Alarm recovery and suppression method and device, equipment and storage medium

Abstract

The invention provides an alarm recovery and suppression method, which comprises the following steps of: monitoring and collecting alarm information in time, judging a monitoring threshold according to a pre-configured alarm monitoring rule, and generating a corresponding alarm; under the condition that the alarm is generated, triggering a corresponding recovery rule according to the name of the alarm; searching a sequential relationship between the generation time and the recovery time of the alarm records on the timeline, if the generation time of the alarm records is later and there is no alarm record with the same type name in front, triggering a suppression rule, not generating an alarm notice, adding an identifier to the alarm records, and marking the alarm records as suppressed; otherwise, marking as non-suppression; traversing the alarm record identifier according to a predetermined period, and if the alarm record identifier is marked as a suppressed alarm record, not generating an alarm notification; and marking the alarm record as an unsuppressed alarm record, and generating an alarm to notify a user. The invention further discloses an alarm recovery and suppression device and equipment and a computer readable storage medium.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information system alarm monitoring, and particularly to a method, device, equipment and computer-readable storage medium for alarm recovery and suppression. Background Art

[0002] With the development of informatization, there are various business systems and application scenarios, and the setting methods of monitoring and alarm rules at all levels are numerous and complex. Every day, the system generates various alarms. For alarms triggered by the same monitoring and alarm rule, suppression notifications need to be carried out; otherwise, an alarm storm will occur. After the fault point is processed, the system can send an alarm recovery notification to inform relevant personnel that the alarm has disappeared.

[0003] The alarm storm has the greatest impact on the stability and processing efficiency of alarm management. When an alarm storm comes, the system will consume a large amount of resources, resulting in the system being slow to respond until it crashes. Therefore, if there is no effective processing method, the alarm storm may cause irreparable losses. In the prior art, in order to avoid alarm storms, alarms are generally issued according to the number of alarms or time periods, and then it is considered that no alarm rule is triggered means recovery, and a recovery notification is sent. However, this kind of suppression is not flexible enough and does not combine suppression with alarm recovery. Alarm recovery is also not accurate enough. For the normal index data generated during implementation, it may be applicable to some scenarios; however, for alarms such as abnormal keywords in the log, not generating abnormal keywords does not mean that the fault has been recovered.

[0004] In summary, how to solve the problems of the lack of linkage between alarm suppression and alarm recovery and the inaccurate definition of the logic of alarm recovery, and accurately and usefully notify alarms and recoveries to users has become an increasingly urgent problem to be solved. Summary of the Invention

[0005] The present invention provides a method, device, equipment and computer-readable storage medium for alarm recovery and suppression. By customizing the alarm recovery rule, accurate notification of alarm recovery is achieved. And through the definition of the suppression rule, the alarm information and the alarm recovery information are linked for detection, and effective alarms are notified to users.

[0006] On the first aspect, a method for alarm recovery and suppression is provided, comprising: real-time monitoring and collection of alarm information, judging a monitoring threshold according to pre-configured alarm monitoring rules, and generating a corresponding alarm when a characteristic value of triggering data of the alarm information is greater than the monitoring threshold, wherein the alarm includes an alarm time, an alarm name, an alarm host, and triggering data; when the alarm has been generated, triggering a corresponding recovery rule according to the name of the alarm, adding an alarm record according to the recovery rule, adding a recovery mark to the alarm record, marking it as recovered, and recording the recovery time ; After monitoring an alarm record marked as restored, retrieve the chronological relationship between the generation time and the recovery time of the alarm record on the timeline. If the generation time of the alarm record is later and there is no alarm record with the same type and name in front, the suppression rule is triggered, no alarm notification is generated, and an identifier is added to the alarm record, marking it as suppressed; otherwise, an identifier is added to the alarm record, marking it as unsuppressed; the alarm record identifiers are traversed according to a predetermined period, wherein, for the alarm record marked as suppressed, no alarm notification is generated; for the alarm record marked as unsuppressed, an alarm notification is generated to the user.

[0007] In some embodiments, generating an alarm to notify a user for an alarm record marked as unsuppressed includes: generating an alarm for an alarm record marked as unsuppressed and notifying the user via text message or email.

[0008] In some embodiments, it also includes: determining the number of suppression times for alarm records of the same type name, wherein the number of suppression times is used to characterize the number of times alarms of the type name are suppressed; when the number of suppression times is greater than or equal to the preset number of suppression times, based on the preset mark status and the information of the alarm host, generating prompt information of the alarm storm.

[0009] In some embodiments, if the generation time of the alarm record is later and there is no alarm record with the same type and name in front, the suppression rule is triggered, no alarm notification is generated, and an identifier is added to the alarm record, marking it as suppressed, including: determining the suppression time of the alarm record, wherein the suppression time is used to represent the time between the start of suppressing the alarm record and the current moment; when the suppression time is greater than the suppression time threshold, the alarm record is restored, the alarm record is unsuppressed, a recovery identifier is added to the alarm record, it is marked as restored, and the recovery time is recorded.

[0010] In some embodiments, the alarm monitoring rule is: perform detection according to a predetermined period, compare the characteristic value of the triggering data of the alarm information with the corresponding monitoring threshold, and decide whether to identify it as a corresponding alarm according to a predetermined judgment rule.

[0011] In some embodiments, the recovery rule is as follows: when an alarm has been generated, a corresponding threshold is triggered for detection, and it is determined whether to add a recovery flag according to a predetermined judgment rule.

[0012] In some embodiments, the suppression rule is as follows: determine whether the alarm record contains a recovered flag. If the alarm record contains a recovered flag, the suppression process ends; otherwise, compare the alarm time with the recovery time of the alarm records before the time line. If there is no previously recovered alarm record, suppression is performed.

[0013] In a second aspect, a device for alarm recovery and suppression is provided, including: an alarm monitoring module, configured to monitor and collect alarm information in real time, judge a monitoring threshold according to a pre-configured alarm monitoring rule, and generate a corresponding alarm when the characteristic value of the trigger data in the alarm information is greater than the monitoring threshold, where the alarm includes an alarm time, an alarm name, an alarm host, and trigger data; an alarm recovery module, configured to, when the alarm has been generated, trigger a corresponding recovery rule according to the name of the alarm, add an alarm record according to the recovery rule, add a recovery flag to the alarm record, mark it as recovered, and record the recovery time; an alarm suppression module, configured to, after detecting an alarm record marked as recovered, retrieve the sequence relationship between the generation time and the recovery time of the alarm record on the time line. If the generation time of the alarm record is later and there is no alarm record with the same type name in front, trigger the suppression rule, do not generate an alarm notification, and add a flag to the alarm record to mark it as suppressed; otherwise, add a flag to the alarm record to mark it as not suppressed; an alarm notification module, configured to traverse the alarm record flags at a predetermined period, where for the alarm records marked as suppressed, no alarm notification is generated; for the alarm records marked as not suppressed, an alarm notification is generated to notify the user.

[0014] In a third aspect, the present invention provides an electronic device, where the electronic device includes: a processor; a memory, on which computer-readable instructions are stored, and when the computer-readable instructions are executed by the processor, the method for alarm recovery and suppression described above is implemented.

[0015] In a fourth aspect, the present invention further provides a computer-readable storage medium, characterized in that program code is stored in the computer-readable storage medium, and the program code can be called by a processor to execute the method for alarm recovery and suppression described above.

[0016] Compared with the prior art, the present invention can at least achieve one of the following beneficial effects:

[0017] First, use the alarm recovery rule to distinguish the recovery conditions from the alarm conditions, and use the alarm suppression rule to identify the historical alarm records as the basis for the alarm suppression rule.

[0018] Second, the linkage between alarm suppression and alarm recovery realizes the suppression function of "only alarm once until the alarm is recovered and then alarm again".

[0019] The Summary of the Invention section is provided to introduce the selection of concepts in a simplified form, which will be further described in the detailed implementation below. The Summary of the Invention section is not intended to identify the important features or essential features of the present disclosure, nor is it intended to limit the scope of the present disclosure. Brief Description of the Drawings

[0020] By describing the exemplary embodiments of the present disclosure in more detail in conjunction with the accompanying drawings, the above and other objects, features, and advantages of the present disclosure will become more apparent, where in the exemplary embodiments of the present disclosure, the same reference numerals generally represent the same components.

[0021] Figure 1 Shows the flowchart of the method for alarm recovery and suppression provided by the embodiments of the present application;

[0022] Figure 2 Is the schematic block diagram of the device for alarm recovery and suppression provided by the embodiments of the present application;

[0023] Figure 3 Is the flowchart of the suppression logic of the method for alarm recovery and suppression provided by the embodiments of the present application;

[0024] Figure 4 Is the schematic structural diagram of an electronic device provided by the embodiments of the present application. Detailed Implementation Modes

[0025] The embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0026] The term "including" and its variations used herein mean open inclusion, that is, "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "at least partially based on". The term "an exemplary embodiment" and "an embodiment" mean "at least one exemplary embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc. may refer to different or the same objects. There may be other explicit and implicit definitions below.

[0027] The present disclosure aims to solve the following problems in the process of alarm recovery and suppression in the prior art: (1) The problem of inaccurate recovery notification: Since the business of the program is complex and alarms are from multiple aspects, for types such as abnormal keywords in the log layer, alarms are often triggered based on whether the abnormal keywords exceed the threshold. However, an abnormal keyword generally triggers only once, resulting in a fault, and no abnormal keyword will be generated during subsequent fault time. If it is considered that the fault has recovered because no abnormal keyword is generated, such a recovery notification is inaccurate. (2) The problem of ineffective alarm suppression: To avoid the generation of alarm storms, the monitoring system can often be set to suppress according to the number of alarms. For example, if the suppression count is set to 100 times, it means that alarm notifications are generated only for the 1st and 101st times, and no notifications are made for the 2nd to 100th times. The monitoring system can also be set to suppress according to time. For example, if the suppression time is set to 1 hour, it means that after an alarm is triggered and notified, if it is triggered again 1 hour later, an alarm notification will be made. However, this is not linked to alarm recovery. If a fault is triggered and then repaired, no alarm notification can be generated within the suppression count or time, and effective alarms cannot be notified to users.

[0028] The present application provides a method for alarm recovery and suppression. The method includes: real-time monitoring and collecting alarm information, judging the monitoring threshold according to pre-configured alarm monitoring rules, and generating corresponding alarms when the characteristic value of the trigger data of the alarm information is greater than the monitoring threshold, where the alarm includes alarm time, alarm name, alarm host, and trigger data; when the alarm has been generated, triggering corresponding recovery rules according to the name of the alarm, adding alarm records according to the recovery rules, adding a recovery identifier to the alarm records, marking them as recovered, and recording the recovery time; after detecting alarm records marked as recovered, retrieving the chronological order relationship between the generation time and the recovery time of the alarm records on the time line. If the generation time of the alarm record is later and there is no alarm record with the same type name in front, trigger the suppression rule, do not generate an alarm notification, and add an identifier to the alarm record, marking it as suppressed; otherwise, add an identifier to the alarm record, marking it as not suppressed; traversing the alarm record identifiers at a predetermined period, where alarm records marked as suppressed do not generate alarm notifications; alarm records marked as not suppressed generate alarm notifications to users.

[0029] Please refer to Figure 1 which is a schematic diagram of an embodiment of the present application. The following will be described in detail with reference to Figure 1 a method 100 for alarm recovery and suppression provided by an embodiment of the present application.

[0030] Step 102: Configure an alarm rule to monitor data and obtain alarm information that triggers a threshold. Specifically, judge the monitoring threshold according to a pre-configured alarm monitoring rule. When the characteristic value of the triggering data in the alarm information exceeds the range of the monitoring threshold, generate a corresponding alarm, where the alarm includes the alarm time, alarm name, alarm host, and triggering data.

[0031] Step 104: Detect the generation of alarm information and trigger a recovery rule to check the data to obtain recovery information. Specifically, when the alarm has been generated, trigger the corresponding recovery rule according to the name of the alarm, add an alarm record according to the recovery rule, add a recovery flag to the alarm record, mark it as recovered, and record the recovery time. For example: After detecting the generation of alarm information, trigger the corresponding recovery rule according to the rule name of the alarm to monitor the data in real time. If the recovery rule is triggered, then add a record with the identifier "recovered" and the recovery time according to the alarm information.

[0032] Step 106: Compare the recovery information with the alarm information on the timeline and trigger a suppression strategy to obtain an identifier indicating whether the alarm is suppressed. Specifically, after detecting an alarm record marked as recovered, retrieve the chronological order relationship between the generation time and the recovery time of the alarm record on the timeline. If the generation time of the alarm record is later and there is no alarm record with the same type name in front, then trigger the suppression rule, do not generate an alarm notification, and add an identifier to the alarm record, marking it as suppressed; otherwise, add an identifier to the alarm record, marking it as not suppressed. For example, after detecting the generation of an alarm information with "recovered", trigger the corresponding suppression rule according to the rule name of the alarm, and then retrieve the chronological relationship between the generation time of the alarm information and the generation time of the recovery on the timeline. If the time of the alarm information is later and there is no alarm information in front of the time, then trigger the suppression of this alarm and do not send an alarm notification; otherwise, do not trigger the suppression and send an alarm notification. Thus, the suppression logic of "an alarm is only alarmed once until the alarm is recovered and then alarmed again" is achieved. For example: At 2024-11-11 09:00:00, an alarm information is generated for 100. At 2024-11-11 09:00:10, an alarm is generated again for 100, and the recovery time is 2024-11-11 08:50:00 for 100. Then, the alarm generated at 2024-11-11 09:00:00 for 100 will send an alarm notification, while the alarm generated at 2024-11-11 09:00:10 for 100 will be alarm-suppressed and no notification will be sent. Add an identifier "suppressed" to the triggered suppressed alarm information, and add an identifier "not suppressed" to the un-triggered alarm information.

[0033] Step 108: Make a notification according to the flag indicating whether the alarm information is suppressed to obtain an alarm result. Specifically, traverse the alarm record flags at a predetermined period. Among them, for the alarm records marked as suppressed, no alarm notification is generated; for the alarm records marked as not suppressed, an alarm notification is generated to notify the user. For example, determine whether the flag indicating whether the alarm information is suppressed contains the flag "suppressed". If the alarm information contains the flag "suppressed", no alarm notification is made. If it contains the flag "not suppressed", an alarm notification is made. Determine whether the alarm information contains the flag "recovered". If it does, a recovery notification is made.

[0034] In some embodiments, for the alarm records marked as not suppressed, an alarm notification is generated to notify the user, including: for the alarm records marked as not suppressed, an alarm is generated and the user is notified by text message or email.

[0035] In some embodiments, it further includes: determining the suppression times for alarm records with the same type name, where the suppression times are used to represent the number of times the alarm of the type name is suppressed; in the case where the suppression times are greater than or equal to the preset suppression times, based on the preset marking status and the information of the alarm host, a prompt message for alarm storm is generated.

[0036] In some embodiments, if the generation time of the alarm record is later and there is no previous alarm record with the same type name, the suppression rule is triggered, no alarm notification is generated, and an identifier is added to the alarm record, marked as suppressed, including: determining the suppression time of the alarm record, where the suppression time is used to represent the time between the start of suppressing the alarm record and the current moment; in the case where the suppression time is greater than the suppression time threshold, the alarm record is restored, the suppression of the alarm record is lifted, a recovery identifier is added to the alarm record, marked as recovered, and the recovery time is recorded.

[0037] In some embodiments, the alarm monitoring rule is: detect at a predetermined period, compare the characteristic value of the trigger data of the alarm information with the corresponding monitoring threshold, and decide whether to recognize it as the corresponding alarm according to the predetermined judgment rule.

[0038] In some embodiments, the recovery rule is: in the case where an alarm has been generated, trigger the detection of the corresponding threshold, and decide whether to add a recovery identifier according to the predetermined judgment rule.

[0039] In some embodiments, the suppression rule is: judge whether the alarm record contains a recovered identifier. If the alarm record contains a recovered identifier, the suppression process ends; otherwise, compare the alarm time with the recovery time of the previous alarm record in the time line. If there is no previously recovered alarm record, suppression is performed.

[0040] Figure 2Schematic block diagram of device 200 for alarm recovery and suppression shown according to an exemplary embodiment. The device 200 for alarm recovery and suppression includes: an alarm monitoring module 202, an alarm recovery module 204, an alarm suppression module 206, and an alarm notification module 208, where:

[0041] The alarm monitoring module 202 is used to monitor and collect alarm information in real time, judge the monitoring threshold according to pre-configured alarm monitoring rules, and generate corresponding alarms when the characteristic value of the trigger data in the alarm information exceeds the monitoring threshold range. Among them, the alarm includes alarm time, alarm name, alarm host, and trigger data;

[0042] The alarm recovery module 204 is used to trigger corresponding recovery rules according to the name of the alarm when the alarm has been generated, add alarm records according to the recovery rules, add a recovery identifier to the alarm records, mark them as recovered, and record the recovery time;

[0043] The alarm suppression module 206 is used to retrieve the chronological order relationship between the generation time and the recovery time of the alarm record on the timeline after detecting an alarm record marked as recovered. If the generation time of the alarm record is later and there is no alarm record with the same type name in front, it triggers the suppression rule, does not generate an alarm notification, and adds an identifier to the alarm record, marking it as suppressed; otherwise, adds an identifier to the alarm record, marking it as not suppressed;

[0044] The alarm notification module 208 is used to traverse the alarm record identifiers at a predetermined period. Among them, for alarm records marked as suppressed, no alarm notification is generated; for alarm records marked as not suppressed, an alarm notification is generated to notify the user.

[0045] Figure 3 Flowchart showing the suppression logic of the method for alarm recovery and suppression, which realizes the linkage between alarm suppression and alarm recovery, realizes the suppression function of "only alarm once until the alarm is recovered and then alarm again", and enables the alarm notification to effectively notify the user, including the following steps:

[0046] Step 310: If an alarm information is generated, then start the execution of the suppression process.

[0047] Step 320: Judge whether the alarm information contains an identifier of "recovered".

[0048] Step 330: If the alarm information contains an identifier of "recovered", end the suppression process, and then send it to the notification template for alarm recovery notification.

[0049] Step 340: If the alarm message does not contain the identifier of "recovered", then compare the time of the alarm message event on the timeline with the time of the alarm recovery information.

[0050] Step 350: Compare the time of the alarm recovery before the timeline according to the time of the alarm message to judge the time size. If there is no recovered alarm before the time, it is false.

[0051] Step 360: If the time of the alarm message is less than the time of the alarm recovery, then perform alarm suppression, do not perform alarm notification, and the suppression process ends.

[0052] Step 370: If the alarm message event is greater than the time of the alarm recovery, then further judge whether there is other alarm information with a time less than the time of the alarm message within the time period between the alarm message and the alarm recovery. This is to determine whether it is the first alarm message after the alarm recovery.

[0053] Step 380: If within the time period between the alarm message and the alarm recovery, there is other alarm information, and the time of this alarm message is greater than the time of other alarm information, perform alarm suppression and do not perform alarm notification.

[0054] Step 390: If within the time period between the alarm message and the alarm recovery, there is no other alarm information, and the time of this alarm message is less than the time of other alarm information, perform alarm notification.

[0055] Figure 4 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. As Figure 4 shown, the electronic device 400 may include a processor 4001 and a memory 4002. Optionally, the electronic device 400 may further include a transceiver 4003. Among them, the processor 4001, the memory 4002, and the transceiver 4003 may be connected through a communication bus, for example. The memory 4002 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 4001, the steps of the method for alarm recovery and suppression as described above are implemented.

[0056] In a specific implementation, as an embodiment, the processor 4001 may include one or more CPUs, such as Figure 4 CPU0 and CPU1 shown in

[0057] In a specific implementation, as an embodiment, the electronic device 400 may also include multiple processors, such as Figure 4The processors 4001 and 4004 shown in []. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processors here can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0058] Among them, the memory 4002 is used to store the software program for implementing the solution of the present invention and is controlled by the processor 4001 for execution. The specific implementation manner can refer to the above method embodiments and will not be elaborated here.

[0059] The transceiver 4003 is used to communicate with network devices or terminal devices.

[0060] Optionally, the transceiver 4003 can include a receiver and a transmitter. Among them, the receiver is used to implement the receiving function, and the transmitter is used to implement the transmitting function.

[0061] Optionally, the transceiver 4003 can be integrated with the processor 4001 or exist independently and be coupled to the processor 4001 through the interface circuit of the electronic device 400. The embodiments of the present invention do not make specific limitations on this.

[0062] It should be noted that Figure 4 the structure of the electronic device 400 shown in [] does not constitute a limitation on the electronic device. The actual electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements. In addition, the technical effects of the electronic device 400 can refer to the technical effects of the above method embodiments and will not be elaborated here.

[0063] In an exemplary embodiment, the present invention also provides a computer-readable storage medium. At least one instruction is stored in the computer-readable storage medium, and the at least one instruction is loaded and executed by a processor to implement the steps of the method for alarm recovery and suppression as described above. For example, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0064] The embodiments of the present invention also provide an electronic device. The electronic device includes: a processor; a memory, and computer-readable instructions are stored on the memory. When the computer-readable instructions are executed by the processor, the method for alarm recovery and suppression as described above is implemented.

[0065] The embodiments of the present invention provide a computer-readable storage medium, characterized in that program code is stored in the computer-readable storage medium, and the program code can be called by a processor to execute the method for alarm recovery and suppression as described above.

[0066] It should also be understood that the memory in the embodiments of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchlink dynamic random access memory (SLDRAM), and direct rambus random access memory (DR RAM).

[0067] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware, or any combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present invention are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired (such as infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that contains one or more collections of available media. The available medium can be a magnetic medium (such as a floppy disk, hard disk, or magnetic tape), an optical medium (such as a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0068] It should be understood that the term "and / or" in this document is merely a description of the association relationship between associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. Here, A and B can be singular or plural. In addition, the character " / " in this document generally represents an "or" relationship between the associated objects before and after, but it may also represent an "and / or" relationship, which can be specifically understood with reference to the context before and after.

[0069] In the present invention, "at least one" means one or more, and "a plurality" means two or more. "At least one of the following" or its similar expressions refer to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, a - b, a - c, b - c, or a - b - c, where a, b, and c can be single or multiple.

[0070] It should be understood that in various embodiments of the present invention, the magnitudes of the sequence numbers of the above processes do not mean the order of execution is prior or subsequent. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

[0071] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0072] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the devices, apparatuses, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be described herein again.

[0073] In several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of the devices or units can be in an electrical, mechanical, or other form.

[0074] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they can be located in one place, or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0075] In addition, the functional units in each embodiment of the present invention can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit.

[0076] When the above-mentioned functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs.

[0077] The embodiments of the present disclosure have been described above. The above description is exemplary and not exhaustive, and is also not limited to the disclosed embodiments. Many modifications and variations are obvious to those of ordinary skill in the art in the technical field without departing from the scope and spirit of the described embodiments. The selection of the terms used herein is intended to best explain the principles of the embodiments, the practical application, or the technical improvement of the technology in the market, or to enable other ordinary skill in the art in the technical field to understand the embodiments disclosed herein.

Claims

1. A method for alarm recovery and suppression, characterized in that, include: Monitor and collect alarm information in real time, determine the monitoring threshold according to pre-configured alarm monitoring rules, and generate a corresponding alarm when the characteristic value of the triggering data of the alarm information exceeds the monitoring threshold range, wherein the alarm includes the alarm time, alarm name, alarm host, and triggering data; In the case where the alarm has been generated, triggering a corresponding recovery rule according to the name of the alarm, adding an alarm record according to the recovery rule, adding a recovery mark to the alarm record, marking it as recovered, and recording the recovery time; After detecting an alarm record marked as restored, the order of the generation time and the restoration time of the alarm record on the timeline is retrieved. If the generation time of the alarm record is later and there is no alarm record with the same type and name before it, the suppression rule is triggered, no alarm notification is generated, and a mark is added to the alarm record, marking it as suppressed; otherwise, a mark is added to the alarm record, marking it as not suppressed; The alarm record identifiers are traversed according to a predetermined period, wherein the alarm records marked as suppressed do not generate an alarm notification; the alarm records marked as unsuppressed generate an alarm notification to the user.

2. The method for alarm recovery and suppression according to claim 1, characterized in that Alarm records marked as unsuppressed generate alarm notifications to users, including: Alarm records marked as unsuppressed generate alarms and notify users via SMS or email.

3. The method for alarm recovery and suppression according to claim 1, characterized in that Also includes: Determine a suppression count for alarm records of the same type name, wherein the suppression count is used to represent the number of times the alarm of the type name is suppressed; When the suppression times are greater than or equal to the preset suppression times, prompt information of an alarm storm is generated based on a preset marking state and information of the alarm host.

4. The method for alarm recovery and suppression according to claim 1, wherein If the alarm record is generated later and there is no previous alarm record of the same type and name, the suppression rule is triggered, no alarm notification is generated, and a flag is added to the alarm record, marking it as suppressed, including: Determining a suppression time of the alarm record, wherein the suppression time is used to represent a time from the start of suppressing the alarm record to the current moment; In the case that the suppression time is greater than the suppression time threshold, the alarm record is restored, the suppression of the alarm record is released, a restoration mark is added to the alarm record, the record is marked as restored, and the restoration time is recorded.

5. The method for alarm recovery and suppression according to any one of claims 1 to 4, characterized in that: The alarm monitoring rule is: perform detection according to a predetermined period, compare the characteristic value of the triggering data of the alarm information with the corresponding monitoring threshold, and decide whether to identify it as a corresponding alarm according to a predetermined judgment rule.

6. The method for alarm recovery and suppression according to claim 5, characterized in that: The recovery rule is: when an alarm has been generated, a corresponding threshold is triggered for detection, and whether to add a recovery mark is determined according to a predetermined judgment rule.

7. The method for alarm recovery and suppression according to claim 6, characterized in that: The suppression rule is: judging whether the alarm record contains a restored flag, and if the alarm record contains a restored flag, ending the suppression process; Otherwise, compare the alarm time with the recovery time of the alarm records before the time line. If there are no previously recovered alarm records, suppression is performed.

8. An apparatus for alarm recovery and suppression, characterized in that, Including: An alarm monitoring module, configured to monitor and collect alarm information in real time, judge the monitoring threshold according to pre-configured alarm monitoring rules, and generate corresponding alarms when the characteristic value of the trigger data of the alarm information exceeds the monitoring threshold range. Wherein, the alarm includes an alarm time, an alarm name, an alarm host, and trigger data; An alarm recovery module, configured to, when the alarm has been generated, trigger a corresponding recovery rule according to the name of the alarm, add an alarm record according to the recovery rule, add a recovery identifier to the alarm record, mark it as recovered, and record the recovery time; An alarm suppression module, configured to, after detecting an alarm record marked as recovered, retrieve the sequence relationship between the generation time and the recovery time of the alarm record on the time line. If the generation time of the alarm record is later and there is no alarm record with the same type name in front, trigger the suppression rule, do not generate an alarm notification, and add an identifier to the alarm record to mark it as suppressed; otherwise, add an identifier to the alarm record to mark it as not suppressed; An alarm notification module, configured to traverse the alarm record identifiers at a predetermined period. Among them, for the alarm records marked as suppressed, no alarm notification is generated; for the alarm records marked as not suppressed, an alarm notification is generated to notify the user.

9. An electronic device, characterized in that, The electronic device includes: A processor; A memory, on which computer-readable instructions are stored. When the computer-readable instructions are executed by the processor, the method for alarm recovery and suppression according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium, characterized in that, Program code is stored in the computer-readable storage medium, and the program code can be called by the processor to execute the method for alarm recovery and suppression according to any one of claims 1 to 4.

Images