Alarm message analysis method and device, equipment and storage medium

Abstract

The invention discloses an alarm message analysis method, device and equipment and a storage medium, and relates to the technical field of alarm analysis, and the method comprises the steps: extracting current basic information and current extension information in a current alarm message; determining a current analysis template based on feature matching of the current basic information, and analyzing the current basic information based on the current analysis template to obtain first analysis information; determining a current extension attribute based on feature matching of the current extension information, and filling the current extension attribute based on the current extension information to obtain second analysis information; and aggregating the first analysis information and the second analysis information to obtain target analysis information corresponding to the current alarm message. The analysis template is adopted to analyze the basic information, and the expansion attribute is adopted to analyze and fill the expansion information, so that the analysis of the basic information and the expansion information is separated, the dynamic analysis of the expansion information is realized, and the technical effect of improving the accuracy of alarm message analysis is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of alarm parsing, and in particular to an alarm message parsing method, device, equipment and storage medium. Background Art

[0002] In the scenario of cross-vendor alarm message parsing, a predefined parsing method is mainly adopted. A full set of message parsing templates are defined in the adapter repository for message parsing. After an alarm occurs on the server, the message parsing templates in the adapter repository are matched to generate alarm messages. However, due to significant differences in the field naming, hierarchical structure, and extended attributes of alarm messages among different vendors, and the fact that static predefined templates are difficult to cover dynamic changes, there is a lack of the ability to dynamically parse extended fields, resulting in the inability to meet the operation and maintenance requirements for accurately parsing alarm messages. Summary of the Invention

[0003] The present invention provides an alarm message parsing method, device, equipment and storage medium to at least solve the problem in related technologies that alarm messages cannot be accurately parsed.

[0004] The present invention provides an alarm message parsing method, including:

[0005] Obtain a current alarm message, and extract current basic information and current extended information in the current alarm message;

[0006] Based on feature matching of the current basic information, determine a current parsing template, and parse the current basic information based on the current parsing template to obtain first parsing information;

[0007] Based on feature matching of the current extended information, determine current extended attributes, and fill the current extended attributes based on the current extended information to obtain second parsing information;

[0008] Aggregate the first parsing information and the second parsing information to obtain target parsing information corresponding to the current alarm message.

[0009] The present invention also provides an alarm message parsing device, including:

[0010] An alarm message extraction module, configured to obtain a current alarm message, and extract current basic information and current extended information in the current alarm message;

[0011] A first parsing module, configured to determine a current parsing template based on feature matching of the current basic information, and parse the current basic information based on the current parsing template to obtain first parsing information;

[0012] A second parsing module, configured to determine a current extended attribute based on feature matching of current extended information, and fill the current extended attribute based on the current extended information to obtain second parsing information;

[0013] A parsing information aggregation module, configured to aggregate the first parsing information and the second parsing information to obtain target parsing information corresponding to the current alarm message.

[0014] The present invention further provides an electronic device, including: a memory, configured to store a computer program; a processor, configured to implement the steps of any of the above alarm message parsing methods when executing the computer program.

[0015] The present invention further provides a computer-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above alarm message parsing methods are implemented.

[0016] The present invention further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of any of the above alarm message parsing methods are implemented.

[0017] Through the present invention, feature matching and parsing are respectively performed on the basic information and the extended information in the alarm message. The basic information is parsed using a parsing template, and the extended information is parsed and filled using extended attributes, so as to separate the parsing of the basic information and the extended information and achieve dynamic parsing of the extended information. Therefore, the technical problem of being unable to accurately parse the alarm message can be solved, and the technical effect of improving the accuracy of alarm message parsing can be achieved. Description of the Drawings

[0018] To more clearly illustrate the embodiments of the present invention, the following will briefly introduce the drawings required in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can also obtain other drawings based on these drawings without creative efforts.

[0019] Figure 1 is a schematic flowchart of an alarm message parsing method according to an embodiment of the present invention;

[0020] Figure 2 is a schematic flowchart of another alarm message parsing method according to an embodiment of the present invention;

[0021] Figure 3 is a schematic diagram of a template feature library in an alarm message parsing method according to an embodiment of the present invention;

[0022] Figure 4 is a schematic diagram of a rule engine library in a parsing template in an alarm message parsing method according to an embodiment of the present invention;

[0023] Figure 5 It is a schematic flowchart of another alarm message parsing method according to an embodiment of the present invention;

[0024] Figure 6 It is a schematic flowchart of a specific embodiment of the alarm message parsing method according to an embodiment of the present invention;

[0025] Figure 7 It is a schematic flowchart of a specific embodiment for updating template features and extended attributes in the alarm message parsing method according to an embodiment of the present invention;

[0026] Figure 8 It is a structural block diagram of an alarm message parsing device according to an embodiment of the present invention;

[0027] Figure 9 It is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed implementation manners

[0028] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0029] It should be noted that in the description of the present invention, the terms "include", "comprise" or any other variant thereof are intended to cover a non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in the present invention are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0030] In order to enable those skilled in the art of the present technology to better understand the solution of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific implementation manners.

[0031] In the scenario of cross-vendor alarm message parsing, a predefined parsing method is mainly adopted. A full set of message parsing templates are defined in the adapter repository for message parsing. After an alarm occurs on the server, the message parsing templates in the adapter repository are matched to generate alarm messages. However, due to significant differences among different vendors in the field naming, hierarchical structure, and extended attributes of alarm messages, and the fact that static predefined templates are difficult to cover dynamic changes, there is a lack of the ability to dynamically parse extended fields, resulting in the inability to meet the operation and maintenance requirements for accurately parsing alarm messages. In addition, when the protocol version is iterated or new vendors are connected, the message parsing templates need to be changed, so the code is frequently modified, leading to low adaptation efficiency and high maintenance costs.

[0032] Based on this, the present invention provides an alarm message parsing method, which obtains the current alarm message and extracts the current basic information and current extended information in the current alarm message; based on the feature matching of the current basic information, determines the current parsing template, and parses the current basic information based on the current parsing template to obtain the first parsing information; based on the feature matching of the current extended information, determines the current extended attribute, and fills the current extended attribute based on the current extended information to obtain the second parsing information; aggregates the first parsing information and the second parsing information to obtain the target parsing information corresponding to the current alarm message. Feature matching and parsing are respectively performed on the basic information and extended information in the alarm message. The basic information is parsed using the parsing template, and the extended information is parsed and filled using the extended attribute, thereby separating the parsing of the basic information and the extended information, realizing the dynamic parsing of the extended information, and thus improving the accuracy and expansion ability of alarm message parsing.

[0033] The alarm message parsing method provided by the present invention can be applied to various cross-vendor operation and maintenance systems. Among them, the cross-vendor operation and maintenance system can use any protocol for pushing and parsing alarm messages. For example, the Redfish protocol can be used as the protocol for pushing and parsing alarm messages.

[0034] On the one hand, in this embodiment, an alarm message parsing method is provided, which can be used in a cross-vendor operation and maintenance system. Figure 1 It is a schematic flowchart of the alarm message parsing method of the embodiment of the present invention. As Figure 1 shown, the process includes the following steps:

[0035] Step S101, obtain the current alarm message and extract the current basic information and current extended information in the current alarm message.

[0036] In an embodiment of the present invention, the current alarm message is the alarm message currently received by the server of the cross-vendor operation and maintenance system. Since multiple vendors are involved, the specific vendor corresponding to the current alarm message is not clear. Therefore, it is necessary to perform feature matching on the current alarm message and parse it according to the corresponding vendor or feature field.

[0037] In an embodiment of the present invention, the current alarm message consists of current basic information and current extended information. Among them, the current basic information is the relevant information corresponding to the basic attributes, and the basic information corresponding to each vendor is formed according to the same format or template. The current basic information can be parsed using the general parsing template of the corresponding vendor. The current extended information is the relevant information corresponding to the extended attributes, which is formed by expanding additional extended fields outside the basic information. The current extended information is then parsed by matching the extended attributes.

[0038] In the related art, for each vendor, the basic attributes and extended attributes are predefined to obtain a static predefined template, and the static predefined template is used to parse the entire alarm message. This results in the inability to fully parse the different extended information dynamically loaded in the alarm message. The alarm message can only form the extended information according to the configuration of the static predefined template, and cannot dynamically form different extended information according to requirements, resulting in the lack of flexibility and applicability of the alarm message and its parsing. In the present invention, for the obtained current alarm message, the current basic information and current extended information therein are extracted, and the current basic information and current extended information are respectively matched and parsed, so as to be able to parse the current extended information that can be dynamically configured in the current alarm message and ensure that the alarm message can be dynamically and flexibly configured.

[0039] In an embodiment of the present invention, in the alarm message, all the extended information can be placed under the extended field indicating the extended information. Based on this extended field, the basic information and extended information in the alarm message can be distinguished. Correspondingly, when the current alarm message is obtained, the extended field therein is identified, and the information contained under the extended field is used as the current extended information, and other information is used as the current basic information.

[0040] Step S102: Based on the feature matching of the current basic information, determine the current parsing template, and parse the current basic information based on the current parsing template to obtain the first parsing information.

[0041] In an embodiment of the present invention, different vendors correspond to different parsing templates for the basic information. Perform feature matching on the current basic information to determine the vendor corresponding to the current basic information, and use the parsing template of the basic information corresponding to this vendor as the current parsing template. Among them, the feature matching of the current basic information can be the matching of the identifier used to indicate the corresponding vendor in the current basic information.

[0042] In the embodiment of the present invention, parsing rules for parsing basic information are configured in the parsing template. According to the parsing rules included in the current parsing template, the information included in the current basic information is parsed in sequence to obtain first parsing information.

[0043] Step S103: Based on the feature matching of the current extended information, determine the current extended attribute, and fill the current extended attribute based on the current extended information to obtain second parsing information.

[0044] In the embodiment of the present invention, the current extended information may include information corresponding to multiple extended attributes. Feature matching is performed on each piece of information in the current extended information to determine the current extended attribute corresponding to each piece of information, so as to be able to identify and parse all the information in the current extended information. Among them, the feature matching of each piece of information in the current extended information may be to match the fields indicating attributes in each piece of information.

[0045] In the embodiment of the present invention, in the current extended information, each piece of information not only includes a field indicating an attribute, but also includes the specific content of the corresponding attribute. The content is filled into the corresponding current extended attribute to obtain second parsing information.

[0046] Step S104: Aggregate the first parsing information and the second parsing information to obtain the target parsing information corresponding to the current alarm message.

[0047] In the embodiment of the present invention, the first parsing information and the second parsing information are aggregated to obtain the target parsing information after the current alarm message is finally parsed. Among them, the first parsing information and the second parsing information can be aggregated according to a preset template, that is, the first parsing information and the second parsing information are filled into the corresponding positions of the template to obtain the target parsing information.

[0048] In an alternative embodiment, after obtaining the target parsing information, the target parsing information is stored in the relevant management software of the server and published.

[0049] An alarm message parsing method provided by an embodiment of the present invention obtains a current alarm message and extracts current basic information and current extended information in the current alarm message; based on feature matching of the current basic information, determines a current parsing template, and parses the current basic information based on the current parsing template to obtain first parsing information; based on feature matching of the current extended information, determines a current extended attribute, and fills the current extended attribute based on the current extended information to obtain second parsing information; aggregates the first parsing information and the second parsing information to obtain target parsing information corresponding to the current alarm message. Feature matching and parsing are respectively performed on the basic information and the extended information in the alarm message. The basic information is parsed using a parsing template, and the extended information is parsed and filled using an extended attribute, so as to separate the parsing of the basic information and the extended information, realize dynamic parsing of the extended information, and thus improve the accuracy and expandability of alarm message parsing.

[0050] In this embodiment, an alarm message parsing method is provided, which can be used in a cross-vendor operation and maintenance system. Figure 2 It is a flowchart of another alarm message parsing method according to an embodiment of the present invention, as Figure 2 shown, and the process includes the following steps:

[0051] Step S201, obtain a current alarm message, and extract current basic information and current extended information in the current alarm message. For details, please refer to Figure 1 step S101 of the embodiment shown, which will not be elaborated here.

[0052] Step S202, based on feature matching of the current basic information, determine a current parsing template, and parse the current basic information based on the current parsing template to obtain first parsing information.

[0053] Specifically, in step S202, based on feature matching of the current basic information, determining a current parsing template may include the following steps:

[0054] Step S2021, match the flag field of the current basic information with a template feature library to determine the current template feature corresponding to the current basic information.

[0055] In the embodiment of the present invention, the template feature library includes multiple template features, and each template feature corresponds to at least one flag field. Among them, multiple template features respectively correspond to different manufacturers, and the flag field is a field indicating a template feature that appears in the basic information or the alarm message; each template feature may correspond to multiple flag fields to adapt to multiple application environments of the same manufacturer, so as to meet the applicability requirements for parsing alarm messages.

[0056] In an embodiment of the present invention, if the flag field of the current basic information is consistent with the flag field corresponding to a certain template feature, then the template feature can be determined as the current template feature.

[0057] In an alternative embodiment, Figure 3 is a schematic diagram of a template feature library in the alarm message parsing method according to an embodiment of the present invention. As Figure 3 shown, a variety of template features are loaded in the template feature library, namely template feature 1, template feature 2, ……, template feature n, and each template feature corresponds to a different manufacturer. In each template feature, there is at least one flag field. Taking template feature 1 as an example, among them, VendorName:VendorA means that VendorName is used as the template feature, that is, the manufacturer name is used as the template feature, and its corresponding flag fields include Vendor_A and manufacturer A. Vendor_A and manufacturer A correspond to different application scenarios respectively. Among them, Vendor_A corresponds to VendorNameEn, which is an application scenario in the English language environment, and manufacturer A corresponds to VendorNameCn, which is an application scenario in the Chinese language environment. When any one of the two flag fields is matched, it can be considered that template feature 1 is matched.

[0058] Step S2022, determine the parsing template corresponding to the current template feature as the current parsing template.

[0059] In an embodiment of the present invention, each template feature has a corresponding parsing template, and the parsing template is a parsing template for the general basic information of the corresponding manufacturer. The parsing template corresponding to the current template feature is determined as the current parsing template, so as to parse the current basic information based on the current parsing template to obtain the first parsing information.

[0060] In an alternative embodiment, if there is no template feature in the template feature library that matches the flag field of the current basic information, it indicates that there is no manufacturer corresponding to the current alarm message or the parsing template corresponding to the template feature in the current existing parsing templates. Therefore, the flag field of the current basic information is used as the template feature and added to the template feature library. At the same time, based on the current basic information, a parsing template is formed and associated with the template feature, so as to continuously enrich and improve the template feature library and the parsing template, and improve the applicability of alarm message parsing. Among them, to form a parsing template based on the current basic information, the specific operation can be: extract the fields representing attributes in the current basic information to form basic attributes, call the preset default rules, and combine the basic attributes with the default rules to obtain the parsing template.

[0061] In an alternative embodiment, the rule engine library for parsing templates contains various parsing rules. Specifically, the rule engine library includes at least a time rule for parsing time, an event rule for parsing events, an encryption rule for encrypting events, and a sensor rule for parsing sensor data. For example, Figure 4 is a schematic diagram of the rule engine library in the parsing template of the alarm message parsing method according to an embodiment of the present invention. As shown in Figure 4 , the rule engine library contains a time rule TimeFormartDrools and an event rule EventIdDrools; in the time rule TimeFormartDrools, the format requirements for time information are defined, and in the event rule EventIdDrools, the event-related information processed by the event rule EventIdDrools is defined.

[0062] In an alternative embodiment, corresponding to the parsing rules included in the rule engine library for the parsing template, the first parsing information includes time parsing information, event parsing information, and sensor parsing information. Correspondingly, in step S202, parsing the current basic information based on the current parsing template to obtain the first parsing information may include the following steps:

[0063] Step S2023, based on the time rule in the current parsing template, perform format conversion on the time information in the current basic information to obtain time parsing information.

[0064] In the embodiment of the present invention, as described above, the time rule defines the format requirements for time information. The time rule extracts the time information in the current basic information and performs format conversion according to the corresponding format requirements to obtain the corresponding time parsing message. For example, if the time information in the current basic information is 2024 / 01 / 05 14 / 02 / 30, according to the time rule, it is converted to 2024-01-05 14:02:30.

[0065] Step S2024, based on the event rule in the current parsing template, extract and aggregate the event-related information in the current basic information to obtain event aggregation information.

[0066] In the embodiments of the present invention, as described above, the event rule defines the event-related information involved. Based on the event rule, the event-related information in the current basic data is extracted and aggregated to obtain event aggregation information, which can uniquely identify the current alarm message. Among them, the event-related information includes the manufacturer, that is, the flag field, IP address, model, BMC version, original alarm event ID, etc. By aggregating these information, an alarm message can be uniquely identified and located among many manufacturers and many alarms. For example, in the current basic information, the flag field is Vendor_A, the IP address is 100.255.255.0, the model is HV5, the BMC version is 4.0.1, and the original alarm event ID is 001. Then, they are aggregated to obtain the event aggregation information as VendorA_100.255.255.0_HV5_4.0.1_001.

[0067] Step S2025, based on the encryption rule in the current parsing template, encrypt the event aggregation information to obtain event parsing information.

[0068] In the embodiments of the present invention, the encryption rule defines the encryption algorithm for the event aggregation information. The encryption rule encrypts the event aggregation information through the encryption algorithm to obtain event parsing information. Among them, there can be multiple encryption rules in the rule engine template. Which one or several encryption rules are specifically selected for encryption is defined by the current parsing template.

[0069] Step S2026, based on the sensor rule in the current parsing template, convert the sensor information in the current basic information to obtain sensor parsing information.

[0070] In the embodiments of the present invention, the sensor rule is used to determine whether the sensor information in the current basic information has an international unit, and when the sensor information has an international unit, the unit in the sensor information is removed to obtain the original value therein as the sensor parsing information. For example, if the sensor information is 32A, the sensor rule removes the unit therein to obtain the sensor parsing information as 32.

[0071] Step S203, based on the feature matching of the current extended information, determine the current extended attribute, and fill the current extended attribute based on the current extended information to obtain the second parsing information. For details, please refer to Figure 1 Step S103 of the illustrated embodiment, which will not be elaborated here.

[0072] Step S204, aggregate the first parsing information and the second parsing information to obtain the target parsing information corresponding to the current alarm message. For details, please refer to Figure 1 Step S104 of the illustrated embodiment, which will not be elaborated here.

[0073] In this embodiment, an alarm message parsing method is provided, which can be used in a cross-vendor operation and maintenance system. Figure 5 It is a schematic flowchart of another alarm message parsing method according to an embodiment of the present invention. As Figure 5 shown, the process includes the following steps:

[0074] Step S501, obtain the current alarm message, and extract the current basic information and current extended information in the current alarm message. For details, please refer to Figure 1 step S101 of the embodiment shown, which will not be elaborated here.

[0075] Step S502, based on the feature matching of the current basic information, determine the current parsing template, and parse the current basic information based on the current parsing template to obtain the first parsing information. For details, please refer to Figure 1 step S102 of the embodiment shown, which will not be elaborated here.

[0076] Step S503, based on the feature matching of the current extended information, determine the current extended attribute, and fill the current extended attribute based on the current extended information to obtain the second parsing information.

[0077] Specifically, in step S503, based on the feature matching of the current extended information, determining the current extended attribute may include the following steps:

[0078] Step S5031, parse the current extended information to obtain the attribute information included in the current extended information.

[0079] In an embodiment of the present invention, the current extended information may include information corresponding to multiple different extended attributes, and each piece of information consists of attribute information and specific attribute values. Parse the current extended information and extract each piece of attribute information therein.

[0080] In an optional implementation manner, in each piece of information of the current extended information, the attribute information and the attribute value are separated by a delimiter. Using the delimiter as the parsing flag, the field before the delimiter is used as the attribute information, and the field after the delimiter is used as the attribute value, so as to complete the parsing of the current extended information. Taking the piece of information sensorName:PSU as an example, where ":" is the parsing flag, the field sensorName before ":" is used as the attribute information, and the field PSU after ":" is used as the attribute value.

[0081] Step S5032, match the attribute information with each extended attribute in the extended attribute library to respectively determine the similarity information of the attribute information with respect to each extended attribute.

[0082] In the embodiments of the present invention, the extended attribute library includes multiple extended attributes. The multiple pieces of attribute information obtained by parsing are respectively matched with each extended attribute in the extended attribute library to determine the similarity information of each piece of attribute information with respect to each extended attribute in the extended attribute library according to the matching results. The similarity information is used to characterize the similarity degree of the attribute information and the compared extended attribute in terms of fields, so as to determine the extended attribute that matches the attribute information based on the similarity information.

[0083] In an alternative embodiment, step S5032 includes:

[0084] Step a1: Compare the fields of the attribute information with the fields of the extended attribute to determine the length of the similar fields of the attribute information with respect to the extended attribute.

[0085] In step a1, compare the fields of the attribute information with the fields of the extended attribute to determine the longest consecutive common field between the two, and use the length of the longest consecutive common field as the length of the similar fields.

[0086] For example, if the field of the attribute information is sensorName and the field of the extended attribute is sensor, the longest consecutive common field between the two is sensor, and the length of this field is 6, then the length of the similar fields is 6. If the field of the attribute information is sesorName and the field of the extended attribute is sensor, the consecutive common fields between the two are se and sor respectively, then the longest consecutive common field is sor, and the length of this field is 3, so the length of the similar fields is 3.

[0087] Step a2: Determine the smaller value between the length of the field of the attribute information and the length of the field of the extended attribute as the reference field length.

[0088] In step a2, determine the field with the smaller length among the field of the attribute information and the field of the extended attribute, and use the length of this field as the reference field length.

[0089] For example, if the field of the attribute information is sensorName and the field of the extended attribute is sensor, the length of the field of the attribute information is 10, and the length of the field of the extended attribute is 6, then use the length of the field of the extended attribute as the reference field length, and the obtained reference field length is 6.

[0090] Step a3: Calculate the ratio of the length of the similar fields to the reference field length to obtain the similarity information.

[0091] In step a3, divide the length of the similar fields by the reference field length to calculate the ratio of the length of the similar fields to the reference field length, and obtain the similarity information.

[0092] Taking the field of the above attribute information as sensorName and the field of the extended attribute as sensor as an example, where the length of the similar field is 6 and the length of the reference field is 6, the calculated similarity information is 1.

[0093] Step S5033: Determine the current extended attribute corresponding to the attribute information as the extended attribute with the maximum similarity information and meeting the threshold requirement among each extended attribute.

[0094] In the embodiment of the present invention, from the similarity information of the attribute information with respect to each extended attribute, the similarity information with the largest value and meeting the threshold requirement is determined, and the extended attribute corresponding to the similarity information is determined as the current extended attribute corresponding to the attribute information. Among them, the threshold requirement is used to define the matching requirement between the attribute information and the extended attribute. When the similarity information is greater than or equal to the threshold requirement, it can be considered that the attribute information matches the extended attribute.

[0095] In an alternative embodiment, if after matching all the extended attributes in the extended attribute library and calculating the similarity information, it is determined that no similarity information meets the threshold requirement, then it can be determined that there is no matching extended attribute for the attribute information in the extended attribute library, and the attribute information is a newly added extended attribute. Therefore, the attribute information can be added to the extended attribute library as a new extended attribute.

[0096] In an alternative embodiment, in step S503, filling the current extended attribute based on the current extended information to obtain the second parsing information may include the following steps:

[0097] Step S5034: Fill the current extended attribute corresponding to the attribute information based on the attribute value corresponding to the attribute information in the current extended information to obtain the second parsing information.

[0098] In the embodiment of the present invention, according to the attribute value corresponding to the attribute information parsed in the above step S5301, the corresponding current extended attribute is filled, thereby obtaining the second parsing message.

[0099] In an alternative embodiment, an extended message parsing plugin can be used to implement the matching and parsing of the attribute information, and the extended attribute library is preset in the extended message parsing plugin; that is, after parsing the attribute information in the current extended information, the attribute information is loaded into the extended message parsing plugin, and the extended message parsing plugin performs the matching and filling of the extended attribute for the loaded attribute information to obtain the second parsing message.

[0100] In an alternative embodiment, to avoid conflicts between the extended attributes of different manufacturers, for different manufacturers, that is, for different template features, an extended message parsing plugin and an extended attribute library are established respectively, and an association relationship is established between the template features, the extended message parsing plugin, and the extended attribute library. The extended attributes used for the corresponding template features are set respectively in the extended attribute library. Before performing feature matching on the attribute information, the corresponding extended message parsing plugin and extended attribute library can be determined according to the template feature corresponding to the current alarm message, so as to ensure that the correct extended message parsing plugin and extended attribute library are used to parse the extended information, thereby ensuring the accuracy of the extended information parsing. Correspondingly, when the flag field in the current alarm message does not match the template features in the template feature library, that is, when the current alarm message comes from a new manufacturer, a new extended attribute library is formed based on the attribute information in the current extended information, and a new extended message parsing plugin is established. At the same time, an association relationship is established among the new extended attribute library, the extended message parsing plugin, and the new template features.

[0101] In an alternative embodiment, for the same extended attribute library, that is, for the problem of redundant new extended attributes that may occur in two cases: different manufacturers using the same extended attribute library and different protocol versions using the same extended attribute library, to improve the accuracy of the extended attribute library, at preset time intervals, the attribute information that has not been successfully matched from the extended attribute library within the preset time is collected, that is, the new extended attributes added within the preset time are collected, and based on the similarity information among these attribute information, the extended attributes are paired, the extended attributes corresponding to the matched attribute information are determined, and the corresponding extended attributes are added to the extended attribute library. Among them, pairing the extended attributes based on the similarity information and determining the extended attributes corresponding to the matched attribute information specifically means: calculating the similarity information between any two pieces of attribute information in the newly added attribute information, and pairing the attribute information whose similarity information meets the threshold requirements. After the pairing is completed, the longest continuous common field in the paired attribute information is used as its corresponding extended attribute. For example, for the attribute information with the field "threshold", the field "thre", and the field "thres", the similarity information between any two of them is 1, and these three can be paired. At the same time, it can be determined that the longest continuous common field among the three is "thre", so "thre" is used as the extended attribute corresponding to these three.

[0102] Step S504: Aggregate the first parsing information and the second parsing information to obtain the target parsing information corresponding to the current alarm message. For details, please refer to Figure 1 Step S104 of the embodiment shown, which will not be elaborated here.

[0103] In an alternative embodiment, in the above embodiment, since there may be multiple versions of the protocol, corresponding template feature libraries, parsing templates, and / or extended attribute libraries, etc. can be set for different protocol versions respectively; correspondingly, when parsing the current alarm message, first determine the template feature library, parsing template, and extended attribute library corresponding to the version based on the protocol version included in the current alarm message, parse the current basic information based on the template features and parsing template corresponding to the version, and parse the current extended information based on the extended attribute library corresponding to the version. Among them, the extended attribute library can be common among different protocol versions. When parsing the current extended information, the extended attribute library can be directly called for matching parsing, or the extended attribute library is common among some protocol versions. When parsing the current extended information, confirm the extended attribute library applicable to the current protocol version and perform matching parsing.

[0104] In an alternative embodiment, if there is a protocol version update, that is, an updated protocol version is released, obtain and save each manufacturer corresponding to the updated protocol version, that is, the parsing template corresponding to each template feature; if in the updated protocol version, only updates are made on the basis of the original parsing template, the original parsing template can be copied, and the updated content can be replaced and updated on the basis of the original parsing template. If the parsing template corresponding to the currently stored protocol version is updated, obtain the updated content and replace and update the updated content on the basis of the corresponding parsing template.

[0105] As a specific embodiment, Figure 6 is a schematic flowchart of a specific embodiment of the alarm message parsing method according to an embodiment of the present invention. As shown in Figure 6 the figure, the server management software of the cross-vendor operation and maintenance system receives the original current alarm message, extracts the flag field in the current alarm message, and performs matching of the flag field with the template feature library. If the matching is successful, extract and parse the current basic information using the parsing template corresponding to the matched template feature to obtain the first parsing information; if the matching fails, add a new template feature to the template feature library, add a parsing template based on the current basic information, and at the same time add an extended message parsing plug-in and an extended attribute library based on the current extended information. Then, perform matching of the current extended message with the extended attribute library. If the matching is successful, extract the matched extended attributes for filling to obtain the second parsing information; if the matching fails, update the unmatched attribute information to the extended message parsing plug-in and the extended attribute library. Then, fuse the first parsing information and the second parsing information, and fill them into the platform alarm model to obtain the target parsing message, and finally store and publish the target parsing information.

[0106] As a specific embodiment, Figure 7It is a schematic flowchart of a specific embodiment for updating template features and extended attributes in the alarm message parsing method according to an embodiment of the present invention. As Figure 7 shown, the cross-vendor operation and maintenance system periodically scans the template feature library in the server, obtains the latest protocol documents of each vendor, and compares the latest protocol documents with the existing ones. Specifically, it can include comparing the protocol versions, and comparing the template feature library, parsing templates, and extended attribute library of the same version. Then, for the template feature library and parsing templates, based on the latest protocol documents, update the template feature library and parsing templates with updated content or newly generated ones; for the extended attribute library, based on the latest protocol documents, determine the extended fields that are not adapted in the extended attribute library for each vendor, and perform a full aggregation of the unadapted extended fields. Then, among the fully aggregated extended fields, calculate the similarity information between each pair, and use the extended fields whose similarity information meets the threshold requirements as extended attributes, and update the extended attributes to the extended attribute library.

[0107] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases, the former is a better implementation method.

[0108] On the other hand, an embodiment of the present invention also provides an alarm message parsing device, as Figure 8 shown, the device includes:

[0109] An alarm message extraction module 801, configured to obtain the current alarm message and extract the current basic information and current extended information in the current alarm message;

[0110] A first parsing module 802, configured to determine the current parsing template based on feature matching of the current basic information, and parse the current basic information based on the current parsing template to obtain first parsing information;

[0111] A second parsing module 803, configured to determine the current extended attribute based on feature matching of the current extended information, and fill the current extended attribute based on the current extended information to obtain second parsing information;

[0112] A parsing information aggregation module 804, configured to aggregate the first parsing information and the second parsing information to obtain target parsing information corresponding to the current alarm message.

[0113] In an optional embodiment, the first parsing module 802 includes:

[0114] A feature matching unit, configured to match the flag field of the current basic information with a template feature library to determine the current template feature corresponding to the current basic information; the template feature library includes multiple template features, and each template feature corresponds to at least one flag field.

[0115] A template determination unit, configured to determine the parsing template corresponding to the current template feature as the current parsing template.

[0116] In an alternative embodiment, the first parsing module 802 further includes:

[0117] A feature adding unit, configured to, if there is no template feature in the template feature library that matches the flag field of the current basic information, use the flag field of the current basic information as a template feature and add it to the template feature library.

[0118] A template adding unit, configured to form a parsing template based on the current basic information and associate it with the template feature.

[0119] In an alternative embodiment, the first parsing information includes time parsing information, event parsing information, and sensor parsing information; the first parsing module 802 includes:

[0120] A time parsing unit, configured to perform format conversion on the time information in the current basic information based on the time rule in the current parsing template to obtain time parsing information.

[0121] An event aggregation unit, configured to extract and aggregate the event-related information in the current basic information based on the event rule in the current parsing template to obtain event aggregation information.

[0122] An event encryption unit, configured to encrypt the event aggregation information based on the encryption rule in the current parsing template to obtain event parsing information.

[0123] A sensor parsing unit, configured to convert the sensor information in the current basic information based on the sensor rule in the current parsing template to obtain sensor parsing information.

[0124] In an alternative embodiment, the second parsing module 803 includes:

[0125] An extended information parsing unit, configured to parse the current extended information to obtain the attribute information included in the current extended information.

[0126] An extended attribute matching unit, configured to match the attribute information with each extended attribute in the extended attribute library to respectively determine the similarity information of the attribute information with respect to each extended attribute.

[0127] An extended attribute determination unit is configured to determine, among all extended attributes, the extended attribute with the maximum similarity information and meeting the threshold requirement as the current extended attribute corresponding to the attribute information.

[0128] In an alternative embodiment, the extended attribute matching unit includes:

[0129] A similar field length determination subunit is configured to compare the fields of the attribute information with the fields of the extended attribute to determine the length of the similar fields of the attribute information relative to the extended attribute;

[0130] A reference field length determination subunit is configured to determine the smaller value between the field length of the attribute information and the field length of the extended attribute as the reference field length;

[0131] A similarity information calculation subunit is configured to calculate the ratio of the length of the similar fields to the reference field length to obtain the similarity information.

[0132] In an alternative embodiment, the second parsing module 803 includes:

[0133] An attribute filling unit is configured to fill the current extended attribute corresponding to the attribute information based on the attribute value corresponding to the attribute information in the current extended information to obtain the second parsing information.

[0134] For the description of the features in the embodiments corresponding to the alarm message parsing device, reference may be made to the relevant description of the embodiments corresponding to the alarm message parsing method, which will not be elaborated here one by one.

[0135] On the other hand, an embodiment of the present invention further provides an electronic device, such as Figure 9 shown, one or more processors 10, a memory 20, and interfaces for connecting various components, including a high-speed interface and a low-speed interface. Each component communicates with each other using different buses and can be installed on a common main board or installed in other ways as needed. The processor can process instructions executed within the electronic device, including instructions stored in the memory or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some alternative embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (such as an array of servers, a set of blade servers, or a multi-processor system). Figure 9 Take one processor 10 as an example in

[0136] The processor 10 may be a central processing unit, a network processor, or a combination thereof. Among them, the processor 10 may further include a hardware chip. The above-mentioned hardware chip may be an application specific integrated circuit, a programmable logic device, or a combination thereof. The above-mentioned programmable logic device may be a complex programmable logic device, a field programmable gate array, a generic array logic, or any combination thereof.

[0137] Among them, the memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiments.

[0138] The memory 20 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some alternative embodiments, the memory 20 may optionally include a memory remotely provided with respect to the processor 10, and these remote memories may be connected to the electronic device through a network. Examples of the above-mentioned network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0139] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk, or a solid state drive; the memory 20 may further include a combination of the above types of memories.

[0140] The electronic device further includes a communication interface 30 for the electronic device to communicate with other devices or communication networks.

[0141] On the other hand, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, and the computer program is set to execute the steps in any of the above-mentioned embodiments of the alarm message parsing method when running.

[0142] In an exemplary embodiment, the above-mentioned computer-readable storage medium may include but is not limited to: various media such as a USB flash drive, a read-only memory (ROM for short), a random access memory (RAM for short), a mobile hard disk, a magnetic disk, or an optical disc that can store a computer program.

[0143] An embodiment of the present invention also provides a computer program product. The computer program product includes a computer program which, when executed by a processor, implements the steps in any of the above-described embodiments of the alarm message parsing method.

[0144] An embodiment of the present invention also provides another computer program product, including a non-volatile computer-readable storage medium. The non-volatile computer-readable storage medium stores a computer program which, when executed by a processor, implements the steps in any of the above-described embodiments of the alarm message parsing method.

[0145] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described according to their functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Skilled professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0146] The above has introduced in detail an alarm message parsing method provided by the present invention. Specific examples are used herein to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention. It should be noted that for those of ordinary skill in the art in the technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the protection scope of the present invention.

Claims

1. A method for parsing an alarm message, characterized in that, Including: Obtain the current alarm message, and extract the current basic information and current extended information in the current alarm message; Based on the feature matching of the current basic information, determine the current parsing template, and parse the current basic information based on the current parsing template to obtain the first parsing information; Based on the feature matching of the current extended information, determine the current extended attribute, and fill the current extended attribute based on the current extended information to obtain the second parsing information; Aggregate the first parsing information and the second parsing information to obtain the target parsing information corresponding to the current alarm message.

2. The alarm message parsing method according to claim 1, wherein The determining the current parsing template based on the feature matching of the current basic information includes: Match the flag field of the current basic information with the template feature library to determine the current template feature corresponding to the current basic information; the template feature library includes multiple template features, and each template feature corresponds to at least one flag field; Determine the parsing template corresponding to the current template feature as the current parsing template.

3. The alarm message parsing method according to claim 2, wherein, The method further includes: If there is no template feature in the template feature library that matches the flag field of the current basic information, use the flag field of the current basic information as a template feature and add it to the template feature library; Based on the current basic information, form a parsing template and associate it with the template feature.

4. The alarm message parsing method according to claim 1, wherein The first parsing information includes time parsing information, event parsing information, and sensor parsing information; The parsing the current basic information based on the current parsing template to obtain the first parsing information includes: Based on the time rule in the current parsing template, perform format conversion on the time information in the current basic information to obtain the time parsing information; Based on the event rule in the current parsing template, extract and aggregate the event-related information in the current basic information to obtain event aggregation information; Based on the encryption rule in the current parsing template, encrypt the event aggregation information to obtain the event parsing information; Based on the sensor rule in the current parsing template, convert the sensor information in the current basic information to obtain the sensor parsing information.

5. The alarm message parsing method according to claim 1, wherein The determining the current extended attribute based on the feature matching of the current extended information includes: Parse the current extended information to obtain the attribute information included in the current extended information; Match the attribute information with each extended attribute in the extended attribute library to respectively determine the similarity information of the attribute information with respect to each extended attribute; Determine the extended attribute with the largest similarity information and meeting the threshold requirement among each extended attribute as the current extended attribute corresponding to the attribute information.

6. The alarm message parsing method according to claim 5, wherein, The matching the attribute information with each extended attribute in the extended attribute library to respectively determine the similarity information of the attribute information with respect to each extended attribute includes: Compare the fields of the attribute information with the fields of the extended attribute to determine the length of the similar fields of the attribute information with respect to the extended attribute; Determine the smaller value between the field length of the attribute information and the field length of the extended attribute as the reference field length; Calculate the ratio of the similar field length to the reference field length to obtain the similarity information.

7. The alarm message parsing method according to claim 5, wherein The filling of the current extended attribute based on the current extended information to obtain the second parsing information includes: Fill the current extended attribute corresponding to the attribute information based on the attribute value corresponding to the attribute information in the current extended information to obtain the second parsing information.

8. An alarm message parsing device, characterized in that Includes: An alarm message extraction module, configured to obtain a current alarm message and extract current basic information and current extended information in the current alarm message; A first parsing module, configured to determine a current parsing template based on feature matching of the current basic information, and parse the current basic information based on the current parsing template to obtain first parsing information; A second parsing module, configured to determine a current extended attribute based on feature matching of the current extended information, and fill the current extended attribute based on the current extended information to obtain second parsing information; A parsing information aggregation module, configured to aggregate the first parsing information and the second parsing information to obtain target parsing information corresponding to the current alarm message.

9. An electronic device, characterized in that, Includes: A memory, configured to store a computer program; A processor, configured to implement the steps of the alarm message parsing method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that A computer program is stored in the computer-readable storage medium, wherein the computer program implements the steps of the alarm message parsing method according to any one of claims 1 to 7 when executed by a processor.

Images