alarm threshold for the server.

[0026] The created alarm template library includes different types of alarm templates. For example, for a server, the alarm template can cover alarm rules such as CPU usage, memory usage, and disk usage; for a database, the alarm template can cover alarm rules such as query performance, number of connections, and disk I / O.

[0027] The cloud vendor platforms include but are not limited to Tencent Cloud, Alibaba Cloud, Huawei Cloud, and AWS Cloud. The above cloud vendor platforms can be cloud platforms used by any enterprise or user.

[0028] Each alarm template in the alarm template library includes: alarm trigger conditions (such as thresholds), trigger frequency, alarm level (such as emergency, serious, warning), recovery conditions, and alarm rule content of the alarm message. Templates can be stored in JSON or YAML file format for easy management and update.

[0029] In addition, a template management unit may be set up to implement storage, version management, and access control of templates, thereby ensuring uniformity and security of template data.

[0030] Step 102: The user client provides the AK key and the SK key to the cloud vendor platform for identity authentication.

[0031] The user client provides the cloud vendor platform with the AK key (Access Key) and the SK key (Secret Key) for identity authentication. The AK key and the SK key interact with the cloud vendor platform's API to ensure that the user client's identity is legal and has the corresponding permissions.

[0032] Optionally, you can use the SDK (Software Development Kit) provided by the cloud vendor platform to programmatically call the cloud API to perform operations. For example, for the AWS cloud vendor platform, you can use the AWS SDK to call the CloudWatch API to create or update alarm rules.

[0033] Step 103: The user client that has passed the identity authentication sends an alarm template to the cloud vendor platform, and converts the alarm rule content in the sent alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource.

[0034] After the user client passes the authentication, it indicates that the user client is safe, and the alarm rule content in the alarm template can be obtained through the user client, and the alarm template can be sent to the cloud vendor platform.

[0035] In order to ensure that the issued alarm template is the latest template, the latest standardized alarm template can be obtained through the template management unit to avoid using outdated templates.

[0036] It should be noted that since the alarm rules require resources as alarm objects, the authenticated user client obtains resource lists of various resources from the cloud vendor platform, such as resource lists of cloud servers and cloud databases. The resources in the resource list are used as alarm objects, and the alarm rules are issued to the cloud vendor platform.

[0037] Since the alarm conditions of various resources may be different, for example, the alarm threshold of a server may be different from that of a disk, different alarm rules may be applicable to different resources.

[0038] In order to enable each resource to use the best alarm rules, after the alarm template is issued, the user client that has passed identity authentication will convert the alarm rule content in the issued alarm template into the specific alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource and implement the issuance of the best alarm rules for each resource type.

[0039] Step 104: Compare the baseline alarm rule of each resource with the current alarm rule of each resource.

[0040] After the alarm template is issued, some alarm rules may be repeatedly configured. You can use the alarm rule check to identify which alarm rules are inconsistent with the best practice baseline alarm rules, compare the two rules, and identify the differences. For the identified differences, the user client can choose whether to adjust them. The purpose of detecting differences is to prevent users from missing, mismatching, and repeated configuration.

[0041] Specifically, different cloud vendor platforms support multiple resource selection methods when configuring alarm rules, such as by application group, by tag, by resource ID, etc. Therefore, when obtaining resources, it is necessary to obtain application group, tag and other information at the same time.

[0042] Obtain the current alarm rules for each resource from the cloud vendor platform through the cloud vendor platform's cloud API, including detailed information such as the application group, tag, and resource ID of each rule.

[0043] Then, obtain a list of all key resources on the current cloud vendor platform (such as servers, databases, disks, network devices, etc.) through the cloud vendor platform's cloud API, and store this resource information in the resource management unit, including detailed information such as resource application grouping, tags, resource IDs, etc.

[0044] According to the best practice template, a baseline alarm rule is generated for each resource and compared with the current alarm rule. The baseline alarm rule includes the alarm trigger condition, alarm level and recovery condition in the alarm template.

[0045] The differences between the baseline alarm rules of each resource and the current alarm rules of each resource mainly include: inconsistent thresholds (the thresholds of the current rules are inconsistent with the best practices), redundant rules (the existence of repeated or redundant alarm rules), and missing rules (the lack of certain key alarm rules).

[0046] Step 105: The user client that has passed the identity authentication corrects the inconsistent current alarm rules, obtains the final alarm rules and sends them to the cloud vendor platform.

[0047] After comparison, the difference between the current alarm rules of each resource and the baseline alarm rules of each resource is obtained. The user client that has passed the identity authentication can choose to make a one-click correction or specify the alarm rule correction. After the user client determines the correction method, it sends a correction instruction to the cloud vendor platform, obtains the final alarm rule and sends it to the cloud vendor platform.

[0048] By setting steps to correct inconsistencies, you can maintain the flexibility of manual adjustments and allow differentiated settings based on specific business needs.

[0049] Step 106: Use the final alarm rule to configure alarms for each resource and apply them to each resource.

[0050] The final alarm rules after differential correction will be configured and applied to each resource to realize the alarm configuration of each resource and improve the standardization and efficiency of alarm configuration.

[0051] An embodiment of the present application proposes an alarm management method, which creates an alarm template library through a user client, wherein the alarm template library includes different types of alarm templates, and each alarm template includes: alarm trigger conditions, trigger frequencies, alarm levels, recovery conditions, and alarm rule contents of alarm messages; the user client provides an AK key and an SK key to a cloud vendor platform for identity authentication; then the user client that passes the identity authentication sends the alarm template to the cloud vendor platform, and converts the alarm rule contents in the sent alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource; the baseline alarm rules of each resource are compared with the current alarm rules of each resource, wherein the baseline alarm rules include the alarm trigger conditions, alarm levels, and recovery conditions in the alarm template; the user client that passes the identity authentication corrects the inconsistent current alarm rules to obtain the final alarm rules and sends them to the cloud vendor platform; finally, the final alarm rules are used to configure alarms for each resource and apply them to each resource.

[0052] This method ensures that all alarm rules are configured in accordance with industry best practices by issuing standardized alarm templates. Standardized alarm configuration reduces errors caused by manual configuration and improves the accuracy and consistency of initial configuration. Through alarm rule checking, redundant or incorrectly configured alarm rules can be discovered and adjusted in a timely manner, reducing unnecessary alarm noise.

[0053] In an optional implementation, the above step 103 converts the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rule of each resource, specifically including: Step 1031: The user client that has passed the identity authentication calls the cloud API to obtain all current resources of the cloud vendor platform and creates a resource list.

[0054] The user client that has passed the identity authentication obtains all the current resources of the cloud vendor platform by calling the cloud API and creates a resource list, which includes servers, databases, disks, networks, etc. The resources are stored in the resource management unit, and the resources are managed and stored through the resource management unit.

[0055] Step 1032: The user client that has passed the identity authentication traverses the resource list, calls the cloud API interface corresponding to each resource in the resource list to convert the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform, and obtains the current alarm rule of each resource.

[0056] The user client establishes identity authentication with the cloud vendor platform through AK (Access Key) and SK (Secret Key). Once the authentication is completed, the user client can call the cloud vendor platform's cloud API through SDK (Software Development Kit) to operate the cloud vendor platform.

[0057] It should be noted that different clouds have different delivery methods: Tencent Cloud delivers by tag, Alibaba Cloud delivers by application group, Huawei Cloud delivers by all resources, and AWS Cloud delivers by instance.

[0058] Therefore, for different resources in the resource list, different cloud API interfaces need to be called to perform alarm configuration conversion.

[0059] Specifically, the user client that has passed the identity authentication traverses the created resource list and calls the cloud API interface corresponding to each resource in the resource list to convert the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform, and obtains the current alarm rules of each resource.

[0060] In an optional embodiment, the method further comprises the following steps: Step 107: The cloud vendor platform feeds back the status of the final alarm rule issuance to the user client.

[0061] After the final alarm rule is issued, in order to ensure the effectiveness of the rule issuance, the cloud vendor platform will feedback the status of the final alarm rule issuance to the user client. The feedback rule issuance status includes but is not limited to the number of rules that were successfully issued, the rules that failed to be issued, and the reasons for the failure to issue.

[0062] Step 108: Generate a rule delivery status list based on the delivery status of the final alarm rule.

[0063] A rule delivery status list is generated through the delivery status of the above-mentioned final alarm rules, so that the user client can view the status of rule delivery through the list, such as the number of rules that are successfully delivered, which rules fail to be delivered, the reasons for the failure, etc.

[0064] Step 109: Display the rule delivery status list on the user interface of the user client.

[0065] After obtaining the rule delivery status list, the rule delivery status list is displayed on the user interface of the user client so that the user can view the above rule status delivery list through the user client interface. The above rule status delivery list includes at least the following contents: the usage, delivery time and applicable resources of each final alarm rule.

[0066] Based on the above implementation, the method further includes: Step 110: For the final alarm rule that fails to be issued, the cloud vendor platform generates an exception notification.

[0067] The final alarm rules for failed delivery can be viewed through the rule delivery status list. For these failed delivery rules, the cloud vendor platform generates an exception notification to remind the user client to find the cause of the delivery failure.

[0068] Step 111: The cloud vendor platform sends the exception notification and the corresponding error log to the user client.

[0069] The cloud vendor platform will send the exception notification and the corresponding error log to the user client so that the user client can know which rules failed to be issued and troubleshoot the reasons for the failure based on the error log to avoid the same problem in the future. Among them, the exception notification is used to prompt the user client to check the reasons for the failure to issue, and the error log is used for the user client to troubleshoot the reasons for the failure to issue.

[0070] See also Figure 2 , Figure 2It is a flow chart of an alarm management method proposed in an embodiment of the present application. A standardized alarm template is prepared according to best practices. The alarm template supports updating and maintenance and is managed through a template management unit. Identity authentication is established with the cloud vendor platform through AK (Access Key) and SK (Secret Key). After authentication is completed, the cloud vendor platform can be operated by calling the cloud API through the SDK. The latest standardized template is obtained from the template management unit, and the cloud API is called to send the template to the alarm rules in the monitoring management of the cloud vendor platform. The actual objects of alarm rule management are various resources in the cloud vendor platform. The resources are obtained from the resource management unit, and the corresponding resources are obtained from the resource management unit when the alarm rules are sent. Then the current alarm rules are obtained from the baseline alarm rules in the baseline template, and the alarm rules are compared. The rule differences are sent to the user client, and the user client confirms the differences and applies the confirmed alarm rules to various resources.

[0071] In an optional embodiment, the method further comprises the following steps: Step 112: Receive an alarm message through the monitoring module of the cloud vendor platform.

[0072] After the final alarm rules are applied to each resource, alarm management is performed on each resource according to the configured alarm rules. When an abnormality occurs in each resource, an alarm message will be issued. Alarm information from different cloud vendor platforms is received through the webhook protocol, and the received alarm information is stored in the alarm management unit, which stores all alarm history information; Webhook is a communication mechanism based on HTTP callback, which allows an application to automatically notify another application through HTTP request when a specific event occurs.

[0073] Specifically, Webhooks are configured in the monitoring modules of different cloud vendor platforms, and alarm messages are sent to the monitoring modules of the cloud vendor platforms through HTTP requests.

[0074] The alarm message is sent by each resource based on the configured final alarm rule, and the alarm message includes: alarm content and alarm level, as well as timestamp, resource ID and other contents.

[0075] Step 113: Generate a unique identifier for each alarm message, where the unique identifier includes: resource ID, alarm type and timestamp.

[0076] A unique identifier (ID) is generated for each alarm message, and combined with a timestamp to ensure the uniqueness of the alarm message. For example, the alarm ID can be in the format of resource ID (resourceID)-alarm type-timestamp.

[0077] Step 114: Based on the unique identifier of each alarm message, multiple alarm messages of the same resource and the same alarm type are merged into one alarm event.

[0078] Aggregate multiple alarm messages into one alarm event through the alarm unique identifier, and use the alarm unique identifier combined with the timestamp as the alarm unique value. Specifically, multiple alarms of the same resource and the same type are merged into one alarm event. For example, if the same server triggers the CPU high usage alarm multiple times in a short period of time, aggregate them into one CPU usage alarm event.

[0079] Step 115: Convert the alarm event that meets the alarm-to-work order rule into an alarm work order.

[0080] Pre-set alarm-to-work order rules. For example, only alarm events that reach a certain alarm level or duration will be converted into alarm work orders. Alarm-to-work order rules can be defined in JSON files and stored in the alarm management system.

[0081] According to the alarm-to-work order rules, alarm events that meet the alarm-to-work order rules are converted into alarm work orders. The converted alarm work orders include but are not limited to alarm details, time, and processing status (processed or unprocessed).

[0082] After the alarm work order is generated, it will be assigned to idle operation and maintenance personnel so that the operation and maintenance personnel can quickly handle the alarm work order.

[0083] Step 116: Mark and analyze the content of the alarm work order to obtain an analysis result.

[0084] In order to effectively analyze the contents of the alarm work order, the contents in the alarm work order are marked with different tags, including but not limited to the alarm validity, the items described in the alarm, the alarm component object, the alarm type, etc. Then the marking results are analyzed to obtain the analysis results.

[0085] Based on the above implementation mode, the above step 116 marks and analyzes the content of the alarm work order to obtain the analysis result, which specifically includes: Step 1161: Use a large language model to perform multi-dimensional tagging on the content of the alarm work order to obtain a tagging result.

[0086] In the embodiment of the present application, a large language model is used to identify alarm messages and alarm comments, and the alarm work order is marked in multiple dimensions. For example, the large language model GPT-3 can be used to mark the content of the alarm work order, and the marking dimensions include but are not limited to: alarm validity (such as valid, invalid), alarm project (such as specific application or service), alarm component object (such as server, database instance, etc.) and alarm type (such as performance alarm, capacity alarm, network alarm, etc.).

[0087] Step 1162: Based on the marking result, analyze the alarm work order and generate an analysis result.

[0088] After the large language model has finished marking the alarm work order, the embodiment of the present application uses the work order analysis unit to analyze the effectiveness and alarm type of the alarm in different marking dimensions, so as to optimize the alarm rules in the next step. The marking results are stored in the work order analysis unit to form a work order analysis database for subsequent analysis and query.

[0089] Specifically, the work order analysis unit analyzes work orders from multiple dimensions (such as effectiveness, type, frequency, etc.) and generates detailed statistical reports. For example, the specific types and components of high-frequency alarms in the past month and the effective alarm rate can be analyzed to identify alarm rules that need to be optimized.

[0090] Generate statistical reports and display them on the user client interface of the alarm management platform to help the operation and maintenance team clearly understand alarm trends and problems.

[0091] Based on the work order analysis results, the system automatically generates optimization suggestions for alarm rules. For example, for high-frequency invalid alarms, the system can suggest adjusting the alarm threshold or canceling redundant alarms. The user client can choose to automatically apply these optimization suggestions or manually adjust the rules.

[0092] See also Figure 3 , Figure 3 It is a flowchart of a method for marking work orders in an alarm management method proposed in an embodiment of the present application. After the cloud vendor platform sends an alarm message (corresponding to the cloud platform alarm in), the alarm message is accessed to the alarm management unit through a webhook, and the alarm message is aggregated according to the resource ID of the alarm message. The aggregated alarm event is converted into an alarm work order and managed. After reading the alarm work order, a large language model is used to mark the alarm work order in multiple dimensions, and the marking results are stored. The work order analysis unit is used to analyze the marking results. By analyzing historical alarms and work order information, the alarm management strategy can be continuously improved. Analyzing the effectiveness and type of alarms provides necessary data support for optimizing alarm rules, helping the operation and maintenance team to continuously improve the accuracy and effectiveness of alarm management.

[0093] In a second aspect, the present application embodiment provides an alarm management device, see Figure 4 , Figure 4 : is a functional module diagram of an alarm device proposed in an embodiment of the present application, the device comprising: The creation module 401 is used to create an alarm template library through a user client, wherein the alarm template library includes different types of alarm templates, each of which includes: alarm triggering conditions, triggering frequency, alarm level, recovery conditions, and alarm rule content of an alarm message; Identity authentication module 402, used for the user client to provide the AK key and the SK key to the cloud vendor platform for identity authentication; The rule conversion module 403 is used for the user client that has passed the identity authentication to send an alarm template to the cloud vendor platform, and convert the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rule of each resource; A comparison module 404 is used to compare the baseline alarm rules of each resource with the current alarm rules of each resource, wherein the baseline alarm rules include the alarm triggering conditions, alarm levels and recovery conditions in the alarm template; Correction module 405, used for the user client that has passed identity authentication to correct the inconsistent current alarm rules, obtain the final alarm rules and send them to the cloud vendor platform; The application module 406 is used to use the final alarm rule to configure alarms for various resources and apply them to various resources.

[0094] Wherein, the device further comprises: A feedback module is used for the cloud vendor platform to feed back the status of the final alarm rule issuance to the user client, and the status of the final alarm rule issuance includes: the number of rules that are successfully issued, the rules that fail to be issued, and the reasons for the failure to issue; A generating module, used for generating a rule issuing status list based on the status of the final alarm rule issuing; The rule display module is used to display the rule delivery status list on the user interface of the user client, and the rule delivery status list includes: the usage, delivery time and applicable resources of each final alarm rule.

[0095] Wherein, the device further comprises: The abnormal notification generation module is used to generate abnormal notifications on the cloud vendor platform for the final alarm rules that fail to be issued; The sending module is used for the cloud vendor platform to send the exception notification and the corresponding error log to the user client, the exception notification is used to prompt the user client to check the reason for the failure of the delivery, and the error log is used for the user client to investigate the reason for the failure of the delivery.

[0096] Wherein, the rule conversion module includes: The resource list creation submodule is used by the user client that has passed the identity authentication to call the cloud API to obtain all current resources of the cloud vendor platform and create a resource list; The rule conversion submodule is used for the user client that has passed the identity authentication to traverse the resource list, call the cloud API interface corresponding to each resource in the resource list to convert the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform, and obtain the current alarm rules of each resource.

[0097] Wherein, the device further comprises: A message receiving module, used to receive an alarm message through a monitoring module of a cloud vendor platform, wherein the alarm message is issued by each resource based on the configured final alarm rule, and the alarm message includes: alarm content and alarm level; An identifier generation module, used to generate a unique identifier for each alarm message, wherein the unique identifier includes: a resource ID, an alarm type and a timestamp; A merging module, used for merging multiple alarm messages of the same resource and the same alarm type into one alarm event based on a unique identifier of each alarm message; The alarm work order conversion module is used to convert the alarm events that meet the alarm conversion work order rules into alarm work orders, and the alarm work order includes alarm details, time, and processing status; The marking and analysis module is used to mark and analyze the content of the alarm work order to obtain an analysis result.

[0098] Wherein, the marker analysis module includes: A marking submodule is used to use a large language model to perform multi-dimensional marking on the content of the alarm work order to obtain a marking result, wherein the dimensions include: alarm validity, alarm item, alarm component object, and alarm type; The analysis submodule is used to analyze the alarm work order based on the marking result and generate an analysis result.

[0099] Based on the same application concept, the embodiment of the present application discloses an electronic device in a third aspect. Figure 5 A schematic diagram of an electronic device disclosed in an embodiment of the present application is shown. Figure 5 As shown, the electronic device 100 includes: a memory 110 and a processor 120, the memory of the electronic device is not less than 12G, the main frequency of the processor is not less than 2.4GHz, the memory 110 and the processor 120 are connected via a bus communication, and a computer program is stored in the memory 110. The computer program can be run on the processor 120 to implement an alarm management method disclosed in an embodiment of the present application.

[0100] Based on the same application concept, the embodiment of the present application discloses in a fourth aspect a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, an alarm management method disclosed in the embodiment of the present application is implemented.

[0101] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0102] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices, electronic devices, and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0103] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0105] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0106] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0107] The above is a detailed introduction to the alarm management method, device, equipment and medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An alarm management method, characterized in that: The method comprises: Creating an alarm template library through a user client, the alarm template library includes different types of alarm templates, each alarm template includes: alarm triggering conditions, triggering frequency, alarm level, recovery conditions and alarm rule content of the alarm message; The user client provides the AK key and SK key to the cloud vendor platform for identity authentication; The user client that has passed the identity authentication sends the alarm template to the cloud vendor platform, and converts the alarm rule content in the sent alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource; Comparing the baseline alarm rules of each resource with the current alarm rules of each resource, wherein the baseline alarm rules include the alarm triggering conditions, alarm levels, and recovery conditions in the alarm template; The user client that has passed the identity authentication corrects the inconsistent current alarm rules, obtains the final alarm rules and sends them to the cloud vendor platform; The final alarm rule is used to configure alarms for various resources and applied to various resources.

2. The alarm management method according to claim 1, characterized in that: The method further comprises: The cloud vendor platform feeds back the status of the final alarm rule issuance to the user client, and the status of the final alarm rule issuance includes: the number of rules that are successfully issued, the rules that fail to be issued, and the reasons for the failure to issue; Based on the status of the final alarm rule issuance, generate a rule issuance status list; The rule delivery status list is displayed on the user interface of the user client, and the rule delivery status list includes: the usage status, delivery time and applicable resources of each final alarm rule.

3. The alarm management method according to claim 2, characterized in that: The method further comprises: For the final alarm rules that fail to be issued, the cloud vendor platform generates an exception notification; The cloud vendor platform sends the exception notification and the corresponding error log to the user client. The exception notification is used to prompt the user client to check the reason for the failure to send, and the error log is used for the user client to check the reason for the failure to send.

4. The alarm management method according to claim 1, characterized in that: Convert the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource, including: The user client that has passed the identity authentication calls the cloud API to obtain all current resources of the cloud vendor platform and create a resource list; The user client that has passed the identity authentication traverses the resource list, calls the cloud API interface corresponding to each resource in the resource list, converts the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform, and obtains the current alarm rule of each resource.

5. The alarm management method according to claim 1, characterized in that: The method further comprises: Receiving an alarm message through a monitoring module of a cloud vendor platform, wherein the alarm message is issued by each resource based on the configured final alarm rule, and the alarm message includes: alarm content and alarm level; Generate a unique identifier for each alarm message, the unique identifier including: resource ID, alarm type and timestamp; Based on the unique identifier of each alarm message, multiple alarm messages of the same resource and the same alarm type are merged into one alarm event; Convert alarm events that meet the alarm-to-work order rules into alarm work orders, where the alarm work orders include alarm details, time, and processing status; The content of the alarm work order is marked and analyzed to obtain an analysis result.

6. The alarm management method according to claim 5, characterized in that: The content of the alarm work order is marked and analyzed to obtain analysis results, including: Using a large language model to perform multi-dimensional tagging on the content of the alarm work order to obtain a tagging result, wherein the dimensions include: alarm validity, alarm item, alarm component object, and alarm type; Based on the marking result, the alarm work order is analyzed to generate an analysis result.

7. An alarm management device, characterized in that: The device comprises: A creation module, used to create an alarm template library through a user client, wherein the alarm template library includes different types of alarm templates, each alarm template includes: alarm triggering conditions, triggering frequency, alarm level, recovery conditions and alarm rule content of the alarm message; The identity authentication module is used by the user client to provide the AK key and SK key to the cloud vendor platform for identity authentication; The rule conversion module is used for the user client that has passed the identity authentication to send the alarm template to the cloud vendor platform, and convert the alarm rule content in the issued alarm template into the alarm configuration corresponding to each resource in the cloud vendor platform to obtain the current alarm rules of each resource; A comparison module, used to compare the baseline alarm rules of each resource with the current alarm rules of each resource, wherein the baseline alarm rules include the alarm triggering conditions, alarm levels and recovery conditions in the alarm template; The correction module is used by the user client that has passed the identity authentication to correct the inconsistent current alarm rules, obtain the final alarm rules and send them to the cloud vendor platform; The application module is used to use the final alarm rule to configure alarms for various resources and apply them to various resources.

8. The alarm management device according to claim 7, characterized in that: The device also includes: A feedback module is used for the cloud vendor platform to feed back the status of the final alarm rule issuance to the user client, and the status of the final alarm rule issuance includes: the number of rules that are successfully issued, the rules that fail to be issued, and the reasons for the failure to issue; A generating module, used for generating a rule issuing status list based on the status of the final alarm rule issuing; The rule display module is used to display the rule delivery status list on the user interface of the user client, and the rule delivery status list includes: the usage, delivery time and applicable resources of each final alarm rule.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the alarm management method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: A computer program / instruction is stored thereon, and when the computer program / instruction is executed by a processor, the alarm management method according to any one of claims 1 to 6 is implemented.

Images