Alarm diagnosis processing method and device, terminal equipment and program product

Abstract

The invention is suitable for the technical field of computers, and provides an alarm diagnosis processing method and device, terminal equipment and a program product, and the method comprises the steps: generating a to-be-processed alarm event for target equipment in response to triggering, and obtaining equipment operation data of the target equipment based on the to-be-processed alarm event; analyzing the equipment operation data to obtain a first diagnosis result of the target equipment; if the first diagnosis result shows that the to-be-processed alarm event is not the preset alarm event, generating a second diagnosis result of the target equipment according to alarm reference data associated with the to-be-processed alarm event and the equipment operation data; and displaying processing prompt information based on the second diagnosis result to prompt a user to solve the to-be-processed alarm event of the target equipment based on the processing prompt information. According to the method, the to-be-processed alarm event of the target equipment is solved through the alarm reference data, the accuracy of alarm diagnosis processing is improved, and normal operation of the target equipment is guaranteed to a certain extent.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular relates to an alarm diagnosis and processing method, apparatus, terminal equipment, and program product. Background Art

[0002] With the rapid development of information technology, the scale and complexity of modern equipment continues to rise, encompassing multiple levels, including network architecture, software applications, and hardware facilities. Within such a large and complex system, various components of modern equipment are interdependent and work together. However, during long-term operation, due to physical wear, component aging, and environmental factors, various potential failures are prone to occur, thereby triggering alarms.

[0003] Alarms, as a barometer of equipment operational status, signal the first signs of a problem. Failure to accurately diagnose and address these alarms not only wastes significant time and effort for operations personnel, but can also lead to continued failures, resulting in serious consequences such as business interruptions and data loss. Therefore, improving the accuracy of alarm diagnosis and processing is a pressing issue. Summary of the Invention

[0004] The embodiments of the present application provide an alarm diagnosis and processing method, apparatus, terminal device, and program product, which can improve the accuracy of alarm diagnosis and processing and ensure the normal operation of the target device to a certain extent.

[0005] In a first aspect, an embodiment of the present application provides an alarm diagnosis and processing method, comprising:

[0006] In response to the trigger, a pending alarm event is generated for the target device, and device operation data of the target device is obtained based on the pending alarm event;

[0007] Parsing the device operation data to obtain a first diagnostic result of the target device, wherein the first diagnostic result at least indicates whether the alarm event to be processed is a preset alarm event;

[0008] If the first diagnosis result indicates that the alarm event to be processed is not a preset alarm event, generating a second diagnosis result of the target device based on the alarm reference data associated with the alarm event to be processed and the device operation data;

[0009] Processing prompt information is displayed based on the second diagnosis result to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0010] In a possible implementation of the first aspect, generating a second diagnostic result of the target device according to alarm reference data associated with the alarm event to be processed and the device operation data includes:

[0011] Query alarm reference data associated with the alarm event to be processed and the equipment operation data, the alarm reference data including target alarm knowledge data and / or Internet alarm data;

[0012] Using a preset large model to process the alarm event to be processed, the equipment operation data, and the alarm reference data to obtain processing result data, wherein the preset large model is obtained by training a neural network model based on training data, and the training data includes at least one of the training alarm event, the training operation data, and the training reference data;

[0013] A second diagnosis result of the target device is determined based on the processing result data.

[0014] In a possible implementation of the first aspect, the alarm reference data includes target alarm knowledge data, and querying the alarm reference data associated with the alarm event to be processed and the device operation data includes:

[0015] Acquire a pre-configured alarm knowledge database, wherein the alarm knowledge database stores a plurality of preset alarm knowledge data for performing alarm diagnosis;

[0016] The preset alarm knowledge data associated with the alarm event to be processed and the equipment operation data in the alarm knowledge database is determined as the target alarm knowledge data.

[0017] In a possible implementation of the first aspect, determining a second diagnosis result of the target device based on the processing result data includes:

[0018] If the processing result data indicates that data still needs to be queried for alarm diagnosis, then return to the step of querying alarm reference data associated with the alarm event to be processed and the equipment operation data, wherein the alarm reference data includes Internet alarm data, until the processing result data does not indicate that data still needs to be queried for alarm diagnosis;

[0019] The processed result data is determined as a second diagnosis result of the target device.

[0020] In a possible implementation of the first aspect, the alarm reference data includes Internet alarm data, and querying the alarm reference data associated with the to-be-processed alarm event and the device operation data includes:

[0021] Perform field extraction on the alarm events to be processed and the equipment operation data to obtain the target alarm fields;

[0022] Search the target alarm field on the Internet to obtain Internet alarm data.

[0023] In a possible implementation of the first aspect, a preset large model is used to process the alarm event to be processed, the device operation data, and the alarm reference data to obtain processing result data, including:

[0024] Generate alarm prompt words based on pending alarm events, equipment operation data and alarm reference data;

[0025] Input the alarm prompt words into the preset large model to obtain the processing result data.

[0026] In a possible implementation of the first aspect, the second diagnostic result includes program data, and the processing prompt information includes authorization request information for the program data, where the authorization request information is used to request the user to authorize the program data;

[0027] Based on the second diagnosis result, processing prompt information is displayed, including:

[0028] If the second diagnosis result includes program data, displaying authorization request information for the program data;

[0029] When the user's authorization response information for the program data is received, the program data is executed to resolve the pending alarm event of the target device.

[0030] In a possible implementation of the first aspect, the second diagnostic result includes troubleshooting data, and displaying processing prompt information based on the second diagnostic result includes:

[0031] If the second diagnostic result includes troubleshooting data, processing prompt information corresponding to the troubleshooting data is displayed to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0032] In a possible implementation of the first aspect, the first diagnostic result further includes: processing operation data corresponding to a preset alarm event. After parsing the device operation data to obtain the first diagnostic result for the target device, the method further includes:

[0033] If the first diagnosis result indicates that the alarm event to be processed is a preset alarm event, an operation corresponding to the processing operation data is performed on the target device to resolve the alarm event to be processed of the target device.

[0034] In a second aspect, an embodiment of the present application provides an alarm diagnosis and processing device, comprising:

[0035] an acquisition module, configured to generate a pending alarm event for a target device in response to a trigger, and acquire device operation data of the target device based on the pending alarm event;

[0036] An analysis module is used to analyze the device operation data to obtain a first diagnosis result of the target device, wherein the first diagnosis result at least indicates whether the alarm event to be processed is a preset alarm event;

[0037] a generating module configured to generate a second diagnostic result for the target device based on alarm reference data associated with the alarm event to be processed and the device operation data if the first diagnostic result indicates that the alarm event to be processed is not a preset alarm event;

[0038] The display module is configured to display processing prompt information based on the second diagnosis result, so as to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0039] In a third aspect, an embodiment of the present application provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the methods of the first aspect when executing the computer program.

[0040] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method of any one of the first aspects.

[0041] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute any one of the methods in the first aspect above.

[0042] The present invention provides an alarm diagnosis and processing method, apparatus, terminal device, and program product, the method comprising: generating a pending alarm event for a target device in response to a trigger, obtaining device operation data of the target device based on the pending alarm event; parsing the device operation data to obtain a first diagnostic result for the target device, wherein the first diagnostic result at least indicates whether the pending alarm event is a preset alarm event; if the first diagnostic result indicates that the pending alarm event is not a preset alarm event, generating a second diagnostic result for the target device based on alarm reference data associated with the pending alarm event and the device operation data; and displaying processing prompt information based on the second diagnostic result to prompt a user to resolve the pending alarm event of the target device based on the processing prompt information. Utilizing the above technical solution, by parsing the device operation data of the target device, and if the first diagnostic result indicates that the pending alarm event is not a preset alarm event, resolving the pending alarm event of the target device based on the alarm reference data associated with the pending alarm event and the device operation data, the accuracy of the alarm diagnosis processing is improved, and the normal operation of the target device is guaranteed to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0044] Figure 1 This is a flowchart of an alarm diagnosis and processing method provided by an embodiment of the present application;

[0045] Figure 2 This is a flowchart of an alarm diagnosis and processing method provided by another embodiment of the present application;

[0046] Figure 3 This is a schematic diagram of the overall architecture of an alarm diagnosis and processing method provided by another embodiment of the present application;

[0047] Figure 4 This is a structural block diagram of an alarm diagnosis and processing device provided by an embodiment of the present application;

[0048] Figure 5 This is a structural diagram of a terminal device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0049] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0050] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0051] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0052] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0053] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0054] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0055] Figure 1 This is a flowchart of an alarm diagnosis and processing method provided by an embodiment of the present application. As an example and not a limitation, the method can be applied to terminal devices, such as Figure 1 As shown, the method includes:

[0056] S101: In response to a trigger, generate a pending alarm event for a target device, and obtain device operation data of the target device based on the pending alarm event.

[0057] Pending alarm events can be considered alarm events generated during the monitoring of a target device based on abnormal data from the target device. These can include simple alarm information, such as the alarm name, alarm trigger time, and alarm content explanation. Device operation data refers to monitoring data related to the target device's operation, such as the target device's status data, performance indicators, and related operation logs.

[0058] This embodiment automatically resolves pending alarm events by performing a series of analyses on the target device's pending alarm events, achieving the goal of rapidly resolving alarms. For example, upon receiving a pending alarm event for a target device, the terminal device can respond to the pending alarm event by acquiring device operating data for the target device, thereby performing subsequent alarm diagnosis and processing based on the device operating data.

[0059] This embodiment does not limit the relationship between the terminal device and the target device. For example, the terminal device can be a monitoring device that monitors the target device, and the target device can be any physical device that is in communication with the monitoring device. The terminal device can also be any independent physical device, and the target device can be a component configured in the terminal device. Alternatively, the terminal device and the target device can have other associations, as long as the terminal device can monitor and process the target device. For example, if the terminal device can be a personal computer, the target device can be a router device connected to the personal computer; if the terminal device can be a computing system, the target device can be the central processing unit of a host in the computing system. Accordingly, the method for obtaining device operation data in this embodiment can be determined based on the actual situation between the terminal device and the target device.

[0060] S102: Analyze the device operation data to obtain a first diagnosis result of the target device.

[0061] The first diagnosis result at least indicates whether the alarm event to be processed is a preset alarm event.

[0062] The preset alarm events can be alarm events in a pre-set pre-authorization library. For example, users can pre-authorize common alarm events that can be automated and establish a pre-authorization library. The pre-authorization library stores regular alarm events that have been pre-authorized by users. The pre-authorization library can be maintained by users according to their needs. Regular alarm events can include router alarm exception events, etc.

[0063] After obtaining the device operation data of the target device, this step can parse the device operation data. The first diagnostic result after analysis can include generating an analysis report, determining whether the current alarm event is a common alarm, etc., so that different processing operations can be taken according to different first diagnostic results.

[0064] As an example, the first diagnostic result further includes: processing operation data corresponding to a preset alarm event. After parsing the device operation data to obtain the first diagnostic result of the target device, the method further includes:

[0065] If the first diagnosis result indicates that the alarm event to be processed is a preset alarm event, an operation corresponding to the processing operation data is performed on the target device to resolve the alarm event to be processed of the target device.

[0066] In a specific embodiment, if the pending alarm event is one of the alarms in the pre-authorization library, that is, the pending alarm event is a preset alarm event, the first diagnostic result may also include processing operation data corresponding to the preset alarm event. The processing operation data can be used to represent the automated operation required for the preset alarm event. In this case, the terminal device can directly execute the corresponding automated operation without requesting user authorization, such as executing the operation corresponding to the processing operation data on the target device to resolve the pending alarm event of the target device. The specific content of the processing operation data is confirmed for different services and fault events. For example, when a router fails, if the device operation data is parsed and the alarm event is determined to be a common alarm (such as numbered c1), and the alarm event is one of the alarms in the common alarm pre-authorization library, it indicates that the alarm event has been pre-authorized by the user and can be directly automated. The terminal device can then directly perform the corresponding automated operation: restarting the router. On this basis, common alarms can be automatically resolved, achieving the purpose of quickly resolving alarms.

[0067] S103: If the first diagnosis result indicates that the alarm event to be processed is not a preset alarm event, generate a second diagnosis result of the target device according to alarm reference data associated with the alarm event to be processed and the device operation data.

[0068] Alarm reference data can be understood as data that needs to be further combined with reference data based on the equipment operation data. This embodiment does not limit the content and source of the alarm reference data. For example, the specific content can be associated with the alarm event to be processed and the equipment operation data, and at the same time can further improve the success rate of alarm resolution. The second diagnosis result can refer to the result obtained by the secondary diagnosis of the alarm event to be processed.

[0069] In a specific implementation, if the first diagnostic result indicates that the alarm event to be processed is not a preset alarm event, it means that the alarm event to be processed is not one of the alarms in the pre-authorization library, and the user has not pre-authorized the alarm event to be processed. That is, this processing requires the user to authorize the alarm event to be processed. At the same time, the terminal device can generate a second diagnostic result for the target device based on the alarm reference data associated with the alarm event to be processed and the device operation data. The specific process of generating the second diagnostic result is not limited. For example, this embodiment can directly analyze based on the alarm reference data to obtain the second diagnostic result of the target device, or it can comprehensively obtain the second diagnostic result of the target device based on the alarm reference data, the alarm event to be processed and the device operation data. Alternatively, on the basis of the preliminary second diagnostic result, it can be determined whether to continue the analysis to obtain the final second diagnostic result based on the specific content of the second diagnostic result. The alarm reference data in each analysis process can be the same or different, and can be configured according to actual needs. This embodiment does not limit this. Furthermore, this embodiment does not limit the specific analysis means for obtaining the second diagnostic result. For example, the second diagnostic result of the target device can be directly output through a preset large model, or the second diagnostic result of the target device can be obtained by performing corresponding comparison or calculation on the alarm reference data, and so on.

[0070] S104: Display processing prompt information based on the second diagnosis result to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0071] In this step, different contents of the processing prompt information may be displayed according to different second diagnostic results.

[0072] As a possible implementation, the second diagnosis result includes program data, and the processing prompt information includes authorization request information of the program data, where the authorization request information is used to request the user to authorize the program data;

[0073] Based on the second diagnosis result, processing prompt information is displayed, including:

[0074] If the second diagnosis result includes program data, displaying authorization request information for the program data;

[0075] When the user's authorization response information for the program data is received, the program data is executed to resolve the pending alarm event of the target device.

[0076] The authorization response information is the user's response information to the authorization request information, which is used to indicate the user's consent to authorize the program data.

[0077] It can be considered that for alarm events that can be directly resolved, the second diagnostic result can generate an alarm resolution program (i.e., program data). Accordingly, the processing prompt information may include authorization request information requesting the user to authorize the program data. For example, the authorization request information of the program data can be displayed on the display panel of the terminal device to request user authorization. When the user's authorization response information for the program data is obtained, the alarm resolution program can be executed, thereby resolving the pending alarm event of the target device.

[0078] As a possible implementation, the second diagnostic result includes troubleshooting data, and processing prompt information is displayed based on the second diagnostic result, including:

[0079] If the second diagnostic result includes troubleshooting data, processing prompt information corresponding to the troubleshooting data is displayed to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0080] It can be considered that for alarm events that cannot be directly resolved, the second diagnostic result may include troubleshooting data, which may include troubleshooting steps or suggestions. On this basis, by displaying processing prompt information corresponding to the troubleshooting data, users can be provided with feasible solutions to the pending alarm event, thereby achieving the purpose of quickly resolving the alarm.

[0081] This embodiment provides an alarm diagnosis and processing method. In response to a trigger generating a pending alarm event for a target device, the method obtains device operating data of the target device based on the pending alarm event; analyzes the device operating data to obtain a first diagnostic result for the target device, wherein the first diagnostic result at least indicates whether the pending alarm event is a preset alarm event; if the first diagnostic result indicates that the pending alarm event is not a preset alarm event, the method generates a second diagnostic result for the target device based on alarm reference data associated with the pending alarm event and the device operating data; and displays processing prompt information based on the second diagnostic result to prompt a user to resolve the pending alarm event of the target device based on the processing prompt information. Using this method, by analyzing the device operating data of the target device and, if the first diagnostic result indicates that the pending alarm event is not a preset alarm event, resolving the pending alarm event of the target device based on the alarm reference data associated with the pending alarm event and the device operating data, the accuracy of the alarm diagnosis processing is improved, ensuring the normal operation of the target device to a certain extent.

[0082] Figure 2This is a flow chart of an alarm diagnosis and processing method provided by another embodiment of the present application. This embodiment will further optimize the generation of the second diagnostic result of the target device based on the alarm reference data associated with the alarm event to be processed and the equipment operation data as follows: query the alarm reference data associated with the alarm event to be processed and the equipment operation data, the alarm reference data includes target alarm knowledge data and / or Internet alarm data; use a preset large model to process the alarm event to be processed, the equipment operation data and the alarm reference data to obtain processing result data, wherein the preset large model is obtained by training a neural network model based on training data, and the training data includes at least one of training alarm events, training operation data and training reference data; determine the second diagnostic result of the target device based on the processing result data. Figure 2 As shown, the method includes:

[0083] S201: In response to a trigger, generate a pending alarm event for a target device, and obtain device operation data of the target device based on the pending alarm event.

[0084] S202: Analyze the device operation data to obtain a first diagnosis result of the target device.

[0085] S203: If the first diagnosis result indicates that the alarm event to be processed is not a preset alarm event, query alarm reference data associated with the alarm event to be processed and the equipment operation data.

[0086] Among them, the alarm reference data includes target alarm knowledge data and / or Internet alarm data. The target alarm knowledge data can be derived from the alarm knowledge database. The alarm knowledge database can store multiple preset alarm knowledge data for alarm diagnosis. The alarm knowledge database can be understood as an expert knowledge base that has been manually sorted after screening and verification. The stored preset alarm knowledge data can include standard operating procedures (SOPs) for resolving alarms, alarm-related knowledge, etc., to ensure the validity of the alarm knowledge base content; the storage carrier of the alarm knowledge database can be selected according to the business type, such as it can include a vector database, a graph database, etc.

[0087] Internet alarm data may originate from the Internet. Internet alarm data may be considered as alarm data on the Internet that is associated with pending alarm events and equipment operation data.

[0088] In this embodiment, the query means corresponding to different alarm reference data may be the same or different.

[0089] As a possible implementation method, the alarm reference data may include target alarm knowledge data. Accordingly, the process of querying the alarm reference data associated with the alarm events to be processed and the equipment operation data may further include: first obtaining the pre-configured alarm knowledge database, and by querying the alarm knowledge database, determining the preset alarm knowledge data associated with the alarm events to be processed and the equipment operation data in the alarm knowledge database as the target alarm knowledge data. For example, the alarm events to be processed and the equipment operation data may be used to search in the alarm knowledge database, thereby determining the returned preset alarm knowledge data as the target alarm knowledge data.

[0090] As another possible implementation, the alarm reference data may include internet alarm data. Accordingly, the process of querying the alarm reference data associated with the pending alarm event and the device operation data may further include: performing a field extraction operation on the pending alarm event and the device operation data to obtain a target alarm field. The target alarm field can be understood as a keyword field in the pending alarm event and the device operation data. The target alarm field can then be searched on the internet to obtain the internet alarm data. The internet search may include a search engine and a specific URL search. The specific URL may be the official website homepage of the target device, a GitHub community, etc. The specific application programming interface (API) for accessing the internet can be adjusted according to the alarm content.

[0091] S204: Use a preset large model to process the alarm event to be processed, the equipment operation data and the alarm reference data to obtain processing result data.

[0092] The preset large model is obtained by training a neural network model based on training data, and the training data includes at least one of training alarm events, training operation data and training reference data.

[0093] In this embodiment, the preset large model can process and integrate various types of data, including alarm data from different monitoring systems, different devices and different network nodes, as well as related logs, performance indicators and other information, so that the preset large model has powerful pattern recognition capabilities, can learn and identify complex patterns and correlations in alarm data, discover the temporal relationships, spatial relationships and logical relationships between alarms, and accurately determine which alarms are interrelated and which are isolated, and then accurately classify and locate the alarms, and analyze the corresponding alarm solutions.

[0094] Optionally, the preset large model may be a large language model (LLM), such as a deep learning model trained using a large amount of text data. This model can generate natural language text or understand the meaning of language text. Its core concept is to learn the patterns and structure of natural language through large-scale unsupervised training, simulating the human language cognition and generation process to a certain extent. The large amount of text data may include one or more of training alarm events, training operation data, and training reference data.

[0095] The processing result data may be the processing result output by the preset large model, and the specific content may be determined based on whether the current data can resolve the alarm event to be processed.

[0096] In a specific implementation, the process of using the preset large model for processing is not limited. For example, alarm prompt words can be generated based on the alarm events to be processed, equipment operation data and alarm reference data, and the generated alarm prompt words are used as the input of the preset large model, that is, the alarm prompt words are input into the preset large model to obtain the processing result data; the corresponding processing result data can also be obtained through other methods, etc.

[0097] S205: Determine a second diagnosis result of the target device based on the processing result data.

[0098] After obtaining the processing result data output by the preset large model through the above steps, the second diagnostic result of the target device can be determined. For example, the processing result data can be directly used as the second diagnostic result of the target device, or the final second diagnostic result of the target device can be determined based on the different content of the processing result data. If the processing result data includes alarm solutions, such as program data or troubleshooting data, it means that the current data is sufficient to support the solution of the alarm event to be processed, then the processing result data can be directly used as the second diagnostic result of the target device; if the processing result data includes other data in addition to the alarm solution, then the second diagnostic result of the target device can be determined by other means.

[0099] Alternatively, this embodiment can continue to query different alarm reference data regardless of the content of the current processing result data, and process it according to the preset large model to obtain the next processing result data, and determine the final second diagnostic result by comparing the current processing result data and the next processing result data.

[0100] As a possible implementation, determining a second diagnosis result of the target device based on the processing result data includes:

[0101] If the processing result data indicates that data still needs to be queried for alarm diagnosis, then return to the step of querying alarm reference data associated with the alarm event to be processed and the equipment operation data, wherein the alarm reference data includes Internet alarm data, until the processing result data does not indicate that data still needs to be queried for alarm diagnosis;

[0102] The processed result data is determined as a second diagnosis result of the target device.

[0103] In a specific implementation, when a preset large model is used to process the alarm event to be processed, the equipment operation data and the target alarm knowledge data, and the processing result data is obtained, if the processing result data includes an alarm solution, it means that the target alarm knowledge data is sufficient to support the solution of the alarm event to be processed, then the obtained processing result data can be directly used as the second diagnostic result of the target device; if the processing result data indicates that data query is still needed for alarm diagnosis, it means that the target alarm knowledge data is insufficient to support the solution of the alarm event to be processed, and further supplementary data is needed for analysis, then the step of querying the alarm reference data associated with the alarm event to be processed and the equipment operation data can be returned to obtain the Internet alarm data, and continue to process according to the Internet alarm data and the preset large model, that is, the preset large model is used to process the alarm event to be processed, the equipment operation data and the Internet alarm data to obtain the processing result data, and finally the processing result data corresponding to the Internet alarm data can be determined as the second diagnostic result of the target device.

[0104] S206: Display processing prompt information based on the second diagnosis result to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0105] This embodiment provides an alarm diagnosis and processing method, which uses a preset large model to process the alarm events to be processed, equipment operation data and alarm reference data to obtain processing result data, thereby providing an accurate data basis for determining the second diagnostic result of the target device and further improving the accuracy of the alarm diagnosis processing.

[0106] Figure 3 This is a schematic diagram of the overall architecture of an alarm diagnosis and processing method provided by another embodiment of the present application. Figure 3As shown, step 1: First, the terminal device can receive alarm information (i.e., the alarm event to be processed), pass the alarm information to the large model (i.e., the preset large model) for analysis, and record the device status snapshot corresponding to the alarm. For example, for a specific alarm i_th, the device status snapshot before optimization (such as snapshot a) and the device status snapshot after optimization (such as snapshot b) can be saved to achieve rapid comparison of device status. Among them, the composition of the large model module can be divided into a single large model and multiple large models. A single large model means that a single large model handles all tasks; multiple large models means that multiple large models work together to process.

[0107] Taking the alarm information of the high CPU usage event as an example, the corresponding alarm information may include the alarm target object, the monitoring task ID, the task name, etc., as shown in Table 1.

[0108] Table 1 Alarm information

[0109]

[0110]

[0111] Step 2: The large model can parse the alarm information and request to obtain the alarm-related data of the CPU occupied on the 129 host (that is, obtain the device operation data of the target device based on the pending alarm event).

[0112] Step 3: Based on the request from the large model, CPU alarm-related data can be extracted from the database or log and returned to the large model. The alarm-related data can be as shown in Table 2, including user name USER, process identifier (PID), CPU usage, start time, command COMMAND, etc.

[0113] Table 2 Alarm related data

[0114]

[0115] Step 4: The large model can analyze the alarm-related data, generate an analysis report, and determine whether the alarm information is a common alarm (that is, analyze the device operation data to obtain the first diagnostic result of the target device, wherein the first diagnostic result at least indicates whether the alarm event to be processed is a preset alarm event). If it is a common alarm, the corresponding automated operation can be directly executed (such as operation 1 and operation 2, that is, executing the operation corresponding to the processing operation data on the target device to resolve the target device's pending alarm event), and record the optimized device status snapshot; if it is not a common alarm, it can be considered that the alarm information is an alarm that requires authorization, and the analysis report will be sent to the user to request user authorization.

[0116] Step 5: After viewing the report, the user can issue an authorization instruction to the large model. Conversely, the user can also refuse authorization, and subsequent processing operations will not be performed.

[0117] Step 6: After the large model processes the alarm information and alarm-related data, it can be searched in the expert knowledge base to obtain the data returned after the search, such as the current data {alarm information, related data, user instructions} can be searched in the expert knowledge base to return the expert knowledge data {alarm information, related data, user instructions, solutions (actions or suggestions)} (that is, obtaining a pre-configured alarm knowledge database, the alarm knowledge database stores multiple preset alarm knowledge data for alarm diagnosis; the preset alarm knowledge data associated with the alarm event to be processed and the equipment operation data in the alarm knowledge database is determined as the target alarm knowledge data); then the expert knowledge data returned by the expert knowledge base is input into the large model as reference data (that is, the preset large model is used to process the alarm event to be processed, the equipment operation data and the alarm The big model can verify whether the returned expert knowledge data can support the generation of solutions, such as constructing judgment prompt words from the current data and reference data as the input of the big model, and using the big model to judge whether the current data and reference data can solve the current alarm information; exemplarily, the judgment prompt words may include "You are an intelligent assistant for alarm resolution. Now you need to analyze the alarm information and related data, and combine the reference data to generate an alarm solution according to the user's instructions. The generated results are given in markdown format. At the same time, if the reference data can help generate a solution, please generate the corresponding alarm solution; if the reference data cannot help generate a solution, please reply that additional data is needed." Inputting the judgment prompt words into the big model can output the generated results.

[0118] Step 7: You can make a judgment based on the response generated by the large model, such as whether additional data is needed. For example, if the response generated by the large model includes an alarm solution (such as generating an action or suggestion), it means that the returned expert knowledge data is sufficient to support the generation of a solution, and step 10 can be implemented; if the response generated by the large model is {supplementary data is required}, it means that the returned expert knowledge data is insufficient to support the generation of a solution, and additional data is currently needed for subsequent analysis, and step 8 can be implemented.

[0119] Step 8: If additional data is required, relevant Internet data can be obtained on the Internet (i.e., if the processing result data indicates that data query is still needed for alarm diagnosis, then return to the step of querying the alarm reference data associated with the alarm event to be processed and the equipment operation data, wherein the alarm reference data includes Internet alarm data; perform field extraction operations on the alarm event to be processed and the equipment operation data to obtain the target alarm field; search the target alarm field on the Internet to obtain Internet alarm data).

[0120] Step 9: After data cleaning, the data obtained from the Internet can be sent to the big model as incremental data. With {alarm information, alarm-related data, incremental data} as input, the big model can generate the final solution.

[0121] Step 10: Solutions can include two types: suggestions and actions. For alarms that cannot be directly resolved, the final solution may include troubleshooting steps or suggestions for manual troubleshooting (i.e., if the second diagnostic result includes troubleshooting data, the corresponding processing prompt information of the troubleshooting data is displayed to prompt the user to resolve the pending alarm events of the target device based on the processing prompt information); for alarms that can be directly resolved, the large model can generate an action (i.e., an alarm resolution program), request user authorization, and execute the resolution program if the user authorizes it (i.e., display the authorization request information of the program data; upon receiving the user's authorization response information for the program data, run the program data to resolve the pending alarm events of the target device); after the execution of the resolution program action is completed, the status of the alarm-related device can be recorded. Conversely, the user can also refuse authorization after analysis.

[0122] As shown in Table 2, for process 1494982, if the alarm resolution program generated by the large model is used to indicate stopping the process and requesting user authorization, the user can determine after analysis that although the process has a high CPU utilization, it is normal and there is no need to stop the process. Therefore, the user can refuse to authorize the action of stopping the process.

[0123] For process 902011, if the alarm resolution program generated by the large model is used to indicate stopping the process, the user can be requested to authorize it. After analysis, if the user determines that the process is abnormal, the user can agree to authorize the action of stopping the process.

[0124] In addition, this embodiment can also determine whether to import the content of this action (such as including alarm information, action content, etc.) into the expert knowledge base based on the import strategy. If the content of this action meets the import strategy, the content of this action can be imported into the expert knowledge base. Among them, the import strategy can set two conditions. Condition 1 can be judged based on user feedback. For example, after the action is generated and executed, the user gives feedback (solved or unsolved). If the user gives feedback that it is solved, condition 1 is met. Condition 2 can be judged based on the frequency of the action. For example, a frequency threshold can be set for each action (for example, the threshold is set to 100). If the frequency of the action generated based on a certain alarm exceeds the threshold of 100, condition 2 is met. When conditions 1 and 2 are met at the same time, the import strategy is met.

[0125] It can be considered that alarm diagnosis and processing requires a lot of manpower to analyze log data and other content. If a large model is used directly to generate a solution, a serious illusion problem will occur. The alarm diagnosis and processing method provided by this embodiment can introduce multi-source data to enhance the accuracy of alarm resolution. For example, the illusion problem can be reduced by using alarm correlation data, the success rate of alarm resolution can be increased by using expert knowledge base, and the success rate of solving new and rare problems in alarms can be increased by using Internet data.

[0126] At the same time, the alarm diagnosis and processing method provided in this embodiment can realize automatic operation solutions for common alarm events, and achieve the purpose of quickly resolving alarms after the alarm events requiring authorization are authorized by the user.

[0127] Corresponding to the alarm diagnosis and processing method of the above embodiment, Figure 4 This is a structural block diagram of an alarm diagnosis and processing device provided in one embodiment of the present application. For the sake of convenience, only the parts related to the embodiment of the present application are shown.

[0128] Reference Figure 4 , the device comprises:

[0129] The acquisition module 301 is configured to generate a pending alarm event for a target device in response to a trigger, and acquire device operation data of the target device based on the pending alarm event.

[0130] The parsing module 302 is configured to parse the device operation data to obtain a first diagnostic result of the target device, wherein the first diagnostic result at least indicates whether the alarm event to be processed is a preset alarm event.

[0131] The generating module 303 is configured to generate a second diagnostic result of the target device based on the alarm reference data associated with the alarm event to be processed and the device operation data if the first diagnostic result indicates that the alarm event to be processed is not a preset alarm event.

[0132] The display module 304 is configured to display processing prompt information based on the second diagnosis result, so as to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0133] This embodiment provides an alarm diagnosis and processing device. An acquisition module generates a pending alarm event for a target device in response to a trigger, and acquires device operating data of the target device based on the pending alarm event. A parsing module parses the device operating data to obtain a first diagnostic result for the target device, wherein the first diagnostic result at least indicates whether the pending alarm event is a preset alarm event. If the first diagnostic result indicates that the pending alarm event is not a preset alarm event, a generation module generates a second diagnostic result for the target device based on alarm reference data associated with the pending alarm event and the device operating data. A display module displays processing prompt information based on the second diagnostic result to prompt a user to resolve the pending alarm event of the target device based on the processing prompt information. This device parses the device operating data of the target device, and if the first diagnostic result indicates that the pending alarm event is not a preset alarm event, resolves the pending alarm event of the target device based on the alarm reference data associated with the pending alarm event and the device operating data. This improves the accuracy of alarm diagnosis processing and, to a certain extent, ensures the normal operation of the target device.

[0134] Optionally, the generated modules include:

[0135] The query unit is used to query alarm reference data associated with the alarm event to be processed and the equipment operation data, and the alarm reference data includes target alarm knowledge data and / or Internet alarm data.

[0136] The processing unit is used to use a preset large model to process the alarm events to be processed, equipment operation data and alarm reference data to obtain processing result data, wherein the preset large model is obtained by training the neural network model based on training data, and the training data includes at least one of the training alarm events, training operation data and training reference data.

[0137] The determining unit is configured to determine a second diagnosis result of the target device based on the processing result data.

[0138] Optionally, the alarm reference data includes target alarm knowledge data, and the query unit is specifically configured to:

[0139] A pre-configured alarm knowledge database is obtained, where the alarm knowledge database stores a plurality of preset alarm knowledge data for performing alarm diagnosis.

[0140] The preset alarm knowledge data associated with the alarm event to be processed and the equipment operation data in the alarm knowledge database is determined as the target alarm knowledge data.

[0141] Optionally, the determining unit is specifically configured to:

[0142] If the processing result data indicates that data still needs to be queried for alarm diagnosis, then return to the step of querying alarm reference data associated with the alarm event to be processed and the equipment operation data, where the alarm reference data includes Internet alarm data, until the processing result data does not indicate that data still needs to be queried for alarm diagnosis.

[0143] The processed result data is determined as a second diagnosis result of the target device.

[0144] Optionally, the alarm reference data includes Internet alarm data, and the query unit is specifically configured to:

[0145] Perform field extraction operations on the alarm events to be processed and the equipment operation data to obtain the target alarm fields.

[0146] Search the target alarm field on the Internet to obtain Internet alarm data.

[0147] Optionally, the processing unit is specifically configured to:

[0148] Generate alarm prompt words based on pending alarm events, equipment operation data and alarm reference data.

[0149] Input the alarm prompt words into the preset large model to obtain the processing result data.

[0150] Optionally, the second diagnostic result includes program data, and the processing prompt information includes authorization request information of the program data, where the authorization request information is used to request the user to authorize the program data.

[0151] The display module is specifically used for:

[0152] If the second diagnosis result includes program data, authorization request information for the program data is displayed.

[0153] When the user's authorization response information for the program data is received, the program data is executed to resolve the pending alarm event of the target device.

[0154] Optionally, the second diagnostic result includes troubleshooting data, and the display module is specifically configured to:

[0155] If the second diagnostic result includes troubleshooting data, processing prompt information corresponding to the troubleshooting data is displayed to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

[0156] Optionally, the first diagnosis result further includes: processing operation data corresponding to a preset alarm event. The alarm diagnosis and processing device provided in this embodiment further includes:

[0157] The execution module is used to parse the device operation data and obtain the first diagnostic result of the target device. If the first diagnostic result shows that the alarm event to be processed is a preset alarm event, the execution module performs the operation corresponding to the processing operation data on the target device to resolve the alarm event to be processed of the target device.

[0158] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0159] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0160] The embodiment of the present application also provides a terminal device, Figure 5 This is a schematic diagram of the structure of a terminal device provided by an embodiment of the present application. Figure 5 As shown, the terminal device includes: at least one processor 401, a memory 402, an input device 403, an output device 404, and a computer program stored in the memory 402 and executable on at least one processor 401. When the processor 401 executes the computer program, the steps in any of the above-mentioned method embodiments are implemented.

[0161] The input device 403 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the terminal device. The output device 404 may include a display device such as a display screen.

[0162] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by the processor 401, the steps in the above-mentioned method embodiments can be implemented.

[0163] An embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0164] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor 401, it can implement the steps of the above-mentioned various method embodiments. Among them, the computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable storage medium may at least include: any entity or device that can carry the computer program code to the device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, a computer-readable storage medium cannot be an electric carrier signal or a telecommunication signal.

[0165] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0166] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0167] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal devices and methods can be implemented in other ways. For example, the device / terminal device embodiments described above are merely illustrative. For example, the division of modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0168] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0169] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. An alarm diagnosis and processing method, characterized in that: include: In response to triggering and generating a pending alarm event for a target device, obtaining device operation data of the target device based on the pending alarm event; Parsing the device operation data to obtain a first diagnostic result of the target device, wherein the first diagnostic result at least indicates whether the alarm event to be processed is a preset alarm event; If the first diagnostic result indicates that the pending alarm event is not the preset alarm event, generating a second diagnostic result for the target device based on alarm reference data associated with the pending alarm event and the device operation data; Processing prompt information is displayed based on the second diagnosis result to prompt a user to resolve the pending alarm event of the target device based on the processing prompt information.

2. The alarm diagnosis and processing method according to claim 1, wherein: Generating a second diagnosis result of the target device according to the alarm reference data associated with the alarm event to be processed and the device operation data includes: Querying alarm reference data associated with the to-be-processed alarm event and the device operation data, the alarm reference data including target alarm knowledge data and / or Internet alarm data; Using a preset large model to process the alarm event to be processed, the equipment operation data, and the alarm reference data to obtain processing result data, wherein the preset large model is obtained by training a neural network model based on training data, and the training data includes at least one of training alarm events, training operation data, and training reference data; A second diagnosis result of the target device is determined based on the processing result data.

3. The alarm diagnosis and processing method according to claim 2, wherein: The alarm reference data includes target alarm knowledge data, and the querying of the alarm reference data associated with the to-be-processed alarm event and the device operation data includes: Acquiring a pre-configured alarm knowledge database, wherein the alarm knowledge database stores a plurality of preset alarm knowledge data for performing alarm diagnosis; The preset alarm knowledge data in the alarm knowledge database that is associated with the alarm event to be processed and the equipment operation data is determined as target alarm knowledge data.

4. The alarm diagnosis and processing method according to claim 3, wherein: Determining a second diagnosis result of the target device based on the processing result data includes: If the processing result data indicates that data still needs to be queried for alarm diagnosis, returning to the step of querying alarm reference data associated with the alarm event to be processed and the equipment operation data, wherein the alarm reference data includes Internet alarm data, until the processing result data does not indicate that data still needs to be queried for alarm diagnosis; The processing result data is determined as a second diagnosis result of the target device.

5. The alarm diagnosis and processing method according to claim 4, wherein: The alarm reference data includes Internet alarm data, and the querying of the alarm reference data associated with the to-be-processed alarm event and the device operation data includes: Performing a field extraction operation on the to-be-processed alarm event and the device operation data to obtain a target alarm field; The target alarm field is searched on the Internet to obtain Internet alarm data.

6. The alarm diagnosis and processing method according to claim 2, wherein: The method of using a preset large model to process the alarm event to be processed, the equipment operation data, and the alarm reference data to obtain processing result data includes: generating an alarm prompt word based on the alarm event to be processed, the equipment operation data and the alarm reference data; The warning prompt words are input into the preset large model to obtain processing result data.

7. The alarm diagnosis and processing method according to claim 1, wherein: The second diagnosis result includes program data, and the processing prompt information includes authorization request information of the program data, where the authorization request information is used to request the user to authorize the program data; The displaying of processing prompt information based on the second diagnosis result includes: If the second diagnostic result includes program data, displaying authorization request information for the program data; In a case where authorization response information of the user for the program data is received, the program data is executed to resolve the pending alarm event of the target device.

8. The alarm diagnosis and processing method according to claim 1, wherein: The second diagnostic result includes troubleshooting data, and the displaying of processing prompt information based on the second diagnostic result includes: If the second diagnostic result includes troubleshooting data, processing prompt information corresponding to the troubleshooting data is displayed to prompt the user to resolve the pending alarm event of the target device based on the processing prompt information.

9. The alarm diagnosis and processing method according to any one of claims 1 to 8, characterized in that: The first diagnostic result further includes: processing operation data corresponding to the preset alarm event. After parsing the device operation data to obtain the first diagnostic result of the target device, the method further includes: If the first diagnosis result indicates that the unprocessed alarm event is a preset alarm event, an operation corresponding to the processing operation data is performed on the target device to resolve the unprocessed alarm event of the target device.

10. An alarm diagnosis and processing device, characterized in that: include: an acquisition module, configured to generate, in response to a trigger, a pending alarm event for a target device, and acquire device operation data of the target device based on the pending alarm event; an analysis module, configured to analyze the device operation data to obtain a first diagnosis result of the target device, wherein the first diagnosis result at least indicates whether the alarm event to be processed is a preset alarm event; a generating module configured to generate a second diagnostic result for the target device based on alarm reference data associated with the alarm event to be processed and the device operation data if the first diagnostic result indicates that the alarm event to be processed is not the preset alarm event; The display module is configured to display processing prompt information based on the second diagnosis result, so as to prompt a user to resolve the pending alarm event of the target device based on the processing prompt information.

11. A terminal device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the terminal device implements the method according to any one of claims 1 to 9.

12. A computer program product, characterized in that When the computer program product is run on a terminal device, the terminal device is caused to execute the method according to any one of claims 1 to 9.

Images