Alarm identification method and device

Abstract

The embodiment of the invention provides an alarm identification method and device. The method comprises the following steps: acquiring alarm information; matching the alarm information with each key alarm template, and if the alarm information is matched with the corresponding key alarm template, sending an alarm prompt message to a monitoring system; the alarm prompt message is used for indicating the monitoring system to perform interface display according to the matched key alarm template; any key alarm template is an alarm template which belongs to any historical fault day and does not belong to a historical normal day in historical alarms; any alarm template is obtained by clustering the historical alarm information. According to the method, the alarm template which belongs to any historical fault day and does not belong to the historical normal day is found from the historical alarms, so that the real-time alarm information is matched with each key alarm template, and whether the alarm information is the key alarm or not can be accurately determined.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an alarm recognition method and device. Background Art

[0002] When a major production incident occurs in the production environment, an alarm storm is usually triggered during the fault period. Among these massive alarms, there are usually key alarms that are strongly related to the incident, as well as a large number of related alarms and various transaction alarms.

[0003] At present, a causal decision network is generally constructed by combining the similarity and distance between alarms, and finally the key alarm is determined based on the causal decision network to facilitate subsequent real-time detection. However, the relationship between alarms is complex and cannot be fully reflected by simple similarity and distance, which leads to low accuracy in locating key alarms.

[0004] In summary, how to improve the accuracy of finding key alarms from alarm storms is a technical problem that needs to be solved urgently. Summary of the invention

[0005] An alarm identification method and device provided in an embodiment of the present invention are used to solve the problem of low accuracy in finding key alarms from an alarm storm in the prior art.

[0006] In the first aspect, an embodiment of the present invention provides an alarm identification method, including: obtaining alarm information; matching the alarm information with each key alarm template, and if the alarm information matches the corresponding key alarm template, sending an alarm prompt message to a monitoring system; the alarm prompt message is used to instruct the monitoring system to display an interface according to the matched key alarm template; any key alarm template is an alarm template in the historical alarm that belongs to any historical fault day and does not belong to a historical normal day; any alarm template is obtained by clustering various historical alarm information.

[0007] In the above technical solution, by finding the alarm template that belongs to any historical fault day and does not belong to the historical normal day from the historical alarms, the alarm templates that are not core and critical can be eliminated, and the key alarm templates unique to abnormal events can be effectively highlighted. In this way, the real-time alarm information is matched with each key alarm template, so it can be more accurately determined whether the alarm information is a key alarm.

[0008] Optionally, any key alarm template is an alarm template that belongs to any historical fault day in the historical alarms and does not belong to a historical normal day, including: for any historical fault day in the historical alarms, determining a first alarm template set within the fault time range of the historical fault day; for any first alarm template in the first alarm template set, determining a second alarm template set that has a first association relationship with the first alarm template; determining a difference set between the first alarm template set and the second alarm template set; the first association relationship is that the first alarm information corresponding to the first alarm template and the second alarm information corresponding to any second alarm template in the second alarm template set are historical alarm information within the same alarm time range of the historical normal day; based on the difference set corresponding to each historical fault day, determining an alarm template that belongs to any historical fault day and does not belong to a historical normal day.

[0009] Optionally, based on the difference set corresponding to each historical fault day, determine an alarm template that belongs to any historical fault day and does not belong to a historical normal day, including: based on any alarm template in the difference set corresponding to each historical fault day, determine the sum of the number of times the alarm template appears in the difference set corresponding to each historical fault day; based on the sum of the number of times and the number of difference sets corresponding to each historical fault day, determine whether the alarm template is an alarm template that belongs to any historical fault day and does not belong to a historical normal day.

[0010] Optionally, any alarm template is obtained by clustering various historical alarm information, including: for any historical alarm information, removing the dynamic fields in the historical alarm information and then performing word segmentation to obtain a word segmentation set of the historical alarm information; taking the alarm template that meets the similarity requirement with the word segmentation set as the class to which the historical alarm information belongs; establishing a second association relationship between the historical alarm information and the alarm template of the class to which it belongs; any alarm template is determined based on the intersection of the word segments corresponding to the historical alarm information within the class to which it belongs.

[0011] Optionally, determining a first alarm template set within a fault time range of a historical fault day comprises: determining each third historical alarm information within the fault time range of the historical fault day; using the alarm templates having a second association relationship with each third historical alarm information as each first alarm template constituting the first alarm template set; determining a second alarm template set having a first association relationship with the first alarm template, comprises: obtaining second historical alarm information within the same alarm time range as the first historical alarm information based on the first historical alarm information on a historical normal day associated with the first alarm template; for any second historical alarm information, constructing a second alarm template set having a first association relationship with the first alarm template based on the second alarm template having a second association relationship with the second historical alarm information.

[0012] Optionally, an alarm template that meets the similarity requirement with the word set is used as the category to which the historical alarm information belongs, including: judging the category to which each piece of historical alarm information belongs in turn; if the word set of the i-th historical alarm information does not meet the similarity requirement with any alarm template, constructing a new alarm template based on the word set of the i-th historical alarm information; if there is an alarm template that meets the similarity requirement, determining the category to which the i-th historical alarm information belongs and updating the alarm template that meets the similarity requirement based on the i-th historical alarm information.

[0013] Optionally, if the alarm information matches the corresponding key alarm template, an alarm prompt message is sent to the monitoring system, including: if the alarm information matches the corresponding key alarm template, and the alarm system information corresponding to the alarm information matches the system configuration item of the key alarm template, an alarm prompt message is sent to the monitoring system.

[0014] Optionally, it also includes: if the alarm information does not match the key alarm template and the alarm information does not match any alarm template, a new alarm template is added according to the alarm information.

[0015] In the second aspect, an embodiment of the present invention provides an alarm identification device, including: an acquisition unit, used to acquire alarm information; a processing unit, used to match the alarm information with each key alarm template, and if the alarm information matches the corresponding key alarm template, an alarm prompt message is sent to the monitoring system; the alarm prompt message is used to instruct the monitoring system to display an interface according to the matched key alarm template; any key alarm template is an alarm template in the historical alarm that belongs to any historical fault day and does not belong to a historical normal day; any alarm template is obtained by clustering various historical alarm information.

[0016] Optionally, the processing unit is specifically used to: determine, for any historical fault day in the historical alarms, a first alarm template set within the fault time range of the historical fault day; for any first alarm template in the first alarm template set, determine a second alarm template set that has a first association relationship with the first alarm template; determine a difference set between the first alarm template set and the second alarm template set; the first association relationship is that the first alarm information corresponding to the first alarm template and the second alarm information corresponding to any second alarm template in the second alarm template set are historical alarm information within the same alarm time range of a historical normal day; and determine, based on the difference set corresponding to each historical fault day, an alarm template that belongs to any historical fault day and does not belong to a historical normal day.

[0017] Optionally, the processing unit is specifically used to: determine the sum of the number of times the alarm template appears in the difference set corresponding to each historical fault day based on any alarm template in the difference set corresponding to each historical fault day; and determine whether the alarm template is an alarm template that belongs to any historical fault day and does not belong to a historical normal day based on the sum of the number of times and the number of difference sets corresponding to each historical fault day.

[0018] Optionally, the processing unit is specifically used to: for any historical alarm information, remove the dynamic fields in the historical alarm information and then perform word segmentation to obtain a word segmentation set of the historical alarm information; use the alarm template that meets the similarity requirement with the word segmentation set as the class to which the historical alarm information belongs; establish a second association relationship between the historical alarm information and the alarm template of the class to which it belongs; any alarm template is determined based on the intersection of the word segments corresponding to each historical alarm information in the class to which it belongs.

[0019] Optionally, the processing unit is specifically used to: determine each third historical alarm information within the fault time range belonging to the historical fault day; use the alarm template having a second association relationship with each third historical alarm information as each first alarm template constituting the first alarm template set. The processing unit is specifically used to: obtain the second historical alarm information within the same alarm time range as the first historical alarm information based on the first historical alarm information on the historical normal day associated with the first alarm template;

[0020] For any second historical alarm information, a second alarm template set having a first association relationship with the first alarm template is constructed according to a second alarm template having a second association relationship with the second historical alarm information.

[0021] Optionally, the processing unit is specifically used to: determine the category to which each historical alarm information belongs in turn; if the word set of the i-th historical alarm information and any alarm template do not meet the similarity requirements, then construct a new alarm template based on the word set of the i-th historical alarm information; if there is an alarm template that meets the similarity requirements, then determine the category to which the i-th historical alarm information belongs and update the alarm template that meets the similarity requirements based on the i-th historical alarm information.

[0022] Optionally, the processing unit is specifically used to: if the alarm information matches the corresponding key alarm template, and the alarm system information corresponding to the alarm information matches the system configuration item of the key alarm template, then send an alarm prompt message to the monitoring system.

[0023] Optionally, the processing unit is further used to: if the alarm information does not match a key alarm template and the alarm information does not match any alarm template, add a new alarm template according to the alarm information.

[0024] In a third aspect, an embodiment of the present application further provides a computer device, comprising: a memory for storing programs; a processor for calling the programs stored in the memory, and executing an alarm identification method as in the first aspect according to the obtained program.

[0025] In a fourth aspect, an embodiment of the present application further provides a computer-readable non-volatile storage medium, comprising a computer-readable program. When a computer reads and executes the computer-readable program, the computer executes an alarm identification method as in the first aspect.

[0026] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of an alarm identification method in the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0028] Figure 1 A flow chart of an alarm identification method provided by an embodiment of the present invention;

[0029] Figure 2 A flow chart of a method for determining an alarm template provided by an embodiment of the present invention;

[0030] Figure 3 A flow chart of a method for determining a key alarm template provided by an embodiment of the present invention;

[0031] Figure 4 A flow chart of a method for determining an alarm template for a fault day provided by an embodiment of the present invention;

[0032] Figure 5 A flow chart of a method for determining a second alarm template for a historical normal day provided by an embodiment of the present invention;

[0033] Figure 6 A flow chart of a method for determining a key alarm template provided by an embodiment of the present invention;

[0034] Figure 7 A schematic diagram of an interface for setting a key alarm template provided by an embodiment of the present invention;

[0035] Figure 8An interaction diagram between an alarm system, an alarm identification device, a monitoring system and an ordering system provided by an embodiment of the present invention;

[0036] Fig. 9 A schematic diagram of an interface provided by an embodiment of the present invention;

[0037] Fig.10 A schematic diagram of an interface provided by an embodiment of the present invention;

[0038] Fig.11 A schematic diagram of health traceability of a system provided by an embodiment of the present invention;

[0039] Fig.12 A schematic diagram of the structure of an alarm identification device provided by an embodiment of the present invention;

[0040] Fig.13 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] In one possible scenario, when a major production event occurs in the production environment, such as the launch of a new system or a system update, an alarm storm will usually be triggered during the failure period, in which a large number of alarms include key alarms that are strongly related to this production event, a large number of alarms with associated relationships, and various transaction alarms. Generally, it is necessary to mark key alarms from historical alarms and input these key alarms into the monitoring platform. In this way, when real-time alarms are input into the monitoring platform, if the real-time alarms match the key alarms, they will be highlighted to help staff quickly locate the cause of the alarm, which can greatly shorten the emergency response time.

[0043] The following describes how to find key alarms from a large number of alarms.

[0044] In one possible case, the key alarm is determined by combining the similarity of the alarm information and the distance in a certain spatial feature with the candidate root cause algorithm and making a comprehensive decision. However, in determining the causal relationship, there may be errors in determining the causal relationship only by the similarity of the alarm data and the spatial feature distance, because there may be complex multiple relationships between alarms, which cannot be fully reflected by simple similarity and distance. In addition, a lot of domain knowledge is required to build a causal decision network, and how to effectively obtain and apply this knowledge is a challenge. The performance of the candidate root cause algorithm directly affects the accuracy of the final positioning result, and different algorithms may have their own limitations. In terms of data quality, the quality of the alarm data directly affects the reliability of the analysis results. If the data is noisy or missing, it will lead to misjudgment of the causal relationship.

[0045] In another possible scenario, the network topology of the Bayesian belief network (BBN) is generated based on the alarm data and expert domain knowledge, and then the conditional probability is calculated based on the frequency relationship between the alarm data, thereby generating the conditional probability table of the BBN, and finally making the root cause alarm inference based on the BBN. ​​However, the construction of BBN is a complex process that requires a lot of domain knowledge and experience. Manual construction may be time-consuming and prone to deviations, and automatic learning algorithms may also have limitations and find it difficult to capture complex causal relationships. In addition, calculating the conditional probability table of BBN requires a large amount of high-quality alarm data. If the amount of data is insufficient or the quality is poor, the probability estimation will be inaccurate, affecting the reasoning results. In terms of reasoning efficiency, when the BBN network structure is complex and the number of nodes is large, the reasoning process may be time-consuming, especially in the scenario of real-time positioning of key alarms, where efficiency may become a bottleneck. In terms of explainability, although BBN can provide probabilistic reasoning results, its reasoning process may not be transparent enough, making it difficult to explain why a particular conclusion is reached.

[0046] In summary, the embodiment of the present invention provides an alarm identification method to solve the problem of low accuracy in finding key alarms from massive alarms in the above solution.

[0047] like Figure 1 FIG. 1 is a flow chart of an alarm identification method provided by an embodiment of the present invention, and the method comprises the following steps:

[0048] Step 101, obtaining alarm information.

[0049] In an embodiment of the present invention, real-time alarm information is obtained to facilitate subsequent matching of the alarm information with various key alarm templates. If the match is successful, it means that the alarm information is a key alarm, and an alarm prompt message needs to be sent to the monitoring system to notify the staff to quickly locate the cause of the alarm and quickly resolve the key alarm.

[0050] Step 102, matching the alarm information with each key alarm template, if the alarm information matches the corresponding key alarm template, sending an alarm prompt message to the monitoring system.

[0051] In the embodiment of the present invention, by matching the alarm information with each key alarm template, it is possible to more accurately determine whether the alarm information is a key alarm. If so, it is necessary to send an alarm prompt message to the monitoring system, wherein the alarm prompt message is used to instruct the monitoring system to display the interface according to the matched key alarm template. Any key alarm template is an alarm template that belongs to any historical fault day in the historical alarm and does not belong to a historical normal day. Any alarm template is obtained by clustering various historical alarm information.

[0052] It can be seen from the above steps 101 to 102 that by finding the alarm template that belongs to any historical fault day and does not belong to a historical normal day from the historical alarms, the alarm templates that are not core and critical can be eliminated, and the key alarm templates unique to abnormal events can be effectively highlighted. In this way, the real-time alarm information is matched with each key alarm template, so as to more accurately determine whether the alarm information is a key alarm.

[0053] In the embodiment of the present invention, since the amount of historical alarm information is large, the amount of key alarm information screened from the massive historical alarm information is also large. In this case, the matching efficiency of subsequent alarm information and key alarms is low. In order to improve the matching efficiency, it is first necessary to compress the massive historical alarm information into multiple alarm templates, and then determine the key alarm template from the multiple alarm templates, so as to improve the matching efficiency of subsequent alarm information and key alarm templates, and quickly and accurately determine whether the alarm information is a key alarm. In order to facilitate understanding of this solution, the following describes how to determine the alarm template.

[0054] like Figure 2 FIG. 1 is a flow chart of a method for determining an alarm template provided by an embodiment of the present invention, the method comprising the following steps:

[0055] Step 201 : for any historical alarm information, remove the dynamic fields in the historical alarm information and then perform word segmentation to obtain a word segmentation set of the historical alarm information.

[0056] In the embodiment of the present invention, although each piece of historical alarm information is not necessarily exactly the same, these historical alarm information all have obvious classification characteristics. For any historical alarm information, the dynamic fields in the historical alarm information are removed, where the dynamic field can be an IP, a timestamp, or an organization number and other dynamic fields with strong variability, which are not limited here. Then, the historical alarm information with the dynamic fields removed is segmented to obtain a segmentation set of any historical alarm information. For example, after segmentation of alarm 1, the segmentation set obtained is [word A, word B, word C, word D, word E, word F], and after segmentation of another alarm 2, the segmentation set obtained is [word B, word C, word D, word E, word F, word H, word I].

[0057] Step 202: The alarm template that meets the similarity requirement with the word set is used as the class to which the historical alarm information belongs; and a second association relationship is established between the historical alarm information and the alarm template of the class to which it belongs.

[0058] In the embodiment of the present invention, the category to which each historical alarm information belongs is judged in turn. If the word set of the i-th historical alarm information and any alarm template do not meet the similarity requirement, a new alarm template is constructed based on the word set of the i-th historical alarm information; if there is an alarm template that meets the similarity requirement, the category to which the i-th historical alarm information belongs is determined and the alarm template that meets the similarity requirement is updated based on the i-th historical alarm information. Any alarm template is determined based on the intersection of the word sets corresponding to each historical alarm information in the category to which it belongs.

[0059] A second association relationship is established between the historical alarm information and the alarm template of the corresponding class, so that the alarm template corresponding to the historical alarm information can be determined later through the second association relationship.

[0060] For example, if there are 1 million historical alarm messages, the word set of the first alarm message is [word A, word B, word C, word D, word E, word F], and the word set of the second alarm message is [word B, word C, word D, word E, word F, word H, word I], the word set of the first alarm message is intersected with the word set of the second alarm message to obtain a new alarm template 1, which is [word B, word C, word D, word E, word F]. Then, the similarity between the word set of the first alarm message and alarm template 1 and the similarity between the word set of the second alarm message and alarm template 1 are determined respectively. If both meet the similarity requirements, alarm template 1 is used as the alarm template for the first alarm message and the second alarm message. Then determine the similarity between the word set of the third alarm information and alarm template 1. If the similarity requirement is met, alarm template 1 is used as the alarm template of the third alarm information. If the similarity requirement is not met, the word set of the third alarm information is used as the new alarm template 2, and then similarity matching is performed with other alarm information in turn.

[0061] It can be seen from the above steps 201 to 202 that by compressing a large amount of alarm information to obtain multiple alarm templates, it is possible to reduce the calculation overhead in the subsequent matching process.

[0062] In the embodiment of the present invention, by matching the alarm information with the critical alarm template, it is possible to more accurately determine whether the alarm information is a critical alarm. In order to understand this solution, the following describes how to determine the critical alarm template.

[0063] like Figure 3 As shown, it is a flow chart of a method for determining a key alarm template provided by an embodiment of the present invention, and the method comprises the following steps:

[0064] Step 301: for any historical fault day in the historical alarms, determine a first alarm template set within the fault time range of the historical fault day.

[0065] In the embodiment of the present invention, since any key alarm template is an alarm template that belongs to any historical fault day in the historical alarms and does not belong to the historical normal day. Therefore, it is first necessary to determine from the historical alarms which are the first alarm template set of the historical fault day and which are the second alarm template set of the historical normal day. The following describes how to determine the first alarm template set of the historical fault day.

[0066] like Figure 4 FIG. 1 is a flow chart of a method for determining an alarm template for a fault day provided by an embodiment of the present invention, the method comprising the following steps:

[0067] Step 401 : determining each third historical alarm information within a fault time range belonging to a historical fault day.

[0068] In the embodiment of the present invention, according to the fault time range belonging to the historical fault day, each third historical alarm information within the fault time range belonging to the historical fault day is found from the historical faults. The fault time range may be a time interval of [fault time point - 5 min, fault time point + 25 min], or a time interval of [fault time point - 5 min, fault time point + 5 min], or other time intervals, which are not limited here.

[0069] Step 402: Use the alarm templates having the second association relationship with each third historical alarm information as each first alarm template constituting the first alarm template set.

[0070] In the embodiment of the present invention, the alarm templates having the second association relationship with each third historical alarm information are used as the first alarm templates in the first alarm template set of the historical fault day.

[0071] It can be seen from the above steps 401 to 402 that, through the fault time range of the historical fault day, the third historical alarm information within the fault time range of the historical fault day can be determined first, and then based on the second association relationship between the alarm information and the alarm template, the first alarm templates in the first alarm template set can be determined more accurately, which is convenient for subsequent determination of which are the key alarm templates based on the first alarm templates.

[0072] Step 302: for any first alarm template in the first alarm template set, determine a second alarm template set having a first association relationship with the first alarm template.

[0073] In the embodiment of the present invention, the key alarm template is an alarm template that belongs to any historical fault day in the historical alarm and does not belong to the historical normal day. Considering that the alarm template of the historical normal day will not cause a major fault and will not affect the normal operation of the system, it will not be a key alarm template. Therefore, by mining the alarm template of the historical normal day related to the alarm template of the historical fault day as much as possible, the alarm template of the historical normal day is filtered out from the first alarm template set in the historical fault day to achieve a more accurate determination of the key alarm template.

[0074] In order to mine the alarm templates of historical normal days as much as possible, considering the complex correlation between alarm information. Therefore, the first alarm template in the historical fault day can be used to find the second alarm template that has a first correlation relationship with the first alarm template from the historical normal day as much as possible. The first correlation relationship is that the first alarm information corresponding to the first alarm template and the second alarm information corresponding to any second alarm template in the second alarm template set are historical alarm information within the same alarm time range of the historical normal day. The following describes how to determine the second alarm template of the historical normal day.

[0075] like Figure 5 As shown, it is a flow chart of a method for determining a second alarm template for a historical normal day provided by an embodiment of the present invention, the method comprising the following steps:

[0076] Step 501: According to first historical alarm information on a historical normal day associated with a first alarm template, second historical alarm information within the same alarm time range as the first historical alarm information is acquired.

[0077] In an embodiment of the present invention, if the first historical alarm information having a second correlation with the first alarm template can be obtained from the historical normal day based on the first alarm template in the historical fault day. This means that the first alarm template in the historical fault day is not a key alarm template. In order to mine the alarm templates of the historical normal day as much as possible, the alarm information having a correlation with the first historical alarm information can be determined based on the first historical alarm information. The alarm template corresponding to the alarm information having a correlation with the first historical alarm information will not be a key alarm template. By mining the alarm templates of the historical normal day as much as possible, the key alarm template can be determined from the alarm template set of the historical fault day. The following describes how to determine the alarm information having a correlation with the first historical alarm information.

[0078] Considering that alarm information with a correlation relationship usually appears at the same time within the same alarm time range. After determining the first historical alarm information, obtain the second historical alarm information that is within the same alarm time range as the first historical alarm information, so as to realize the mining of historical alarm information of historical normal days as much as possible. For example, if the first alarm template is 0010, then obtain the first historical alarm information that has a second correlation relationship with the alarm template 0010 from the historical normal day, where the second historical alarm information is alarm information 1 and alarm information 2. Then obtain alarm information 3 that is within the same alarm time range as alarm information 1, and obtain alarm information 4 that is within the same alarm time range as alarm information 2, where alarm information 3 and alarm information 4 are the second historical alarm information.

[0079] Step 502: for any second historical alarm information, based on a second alarm template having a second association relationship with the second historical alarm information, construct a second alarm template set having a first association relationship with the first alarm template.

[0080] In an embodiment of the present invention, for any second historical alarm information, a second alarm template having a second association relationship with the second historical alarm information is determined, thereby realizing the construction of a second alarm template set having a first association relationship with the first alarm template. For example, the first alarm template set is composed of three first alarm templates [a, b, c]. Among them, the second alarm template set B1 having a first association relationship with a is composed of eight second alarm templates [b, c, d, e, f, g, h, i], the second alarm template set B2 having a first association relationship with b is composed of six second alarm templates [c, d, e, f, g, h], and the second alarm template set B3 having a first association relationship with c is composed of six second alarm templates [d, e, f, i, h, k].

[0081] It can be seen from the above steps 501 to 502 that the first historical alarm information having a second correlation with the first alarm template in the historical fault day can be mined as much as possible from the historical normal day through the first fault template in the historical fault day, and then considering that the alarm information with a correlation usually appears at the same time within the same alarm time range, the second historical alarm information can be mined as much as possible through the alarm time range of the first historical alarm information, thereby achieving the acquisition of the first correlation with the first alarm template as much as possible.

[0082] Step 303: determine a difference set between the first alarm template set and the second alarm template set.

[0083] In the embodiment of the present invention, for example, the first alarm template set A is subtracted from B1, B2 and B3 respectively to obtain corresponding difference sets, which are C1 [a], C2 [a, b], and C3 [a, c, d]. C1 is the difference set obtained by subtracting A from B1, C2 is the difference set obtained by subtracting A from B2, and C3 is the difference set obtained by subtracting A from B3.

[0084] Step 304: Determine an alarm template that belongs to any historical fault day and does not belong to a historical normal day according to the difference set corresponding to each historical fault day.

[0085] In the embodiment of the present invention, the following describes how to determine a key alarm template according to a difference set corresponding to each historical fault day.

[0086] like Figure 6 As shown, it is a flow chart of a method for determining a key alarm template provided by an embodiment of the present invention, and the method comprises the following steps:

[0087] Step 601 : Based on any alarm template in the difference set corresponding to each historical fault day, determine the sum of the number of times the alarm template appears in the difference set corresponding to each historical fault day.

[0088] In the embodiment of the present invention, for example, C1 is [a], C2 is [a, b], and C3 is [a, c, d]. It is determined that the number of times a appears in C1, C2, and C3 is 3, the number of times b appears in C1, C2, and C3 is 1, and the number of times c appears in C1, C2, and C3 is 1.

[0089] Step 602: Determine whether the alarm template is an alarm template that belongs to any historical fault day and does not belong to a historical normal day based on the sum of the times and the number of difference sets corresponding to each historical fault day.

[0090] In the embodiment of the present invention, the score of any alarm template is determined according to the sum of the number of times of any alarm template and the number of difference sets corresponding to each historical fault day, and the alarm template with a score greater than a preset threshold is regarded as a critical alarm template.

[0091] For example, if the preset threshold is 0.9, taking a as an example, the number of times a appears in C1, C2, and C3 is 3, where the number of difference sets corresponding to each historical fault day is 3, and the score of a is calculated = (the number of times a appears in C1, C2, and C3) / (the number of difference sets corresponding to each historical fault day) = 1, where 1 is greater than the preset threshold, so a is a critical alarm template.

[0092] It can be seen from the above steps 601 to 602 that by subtracting the alarm templates in historical fault days from the alarm templates in historical normal days, multiple difference sets are obtained, wherein the alarm templates that appear more times in the difference set have stronger individuality and are more likely to be key alarm templates.

[0093] It can be seen from the above steps 301 to 304 that by subtracting the alarm templates in the historical fault days from the alarm templates in the historical normal days, the key alarm set can be found more accurately from the alarm templates in the historical fault days.

[0094] Optionally, in step 102, the alarm information is matched with each key alarm template. If the alarm information does not match the key alarm template and the alarm information does not match any alarm template, a new alarm template is added according to the alarm information.

[0095] Through the above steps 301 to 302, the key alarm template set is determined, and then the alarm level needs to be set for each key alarm template in the key alarm template set. See Table 1. The levels of key alarm templates are divided into three levels, level 0, level 0' and level 1. The newly added alarm template corresponding to the alarm information that does not match the key alarm template and the alarm information does not match any alarm template is an alarm template that has not occurred in history, and the alarm level of the alarm template that has not occurred in history is level 1. It should be noted that the non-change period is when the system is not under maintenance and update, and the change period is when the system is under maintenance and update.

[0096]

[0097] like Figure 7 As shown, it is a schematic diagram of an interface for setting a critical alarm template provided in an embodiment of the present invention, wherein the setting interface is used to set the system configuration items of the critical alarm template and the alarm level of the critical alarm template, wherein the system configuration items include the corresponding systems, components and projects.

[0098] like Figure 8As shown, it is an interaction diagram between an alarm system, an alarm identification device, a monitoring system and an ordering system provided by an embodiment of the present invention, including the following steps:

[0099] Step 801: The alarm system sends alarm information to the alarm identification device.

[0100] In the embodiment of the present invention, the alarm system sends alarm information to the alarm identification device, and the alarm identification device determines whether the alarm information is critical alarm information.

[0101] Step 802: The alarm identification device sends a query request to the billing system.

[0102] In the embodiment of the present invention, the alarm identification device sends a query request to the billing system, wherein the query request is used to query the alarm system information of the alarm information.

[0103] Step 803: The ordering system sends the query result to the alarm identification device.

[0104] In the embodiment of the present invention, the billing system sends a query result to the alarm identification device, wherein the query result includes alarm system information of the alarm information.

[0105] Step 804 , the alarm identification device determines whether the alarm information is critical alarm information, if so, executes step 805 , if not, executes step 806 .

[0106] In the embodiment of the present invention, if the alarm information matches the corresponding key alarm template, and the alarm system information corresponding to the alarm information matches the system configuration item of the key alarm template, an alarm prompt message is sent to the monitoring system.

[0107] Step 805: The alarm identification device sends an alarm prompt message to the monitoring system.

[0108] Step 806, end.

[0109] Step 807: The monitoring system obtains change information of the system to which the alarm information belongs from the alarm system.

[0110] In the embodiment of the present invention, the change information is that the system to which the alarm information belongs is in a change period or in a non-change period.

[0111] Step 808: The monitoring system determines whether to send an order issuance instruction message to the order issuance system based on the change information of the system to which the alarm information belongs.

[0112] In an embodiment of the present invention, the monitoring system, based on the change information of the system to which the alarm information belongs, if the alarm level of the alarm information is level 0 and it is in a change period, then no score reduction or invoice will be issued, and there is no need to display an alarm prompt message on the interface subsequently. If the alarm level of the alarm information is level 0' and it is in a change period, it is necessary to reduce the score normally, for which the reduction can be specifically referred to in Table 1, and if an invoice is also issued, an invoice indication message is sent to the invoice system. If the alarm level of the alarm information is level 1 and it is in a change period, it is necessary to reduce the score normally, for which the reduction can be specifically referred to in Table 1, and if an invoice is also issued, an invoice indication message is sent to the invoice system. If the alarm information is in a non-change period, both the score reduction and the invoice need to be reduced normally, and an invoice is sent to the invoice system.

[0113] Step 809: The monitoring system displays an alarm prompt message on the interface.

[0114] In the embodiment of the present invention, the monitoring system will display the alarm information of the billing instruction message that needs to be sent to the billing system on the interface, which can be seen in Fig. 9 , is a schematic diagram of an interface provided by an embodiment of the present invention. Fig. 9 Only the key parts of the key warning information are shown, for example, Fig. 9 The original alarm content and the translated alarm content in the key alarm information will be displayed. Fig. 9 If you click the Expand option in the dialog box, the specific warning message will be displayed on the interface. Fig.10 ,in Fig.10 The key alarm information will display the original alarm content, translated alarm content, event ticket ID, system configuration items, alarm code, level, priority, alarm number, processing status, source, occurrence time, error source host name, and related historical event tickets.

[0115] Step 810: The billing system sends a closing instruction to the monitoring system.

[0116] In an embodiment of the present invention, in one possible case, the user manually ends the warning prompt message on the interface, and the billing system receives the user's end operation and sends a closing instruction to the monitoring system. In another possible case, the billing system obtains the status of the event ticket from the monitoring system and the monitoring system, and if the event ticket is in a closed state, sends a closing instruction to the monitoring system.

[0117] It can be seen from the above steps 801 to 810 that, through the interaction between the alarm system, the monitoring system and the ordering system, when the alarm information is critical alarm information, the alarm prompt message can be displayed in time on the interface of the monitoring system, so that the staff can handle the alarm in time.

[0118] Optionally, when you click on any system on the monitoring system interface, a health traceability diagram of the system will be displayed. Fig.11 , where the health traceability diagram has the system as the root node, the component as the intermediate node, and the alarm information as the leaf node. By clicking on any system, the alarm information of the system and the component corresponding to the alarm information can be displayed.

[0119] Based on the same technical concept, the present application embodiment provides an alarm identification device, which can be seen in Fig.12 The device 1200 includes: an acquisition unit 1201, used to acquire alarm information; a processing unit 1202, used to match the alarm information with each key alarm template, and if the alarm information matches the corresponding key alarm template, an alarm prompt message is sent to the monitoring system; the alarm prompt message is used to instruct the monitoring system to display the interface according to the matched key alarm template; any key alarm template is an alarm template in the historical alarm that belongs to any historical fault day and does not belong to a historical normal day; any alarm template is obtained by clustering various historical alarm information.

[0120] Optionally, the processing unit is specifically used to: determine, for any historical fault day in the historical alarms, a first alarm template set within the fault time range of the historical fault day; for any first alarm template in the first alarm template set, determine a second alarm template set that has a first association relationship with the first alarm template; determine a difference set between the first alarm template set and the second alarm template set; the first association relationship is that the first alarm information corresponding to the first alarm template and the second alarm information corresponding to any second alarm template in the second alarm template set are historical alarm information within the same alarm time range of a historical normal day; and determine, based on the difference set corresponding to each historical fault day, an alarm template that belongs to any historical fault day and does not belong to a historical normal day.

[0121] Optionally, the processing unit is specifically used to: determine the sum of the number of times the alarm template appears in the difference set corresponding to each historical fault day based on any alarm template in the difference set corresponding to each historical fault day; and determine whether the alarm template is an alarm template that belongs to any historical fault day and does not belong to a historical normal day based on the sum of the number of times and the number of difference sets corresponding to each historical fault day.

[0122] Optionally, the processing unit is specifically used to: for any historical alarm information, remove the dynamic fields in the historical alarm information and then perform word segmentation to obtain a word segmentation set of the historical alarm information; use the alarm template that meets the similarity requirement with the word segmentation set as the class to which the historical alarm information belongs; establish a second association relationship between the historical alarm information and the alarm template of the class to which it belongs; any alarm template is determined based on the intersection of the word segments corresponding to each historical alarm information in the class to which it belongs.

[0123] Optionally, the processing unit is specifically used to: determine each third historical alarm information within the fault time range belonging to the historical fault day; use the alarm template having a second association relationship with each third historical alarm information as each first alarm template constituting the first alarm template set. The processing unit is specifically used to: obtain the second historical alarm information within the same alarm time range as the first historical alarm information based on the first historical alarm information on the historical normal day associated with the first alarm template;

[0124] For any second historical alarm information, a second alarm template set having a first association relationship with the first alarm template is constructed according to a second alarm template having a second association relationship with the second historical alarm information.

[0125] Optionally, the processing unit is specifically used to: determine the category to which each historical alarm information belongs in turn; if the word set of the i-th historical alarm information and any alarm template do not meet the similarity requirements, then construct a new alarm template based on the word set of the i-th historical alarm information; if there is an alarm template that meets the similarity requirements, then determine the category to which the i-th historical alarm information belongs and update the alarm template that meets the similarity requirements based on the i-th historical alarm information.

[0126] Optionally, the processing unit is specifically used to: if the alarm information matches the corresponding key alarm template, and the alarm system information corresponding to the alarm information matches the system configuration item of the key alarm template, then send an alarm prompt message to the monitoring system.

[0127] Optionally, the processing unit is further used to: if the alarm information does not match a key alarm template and the alarm information does not match any alarm template, add a new alarm template according to the alarm information.

[0128] Based on the same technical concept, the embodiment of the present application provides a computer device 1300, such as Fig.13 As shown, it includes at least one processor 1301 and a memory 1302 connected to the at least one processor. The specific connection medium between the processor 1301 and the memory 1302 is not limited in the embodiment of the present application. Fig.13 For example, the processor 1301 and the memory 1302 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0129] In the embodiment of the present application, the memory 1302 stores instructions that can be executed by at least one processor 1301, and the at least one processor 1301 can perform the steps of the above-mentioned alarm identification method by executing the instructions stored in the memory 1302.

[0130] Among them, the processor 1301 is the control center of the computing device, and can use various interfaces and lines to connect various parts of the computing device, and realize the processing of the alarm identification method by running or executing instructions stored in the memory 1302 and calling data stored in the memory 1302. Optionally, the processor 1301 may include one or more processing units, and the processor 1301 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor can also be integrated into the processor 1301. In some embodiments, the processor 1301 and the memory 1302 can be implemented on the same chip, and in some embodiments, they can also be implemented separately on independent chips.

[0131] Processor 1301 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor to be executed, or can be executed by a combination of hardware and software modules in the processor.

[0132] Memory 1302 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1302 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. Memory 1302 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 1302 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0133] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned alarm identification method.

[0134] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0135] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0138] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying an alarm, characterized in that: include: Get alarm information; Matching the alarm information with each key alarm template, if the alarm information matches the corresponding key alarm template, sending an alarm prompt message to the monitoring system; The alarm prompt message is used to instruct the monitoring system to display an interface according to the matched key alarm template; Any key alarm template is an alarm template that belongs to any historical fault day and does not belong to a historical normal day in the historical alarms; any alarm template is obtained by clustering various historical alarm information.

2. The method according to claim 1, characterized in that Any key alarm template is an alarm template that belongs to any historical fault day and not a historical normal day in the historical alarms, including: For any historical fault day in the historical alarms, determine a first alarm template set within the fault time range of the historical fault day; For any first alarm template in the first alarm template set, determine a second alarm template set having a first association relationship with the first alarm template; Determine a difference set between the first alarm template set and the second alarm template set; the first association relationship is that the first alarm information corresponding to the first alarm template and the second alarm information corresponding to any second alarm template in the second alarm template set are historical alarm information within the same alarm time range of a historical normal day; According to the difference set corresponding to each historical fault day, an alarm template belonging to any historical fault day and not belonging to a historical normal day is determined.

3. The method according to claim 2, characterized in that According to the difference set corresponding to each historical fault day, determine the alarm template that belongs to any historical fault day and does not belong to a historical normal day, including: Based on any alarm template in the difference set corresponding to each historical fault day, determining the sum of the number of times the alarm template appears in the difference set corresponding to each historical fault day; According to the sum of the times and the number of difference sets corresponding to each historical fault day, it is determined whether the alarm template is an alarm template belonging to any historical fault day and not a historical normal day.

4. The method according to any one of claims 1 to 3, characterized in that: Any alarm template is obtained by clustering historical alarm information, including: For any historical alarm information, remove the dynamic fields in the historical alarm information and then perform word segmentation to obtain a word segmentation set of the historical alarm information; The alarm template that meets the similarity requirement with the word set is used as the class to which the historical alarm information belongs; a second association relationship is established between the historical alarm information and the alarm template of the class to which it belongs; any alarm template is determined based on the intersection of the word segments corresponding to each historical alarm information in the class to which it belongs.

5. The method according to claim 4, characterized in that Determining a first alarm template set within a fault time range of the historical fault day includes: Determine each third historical alarm information within the fault time range belonging to the historical fault day; Using the alarm templates having a second association relationship with each third historical alarm information as each first alarm template constituting the first alarm template set; Determining a second alarm template set having a first association relationship with the first alarm template includes: According to the first historical alarm information on a historical normal day associated with the first alarm template, obtaining second historical alarm information within the same alarm time range as the first historical alarm information; For any second historical alarm information, a second alarm template set having a first association relationship with the first alarm template is constructed according to a second alarm template having a second association relationship with the second historical alarm information.

6. The method according to claim 4, characterized in that The alarm template that meets the similarity requirement with the word set is used as the category to which the historical alarm information belongs, including: The category to which each historical alarm information belongs is judged in turn. If the word set of the i-th historical alarm information and any alarm template do not meet the similarity requirement, a new alarm template is constructed based on the word set of the i-th historical alarm information; if there is an alarm template that meets the similarity requirement, the category to which the i-th historical alarm information belongs is determined and the alarm template that meets the similarity requirement is updated based on the i-th historical alarm information.

7. The method according to any one of claims 1 to 3, characterized in that: If the alarm information matches the corresponding key alarm template, an alarm prompt message is sent to the monitoring system, including: If the alarm information matches the corresponding key alarm template, and the alarm system information corresponding to the alarm information matches the system configuration item of the key alarm template, an alarm prompt message is sent to the monitoring system.

8. The method according to any one of claims 1 to 3, characterized in that Also includes: If the alarm information does not match a key alarm template and the alarm information does not match any alarm template, a new alarm template is added according to the alarm information.

9. An alarm identification device, characterized in that: include: An acquisition unit, used for acquiring alarm information; A processing unit, used to match the alarm information with each key alarm template, and if the alarm information matches the corresponding key alarm template, send an alarm prompt message to the monitoring system; The alarm prompt message is used to instruct the monitoring system to display the interface according to the matched key alarm template; any key alarm template is an alarm template in the historical alarm that belongs to any historical fault day and does not belong to a historical normal day; any alarm template is obtained by clustering various historical alarm information.

10. A computer device, characterized in that: include: Memory for storing computer programs; A processor, configured to call a computer program stored in the memory, and execute the steps of the method according to any one of claims 1 to 8 according to the obtained program.

Images