A dynamic alarm knowledge base creation method and system based on alarm management

Abstract

The application discloses a kind of dynamic alarm knowledge base creation methods based on alarm management, comprising: S1, based on the experience of engineer processing alarm matter is converted into alarm knowledge point data formation engineer knowledge base, engineer knowledge base is used to form think tank management under the unified management;S2, based on the alarm data acquisition and processing of multiple heterogeneous monitoring systems, heterogeneous monitoring equipment and heterogeneous monitoring server alarm data corresponding information is created into alarm failure knowledge base;S3, engineer knowledge base and alarm failure knowledge base are associated and information integration, to form dynamic alarm knowledge base, dynamic alarm knowledge base is used to provide the guidance and support of fault handling, and assist engineer to quickly locate and solve one or more problems in multiple heterogeneous monitoring systems, heterogeneous monitoring equipment and heterogeneous monitoring server. Corresponding system, electronic equipment and readable storage medium are also disclosed.

Description

Technical Field

[0001] This invention relates to the technical field of alarms, alarm monitoring, management and response in IT systems, network systems and industrial control systems, and in particular to a method and system for creating a dynamic alarm knowledge base based on alarm management. Background Technology

[0002] This is due to the continuous improvement of informatization and automation, especially in IT systems, network systems, and industrial control systems. As these systems become more complex and larger, effectively monitoring, managing, and responding to various alarms within them has become an urgent problem to be solved.

[0003] Secondly, with the development of emerging technologies such as cloud computing, big data, and the Internet of Things, system architectures have become more complex, and alarm messages across platforms, networks, and devices frequently occur. These alarm messages are not only numerous but also come from a wide range of sources and are diverse in type, requiring alarm management systems to have powerful processing capabilities to collect, analyze, and process these alarm messages in a unified manner. As the complexity and scale of the system continue to increase, relying solely on the experience and knowledge of individual engineers is no longer sufficient to meet the needs of alarm processing. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a method and system for creating a dynamic alarm knowledge base based on alarm management. This system manages alarms by converting them into knowledge points. On one hand, based on the alarm management system, it directly converts each processing method, means, and related knowledge used by engineers in handling alarm matters into knowledge points, forming an engineer knowledge base under unified control. On the other hand, based on alarm data collection and integration, it transforms alarm content into text, stores it, or generates new knowledge points for the knowledge base, establishing an alarm fault knowledge base. This base organizes and summarizes fault handling experience and recovery solutions accumulated in daily operation and maintenance work. Thus, it provides guidance and support for fault handling from both aspects simultaneously, helping engineers quickly locate and resolve problems.

[0005] This invention provides a method for creating a dynamic alarm knowledge base based on alarm management, comprising:

[0006] S1, Based on the experience of engineers in handling alarm matters, alarms are converted into knowledge point data to form an engineer knowledge base, which is used to form a think tank management under unified control;

[0007] S2, Based on the collection and processing of alarm data from various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, the information corresponding to the alarm data is created into an alarm fault knowledge base;

[0008] S3. The engineer knowledge base and the alarm fault knowledge base are associated and integrated to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and to assist engineers in quickly locating and resolving problems in one or more of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0009] Preferably, S1 includes:

[0010] S11, Collect process data of multiple engineers handling alarm matters, the process data including each processing method, processing means and related knowledge used;

[0011] S12, the process data is converted into different alarm knowledge point data according to the data type;

[0012] S13, integrate the different alarm knowledge point data to form an upgradeable and updatable engineer knowledge base.

[0013] Preferably, S2 includes:

[0014] S21, collect multi-source alarm information data from one or more heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, and process the alarm information.

[0015] S22, receive alarms, record alarms, and store alarms for the currently processed alarm information, and can store historical alarm information;

[0016] S23, after modularizing, converting and uniformly reviewing the received alarm information, store it or generate new think tank knowledge points, and establish an alarm fault knowledge base based on the new think tank knowledge points.

[0017] Preferably, S21 includes:

[0018] (1) Collect multi-source alarm information from various heterogeneous monitoring systems, devices and servers; wherein, the collection includes: collecting single alarm information or multi-dimensional collection using agent or agentless methods.

[0019] (2) Based on a unified interface or protocol, the alarm information is integrated and standardized among the various heterogeneous monitoring systems, devices and servers.

[0020] Preferably, the received alarm information is modularized by adopting a modular design concept, dividing the alarm management system into different functional modules according to the alarm processing method and case, so as to facilitate the management and expansion of new think tank knowledge points.

[0021] Preferably, S23 includes:

[0022] (1) The received alarm information is filtered based on the filtering rules to remove useless information and retain only meaningful alarm information. The filtering rules are formulated according to the business scenario under the alarm filtering.

[0023] (2) The alarms after the alarm filtering are managed in a unified manner in the form of a list, and the filtered alarm information is analyzed based on unified analysis and causal analysis technology.

[0024] Preferably, the process of storing or generating new think tank knowledge points after text conversion and unified review includes:

[0025] (1) Use a primary think tank to view and extract knowledge points that have not undergone text conversion;

[0026] (2) After generating knowledge points from the text-generating method that have not undergone text conversion, the knowledge points are reviewed.

[0027] (3) Based on the verified knowledge points, determine the alarm trigger source and perform alarm detection, process the detected alarm data, and build an alarm rule engine;

[0028] (4) Perform alarm processing based on the alarm rule engine and the alarm data after data processing.

[0029] A second aspect of the present invention provides a dynamic alarm knowledge base creation system based on alarm management, for implementing the method of the first aspect, comprising:

[0030] The engineer knowledge base establishment module (101) is used to transform alarm-to-knowledge point data based on the experience of engineers in handling alarm matters to form an engineer knowledge base, which is used to form a think tank management under unified control.

[0031] The alarm fault knowledge base establishment module (102) is used to create an alarm fault knowledge base based on the alarm data collection and processing of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0032] The dynamic alarm knowledge base establishment module (103) is used to associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and to assist engineers in quickly locating and solving problems in one or more of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0033] A third aspect of the present invention provides an electronic device including a processor and a memory, the memory storing a plurality of instructions, the processor being configured to read the instructions and execute the method as described in the first aspect.

[0034] A fourth aspect of the present invention provides a computer-readable storage medium storing a plurality of instructions which can be read by a processor and executed as described in the first aspect.

[0035] The method, system, and electronic device provided by this invention have the following beneficial effects:

[0036] (1) Through a unified management platform, alarm information scattered in different monitoring systems can be effectively aggregated, avoiding the problem of scattered and non-standard alarm information.

[0037] (2) Unified management and development of alarm handling knowledge points can reduce the complexity and pressure of operation and maintenance personnel, and reduce false alarms, missed alarms and duplicate alarms.

[0038] (3) The unified management platform can provide more comprehensive alarm information, including alarm source, level, time, content, etc., so that operation and maintenance personnel can have a more comprehensive understanding of the system status.

[0039] (4) View the alarm details to obtain the relevant alarm device information, obtain the alarm level and content in its corresponding monitoring items and triggers, and synchronize the processing method to the think tank when processing the alarm.

[0040] (5) By integrating alarm data from different monitoring systems, a more complete alarm view can be formed, which helps maintenance personnel to quickly locate problems. Attached Figure Description

[0041] Figure 1 A flowchart illustrating a method for creating a dynamic alarm knowledge base based on alarm management according to an embodiment of the present invention;

[0042] Figure 2 A flowchart of a method for creating an alarm fault knowledge base based on alarm data collection and processing using multiple heterogeneous monitoring systems, heterogeneous monitoring devices, and heterogeneous monitoring servers, according to an embodiment of the present invention.

[0043] Figure 3 This is a schematic diagram of an interface divided into different functional modules according to an embodiment of the present invention;

[0044] Figure 4 This is a schematic diagram of an alarm filtering interface according to an embodiment of the present invention;

[0045] Figure 5This is a schematic diagram of an interface for analyzing filtered alarm information based on technologies such as unified analysis and causal analysis according to an embodiment of the present invention.

[0046] Figure 6 A flowchart illustrating the principle of a method for text conversion and unified review followed by storage or generation of new think tank knowledge points according to an embodiment of the present invention;

[0047] Figure 7 A system architecture diagram is created for a dynamic alarm knowledge base based on alarm management according to an embodiment of the present invention;

[0048] Figure 8 This is a schematic diagram of an electronic device structure according to an embodiment of the present invention. Detailed Implementation

[0049] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0050] Example 1

[0051] like Figure 1 As shown, this embodiment provides a method for creating a dynamic alarm knowledge base based on alarm management, including:

[0052] S1, Based on the experience of engineers in handling alarm matters, alarms are converted into knowledge point data to form an engineer knowledge base, which is used to form a think tank management under unified control;

[0053] In a preferred embodiment, S1 includes:

[0054] S11, Collect process data of multiple engineers handling alarm matters, the process data including each processing method, processing means and related knowledge used;

[0055] S12, the process data is converted into different alarm knowledge point data according to the data type;

[0056] S13, integrate the different alarm knowledge point data to form an upgradeable and updatable engineer knowledge base.

[0057] like Figure 2 As shown in Figure S2, alarm data collection and processing based on multiple heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers will create an alarm fault knowledge base by creating information corresponding to the alarm data.

[0058] In a preferred embodiment, S2 includes:

[0059] S21, collect multi-source alarm information data from one or more heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, and process the alarm information.

[0060] In this embodiment, S21 includes:

[0061] (1) Collect multi-source alarm information from various heterogeneous monitoring systems, devices and servers (such as Prometheus, Grafana, Zabbix, etc.); wherein, the collection includes: collecting single alarm information or multi-dimensional collection using agent or agentless methods.

[0062] (2) Based on a unified interface or protocol (such as REST API, Webhooks, etc.), perform data integration and data standardization processing of the alarm information among the various heterogeneous monitoring systems, devices and servers.

[0063] S22, receive alarms, record alarms, and store alarms for the currently processed alarm information, and can store historical alarm information.

[0064] In this embodiment, the method supports the storage and querying of historical alarm information. Administrators can view historical alarm records and alarm trend analysis charts through the query interface.

[0065] S23, after modularizing, converting and uniformly reviewing the received alarm information, store or generate new knowledge points for the think tank, and establish an alarm and fault knowledge base based on the new knowledge points. The alarm and fault knowledge base is used to organize and summarize the fault handling experience and recovery solutions accumulated in daily operation and maintenance work.

[0066] like Figure 3 As shown, in a preferred embodiment, modularizing the received alarm information is essentially a modular design approach. The alarm management system is divided into different functional modules based on the alarm processing method and case, so as to facilitate the management and expansion of new knowledge points.

[0067] In a preferred embodiment, S23 includes:

[0068] (1) As Figure 4 As shown, the received alarm information is filtered based on filtering rules to remove useless information and retain only meaningful alarm information. Under the circumstances of alarm filtering, the filtering rules are formulated according to the business scenario to ensure that the filtered information will not affect the business.

[0069] (2) Figure 5As shown, the alarms after the alarm filtering are managed uniformly in the form of a list, and the filtered alarm information is analyzed based on technologies such as unified analysis and causal analysis.

[0070] like Figure 6 As shown, in a preferred embodiment, the process of storing or generating new think tank knowledge points after text conversion and unified review includes:

[0071] (1) Use a primary think tank to view and extract knowledge points that have not undergone text conversion;

[0072] (2) After generating knowledge points from the text-generating method that have not undergone text conversion, the knowledge points are reviewed.

[0073] (3) Based on the verified knowledge points, determine the alarm trigger source and perform alarm detection, process the detected alarm data, and build an alarm rule engine;

[0074] (4) Perform alarm processing based on the alarm rule engine and the alarm data after data processing.

[0075] S3. The engineer knowledge base and the alarm fault knowledge base are associated and integrated to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and to assist engineers in quickly locating and resolving problems in one or more of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0076] Example 2

[0077] like Figure 7 As shown, this embodiment provides a dynamic alarm knowledge base creation system based on alarm management, used to implement the method of Embodiment 1, including:

[0078] The engineer knowledge base establishment module 101 is used to transform alarm data into knowledge points based on engineers' experience in handling alarm matters to form an engineer knowledge base. The engineer knowledge base is used to form a think tank management under unified control.

[0079] The alarm fault knowledge base establishment module 102 is used to create an alarm fault knowledge base based on the alarm data collection and processing of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0080] The dynamic alarm knowledge base establishment module 103 is used to associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and to assist engineers in quickly locating and resolving one or more problems in various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

[0081] The present invention also provides a memory that stores multiple instructions for implementing the method as described in Embodiment 1.

[0082] like Figure 8 As shown, the present invention also provides an electronic device, including a processor 301 and a memory 302 connected to the processor 301. The memory 302 stores a plurality of instructions, which can be loaded and executed by the processor to enable the processor to perform the method as described in Embodiment 1.

[0083] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A method for creating a dynamic alarm knowledge base based on alarm management, characterized in that, include: S1, Based on the experience of engineers in handling alarm matters, alarms are converted into knowledge point data to form an engineer knowledge base, which is used to form a think tank management under unified control; S2, Based on the collection and processing of alarm data from various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, the information corresponding to the alarm data is created into an alarm fault knowledge base; S3, associating and integrating the engineer knowledge base and the alarm / fault knowledge base to form a dynamic alarm knowledge base. This dynamic alarm knowledge base provides guidance and support for fault handling and assists engineers in quickly locating and resolving problems in one or more of various heterogeneous monitoring systems, devices, and servers. S1 includes: S11, Collect process data of multiple engineers handling alarm matters, the process data including each processing method, processing means and related knowledge used; S12, the process data is converted into different alarm knowledge point data according to the data type; S13, integrate the different alarm knowledge point data to form an upgradeable and updatable engineer knowledge base; S2 includes: S21, collect multi-source alarm information data from one or more heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, and process the alarm information. S22, receive alarms, record alarms, and store alarms for the currently processed alarm information, and can store historical alarm information; S23, after modularizing, converting and uniformly reviewing the received alarm information, store it or generate new think tank knowledge points, and establish an alarm fault knowledge base based on the new think tank knowledge points.

2. The method for creating a dynamic alarm knowledge base based on alarm management according to claim 1, characterized in that, S21 includes: (1) Collect multi-source alarm information from various heterogeneous monitoring systems, devices and servers; wherein, the collection includes: collecting single alarm information or multi-dimensional collection using agent or agentless methods; (2) Based on a unified interface or protocol, the alarm information is integrated and standardized among the various heterogeneous monitoring systems, devices and servers.

3. The method for creating a dynamic alarm knowledge base based on alarm management according to claim 2, characterized in that, The received alarm information is modularized by adopting a modular design concept. The alarm management system is divided into multiple functional modules according to the alarm processing method and case, so as to facilitate the management and expansion of new knowledge points.

4. The method for creating a dynamic alarm knowledge base based on alarm management according to claim 3, characterized in that, S23 includes: (1) The received alarm information is filtered based on the filtering rules to remove useless information and retain only meaningful alarm information. The filtering rules are formulated according to the business scenario under the alarm filtering. (2) The alarms after the alarm filtering are managed in a unified manner in the form of a list, and the filtered alarm information is analyzed based on unified analysis and causal analysis technology.

5. The method for creating a dynamic alarm knowledge base based on alarm management according to claim 4, characterized in that, The process of converting and uniformly reviewing the text before storing or generating new think tank knowledge points includes: (1) Use a primary think tank to view and extract knowledge points that have not undergone text conversion; (2) After generating knowledge points from the unconverted knowledge points using the text generation method, the knowledge points are reviewed. (3) Based on the verified knowledge points, determine the alarm trigger source and perform alarm detection, process the detected alarm data, and build an alarm rule engine; (4) Perform alarm processing based on the alarm rule engine and the alarm data after data processing.

6. A dynamic alarm knowledge base creation system based on alarm management, used to implement the method described in any one of claims 1-5, characterized in that, include: The engineer knowledge base establishment module (101) is used to transform alarm-to-knowledge point data based on the experience of engineers in handling alarm matters to form an engineer knowledge base. The engineer knowledge base is used to form a think tank management under unified control. The engineer knowledge base establishment module (101) is also used to: collect process data of multiple engineers handling alarm matters. The process data includes each processing method, processing means and related knowledge used. The process data is converted into different alarm knowledge point data according to the data type; the different alarm knowledge point data are integrated to form an upgradeable and updatable engineer knowledge base; The alarm fault knowledge base establishment module (102) is used to create an alarm fault knowledge base based on the alarm data collection and processing of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers. The alarm fault knowledge base establishment module (102) is also used to collect multi-source alarm information data from one or more heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers, and to process the alarm information. The system receives, records, and stores the currently processed alarm information, and can also store historical alarm information; after modularizing, converting, and uniformly reviewing the received alarm information, it stores or generates new knowledge points for the think tank, and establishes an alarm fault knowledge base based on the new knowledge points; The dynamic alarm knowledge base establishment module (103) is used to associate and integrate the engineer knowledge base and the alarm fault knowledge base to form a dynamic alarm knowledge base. The dynamic alarm knowledge base is used to provide guidance and support for fault handling and to assist engineers in quickly locating and solving problems in one or more of various heterogeneous monitoring systems, heterogeneous monitoring devices and heterogeneous monitoring servers.

7. An electronic device, characterized in that, It includes a processor and a memory, the memory storing multiple instructions, and the processor being used to read the instructions and execute the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions, which can be read by a processor and executed as described in any one of claims 1-5.

Images