Aggregation alarm method and system

Abstract

The invention provides an aggregation alarm method and system, and belongs to the technical field of aggregation alarm, and the method comprises the steps: S1, receiving source alarm events generated by different alarm sources, and carrying out the standardization processing of the alarm information of the source alarm events, and obtaining standardized alarm events; s2, performing aggregation analysis processing on the standardized alarm event to obtain an aggregation alarm event; and S3, giving an alarm according to the aggregated alarm event. The method has the beneficial effects that the source alarm event information from various different monitoring devices and systems is received, the aggregation analysis is performed on the source alarm event through the aggregation analysis rule and algorithm, the aggregation alarm event information is generated and pushed to a common alarm notification channel in a unified manner, and the subsequent cooperative processing mechanism of the alarm event is provided; therefore, the problems of repeated alarms and difficulty in cooperative troubleshooting due to the fact that each monitoring device and system fight independently are solved, and unified alarm information pushing and follow-up cooperative processing of various alarm notification channels and protocols are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of aggregate alarm, and in particular to an aggregate alarm method and system. Background Art

[0002] In the process of information system construction, in order to monitor the operation and health status of the system, such as Figure 1 As shown in the figure, it is generally equipped with security monitoring equipment or software, operation and maintenance monitoring system and automatic inspection system. Security monitoring equipment or software is used to monitor and protect system security. The operation and maintenance monitoring system is responsible for monitoring components such as hosts and network infrastructure, middleware, databases and applications, and the automatic inspection system is responsible for monitoring core links and services. When the security monitoring equipment or software, operation and maintenance monitoring system or automatic inspection system detects an abnormal event, it will use the built-in alarm module to push notifications of the alarm event through channels or protocols such as SMS, email, instant messaging (IM), phone and webhook.

[0003] The existing alarm mechanism mainly relies on the built-in alarm modules of each monitoring device or system to alarm abnormal events. Although these modules can realize basic alarm notification functions, each monitoring device and system only focuses on its own monitoring field and works independently. The generated alarm events are difficult to coordinate, which leads to the following problems. First, each alarm module needs to be configured or adapted to various alarm notification channels, and customized development is required for unsupported channels or protocols, which increases the cost of implementation and maintenance. Secondly, a large number of repeated and unrelated alarm events will be generated, which require manual analysis and troubleshooting, making it difficult to deal with problems in a timely manner, and lacking unified follow-up processing capabilities for alarm events. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides an aggregate alarm method; on the other hand, it also provides an aggregate alarm system.

[0005] The technical problem solved by the present invention can be achieved by adopting the following technical solutions:

[0006] An aggregate alarm method, comprising:

[0007] Step S1, receiving source alarm events generated from different alarm sources, and performing standardization processing on the alarm information of the source alarm events to obtain standardized alarm events;

[0008] Step S2, performing aggregation analysis on the standardized alarm events according to the aggregation analysis rules to obtain aggregated alarm events;

[0009] Step S3: issuing an alarm according to the aggregated alarm event.

[0010] Preferably, the step S1 comprises:

[0011] Step S11, constructing alarm event metadata to standardize the alarm information;

[0012] Step S12: Based on the constructed alarm event metadata, the received alarm information of the source alarm event is subjected to standardized mapping and conversion to obtain a standardized alarm event.

[0013] Preferably, the alarm information includes any one or more combinations of alarm source, alarm object type, alarm object, alarm type, alarm level, alarm time and alarm label.

[0014] Preferably, the aggregation analysis rules include any one or more combinations of the following:

[0015] Convergence aggregation rules are used to perform convergence aggregation processing on standardized alarm events and active aggregation alarm events based on the convergence aggregation time window combined with the filter condition combination of various dimensions of the alarm event metadata;

[0016] Alarm suppression rules are used to suppress new aggregate alarm events based on active aggregate alarm events based on the suppression time window combined with the filter condition combination of various dimensions of the alarm event metadata;

[0017] Alarm silence rules are used to silently process new aggregate alarm events based on the silent time window and the combination of filter conditions of various dimensions of the alarm event metadata.

[0018] Preferably, step S2 comprises:

[0019] Step S21, when a new standardized alarm event is received, the new standardized alarm event is matched with the currently existing active aggregated alarm events according to the convergence aggregation rule:

[0020] If an active aggregation alarm event is matched, the new standardized alarm event is aggregated into the matched active aggregation alarm event, and the start time of the convergence aggregation time window is updated, and then the step S3 is entered;

[0021] If no active aggregate alarm event is matched or there is no active aggregate alarm event currently, a new aggregate alarm event is created according to the new standardized alarm event, and then the process goes to step S22;

[0022] Step S22: Match the new aggregate alarm event created for the first time with the active aggregate alarm event according to the alarm suppression rule:

[0023] If an active aggregate alarm event is matched, suppressing the new aggregate alarm event according to the matched active aggregate alarm event, and returning to step S1;

[0024] If no active aggregate alarm event is matched, proceed to step S23;

[0025] Step S23, determining whether the new aggregate alarm event satisfies the alarm silence rule:

[0026] If the new aggregate alarm event satisfies any of the alarm silencing rules, the new aggregate alarm event is silencingly processed, and the process returns to step S1;

[0027] If the new aggregated alarm event does not satisfy all the alarm silencing rules, the process proceeds to step S3.

[0028] Preferably, step S3 comprises:

[0029] Step S31, matching the aggregated alarm event with a plurality of pre-configured alarm dispatching rules, and when an alarm dispatching rule is matched, pushing the aggregated alarm event to a corresponding alarm team according to the matched alarm dispatching rule;

[0030] Step S32, determining whether the aggregate alarm event is claimed, and entering step S33 after the aggregate alarm event is claimed;

[0031] Step S33: when receiving a closing message of the aggregate alarm event, closing the aggregate alarm event.

[0032] Preferably, the alarm assignment rule is configured with an alarm team, an alarm notification channel and an alarm template;

[0033] The step S31 includes: for the aggregate alarm event, according to the matched alarm dispatching rule, generating alarm notification information according to the alarm template, pushing it to the corresponding alarm team through the corresponding alarm notification channel, and recording the dispatch notification log.

[0034] Preferably, in step S32, when the aggregate alarm event is not claimed after being assigned and exceeds a first preset claim time, an upgrade notification is first made by telephone, and when it is still not claimed after a second preset claim time, the aggregate alarm event is upgraded and assigned according to the alarm upgrade rules configured by the alarm dispatching rules.

[0035] Preferably, in the step S33, before receiving the closing message of the aggregate alarm event, the step further includes:

[0036] Upon receiving the alarm collaboration message sent by the alarm team, sending a collaborative processing notification message of the aggregated alarm event to the collaborative personnel; and / or

[0037] When the alarm upgrade message sent by the alarm team is received, the aggregated alarm event is upgraded.

[0038] The present invention also provides an aggregate alarm system for implementing the above-mentioned aggregate alarm method, the system comprising:

[0039] An alarm event receiving module is used to receive source alarm events generated from different alarm sources, and perform standardization processing on the alarm information of the source alarm events to obtain standardized alarm events;

[0040] An aggregate alarm analysis module, connected to the alarm event receiving module, configured to perform aggregate analysis on the standardized alarm events according to an aggregate analysis rule to obtain an aggregate alarm event;

[0041] The aggregate alarm notification processing module is connected to the aggregate alarm analysis module and is used to generate an alarm according to the aggregate alarm event.

[0042] The advantages or beneficial effects of the technical solution of the present invention are:

[0043] The present invention receives source alarm event information from various monitoring devices and systems, performs aggregate analysis on the source alarm events through aggregate analysis rules and algorithms, generates aggregate alarm event information and uniformly pushes it to common alarm notification channels, as well as a subsequent collaborative processing mechanism for alarm events, thereby solving the problems of repeated alarms and unrelated problems that are difficult to coordinate and troubleshoot due to each monitoring device and system operating independently, and solving the unified alarm information push and subsequent collaborative processing of multiple alarm notification channels and protocols. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of monitoring, alarming and notification of a traditional information system in the prior art;

[0045] Figure 2 A schematic diagram of a flow chart of an aggregate alarm method in a preferred embodiment of the present invention;

[0046] Figure 3 This is a flow chart of step S1 in a preferred embodiment of the present invention;

[0047] Figure 4 This is a flow chart of step S2 in a preferred embodiment of the present invention;

[0048] Figure 5 This is a flow chart of step S3 in a preferred embodiment of the present invention;

[0049] Figure 6 This is a structural block diagram of an aggregate alarm system in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0052] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but they are not intended to limit the present invention.

[0053] In a preferred embodiment of the present invention, based on the above-mentioned problems existing in the prior art, an aggregate alarm method and system are provided, which relate to the field of operation and maintenance monitoring alarm and the field of big data analysis and processing, and can receive various alarm events and perform aggregate analysis and subsequent processing.

[0054] like Figure 2 As shown, an aggregate alarm method includes:

[0055] Step S1, receiving source alarm events generated from different alarm sources, and performing standardization processing on the alarm information of the source alarm events to obtain standardized alarm events;

[0056] Step S2, performing aggregation analysis on the standardized alarm events according to the aggregation analysis rules to obtain aggregated alarm events;

[0057] Step S3: issuing an alarm based on the aggregated alarm event.

[0058] Specifically, the embodiments of the present invention are capable of receiving source alarm events generated by various types of different alarm sources, and performing standardized alarm event information conversion; through aggregation analysis rules and algorithms, convergence aggregation, alarm suppression, and alarm silencing of alarm events are implemented to generate aggregated alarm event information; subsequently, alarm processing is performed according to the aggregated alarm events, and the alarm processing includes but is not limited to the dispatch, notification, claiming, and processing of the aggregated alarm events, so as to uniformly push the generated aggregated alarm events to common alarm notification channels, as well as a subsequent collaborative processing mechanism for alarm events, thereby solving the problem of repeated alarms and unrelated problems that are difficult to coordinate due to the independent operations of various monitoring devices and systems, and solving the unified alarm information push and subsequent collaborative processing of multiple alarm notification channels and protocols.

[0059] Furthermore, before step S1, the method may also include: pre-building an alarm event sending component and a receiving component to implement the sending and receiving of alarm events.

[0060] Among them, the alarm event sending component is used to send the source alarm event generated by the alarm source to the system of the present invention. The source alarm event is generally generated by alarm sources such as various monitoring devices and systems, and the source alarm event is pushed or notified through the built-in alarm module, which generally supports the webhook push protocol. The original built-in alarm module is the alarm event sending component.

[0061] The alarm event receiving component is used to receive source alarm events generated by different alarm sources, convert the source alarm events into standardized alarm event information according to the alarm event metadata, and then transfer them to the next step for aggregation analysis and processing.

[0062] Furthermore, the alarm event receiving component can implement push protocols for different alarm sources through dynamic extension mechanisms such as plug-ins or scripts, and can also provide a custom receiving protocol or API for external calls.

[0063] Through the above-mentioned alarm event sending component and alarm event receiving component, two alarm source docking modes are provided to realize the reception of source alarm events.

[0064] Furthermore, before step S1, the following steps may be included: configuring alarm event metadata, alarm source, alarm team, alarm notification channel, alarm template and alarm rule.

[0065] Alarm event metadata configuration includes, but is not limited to, unified configuration of alarm object type, alarm object, alarm type, alarm level, and alarm tag.

[0066] in:

[0067] The alarm object type refers to the target object type that generates the alarm event, including infrastructure such as hosts, storage and networks, and system components such as databases, middleware and applications. The alarm object type configuration includes unified definition of physical device node types such as hosts, networks and security, and software node types such as applications, databases and various middleware.

[0068] The alarm object is the unique identifier of the target object that generates the alarm event. Alarm object configuration includes uniquely identifying all target objects that trigger alarms, and with the alarm tag, it can establish an association relationship between different alarm objects.

[0069] Alarm type refers to the type of alarm event, including alarm events and corresponding alarm recovery events, etc. Alarm type configuration includes unified definition of alarm event types, including alarm events and corresponding alarm recovery events.

[0070] Alarm level refers to the classification based on the severity of the impact of the alarm event, including but not limited to the three-level classification method of general events, warning events and severe events, or the four-level classification method of minor events, general events, severe events and emergency events. Alarm level configuration includes standardized definition of the severity of alarms, including three alarm levels of minor, warning and severe by default.

[0071] Alarm tags refer to the associated tag information of alarm events, which are used to supplement the business and environment context information of alarm events. Alarm tags provide an information supplement and enhancement mechanism for alarm events. Metadata such as alarm object type, alarm object identifier, alarm type and alarm level can be used to supplement and enhance alarm information through alarm tags.

[0072] For example, taking the user management application as an example, its alarm tag may be:

[0073] event_id:1322100157, event identifier

[0074] app_id:user_mgmt_service, application identifier

[0075] app_name: User management service, application name

[0076] source:acos, alarm source identifier

[0077] source_event_id:12330788, source alarm event ID

[0078] host:xt_dsjgf_app_01, the host name

[0079] ip:172.16.23.12, the host IP

[0080] port:31022, application service port

[0081] Alarm source configuration is used to configure the alarm sources such as monitoring equipment and systems that generate source alarm events. Alarm sources refer to the sources of alarm events, including various monitoring equipment and systems, business systems and other components.

[0082] There are two main ways to connect to alarm sources:

[0083] The commonly used operation and maintenance monitoring and alarm systems in the industry generally support the alarm event callback of the webhook protocol, and realize the adaptation and integration with alarm sources such as acos, Observation Cloud and Prometheus through the plug-in mechanism. The system generates the corresponding webhook callback address and registers it to the alarm push configuration of the alarm source to receive alarm events.

[0084] The system provides a standardized API interface for reporting alarm events, and allocates corresponding call tokens to the API interface callers. The interface callers can call the API interface through the HTTP protocol or the SDK provided by the system to report alarm events.

[0085] Alarm team configuration is used to manage alarm groups and alarm group members. The alarm team consists of alarm groups and alarm group members, and the alarm dispatching rules are combined to aggregate alarm events to alarm groups or alarm members. The present invention synchronizes the organization user data by docking with the authoritative organization data of the project, and the members of the alarm team are selected from the provided users.

[0086] Alarm notification channel configuration is used to configure alarm event notification channels such as SMS, email, phone, government WeChat, and custom webhook callback.

[0087] Alarm event notification channels include but are not limited to:

[0088] SMS: configure the SMS sending gateway and perform SMS sending test;

[0089] Mail: Configure the mail sending gateway and conduct mail sending tests;

[0090] Telephone: configure voice call service and conduct voice sending test;

[0091] Government WeChat: Configure the application to obtain AK / SK in the government WeChat management background, and perform corresponding configuration and testing in the government WeChat notification channel;

[0092] webhook: used for custom alarm event callback configuration and testing, optional.

[0093] Alarm template configuration is used to configure the information template of the alarm event notification. For example, a template engine can be used to combine the alarm event information and metadata to output the alarm notification text in a templated manner. Preferably, different alarm notification channels use independent templates, and preset templates can be used or customized configurations can be performed.

[0094] Alarm rule configuration is used to configure alarm event aggregation, suppression, silencing, and dispatching rules.

[0095] Alarm rules include but are not limited to convergence aggregation rules, alarm silence rules, alarm silence rules and alarm dispatch rules, of which the first three are collectively referred to as aggregation analysis rules, and alarm dispatch rules are applied to alarm processing.

[0096] In the convergence aggregation rule, the time span of an aggregation is configured through the time window. Alarm events exceeding the time span will be aggregated into new aggregate alarm events. The aggregation rule is configured through the filtering conditions of each dimension of the alarm event metadata.

[0097] In the alarm silent rule, you can configure a single or periodic silent time window for one or more time periods, and configure the silent rule through the filtering conditions of various dimensions of the alarm event metadata.

[0098] In the alarm silence rule, the suppression time window is defined. You can configure the suppression rules for newly generated aggregate alarm events for active aggregate alarm events. The suppression rules can be configured by combining the filtering conditions of various dimensions of the alarm event metadata.

[0099] In the alarm dispatching rules, based on the filtering conditions of the time window and various dimensions of the alarm event metadata, the dispatching rules for aggregated alarm events to the alarm team are configured.

[0100] As a preferred embodiment, wherein Figure 3 As shown, step S1 includes:

[0101] Step S11, constructing alarm event metadata to standardize the alarm information;

[0102] The alarm information includes any one or more combinations of alarm source, alarm object type, alarm object, alarm type, alarm level, alarm time and alarm label.

[0103] Step S12: Based on the constructed alarm event metadata, the alarm information of the received source alarm event is subjected to standardized mapping and conversion to obtain a standardized alarm event.

[0104] Specifically, in this embodiment, by constructing metadata of alarm events, standardized definitions are performed on alarm information such as alarm source, alarm object type, alarm object, alarm type, alarm level, alarm time and alarm label. Through standardized definitions, standardized mapping and conversion of source alarm information can be achieved, thereby providing a unified alarm information structure for subsequent aggregated alarm analysis and processing.

[0105] The alarm time refers to the system timestamp when the alarm event is triggered. Standard time such as UTC can be used.

[0106] As a preferred implementation, the aggregation analysis rules include any one or more combinations of the following:

[0107] Convergence aggregation rules are used to perform convergence aggregation processing on standardized alarm events and active aggregation alarm events based on the convergence aggregation time window combined with the filter condition combination of various dimensions of the alarm event metadata;

[0108] Alarm suppression rules are used to suppress new aggregate alarm events based on active aggregate alarm events based on the suppression time window combined with the filter condition combination of various dimensions of the alarm event metadata;

[0109] Alarm silence rules are used to perform silent processing on new aggregate alarm events based on the silent time window and the combination of filter conditions of various dimensions of the alarm event metadata.

[0110] Specifically, in the convergence aggregation rule, the time span of an aggregation can be configured based on the time window, and the source alarm time that meets the preset filter condition combination within a certain time span can be aggregated into the same aggregate alarm event in combination with the filter condition combination of the alarm target object, alarm object type or alarm tag and other alarm event metadata dimensions. For alarm events that exceed the time span or do not meet the filter condition combination within the same time span, they are aggregated into a new aggregate alarm event.

[0111] In the alarm suppression rules, based on the pre-configured suppression time window and the combination of filtering conditions of various dimensions of the alarm event metadata, the active aggregate alarm events can suppress the newly generated aggregate alarm events. For example, for the same alarm target object, when multiple alarm events of different levels appear in the aggregation time window, the alarms of higher severity should suppress the alarms of lower severity to avoid interference caused by too many alarms.

[0112] In the alarm silence rule, based on the single or periodic silence time window of one or more pre-configured time periods, combined with the filter conditions of each dimension of the alarm event metadata, the alarm events are filtered and silenced. For example, the alarm events generated by expected maintenance actions are silenced.

[0113] As a preferred embodiment, wherein Figure 4 As shown, step S2 includes:

[0114] Step S21, when a new standardized alarm event is received, the new standardized alarm event is matched with the currently existing active aggregated alarm events according to the convergence aggregation rule:

[0115] If an active aggregate alarm event is matched, the new standardized alarm event is aggregated into the matched active aggregate alarm event, and the start time of the convergence aggregation time window is updated, and then step S3 is entered;

[0116] If no active aggregate alarm event is matched or there is no active aggregate alarm event currently, a new aggregate alarm event is created according to the new standardized alarm event, and then the process goes to step S22;

[0117] Step S22: Match the newly created aggregate alarm event with the active aggregate alarm event according to the alarm suppression rule:

[0118] If an active aggregate alarm event is matched, suppress the new aggregate alarm event according to the matched active aggregate alarm event, and return to step S1;

[0119] If no active aggregate alarm event is matched, proceed to step S23;

[0120] Step S23, determine whether the new aggregate alarm event meets the alarm silence rule:

[0121] If the new aggregate alarm event satisfies any alarm silencing rule, the new aggregate alarm event is silencingly processed and the process returns to step S1;

[0122] If the new aggregated alarm event does not satisfy all alarm silencing rules, proceed to step S3.

[0123] As a preferred embodiment, wherein Figure 5 As shown, step S3 includes:

[0124] Step S31, matching the aggregated alarm event with a plurality of pre-configured alarm dispatching rules, and when the alarm dispatching rule is matched, pushing the aggregated alarm event to the corresponding alarm team according to the matched alarm dispatching rule;

[0125] Step S32, determining whether the aggregate alarm event is claimed, and entering step S33 after the aggregate alarm event is claimed;

[0126] Step S33: when receiving a closing message of the aggregate alarm event, close the aggregate alarm event.

[0127] Specifically, during the first aggregation, if a standardized alarm event is received and there is currently no matching active aggregate alarm event, a corresponding aggregate alarm event is created and transferred to subsequent aggregation analysis rule processing.

[0128] When it is not the first aggregation, the convergence aggregation rules are entered first. When a new standardized alarm event is received, it is matched according to the pre-configured convergence aggregation time window and filtering conditions:

[0129] If there is an active aggregate alarm event that matches the new standardized alarm event within the convergence aggregation time window, the new standardized alarm event is aggregated into the corresponding active aggregate alarm event, and the start time of the convergence aggregation time window is reset to the current time;

[0130] If there is no corresponding active aggregate alarm event, a new aggregate alarm event is created.

[0131] Furthermore, after the new aggregate alarm event is created for the first time, it will be transferred to the alarm suppression rule for processing. The alarm suppression process is to suppress the newly added, low-level aggregate alarm event by the high-level active aggregate alarm event through the alarm suppression rule.

[0132] The premise of the suppression rule is that there must be an active aggregate alarm event and the suppression condition can match the new aggregate alarm event within the suppression time window.

[0133] Preferably, the aggregation convergence of the same aggregate alarm event to the new aggregate alarm event will not trigger alarm suppression processing.

[0134] For new aggregate alarm events, when the suppression rule takes effect, it will not flow to the subsequent alarm silence rule processing, and subsequent alarm processing of the aggregate alarm event (such as dispatch, notification, claim and processing) will not be performed.

[0135] Furthermore, after a new aggregate alarm event is created for the first time and is not suppressed by the alarm suppression rule, it will be transferred to the alarm silence rule for processing.

[0136] Alarm silencing is the process of silently processing aggregated alarm events through alarm silencing rules.

[0137] Specifically: if a new aggregate alarm event within the silent time window matches the filtering condition configured in an alarm silent rule, the aggregate alarm event will be silent.

[0138] If there is no matching alarm silence rule, the new aggregate alarm event will undergo the alarm processing of subsequent aggregate alarm events (such as dispatching, notifying, claiming and processing).

[0139] As a preferred implementation, the alarm dispatching rules are configured with an alarm team, an alarm notification channel and an alarm template;

[0140] Step S31 includes: for the aggregate alarm event, according to the matched alarm dispatching rule, generating alarm notification information according to the alarm template, pushing it to the corresponding alarm team through the corresponding alarm notification channel, and recording the dispatch notification log.

[0141] As a preferred implementation, in step S32, when the aggregate alarm event is not claimed after being assigned and exceeds the first preset claim time, an upgrade notification is first made by telephone, and when it is still not claimed after the second preset claim time, the aggregate alarm event is upgraded and assigned according to the alarm upgrade rules configured by the alarm dispatching rules.

[0142] As a preferred implementation, in step S33, before receiving the closing message of the aggregate alarm event, the method further includes:

[0143] Upon receiving the alarm collaboration message sent by the alarm team, a collaborative processing notification message of the aggregated alarm event is sent to the collaborative personnel; and / or

[0144] When receiving the alarm upgrade message sent by the alarm team, the aggregated alarm event is upgraded.

[0145] Specifically, in this embodiment, the alarm processing includes the dispatch, notification, claim and processing mechanism of aggregated alarm events. It is a closed-loop alarm processing process of dispatching notification, claiming, upgrading, coordinating and closing the aggregated alarm events based on the aggregated alarm events generated after the convergence aggregation, alarm suppression and alarm silencing of the source alarm events are completed in step S2.

[0146] Before executing the dispatch notification, you should first complete the configuration of the alarm team, alarm notification channel, alarm template, and alarm dispatch rules.

[0147] Dispatching notifications, receiving newly generated aggregate alarm events after processing from the aggregate analysis rules, generating alarm notification information according to the alarm template based on the alarm notification channel configured by the alarm dispatching rules, and pushing it to the corresponding alarm notification channel.

[0148] After a new aggregate alarm event is created for the first time, and it is not suppressed by the alarm suppression rule, nor silenced by the alarm silence rule, it will be transferred to the dispatch notification stage for processing;

[0149] Multiple alarm dispatch rules can be configured. After receiving the aggregate alarm event, the rules are matched one by one in order. If there is a matching dispatch rule, the alarm notification information is generated and sent according to the alarm team, notification channel and alarm template configured in the alarm dispatch rule, and the dispatch notification log is recorded.

[0150] If there is no matching dispatch rule, the dispatch notification process is not performed. Preferably, a backup dispatch strategy can be configured to avoid missed alarms.

[0151] Among them, alarm distribution: corresponding alarm teams can be established according to job functions, and alarm events can be assigned to alarm teams through the metadata of alarm events.

[0152] Alarm notification: After completing the alarm assignment, the corresponding alarm team members can be notified through common channels such as SMS, email, IM message and phone.

[0153] When using SMS or email notifications, members of the alarm team can enter the aggregate alarm system backend through the link attached to the alarm information, view the detailed information of the alarm event and perform subsequent processing.

[0154] When using government WeChat notifications, members of the alarm team can view detailed information about the alarm event through the information card of the alarm application IM message, and can also perform subsequent processing through the operation buttons on the information card.

[0155] Telephone notification is generally a high-priority notification method when the alarm level is high or the alarm is not claimed and processed in time.

[0156] Alarm claiming: After receiving an alarm notification, the alarm team members can claim the alarm according to the alarm notification. If the alarm team adopts a shift mechanism, the alarm can be automatically claimed. Preferably, after receiving an alarm notification, the alarm team members can claim the alarm event through the link to the system backend or the operation button of the IM information card. If the alarm team members fail to claim the alarm in time within the time specified by the dispatch rules, the alarm will be upgraded.

[0157] Alarm processing: After completing the alarm claim, the alarm team members can perform corresponding problem analysis, troubleshooting and repair based on the alarm event information.

[0158] When encountering situations that cannot be handled individually, members of the alarm team can initiate handling measures such as alarm collaboration or alarm escalation.

[0159] Alarm escalation: If the alarm team members fail to complete the claim work within the specified time after receiving the alarm notification, they will first use a telephone to notify them of the upgrade. If they still fail to claim it in time, the system will automatically trigger the upgrade dispatch according to the alarm upgrade configuration in the dispatch rule. The upgrade dispatch configuration can be established between the main and standby duty personnel, between superiors and subordinates, or between the first- and second-line personnel.

[0160] Alarm collaboration: After an alarm team member claims an alarm event, if other alarm team members are required to collaborate, they can add collaborators through the system. The collaborators will receive the alarm event collaborative processing notification sent by the system, and can then enter the system background or IM message card for collaborative processing.

[0161] Alarm Closure: After the problem corresponding to the alarm event is repaired, the alarm event can be closed to complete the closed-loop processing of the alarm. Preferably, when the alarm team member completes the fault processing corresponding to an alarm event, the corresponding alarm event can be closed through the system background or IM message card.

[0162] The processing of a new aggregate alarm event starts with alarm assignment and notification, followed by a closed-loop processing process of alarm events such as claiming, upgrading, coordination and closing.

[0163] The method of the present invention can realize one-stop unified alarm notification, quickly access alarm events of various monitoring devices and systems through a plug-in mechanism, perform standardized conversion of alarm event information, and uniformly connect to common alarm notification channels such as text messages, emails, telephones, and IM messages, which can effectively reduce the difficulty and workload of connecting alarm notification channels. Through standardized alarm notification information templates, the difficulty of information identification and collaboration can also be effectively reduced; through grouping and grading notification configuration of alarm teams and notification channels, automatic alarm dispatch and automatic upgrade strategies can be flexibly implemented.

[0164] The method of the present invention can realize one-stop centralized alarm processing, and can effectively reduce the problems of repeated alarms and frequent interruptions by converging and aggregating source alarm events; by establishing an alarm team and automatically dispatching notifications through rules, it can effectively improve the efficiency of claiming and processing alarm events and reduce the omission of alarms; by establishing claiming, upgrading, coordinating and closing processing mechanisms, covering the subsequent closed-loop processing process of alarm events, it can effectively improve the processing and tracing capabilities of alarm events.

[0165] The present invention also provides an aggregate alarm system for implementing the above-mentioned aggregate alarm method, such as Figure 6 As shown, the system includes:

[0166] The alarm event receiving module 102 is used to receive source alarm events generated from different alarm sources, and perform standardization processing on the alarm information of the source alarm events to obtain standardized alarm events;

[0167] The aggregate alarm analysis module 103 is connected to the alarm event receiving module 102 and is used to perform aggregate analysis on the standardized alarm events according to the aggregate analysis rules to obtain aggregate alarm events;

[0168] The aggregate alarm notification processing module 104 is connected to the aggregate alarm analysis module 103 and is used to generate an alarm according to an aggregate alarm event.

[0169] Specifically, in this embodiment, the above method is used to build an aggregate alarm system, which provides an integrated office platform composed of multiple subsystems, and deploys multiple operation and maintenance monitoring systems including observation cloud, acos and Prometheus for monitoring hosts, networks, databases, middleware, application services and tracking call chains. At the same time, an automated inspection system is deployed for automated inspection of core link services.

[0170] The aggregated alarm system of the present invention is intended to solve the problem of a large number of alarms and difficulty in coordinated processing caused by each operation and maintenance monitoring and automated inspection system working independently.

[0171] Furthermore, the system also includes: an aggregate alarm configuration management module 101, which is respectively connected to the alarm event receiving module 102, the aggregate alarm analysis module 103 and the aggregate alarm notification processing module 104, and is responsible for the configuration management of the alarm event metadata, alarm source, alarm team, alarm rules, alarm notification channels and alarm templates.

[0172] Furthermore, the system also includes: an alarm event sending module 105, including an alarm event sending component and a receiving component, which is responsible for collecting and sending alarm events.

[0173] When the module is used as a software development kit SDK, the external system can integrate the alarm event sending module 105 to send alarm events.

[0174] When the module is used as an independently running alarm event collection program, it can be deployed to the environment where the external system is located, configure alarm rules and monitor data sources such as Prometheus, and send alarm events to the alarm event receiving module 102 when the alarm rules are triggered.

[0175] Preferably, the alarm event is sent in any of the following ways:

[0176] a. The alarm event sending of the webhook protocol is completed by the connection method configured by the alarm source;

[0177] b. The automated inspection system sends the information through API calls;

[0178] c. The business system and the alarm event sending module 105 can be sent through the integrated SDK.

[0179] Preferably, the alarm event is received in any of the following ways:

[0180] d. The alarm events of the webhook protocol are received by the configured alarm source callback address;

[0181] e. The sending of standardized alarm events is received by the API interface provided by the system.

[0182] The alarm event receiving module 102 is responsible for receiving source alarm event information sent from the alarm source or the alarm event sending module 105, and converting the alarm event information into standardized alarm event information according to the alarm event metadata.

[0183] Alarm events are converted and processed in any of the following ways:

[0184] The alarm events received by the webhook protocol identify the alarm source based on the callback address;

[0185] The alarm events received by the API interface identify the alarm source based on AK / SK;

[0186] The source alarm event is converted into a standardized alarm event according to the alarm event mapping rule of the alarm source.

[0187] The converted standardized alarm events are sent to the aggregate alarm analysis module 103 for further aggregate analysis and processing.

[0188] The aggregate alarm analysis module 103 is responsible for receiving standardized alarm event information from the aggregate alarm receiving module, performing aggregate analysis on the source alarm events according to the configured aggregate alarm rules and algorithms, realizing convergence aggregation, alarm suppression and alarm silencing of alarm events, and generating aggregate alarm events to send to the aggregate alarm notification and processing module for subsequent processing.

[0189] The aggregate alarm notification and processing module 104 is responsible for receiving aggregate alarm events from the aggregate alarm analysis module, and automatically assigning alarm events to the alarm team according to the alarm dispatching rules; integrating common notification channels such as SMS, email, government WeChat IM messages and phone calls to realize notification of alarm events; supporting alarm team members to claim and collaboratively handle alarm events, and realizing one-stop processing of alarm notification and alarm processing in government WeChat by integrating the light application capabilities of government WeChat.

[0190] The aggregate alarm system of the present invention can complete the aggregate alarm closed-loop processing process from metadata, alarm source and rule configuration, to alarm event sending and receiving processing, to alarm event aggregation analysis processing, to the allocation, claiming, upgrading, coordination and closing of aggregate alarm events.

[0191] The advantages or beneficial effects of adopting the above technical solution are: the present invention receives source alarm event information from various monitoring devices and systems, performs aggregate analysis on the source alarm events through aggregate analysis rules and algorithms, generates aggregate alarm event information and pushes it uniformly to common alarm notification channels, as well as a subsequent collaborative processing mechanism for alarm events, thereby solving the problem of repeated alarms and unrelated problems that are difficult to coordinate and troubleshoot due to the independent operations of various monitoring devices and systems, and solving the unified alarm information push and subsequent collaborative processing of multiple alarm notification channels and protocols.

[0192] The above are only preferred embodiments of the present invention, and are not intended to limit the implementation methods and protection scope of the present invention. Those skilled in the art should be aware that all solutions obtained by equivalent substitutions and obvious changes made using the contents of this specification and illustrations should be included in the protection scope of the present invention.

Claims

1. An aggregate alarm method, characterized in that: include: Step S1, receiving source alarm events generated from different alarm sources, and performing standardization processing on the alarm information of the source alarm events to obtain standardized alarm events; Step S2, performing aggregation analysis on the standardized alarm events according to the aggregation analysis rules to obtain aggregated alarm events; Step S3: issuing an alarm according to the aggregated alarm event.

2. The aggregate alarm method according to claim 1, characterized in that: The step S1 comprises: Step S11, constructing alarm event metadata to standardize the alarm information; Step S12: Based on the constructed alarm event metadata, the received alarm information of the source alarm event is subjected to standardized mapping and conversion to obtain a standardized alarm event.

3. The aggregate alarm method according to claim 1, characterized in that: The alarm information includes any one or more combinations of an alarm source, an alarm object type, an alarm object, an alarm type, an alarm level, an alarm time, and an alarm tag.

4. The aggregate alarm method according to claim 1, characterized in that: The aggregation analysis rules include any one or more combinations of the following: Convergence aggregation rules are used to perform convergence aggregation processing on standardized alarm events and active aggregation alarm events based on the convergence aggregation time window combined with the filter condition combination of various dimensions of the alarm event metadata; Alarm suppression rules are used to suppress new aggregate alarm events based on active aggregate alarm events based on the suppression time window combined with the filter condition combination of various dimensions of the alarm event metadata; Alarm silence rules are used to silently process new aggregate alarm events based on the silent time window and the combination of filter conditions of various dimensions of the alarm event metadata.

5. The aggregate alarm method according to claim 4, characterized in that: The step S2 comprises: Step S21, when a new standardized alarm event is received, the new standardized alarm event is matched with the currently existing active aggregated alarm events according to the convergence aggregation rule: If an active aggregation alarm event is matched, the new standardized alarm event is aggregated into the matched active aggregation alarm event, and the start time of the convergence aggregation time window is updated, and then the step S3 is entered; If no active aggregate alarm event is matched or there is no active aggregate alarm event currently, a new aggregate alarm event is created according to the new standardized alarm event, and then the process goes to step S22; Step S22: Match the new aggregate alarm event created for the first time with the active aggregate alarm event according to the alarm suppression rule: If an active aggregate alarm event is matched, suppressing the new aggregate alarm event according to the matched active aggregate alarm event, and returning to step S1; If no active aggregate alarm event is matched, proceed to step S23; Step S23, determining whether the new aggregate alarm event satisfies the alarm silence rule: If the new aggregate alarm event satisfies any of the alarm silencing rules, the new aggregate alarm event is silencingly processed, and the process returns to step S1; If the new aggregated alarm event does not satisfy all the alarm silencing rules, the process proceeds to step S3.

6. The aggregate alarm method according to claim 1, characterized in that: The step S3 comprises: Step S31, matching the aggregated alarm event with a plurality of pre-configured alarm dispatching rules, and when an alarm dispatching rule is matched, pushing the aggregated alarm event to a corresponding alarm team according to the matched alarm dispatching rule; Step S32, determining whether the aggregate alarm event is claimed, and entering step S33 after the aggregate alarm event is claimed; Step S33: when receiving a closing message of the aggregate alarm event, closing the aggregate alarm event.

7. The aggregate alarm method according to claim 1, characterized in that: The alarm dispatching rules are configured with an alarm team, an alarm notification channel and an alarm template; The step S31 includes: for the aggregate alarm event, according to the matched alarm dispatching rule, generating alarm notification information according to the alarm template, pushing it to the corresponding alarm team through the corresponding alarm notification channel, and recording the dispatch notification log.

8. The aggregate alarm method according to claim 6, characterized in that: In the step S32, when the aggregate alarm event is not claimed after the first preset claim time after being assigned, an upgrade notification is first made by telephone, and when it is still not claimed after the second preset claim time, the aggregate alarm event is upgraded and assigned according to the alarm upgrade rule configured by the alarm assignment rule.

9. The aggregate alarm method according to claim 6, characterized in that: In the step S33, before receiving the closing message of the aggregate alarm event, the step further includes: Upon receiving the alarm collaboration message sent by the alarm team, sending a collaborative processing notification message of the aggregated alarm event to the collaborative personnel; and / or When the alarm upgrade message sent by the alarm team is received, the aggregated alarm event is upgraded.

10. An aggregate alarm system, characterized in that: For implementing the aggregate alarm method according to any one of claims 1 to 9, the system comprises: An alarm event receiving module is used to receive source alarm events generated from different alarm sources, and perform standardization processing on the alarm information of the source alarm events to obtain standardized alarm events; An aggregate alarm analysis module, connected to the alarm event receiving module, configured to perform aggregate analysis on the standardized alarm events according to an aggregate analysis rule to obtain an aggregate alarm event; The aggregate alarm notification processing module is connected to the aggregate alarm analysis module and is used to generate an alarm according to the aggregate alarm event.

Images