System alarm processing operation and maintenance method and system

Abstract

The invention provides a system alarm processing operation and maintenance method and system. The method comprises the following steps: constructing an alarm database; monitoring and collecting system alarm information in real time; performing similarity matching on the real-time alarm information and an alarm database; if the corresponding historical alarm is matched in the alarm database and the score of the solution meets a preset score threshold value, automatically calling a script in the solution to perform alarm processing; if a corresponding historical alarm is matched in the alarm database and the score of the solution does not meet a preset score threshold, creating an alarm processing work order based on the solution, and sending the alarm processing work order to an operation and maintenance personnel terminal for alarm processing after adjustment; and if the corresponding historical alarm is not matched in the alarm database, automatically analyzing and generating a reference solution of the real-time alarm, creating an alarm processing work order, and sending the alarm processing work order to an operation and maintenance personnel terminal for alarm processing after adjustment. According to the invention, solutions can be intelligently matched, manual intervention is greatly reduced, and the alarm processing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer operation and maintenance, and particularly to a system alarm processing operation and maintenance method and system. Background Art

[0002] With the continuous growth of the scale and complexity of enterprise business systems, system monitoring and alarm processing have become key links in ensuring business continuity. The traditional alarm processing process usually includes: the monitoring system detects anomalies in real time and sends alarm notifications, and the on-duty personnel retrieve historical records through the internal document system for manual analysis, manually match the error types and solutions to generate operation and maintenance work orders, and finally the operation and maintenance personnel execute repair operations.

[0003] However, this processing method has obvious technical defects: First, the system highly depends on the personal experience of the on-duty personnel. Lack of experience is likely to lead to misjudgment or processing delays, seriously affecting business stability; Second, in the face of a large amount of alarm information, the processes of manual screening, analysis, and work order generation are inefficient, consuming a large amount of human resources; In addition, due to the lack of unified standards, there are differences in the processing methods of the same alarm by different personnel, and experience is difficult to effectively inherit, and there is no accumulation mechanism for the optimal solution. Generally speaking, the existing technology lacks intelligent analysis capabilities, there is no structured association between alarm information and solutions, the degree of automation of the processing process is insufficient, and the operation and maintenance knowledge management is too fragmented. Summary of the Invention

[0004] The purpose of the present invention is to provide a system alarm processing operation and maintenance method and system to solve the above problems, which can intelligently match solutions, greatly reduce manual intervention, significantly shorten the alarm response time, and improve the alarm processing efficiency.

[0005] The present invention proposes a system alarm processing operation and maintenance method, including the following steps:

[0006] Construct an alarm database, where the alarm database includes historical alarms, solutions corresponding to the historical alarms, and scores of the solutions;

[0007] Monitor and collect system alarm information in real time;

[0008] Match the real-time alarm information with the alarm database for similarity;

[0009] If a corresponding historical alarm is matched in the alarm database, and the score of the solution corresponding to the historical alarm meets the preset score threshold, the script in the solution is automatically called for alarm processing;

[0010] If a corresponding historical alarm is matched in the alarm database, and the score of the solution corresponding to the historical alarm does not meet the preset score threshold, an alarm handling work order is created based on the solution, and the alarm handling work order is sent to the operation and maintenance personnel side for adjustment and then alarm handling is performed;

[0011] If no corresponding historical alarm is matched in the alarm database, a reference solution for the real-time alarm is automatically analyzed and generated based on the solution of the historical alarm in the alarm database that is most similar to the real-time alarm. An alarm handling work order is created based on the reference solution, and the alarm handling work order is sent to the operation and maintenance personnel side for adjustment and then alarm handling is performed.

[0012] In one embodiment, if no corresponding historical alarm is matched in the alarm database, after automatically analyzing and generating a reference solution for the real-time alarm based on the solution of the historical alarm in the alarm database that is most similar to the real-time alarm, the reference solution of the real-time alarm is also stored in the alarm database.

[0013] In one embodiment, the construction of the alarm database specifically includes:

[0014] Classify historical alarms;

[0015] Formulate corresponding solutions for various historical alarms;

[0016] Score the solutions corresponding to each historical alarm.

[0017] In one embodiment, the rule for classifying historical alarms is:

[0018] Classify historical alarms into three levels, namely, first-level major categories, second-level middle categories, and third-level minor categories;

[0019] The first-level major categories are divided according to the source of the alarm, and the first-level major categories include host category, data category, and log category;

[0020] The second-level middle categories are divided according to specific entities under the first-level major categories. The second-level middle categories include host IP under the host category and service name under the log category;

[0021] The third-level minor categories are divided according to specific problem types under the second-level middle categories. The third-level minor categories include disk alarms under host IP and message consumption failure under service name.

[0022] In one embodiment, the solutions corresponding to historical alarms belonging to the same third-level minor category are the same, and the scores of the solutions are the same;

[0023] The scoring of the solutions corresponding to each historical alarm is specifically: scoring based on the feasibility rate of using the solution to solve the corresponding alarm within a period of time.

[0024] In one embodiment, the system for real-time monitoring and collecting system warning information specifically includes:

[0025] Use Prometheus to collect the metric data of basic components, where the basic components include servers and databases, and the metric data of the basic components include CPU, memory, and disk;

[0026] Use Alibaba Cloud Log Service to collect business service logs.

[0027] In one embodiment, the method of matching the real-time warning information with the warning database specifically includes:

[0028] Set the warning information collection time window;

[0029] After receiving the system warning information, collect all the warning information within the time window;

[0030] Through similarity analysis, merge the same type of warnings according to the classification rules of historical warnings in the warning database, and match them with the warning database.

[0031] In one embodiment, the system warning handling and operation and maintenance method further includes: after the real-time warning is processed, update the solution and score of the real-time warning to the warning database.

[0032] The present invention also proposes a system warning handling and operation and maintenance system for implementing the above-mentioned system warning handling and operation and maintenance method, including:

[0033] A warning database for storing historical warnings, the solutions corresponding to the historical warnings, and the scores of each solution;

[0034] A warning detection module for real-time monitoring and collecting system warning information;

[0035] A warning matching module for matching the real-time warning information with the warning database in terms of similarity;

[0036] A decision-making module for generating a solution to the real-time warning information based on the matching result and / or the score of the solution;

[0037] A warning handling execution module for handling warnings according to the solution to the real-time warning information.

[0038] In one embodiment, the system warning handling and operation and maintenance system further includes a scoring module, and the scoring module is used to score the solution based on the feasibility rate of using the solution to solve the corresponding warning within a period of time.

[0039] Compared with the prior art, the beneficial effects of the system alarm handling operation and maintenance method and system of the present invention are as follows:

[0040] 1) Through alarm automatic classification, alarm database matching, and automated processing processes, the present invention can automatically filter duplicate alarms and intelligently match solutions, greatly reducing manual intervention, significantly shortening the alarm response time, and improving the alarm handling efficiency.

[0041] 2) Through the intelligent decision-making module and the structured alarm database, the present invention can effectively reduce the weight of manual judgment, reduce the dependence on personal experience, reduce the risk of human error, greatly improve the accuracy and consistency of alarm handling, and achieve standardization and quantifiability throughout the alarm handling process.

[0042] 3) Through continuous feedback and scoring mechanisms, the present invention can continuously optimize the content of the alarm database and the processing process, update best practices in real time, and ensure the accuracy and timeliness of the solutions.

[0043] 4) By constructing an alarm database, the present invention can automatically summarize the optimal processing solutions, form standardized processing knowledge, and thus realize the real-time sharing and inheritance of processing experience, and improve the overall skill level of the operation and maintenance team.

[0044] 5) The present invention adopts a dual evaluation mechanism of "matching result + solution score", and through multi-dimensional cross-validation, it ensures that the recommended solution not only conforms to the current alarm characteristics but also has a high historical success rate, thereby effectively improving the feasibility of the solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a schematic flowchart of the system alarm handling operation and maintenance method according to an embodiment of the present invention;

[0046] Figure 2 It is a flowchart of the system alarm handling according to an embodiment of the present invention;

[0047] Figure 3 It is a schematic structural diagram of the system alarm handling operation and maintenance system according to an embodiment of the present invention.

[0048] REFERENCE SIGNS

[0049] 100, alarm database; 200, alarm detection module; 300, alarm matching module; 400, decision-making module; 500, alarm handling execution module; 600, scoring module. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0050] To make the objectives, technical solutions, and advantages of the present invention more comprehensible, the present invention will be further described in detail below with reference to the accompanying drawings of the specification and specific embodiments. It should be noted here that many specific details are set forth in the following description to facilitate a thorough understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Persons skilled in the art may make similar extensions without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0051] Secondly, "an embodiment" or "a kind of embodiment" in this application refers to specific features, structures, or characteristics that may be included in at least one implementation manner of the present invention. The phrases "in an embodiment" and "a kind of embodiment" that appear in different places in this specification do not necessarily refer to the same embodiment, nor are they separate or selectively exclusive embodiments from other embodiments. The terms "comprising" and "including" indicate the presence of the claimed features, but do not exclude the presence of one or more other features. The phrase "and / or" used in this application includes any and all combinations of one or more of the related listed items.

[0052] The present invention proposes a system alarm handling operation and maintenance method. Refer to Figure 1 , which includes the following steps:

[0053] Step S1: Construct an alarm database, which includes historical alarms, solutions corresponding to the historical alarms, and scores of the solutions.

[0054] Step S2: Real-time monitor and collect system alarm information.

[0055] Step S3: Perform similarity matching between the real-time alarm information and the alarm database.

[0056] Step S4: If a corresponding historical alarm is matched in the alarm database and the score of the solution corresponding to the historical alarm meets the preset score threshold, automatically call the script in the solution for alarm handling;

[0057] If a corresponding historical alarm is matched in the alarm database and the score of the solution corresponding to the historical alarm does not meet the preset score threshold, create an alarm handling work order based on the solution and send the alarm handling work order to the operation and maintenance personnel side for adjustment and then perform alarm handling;

[0058] If no corresponding historical alarm is found in the alarm database, a reference solution for the real-time alarm is automatically analyzed and generated based on the solution of the historical alarm most similar to the real-time alarm in the alarm database and by integrating other solutions with relatively high similarity. The reference solution for the real-time alarm is stored in the alarm database, and an alarm handling work order is created based on the reference solution. Then, the alarm handling work order is sent to the operation and maintenance personnel for adjustment and alarm handling.

[0059] Specifically, if no corresponding historical alarm is found in the alarm database, a similarity standard can be set, and the solutions corresponding to the historical alarms with a similarity higher than this standard are analyzed to generate a reference solution. If there are multiple historical alarms with a similarity higher than this standard, their corresponding solutions can also be integrated and analyzed to generate a reference solution.

[0060] Step S5: After the real-time alarm is processed, update the solution and score of the real-time alarm to the alarm database.

[0061] Step S1 of an embodiment of the present invention: Construct an alarm database, specifically including:

[0062] Classify historical alarms;

[0063] Formulate corresponding solutions for various historical alarms;

[0064] Score the solutions corresponding to each historical alarm.

[0065] The rule for classifying historical alarms in an embodiment of the present invention is as follows: Historical alarms are classified into three levels, namely, first-level major categories, second-level middle categories, and third-level minor categories. The first-level major categories are divided according to the source of the alarm, including host category, data category, log category, etc. The second-level middle categories are divided according to specific entities under the first-level major categories, including host name / IP under the host category, service name under the log category, etc. The third-level minor categories are divided according to specific problem types under the second-level middle categories, including disk alarms under host name / IP, message consumption failure under service name, etc. For example, if the alarm information is "hosts-host_name / host_ip-disk availability is less than 85%", it belongs to the "host category" in the first-level major category, "host name or IP" in the second-level middle category, and "disk alarm" in the third-level minor category. If the alarm information is "service_log / lps-service: message consumption failure, message ID is 81xx8f1e4f08xxc3b6b61f7xx0exxddf", it belongs to the "log category" in the first-level major category, "service name" in the second-level middle category, and "message consumption failure" in the third-level minor category.

[0066] In one embodiment of the present invention, the Qwen model is used to automatically classify historical alarms through similarity analysis. The specific classification operations include: extracting the features of the alarm information to generate vectors with a fixed dimension; calculating the cosine similarity between the alarm information vectors; setting a similarity threshold or using a clustering algorithm for grouping. Of course, in addition to the Qwen model, other models can also be used for the automatic classification of alarm information, such as BGE (BAAI General Embedding), Cohere Embed, Sentence-BERT (SBERT), etc.

[0067] The solutions corresponding to historical alarms belonging to the same third-level subclass are the same, and the scores of the solutions are the same.

[0068] In one embodiment of the present invention, the solutions corresponding to each historical alarm are scored. Specifically: scoring is based on the feasibility rate of using the solution to solve the corresponding alarm within a period of time. The feasibility rate is the success rate of the solution in solving the corresponding alarm. This scoring index can also be called solution feasibility. In one embodiment of the present invention, the scores of each solution are in a hundred-point system. For example, if within the most recent 1 month and the number of times is greater than 30, and the solution can solve 99% of such problems, then the score of this solution is 99 points.

[0069] Step S2 of one embodiment of the present invention: real-time monitoring and collecting system alarm information, specifically including:

[0070] Using Prometheus to collect the metric data of basic components. The basic components include servers, databases, etc., and the metric data of the basic components include CPU, memory, disk, etc.;

[0071] Using Alibaba Cloud Log Service to collect business service logs.

[0072] Among them, Prometheus is an open-source time series database (TSDB) + monitoring and alarm system, and is one of the benchmark tools in the monitoring field. It pulls metric data through the Pull mode and realizes flexible alarm rules and notifications through Alertmanager. Alibaba Cloud Log Service (Log Service, abbreviated as SLS) is a fully managed one-stop log big data platform that supports real-time collection, storage, analysis, and alarm of log data by collecting logs in real time through the Push mode (active upload) or Agent (such as Logtail).

[0073] Step S3 of one embodiment of the present invention: performing similarity matching between the real-time alarm information and the alarm database, specifically including:

[0074] Setting an alarm information collection time window;

[0075] After receiving the system alarm information, collect all alarm information within the time period specified by the collection time window;

[0076] Through similarity analysis, merge the same type of alarms according to the classification rules of historical alarms in the alarm database, and match them with the alarm database.

[0077] Similarly, the Qwen model can also perform similar merging on the collected real-time alarm information and match it with the fault database. Collecting alarm information within a certain time window can effectively remove duplicates and reduce redundant processing, thereby significantly reducing system resource consumption, improving processing efficiency, and optimizing resource utilization.

[0078] The above system alarm handling and operation and maintenance method is elaborated in detail through a specific embodiment below. For the specific process, see Figure 2 which mainly includes the following steps:

[0079] 1) Build an alarm database: Classify historical alarms according to the above three-level classification rules, formulate corresponding solutions for the historical alarms under each third-level subcategory, and score each solution.

[0080] 2) Use Prometheus and Alibaba Cloud Log Service to monitor and collect system alarm information in real time.

[0081] 3) After receiving the system alarm information, start a 5-minute alarm information collection time window, and use the Qwen model to aggregate similar alarms generated during this time period through a similarity analysis algorithm, and merge the same type of alarms according to the above three-level classification rules.

[0082] 4) Match the real-time alarm information with the alarm database, and set the scoring threshold for the solution to 99 points:

[0083] If there is a solution to the relevant historical alarm in the alarm database and the score of this solution reaches 99 points or above, automatically create a work order and call the script in the solution to automatically execute alarm handling. After the processing is completed, feedback the result to the operation and maintenance personnel for scoring.

[0084] If there is a solution to the relevant historical alarm in the alarm database and the score of this solution is below 99 points, automatically create a work order and notify the operation and maintenance personnel to further adjust and improve it before processing, and record the processing result for solution scoring.

[0085] If there is no solution for the relevant historical alarm in the alarm database, then based on the solution of the historical alarm that is most similar to the real-time alarm in the alarm database and integrating other solutions with relatively high similarity, automatically analyze and generate a reference solution for the real-time alarm, save the reference solution to the alarm database, and at the same time automatically create a work order to notify the operation and maintenance personnel to further adjust and improve it for processing, and record the processing results for solution scoring.

[0086] The present invention also proposes a system alarm processing and operation and maintenance system for implementing the system alarm processing and operation and maintenance method as described above, including an alarm database 100, an alarm detection module 200, an alarm matching module 300, a decision-making module 400, an alarm processing execution module 500, and a scoring module 600. Refer to Figure 3 . The alarm database 100 is used to store historical alarms, the solutions corresponding to the historical alarms, and the scores of each solution. The alarm detection module 200 is used to monitor and collect system alarm information in real time. The alarm matching module 300 is used to perform similarity matching between the real-time alarm information and the alarm database 100. The alarm matching module in an embodiment of the present invention is the Qwen model. The decision-making module 400 is used to generate a solution for the real-time alarm information according to the matching result and / or the score of the solution. The alarm processing execution module 500 is used to perform alarm processing according to the solution of the real-time alarm information. The scoring module 600 is used to score the solution based on the feasibility rate of using the solution to solve the corresponding alarm within a period of time.

[0087] Specifically, if a corresponding historical alarm is matched in the alarm database and the score of the solution corresponding to the historical alarm meets the preset score threshold, the decision-making module determines the solution as the solution for the real-time alarm information. After receiving the solution, the alarm processing execution module automatically calls the script in the solution for alarm processing.

[0088] If a corresponding historical alarm is matched in the alarm database and the score of the solution corresponding to the historical alarm does not meet the preset score threshold, the decision-making module creates an alarm processing work order based on the solution. The operation and maintenance personnel view the alarm processing work order at the alarm processing execution module and perform alarm processing after adjustment.

[0089] If no corresponding historical alarm is matched in the alarm database, the decision-making module automatically analyzes and generates a reference solution for the real-time alarm based on the solution of the historical alarm that is most similar to the real-time alarm in the alarm database and integrating other solutions with relatively high similarity, and creates an alarm processing work order based on the reference solution. The operation and maintenance personnel view the alarm processing work order at the alarm processing execution module and perform alarm processing after adjustment.

[0090] It should be noted that in this application, unless otherwise clearly specified and limited, terms such as "connection" should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium, and it can also be the communication inside two components. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific situation.

[0091] The present invention has the following beneficial effects:

[0092] 1) Through automatic alarm classification, alarm database matching, and automated processing processes, the present invention can automatically filter duplicate alarms and intelligently match solutions, greatly reducing manual intervention, significantly shortening the alarm response time, and improving the alarm handling efficiency.

[0093] 2) By means of the intelligent decision-making module and the structured alarm database, the present invention can effectively reduce the weight of manual judgment, reduce the dependence on personal experience, reduce the risk of human error, greatly improve the accuracy and consistency of alarm handling, and realize the standardization and quantifiability of the entire process of alarm handling.

[0094] 3) Through continuous feedback and scoring mechanisms, the present invention can continuously optimize the content of the alarm database and the processing process, update the best practices in real time, and ensure the accuracy and timeliness of the solutions.

[0095] 4) By constructing an alarm database, the present invention can automatically summarize the optimal processing solutions, form standardized processing knowledge, so as to realize the real-time sharing and inheritance of processing experience, and improve the overall skill level of the operation and maintenance team.

[0096] 5) The present invention adopts a dual evaluation mechanism of "matching result + solution score". Through multi-dimensional cross-validation, it ensures that the recommended solutions not only conform to the current alarm characteristics but also have a high historical success rate, thus effectively improving the feasibility of the solutions.

[0097] The steps of the methods or algorithms described in combination with the embodiments disclosed in this article can be directly embodied in hardware, in software modules executed by a processor, or in a combination of the two. The software modules can reside in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read from and write to the storage medium. In an alternative, the storage medium can be integrated into the processor. The processor and the storage medium can reside in an ASIC. The ASIC can reside in a user terminal. In an alternative, the processor and the storage medium can reside in the user terminal as discrete components.

[0098] In one or more exemplary embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functions may be stored on or transmitted via a computer-readable medium as one or more instructions or code. The computer-readable medium includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. The storage media may be any available media that can be accessed by a computer. By way of example and not limitation, such computer-readable media can include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a web site, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. As used herein, the terms "disk" and "disc" include compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0099] Although the methods described above are illustrated and described as a series of acts, it should be understood and appreciated that the methods are not limited by the order of the acts, as some acts may occur in different orders and / or concurrently with other acts from those illustrated and described herein or not illustrated and described herein but understood by those skilled in the art, according to one or more embodiments.

[0100] The construction and arrangement of the present application shown in multiple different exemplary embodiments are merely illustrative. Although only a few embodiments are described in detail in this disclosure, those who refer to this disclosure should easily understand that many modifications are possible without substantially departing from the novel teachings and advantages of the subject matter described in this application. Therefore, all such modifications are intended to be included within the scope of the present invention. The order or sequence of any process or method steps may be changed or reordered according to alternative embodiments. In the claims, any "means plus function" clauses are intended to cover the structures that perform the recited functions described herein, and not only structural equivalents but also equivalent structures. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding modifications and changes according to the present invention, but these corresponding modifications and changes should all fall within the protection scope of the present invention.

Claims

1. A method for system alarm handling and operation and maintenance, characterized in that, It includes the following steps: Construct an alarm database, which includes historical alarms, corresponding solutions to the historical alarms, and scores of the solutions; Monitor and collect system alarm information in real time; Perform similarity matching between the real-time alarm information and the alarm database; If a corresponding historical alarm is matched in the alarm database and the score of the solution corresponding to the historical alarm meets the preset score threshold, automatically call the script in the solution to handle the alarm; If a corresponding historical alarm is matched in the alarm database and the score of the solution corresponding to the historical alarm does not meet the preset score threshold, create an alarm handling work order based on the solution, and send the alarm handling work order to the operation and maintenance personnel side for adjustment and then handle the alarm; If no corresponding historical alarm is matched in the alarm database, automatically analyze and generate a reference solution for the real-time alarm based on the solution of the historical alarm that is most similar to the real-time alarm in the alarm database, create an alarm handling work order based on the reference solution, and send the alarm handling work order to the operation and maintenance personnel side for adjustment and then handle the alarm.

2. The system alarm handling operation and maintenance method according to claim 1, wherein, If no corresponding historical alarm is matched in the alarm database, after automatically analyzing and generating a reference solution for the real-time alarm based on the solution of the historical alarm that is most similar to the real-time alarm in the alarm database, also store the reference solution of the real-time alarm in the alarm database.

3. The system alarm handling operation and maintenance method according to claim 1, wherein, The construction of the alarm database specifically includes: Classify historical alarms; Formulate corresponding solutions for various historical alarms; Score the solutions corresponding to each historical alarm.

4. The system alarm handling and operation and maintenance method according to claim 3, wherein The rules for classifying historical alarms are: Classify historical alarms into three levels, namely, first-level major categories, second-level middle categories, and third-level minor categories; The first-level major categories are divided according to the source of the alarms, and the first-level major categories include host categories, data categories, and log categories; The second-level middle categories are divided according to specific entities under the first-level major categories, and the second-level middle categories include host IPs under the host category and service names under the log category; The third-level minor categories are divided according to specific problem types under the second-level middle categories, and the third-level minor categories include disk alarms under the host IP and message consumption failures under the service name.

5. The system alarm handling operation and maintenance method according to claim 4, characterized in that The solutions corresponding to historical alarms belonging to the same third-level minor category are the same, and the scores of the solutions are the same; The scoring of the solutions corresponding to each historical alarm is specifically: scoring based on the feasibility rate of using the solution to solve the corresponding alarm within a period of time.

6. The system alarm handling and operation and maintenance method according to claim 1, characterized in that The real-time monitoring and collection of system alarm information specifically includes: Use Prometheus to collect metric data of basic components, and the basic components include servers and databases, and the metric data of the basic components include CPU, memory, and disks; Use Alibaba Cloud Log Service to collect business service logs.

7. The system alarm handling and operation and maintenance method according to claim 3, wherein, The similarity matching between the real-time alarm information and the alarm database specifically includes: Set an alarm information collection time window; After receiving the system alarm information, collect all alarm information within the time window; Through similarity analysis, the same type of alarms are merged according to the classification rules of historical alarms in the alarm database and matched with the alarm database.

8. The system alarm handling operation and maintenance method according to claim 1, characterized in that, It further includes: After the real-time alarm is processed, the solution and score of the real-time alarm are updated to the alarm database.

9. A system alarm handling operation and maintenance system, characterized in that, For implementing the system alarm processing and operation and maintenance method according to any one of claims 1-8, it includes: An alarm database, which is used to store historical alarms, the solutions corresponding to the historical alarms, and the scores of each solution; An alarm detection module, which is used to monitor and collect system alarm information in real time; An alarm matching module, which is used to perform similarity matching between the real-time alarm information and the alarm database; A decision-making module, which is used to generate a solution to the real-time alarm information according to the matching result and / or the score of the solution; An alarm processing execution module, which is used to process the alarm according to the solution of the real-time alarm information.

10. The system alarm handling and operation and maintenance system according to claim 9, characterized in that, It further includes a scoring module, and the scoring module is used to score the solution based on the feasibility rate of using the solution to solve the corresponding alarm within a period of time.

Images