Alarm processing system and method based on plug-in chain, medium and equipment

Abstract

The invention provides an alarm processing system and method based on a plug-in chain, a medium and equipment, and relates to the technical field of alarm processing, and the system comprises at least one plug-in chain composed of a plurality of plug-ins; the plug-in chain processes the alarm event to be processed according to the contained pre-arranged plug-in sequence; the plug-in chain comprises at least one event aggregation plug-in; the event aggregation plug-in has a corresponding necessary aggregation tag; the aggregation necessary tag and the event tag are any one of a plurality of tags; each label is composed of a label attribute and an attribute value. According to the plug-in chain disclosed by the invention, different types of alarm events from different alarm main bodies can be processed without frequently replacing plug-ins. And if the to-be-processed plug-in cannot be processed, a new plug-in can be added at a proper position of the existing plug-in chain, so that the to-be-processed plug-in can be processed. The plug-in is flexible to set, and various types of alarm events can be processed.

Description

Technical Field

[0001] The present application relates to the technical field of alarm processing, and in particular to an alarm processing system, method, medium and device based on a plug-in chain. Background Art

[0002] In today's rapidly developing digital age, various electronic devices, information systems, and industrial automation facilities are widely used in people's daily lives. During operation, these systems are prone to generating various alarm events due to various factors, such as hardware failures, software vulnerabilities, network anomalies, and external environmental interference. Complex industrial production scenarios, such as automated production lines in large factories, involve the coordinated operation of numerous devices. Once a problem occurs in any one link, it often triggers a chain reaction, resulting in multiple alarm events being generated almost simultaneously.

[0003] Existing alarm systems have exposed numerous problems in practical applications. The most prominent of these is their ability to handle only a single type of alarm event. Even if they can handle different types of alarm events, they still require a complex architecture, consume a lot of resources, and have low efficiency. Summary of the Invention

[0004] In response to the above technical problems, the present application provides an alarm processing system, method, medium and device based on a plug-in chain, which at least partially solves the problems existing in the prior art.

[0005] In a first aspect of the present application, a plug-in chain-based alarm processing system is provided, the system comprising: at least one plug-in chain consisting of a plurality of plug-ins; the plug-in chain processes pending alarm events according to a pre-arranged order of the included plug-ins; the plug-in chain comprises at least one event aggregation plug-in; the event aggregation plug-in has a corresponding aggregation-required tag; the aggregation-required tag and the event tag are each any one of a plurality of tags; each tag comprises a tag attribute and an attribute value; wherein the event aggregation plug-in is configured to perform the following steps:

[0006] S100, obtaining an event tag set corresponding to an alarm event to be processed; wherein the event tag set includes all event tags corresponding to the alarm event to be processed; and the event tag set corresponding to the alarm event to be processed includes event tags having the same tag attributes as each necessary aggregation tag;

[0007] S200, determining a target alarm event set corresponding to the alarm event to be processed based on the aggregation necessary tags and the event tag set corresponding to the alarm event to be processed; wherein the target alarm event set is one of several preset alarm event sets corresponding to the event aggregation plug-in or a newly created alarm event set obtained based on the alarm event to be processed; the alarm subject and alarm type corresponding to any two alarm events included in each preset alarm event set are the same; and each preset alarm event set contains at least one alarm event;

[0008] S300: If the target alarm event set corresponding to the alarm event to be processed is one of the preset alarm event sets, the alarm event to be processed is associated with the target alarm event set and the processing of the alarm event to be processed is determined to be completed.

[0009] In a second aspect of the present application, a plug-in chain-based alarm processing method is provided, the method comprising:

[0010] S001, controlling the event aggregation plug-in to obtain an event tag set corresponding to the pending alarm event; wherein the event tag set includes all event tags corresponding to the pending alarm event; and the event tag set corresponding to the pending alarm event includes event tags having the same tag attributes as each aggregation required tag;

[0011] S002, controlling the event aggregation plug-in to determine a target alarm event set corresponding to the alarm event to be processed based on the aggregation necessary tags and the event tag set corresponding to the alarm event to be processed; wherein the target alarm event set is one of several preset alarm event sets corresponding to the event aggregation plug-in or a newly created alarm event set obtained based on the alarm event to be processed; the alarm subject and alarm type corresponding to any two alarm events included in each preset alarm event set are the same; and each preset alarm event set contains at least one alarm event;

[0012] S003: If the target alarm event set corresponding to the pending alarm event is one of the preset alarm event sets, the control event aggregation plug-in associates the pending alarm event with the target alarm event set and determines that the pending alarm event has completed processing.

[0013] In the third aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored, and the at least one instruction or at least one program is loaded and executed by a processor to implement the aforementioned plug-in chain-based alarm processing method.

[0014] In a fourth aspect of the present application, an electronic device is provided, comprising a processor and the above-mentioned non-transitory computer-readable storage medium.

[0015] This application has at least the following beneficial effects:

[0016] The plug-in chain-based alarm processing system provided by the present application includes at least one plug-in chain composed of several plug-ins; the plug-in chain processes the pending alarm event according to the pre-arranged plug-in order included; each plug-in has a corresponding function and key tag; the key tag of the plug-in is used to determine whether the plug-in processes the alarm event based on the event tag included in the alarm event. First, several event tags of the pending event are obtained; the event tag can be used for query, statistics, judgment, etc. Subsequently, after the pending alarm event enters the plug-in chain, the plug-in chain determines the currently executed plug-in according to the pre-arranged plug-in order included. Afterwards, the currently executed plug-in is controlled to determine whether the currently executed plug-in processes the pending alarm event based on the corresponding key tag and the event tag set corresponding to the pending alarm event. If it is determined to be processed, the pending alarm event is processed according to the function corresponding to the currently executed plug-in. After the processing is completed, the next plug-in is switched to the currently executed plug-in. Until the processing of the pending alarm event is completed. Here, the completion of processing of pending alarm events includes determining that the pending alarm events will not be alarmed or determining that the pending alarm events will be alarmed and distributed to the corresponding alarm processing subject, wherein the completion of processing of pending alarm events includes the aggregation of pending alarm events with existing alarm categories, the blocking of pending alarm events, or the recovery of pending alarm events. It should be noted that: unless there are special circumstances, the pending alarm events are processed after being rotated from beginning to end in the plug-in chain, and the completion of processing here means sending the pending alarm events to the corresponding processing subject. In the alarm processing system based on the plug-in chain provided by the present application, the plug-ins on the plug-in chain can determine whether they need to process the alarm event based on the event tags contained in the alarm event. Therefore, the plug-in chain of the present application does not need to frequently replace plug-ins, that is, it can process alarm events of different categories from different alarm subjects. And if there is a pending plug-in that cannot be processed, a new plug-in can be added at a suitable position in the existing plug-in chain to implement the pending plug-in. The plug-in setting is flexible and can handle various types of alarm events. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 A structural block diagram of the plug-in chain-based alarm processing system provided in an embodiment of the present application;

[0019] Figure 2 A flowchart of the plug-in chain-based alarm processing method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0022] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this application, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0023] Please refer to Figure 1 As shown, an embodiment of the present application provides an alarm processing system 100 based on a plug-in chain, and the alarm processing system 100 based on a plug-in chain includes: at least one plug-in chain composed of a number of plug-ins; the plug-in chain processes the alarm events to be processed in the order of the included plug-ins 110; each plug-in has corresponding functions and key tags; the key tags are used to determine whether the plug-in processes the alarm event based on the event tags contained in the alarm event.

[0024] The plug-in chain-based alarm processing system provided in this embodiment includes a plug-in pool, wherein the plug-in pool contains at least one plug-in chain composed of multiple plug-ins. The plug-in chain processes pending alarm events according to the pre-arranged order of the included plug-ins. Here, the order of the plug-ins in the plug-in chain can be set according to the alarm event processing process, so that alarm events can be processed efficiently and quickly. The order of the plug-ins in the plug-in chain can be set by those skilled in the art and is not specifically limited here.

[0025] Each plug-in has corresponding functions and key tags; here, the functions of the plug-in can be shielding, aggregation, filtering, processing, sending, etc. The key tag of the plug-in is used to determine whether the plug-in handles the alarm event based on the event tag contained in the alarm event. In other words, the plug-in in the plug-in chain provided by this embodiment can determine whether it needs to handle the alarm event based on the event tag contained in the alarm event. Therefore, the plug-in chain provided by this embodiment does not need to frequently replace plug-ins, that is, it can handle different types of alarm events from different alarm entities.

[0026] It should be noted that the plug-in chain can batch process multiple alarm events at the same time.

[0027] The plug-in chain has a pre-arranged plug-in order, and the plug-in order can be adjusted as needed.

[0028] The plug-in chain is used to perform the following steps:

[0029] S100 , in response to receiving an alarm event to be processed, obtaining an event tag set corresponding to the alarm event to be processed; wherein the event tag set includes all event tags corresponding to the alarm event to be processed.

[0030] Specifically, the format of the pending alarm event is a string, and all event tags corresponding to the pending alarm event are obtained to obtain an event tag set. Here, each event tag is used to describe an attribute of the pending event. As an example: the pending alarm event A is: [W3][10.5.145.19][dubb0-admin][Server cpu usage is greater than 95%][Trigger value: 96.05372]; the event tag set corresponding to the pending alarm event A is as follows:

[0031] Alarmtype--os

[0032] Application--dubbo-admin

[0033] Check--Server CPU usage is greater than 95%

[0034] Cluster--vm_arm

[0035] group_name--ume_ops

[0036] Ident--10.5.145.19

[0037] prom_eval --interval 60

[0038] rule_id--10920

[0039] rule_note--m1

[0040] trigger_value--96.05372

[0041] Among them: Alarmtype--os is an event tag; Alarmtype is the tag attribute; os is the attribute value of the tag.

[0042] Here, event tags can be used for query, statistics, judgment, etc.

[0043] S200: Determine the currently executed plug-in according to the pre-arranged plug-in sequence.

[0044] Specifically, the plug-in chain processes the pending alarm event according to the pre-arranged order of the included plug-ins. That is, after the pending alarm event enters the plug-in chain, the plug-in chain determines the currently executed plug-in according to the pre-arranged order of the included plug-ins.

[0045] S300 , controlling the currently executed plug-in to determine whether the currently executed plug-in processes the pending alarm event according to the corresponding key tag and the event tag set corresponding to the pending alarm event.

[0046] Specifically, the currently executed plug-in is controlled to determine whether the currently executed plug-in processes the pending alarm event according to the corresponding key tag and the event tag set corresponding to the pending alarm event.

[0047] S400, if it is determined to be processed, the pending alarm event is processed according to the function corresponding to the currently executed plug-in until the pending alarm event is processed; wherein, the completion of the processing of the pending alarm event includes determining that the pending alarm event will not be processed or determining that the pending alarm event will be processed and distributed to the corresponding alarm processing entity.

[0048] Specifically, if it is determined to be processed, the pending alarm event is processed according to the function corresponding to the currently executed plug-in. After the processing is completed, the next plug-in is switched to the currently executed plug-in. Until the processing of the pending alarm event is completed. Here, the completion of the processing of the pending alarm event includes determining that the pending alarm event will not be alarmed or determining that the pending alarm event will be alarmed and distributed to the corresponding alarm processing subject, wherein the completion of the processing of the pending alarm event includes the aggregation of the pending alarm event with the existing alarm category, the blocking of the pending alarm event, or the recovery of the pending alarm event. It should be noted that: if there are no special circumstances, the pending alarm event is processed after rotating from beginning to end in the plug-in chain, and the completion processing here is to send the pending alarm event to the corresponding processing subject.

[0049] However, there are some special cases. For example, if the currently executed plug-in is an event aggregation plug-in, that is, the current plug-in's function is to aggregate multiple alarm events of the same alarm type (for example, server CPU usage greater than 95%) from the same alarm subject (for example, the same device), that is, the alarms of device A's server CPU usage greater than 95% occurring at different times should be processed uniformly. Here, the event aggregation plug-in aggregates these duplicate alarm events. When the plug-in chain first receives the alarm event of device A's server CPU usage greater than 95%, it has already been processed accordingly, that is, sent to the corresponding processing subject. However, due to reasons such as delayed processing, this alarm event is not processed promptly. After a period of time, the same alarm information is received again. Since it has already been sent to the corresponding processing subject, the event aggregation plug-in associates and records this new alarm information with the same alarm information already sent to the corresponding processing subject, and no longer repeats the alarm. In other words, the new alarm information has been processed and does not continue to rotate to the end of the plug-in chain. As a result, the number of alarms is reduced and waste of system resources is avoided. If the currently executed plug-in is a shielding plug-in, that is, the function of the currently executed plug-in is to shield the alarm events sent by certain alarm entities that are known to issue alarms, and no longer rotate backward to the end of the plug-in chain. As an example: a service has not been debugged, and it is known that it will trigger a corresponding alarm event. At this time, the shielding plug-in can shield the alarm event so that the alarm event no longer rotates backward to the end of the plug-in chain and no alarm is issued. The recovery of pending alarm events means that when an alarm event rotates in the plug-in pool, it receives information that its alarm is lifted. At this time, the alarm event will continue to rotate backward to the end of the plug-in chain. But no alarm is issued.

[0050] In the plug-in chain-based alarm processing system provided in this embodiment, the plug-ins on the plug-in chain can determine whether they need to process the alarm event based on the event tag contained in the alarm event. Therefore, the plug-in chain provided in this embodiment does not require frequent plug-in replacement, and can process different types of alarm events from different alarm entities. Moreover, if there is a pending plug-in that cannot be processed, a new plug-in can be added to the appropriate position of the existing plug-in chain to implement the pending plug-in. The plug-in setting is flexible and can handle various types of alarm events.

[0051] In an exemplary embodiment of the present application, the plug-in chain is used to perform the following steps to implement step S100:

[0052] S110: Obtain the alarm subject corresponding to the alarm event to be processed.

[0053] S120, according to the alarm subject corresponding to the alarm event to be processed and the preset label splitting method mapping table, obtain the target label splitting method corresponding to the alarm event to be processed; wherein, the preset label splitting method mapping table includes each alarm subject and the preset label splitting method corresponding to the alarm subject; the preset label splitting method is used to split the character string corresponding to the alarm event to be processed.

[0054] S130 , processing the character string corresponding to the alarm event to be processed according to the target label splitting method to obtain an event label set corresponding to the alarm event to be processed.

[0055] In this embodiment, the contents of the alarm events corresponding to different alarm subjects may be different. Therefore, in the preset label splitting method mapping table, each alarm subject included in the alarm system of the present application has a corresponding preset label splitting method, such as a regular expression; according to the target label splitting method corresponding to the alarm subject of the alarm event to be processed, the character string corresponding to the alarm event to be processed is processed to obtain a number of event labels, so as to obtain an event label set corresponding to the alarm event to be processed.

[0056] In an exemplary embodiment of the present application, after step S300, the plug-in chain is further configured to perform the following steps:

[0057] S500, if it is determined not to be processed, the next plug-in connected to the current execution plug-in on the plug-in chain is updated to the current execution plug-in; and jump to "control the current execution plug-in to determine whether the current execution plug-in processes the pending alarm event based on the corresponding key tag and the event tag set corresponding to the pending alarm event" until the pending alarm event is processed.

[0058] In this embodiment, if it is determined not to be processed, the plug-in is skipped and the next plug-in is determined to be the current plug-in to be executed.

[0059] In an exemplary embodiment of the present application, the plug-in chain is used to perform the following steps to implement step S300:

[0060] S310, if the tag attribute and attribute value of any event tag in the event tag set corresponding to the pending alarm event are identical to the tag attribute and attribute value of any key tag corresponding to the currently executed plug-in, then determine that the currently executed plug-in processes the pending alarm event;

[0061] S320: If the attribute value of each event tag in the event tag set corresponding to the pending alarm event is different from the attribute value of each key tag corresponding to the currently executed plug-in, it is determined that the currently executed plug-in does not process the pending alarm event.

[0062] Specifically, as an example, the key tag corresponding to the currently executed plug-in may be: Alarm Type (Tag Attribute): OS (Attribute Value); that is, when any event tag in the event tag set corresponding to the pending alarm event is: Alarm Type: OS, the currently executed plug-in processes the pending alarm event. Conversely, if the attribute value of each event tag in the event tag set corresponding to the pending alarm event is different from the attribute value of each key tag corresponding to the currently executed plug-in, that is, the plug-in may not be a plug-in that processes this type of event, in which case it is determined that the currently executed plug-in does not process the pending alarm event.

[0063] This embodiment determines whether a plug-in processes a corresponding alarm event through the relationship between tags. This is simple and efficient, improves the efficiency of the plug-in chain in processing alarm events, and saves processing time compared to processing or trying each plug-in one by one.

[0064] In an exemplary embodiment of the present application, the plug-in chain is further configured to perform the following steps:

[0065] S600: If the pending alarm event is not determined to be processed after the pending alarm event completes rotation on the plug-in chain, a corresponding plug-in is added to the plug-in pool according to the pending alarm event to complete the processing of the pending alarm event.

[0066] Specifically, if the pending alarm event is not determined to be processed after the rotation is completed on the plug-in chain, it means that the plug-in chain may lack a plug-in that can effectively process the current pending alarm event. As an example: it may not be clear which independent processing entity needs to be sent to. At this time, the corresponding plug-in is added to the plug-in pool according to the pending alarm event to complete the processing of the pending alarm event.

[0067] The plug-in chain-based alarm processing system provided in this embodiment can flexibly insert new plug-ins into the plug-in chain, so that the plug-in chain-based alarm processing system can handle various types of alarm events, and the plug-ins can be adjusted and increased or decreased, which is flexible.

[0068] In an exemplary embodiment of the present application, an event aggregation plug-in is also provided on the plug-in chain; the event aggregation plug-in has a corresponding aggregation necessary tag; the aggregation necessary tag and the event tag are any of several tags; each tag consists of a tag attribute and an attribute value; wherein, if the event tag set corresponding to the alarm event to be processed contains an event tag with the same tag attribute as each aggregation necessary tag, then it is determined that the event aggregation plug-in processes the alarm event to be processed.

[0069] Here, the aggregation necessary tags include the key tags corresponding to the event aggregation plug-in; that is, the event aggregation plug-in is a special type of plug-in, which not only requires that the tag attributes and attribute values ​​of any event tag contained in the alarm event to be processed are the same as the tag attributes and attribute values ​​of any key tag corresponding to the event aggregation plug-in, but also requires that the event tag set corresponding to the alarm event to be processed contain event tags with the same tag attributes as each aggregation necessary tag.

[0070] In an exemplary embodiment of the present application, an event aggregation plug-in is also provided on the plug-in chain; the event aggregation plug-in has corresponding key tags and aggregation necessary tags; the key tags, aggregation necessary tags and event tags are any of several tags; each tag consists of a tag attribute and an attribute value.

[0071] Specifically, the event aggregation plug-in has a corresponding key tag, which can be one or more, and is used to determine whether the event aggregation plug-in processes the pending alarm event (this is the same as the process of whether the plug-in processes the pending alarm event, which will not be repeated here). If the event aggregation plug-in determines to process the pending alarm event, the event aggregation plug-in is used to perform the following steps:

[0072] Sa1, determines the target alarm event set corresponding to the alarm event to be processed based on the aggregation necessary tags and the event tag set corresponding to the alarm event to be processed; wherein, the target alarm event set is one of the preset alarm event sets corresponding to the event aggregation plug-in or a newly created alarm event set obtained based on the alarm event to be processed; the alarm subjects and alarm types corresponding to any two alarm events contained in each preset alarm event set are the same; each preset alarm event set contains at least one alarm event.

[0073] Specifically, based on the aggregation necessary tags and the event tag set corresponding to the alarm event to be processed, it is determined whether the alarm event to be processed belongs to any existing preset alarm event set. Here, the alarm subject and alarm type corresponding to any two alarm events contained in each preset alarm event set are the same; that is, each preset alarm event set contains the same alarm issued at different times. The process of forming a preset alarm event set is as follows: As an example: the alarm that the CPU usage rate of the device A server is greater than 95% is issued at 10:05 and 10:10. Here, the event aggregation plug-in aggregates such repeated alarm events. And when the plug-in chain first receives the alarm event that the CPU usage rate of the device A server is greater than 95% (10:05), the alarm event has been processed accordingly, that is, it has been sent to the corresponding processing subject. However, due to reasons such as failure to process in time, the alarm information is received again after a period of time (10:10). Since the aforementioned alarm information has been sent to the corresponding processing entity, at this time, for this new alarm information, the event aggregation plug-in will associate and record it with the same alarm information that has been sent to the corresponding processing entity, that is, aggregate it to obtain a preset alarm event set.

[0074] In this embodiment, the alarm event to be processed may not belong to any preset alarm event set. In this case, a new alarm event set is obtained for the alarm event to be processed.

[0075] Sa2: If the target alarm event set corresponding to the alarm event to be processed is one of the preset alarm event sets, the alarm event to be processed is associated with the target alarm event set and the processing of the alarm event to be processed is determined to be completed.

[0076] Specifically, if the target alarm event set corresponding to the pending alarm event is one of several preset alarm event sets, it means that the alarm event identical to the pending alarm event has already been alarmed before the pending alarm event occurs. Therefore, the pending alarm event is associated with the target alarm event set and it is determined that the pending alarm event has been processed. No more repeated alarms are issued, that is, the pending alarm event has been processed by the event aggregation plug-in and no longer rotates backward to the end of the plug-in chain. This reduces the number of alarms and avoids wasting system resources.

[0077] In this embodiment, an event aggregation plug-in is set in the alarm processing system. First, it is determined whether the alarm event to be processed belongs to any existing preset alarm event set based on the aggregation necessary tags and the event tag set corresponding to the alarm event to be processed. If it does, it means that the alarm event that is the same as the alarm event to be processed has already been alarmed before the alarm event to be processed occurs. Therefore, the alarm event to be processed is associated with the target alarm event set and it is determined that the alarm event to be processed has been processed. No repeated alarms are issued, that is, the alarm event to be processed has been processed by the event aggregation plug-in and no longer rotates backward to the end of the plug-in chain. In this way, the number of alarms is reduced and waste of system resources is avoided.

[0078] In an exemplary embodiment of the present application, the event aggregation plug-in is configured to perform the following steps to implement step Sa1:

[0079] Sa11, obtain a key event tag set based on the event tag set corresponding to the alarm event to be processed and the aggregated necessary tags; wherein the key event tag set includes several key event tags; a key event tag is a tag in the event tag set that has the same tag attribute as any aggregated necessary tag.

[0080] Specifically, each event tag having the same tag attribute as the aggregation necessary tag is determined as a key event tag from the event tag set corresponding to the to-be-processed alarm event, so as to obtain a key event tag set.

[0081] Sa12, obtaining an aggregated feature value corresponding to the alarm event to be processed according to each key event tag in the key event tag set corresponding to the alarm event to be processed.

[0082] Specifically, Sa12 includes:

[0083] Sa121, obtain a key character string according to each key event tag in the key event tag set corresponding to the alarm event to be processed; wherein the key character string is composed of the tag attribute and attribute value corresponding to each event tag.

[0084] Sa122, obtain the hash value of the key string, and determine the hash value of the key string as the aggregate feature value corresponding to the alarm event to be processed.

[0085] Each key event tag has a corresponding tag attribute and attribute value. The tag attributes and attribute values ​​corresponding to each key event tag in the key event tag set corresponding to the pending alarm event are sequentially arranged to obtain a key string. Next, a hash value of the key string is obtained. The method for obtaining the hash value can be determined by those skilled in the art and will not be further described here. Finally, the hash value of the key string is determined as the aggregated feature value corresponding to the pending alarm event.

[0086] Sa13: If the aggregation feature value corresponding to the alarm event to be processed is the same as the aggregation feature value of any preset alarm event set corresponding to the currently executed event aggregation plug-in, the preset alarm event set is determined as the target alarm event set.

[0087] If the aggregated feature value corresponding to the pending alarm event is the same as the aggregated feature value of any preset alarm event set corresponding to the currently executed event aggregation plug-in, then the pending alarm event and each high alarm event included in the preset alarm event set are identical, except for the time of occurrence. In this case, the preset alarm event set is determined as the target alarm event set.

[0088] After step Sa12, the event aggregation plug-in is further used to perform the following steps:

[0089] Sa14, if the aggregation feature value corresponding to the alarm event to be processed is different from the aggregation feature value of each preset alarm event set corresponding to the currently executed event aggregation plug-in, then a new alarm event set is obtained based on the alarm event to be processed; wherein, the new alarm event set only contains the alarm event to be processed.

[0090] Specifically, if the aggregation feature value corresponding to the alarm event to be processed is different from the aggregation feature value of each preset alarm event set corresponding to the currently executed event aggregation plug-in, it means that the alarm event to be processed and each preset alarm event set are not the same alarm events. At this time, the alarm event to be processed is placed in the newly created alarm event set.

[0091] In an exemplary embodiment of the present application, each preset alarm event set or newly created alarm event set has a corresponding alarm level; after step Sa2, the event aggregation plug-in is further configured to perform the following steps:

[0092] Sa3: If the alarm level of the alarm event to be processed is greater than the alarm level of each alarm event in the target alarm event set, the alarm level of the target alarm event is updated to the alarm level of the alarm event to be processed.

[0093] In this embodiment, the alarm level of a preset or newly created alarm event set is the alarm level of the highest-level alarm event contained therein. If the alarm level of the pending alarm event is greater than the alarm level of each alarm event in the target alarm event set, the alarm level of the target alarm event is updated. This ensures that the alarm level of the target alarm event set is updated promptly, allowing the corresponding processing entity to make timely and correct decisions.

[0094] In an exemplary embodiment of the present application, after step Sa2, the event aggregation plug-in is further configured to perform the following steps:

[0095] Sa4: If the target alarm event set corresponding to the alarm event to be processed is a newly created alarm event set obtained according to the alarm event to be processed, then the alarm event to be processed is continued to be processed according to the plug-in chain.

[0096] In this embodiment, if the target alarm event set corresponding to the alarm event to be processed is a newly created alarm event set obtained based on the alarm event to be processed, it means that the alarm event to be processed has not been alarm processed before, and the alarm event to be processed will continue to be processed according to the plug-in chain to achieve timely alarm for the alarm event to be processed.

[0097] In an exemplary embodiment of the present application, an event set aggregation plug-in is also provided on the plug-in chain; each event set aggregation plug-in has a corresponding aggregation rule set; the aggregation rule set contains several aggregation rules; the position of the event set aggregation plug-in on the plug-in chain is set after the event aggregation plug-in.

[0098] In this embodiment, an event set aggregation plug-in is provided after the event aggregation plug-in. The event set aggregation plug-in is used to aggregate at least two alarm event sets that meet any aggregation rule, so as to further discover deeper problems.

[0099] The event aggregation plugin is used to perform the following steps:

[0100] Sb1, at each preset aggregation time point, traverse the alarm event set list according to the aggregation rule set corresponding to the event set aggregation plug-in, aggregate any number of alarm event sets in the alarm event set list that meet the same aggregation rule, and obtain a reconstructed alarm event set list; wherein, any reconstructed alarm event set list contains at least two alarm event sets.

[0101] Here, the event aggregation plugin targets alarm event sets, which include both pre-set alarm event sets and newly created alarm event sets. Therefore, in this embodiment, a list of alarm event sets is obtained at each pre-set aggregation time point. It is understood that the plugin chain may contain multiple event aggregation plugins, and each event aggregation plugin may also correspond to multiple alarm event sets.

[0102] Specifically, any number of alarm event sets that meet the same aggregation rule are aggregated to obtain several reconstructed alarm event sets.

[0103] Sb2, determining the alarm level corresponding to each reconstructed alarm event set list according to the alarm level corresponding to each alarm event set; and determining whether to issue an alarm to the corresponding alarm processing subject according to the corresponding alarm level.

[0104] Specifically, in one embodiment, the level of the alarm event set with the highest alarm level in the reconstructed alarm event set list is determined as the alarm level of the reconstructed alarm event set list. At this time, since the previous alarm event sets have all been alarmed, no alarm will be issued at this time. In another embodiment of the present application, an upgraded alarm level is obtained according to a preset alarm upgrade mapping table; wherein the preset alarm upgrade mapping table includes the upgraded alarm level and the aggregated necessary labels of each alarm event set corresponding to each upgraded alarm level and its alarm level, and if there is at least one upgraded alarm level, the highest upgraded alarm level is determined as the alarm level of the reconstructed alarm event set list; and an alarm is issued to the corresponding alarm processing entity. At this time, due to the interaction between certain alarms, the alarm is upgraded, and at this time, the alarm is re-issued.

[0105] In this embodiment, an event set aggregation plug-in, installed after the event aggregation plug-in, aggregates alarm event sets at preset aggregation time points to further identify deeper issues. For example, the alarm event set indicating CPU overload on device A and the alarm event indicating hard disk failure on device A are aggregated into a reconstructed alarm event set to identify deeper issues with device A.

[0106] In an exemplary embodiment of the present application, each aggregation rule has at least one corresponding intermediate label; each intermediate label is any one of several labels; each alarm event set has a corresponding aggregation necessary label; each aggregation necessary label is any one of several labels; each label consists of a label attribute and an attribute value; wherein, the alarm event set that conforms to the same aggregation rule conforms to the following rule: it has an aggregation necessary label with the same label attribute and attribute value, and the label attribute of the aggregation necessary label is the same as the label attribute of any intermediate label.

[0107] Here, the two alarm event sets have an aggregation necessary label with the same label attributes and attribute values; and when the label attribute of the aggregation necessary label is the same as the label attribute of any intermediate label, it means that the two alarm event sets simultaneously meet the corresponding aggregation rules. At this time, the two alarm event sets are aggregated to obtain a reconstructed alarm event set.

[0108] In an exemplary embodiment of the present application, if the alarm event set contains only one alarm event (ie, a new alarm event set is created), the alarm event set will not generate an alarm before being processed by the event set aggregation plug-in.

[0109] In this embodiment, when the alarm event set contains only one alarm event and there is an event set aggregation plug-in in the plug-in chain, the alarm event in the alarm event set is not alarmed first, but the event set aggregation plug-in is waited for to aggregate it, so as to reduce the number of alarms and save the system's computing resources.

[0110] The alarm system of this application mainly supports the following languages: Python on the backend and Vue3 on the front end.

[0111] like Figure 2 As shown, the present application provides an alarm processing method of an alarm processing system based on a plug-in chain, the method comprising:

[0112] S001, in response to receiving an alarm event to be processed, controlling the plug-in chain to obtain an event tag set corresponding to the alarm event to be processed; wherein the event tag set includes all event tags corresponding to the alarm event to be processed.

[0113] S002, controlling the plug-in chain to determine the currently executed plug-in according to the pre-arranged plug-in sequence.

[0114] S003, controlling the currently executed plug-in to determine whether the currently executed plug-in processes the pending alarm event according to the corresponding key tag and the event tag set corresponding to the pending alarm event.

[0115] S004, if it is determined to be processed, the function corresponding to the currently executed plug-in is controlled to process the pending alarm event until the pending alarm event is processed; wherein, the completion of the processing of the pending alarm event includes determining that the pending alarm event will not be alarmed or determining that the pending alarm event will be alarmed and distributed to the corresponding alarm processing entity.

[0116] Here, for the explanation of the method, please refer to the above description of the alarm processing system based on the plug-in chain, which will not be repeated here.

[0117] In an exemplary embodiment of the present application, an electronic device capable of implementing the above method is also provided.

[0118] Those skilled in the art will appreciate that various aspects of the present application can be implemented as systems, methods, or program products. Therefore, various aspects of the present application can be specifically implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0119] The electronic device according to this embodiment of the present application is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0120] The electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, the aforementioned at least one processor, the aforementioned at least one storage, and a bus connecting different system components (including the storage and the processor).

[0121] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present application.

[0122] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0123] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0124] The bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0125] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. As shown, the network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0126] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present application.

[0127] In exemplary embodiments of the present application, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of the present application may also be implemented in the form of a program product, which includes program code. When the program product is executed on a terminal device, the program code is used to cause the terminal device to execute the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present application.

[0128] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0129] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0130] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0131] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0132] Furthermore, the above-mentioned figures are merely illustrative of the processes included in the methods according to exemplary embodiments of the present application and are not intended to be limiting. It is readily understood that the processes illustrated in the above-mentioned figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0133] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiment of the application, the features and functions of two or more modules or units described above can be concretized in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0134] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An alarm processing system based on a plug-in chain, characterized in that: The system includes: at least one plug-in chain consisting of a plurality of plug-ins; the plug-in chain processes an alarm event to be processed according to a pre-arranged order of the plug-ins included; each plug-in has a corresponding function and a key tag; the key tag is used to determine whether the plug-in processes the alarm event based on an event tag included in the alarm event; the plug-in chain is used to perform the following steps: S100, in response to receiving an alarm event to be processed, obtaining an event tag set corresponding to the alarm event to be processed; wherein the event tag set includes all event tags corresponding to the alarm event to be processed; S200, determining the currently executed plug-in according to the pre-arranged plug-in sequence; S300, controlling the currently executed plug-in to determine whether to process the pending alarm event based on the corresponding key tag and the event tag set corresponding to the pending alarm event; S400, if it is determined to be processed, the pending alarm event is processed according to the function corresponding to the currently executed plug-in until the pending alarm event is processed; wherein, the completion of the processing of the pending alarm event includes determining that the pending alarm event will not be processed or determining that the pending alarm event will be processed and distributed to the corresponding alarm processing entity.

2. The plug-in chain-based alarm processing system according to claim 1, characterized in that: The plug-in chain is used to perform the following steps to implement step S100: S110, obtaining the alarm subject corresponding to the alarm event to be processed; S120, obtaining a target label splitting method corresponding to the alarm event to be processed based on the alarm subject corresponding to the alarm event to be processed and a preset label splitting method mapping table; wherein the preset label splitting method mapping table includes each alarm subject and the preset label splitting method corresponding to the alarm subject; the preset label splitting method is used to split the string corresponding to the alarm event to be processed; S130 , processing the character string corresponding to the alarm event to be processed according to the target label splitting method to obtain an event label set corresponding to the alarm event to be processed.

3. The plug-in chain-based alarm processing system according to claim 1 or 2, characterized in that: Key tags and event tags are any of several tags; each tag consists of a tag attribute and an attribute value.

4. The plug-in chain-based alarm processing system according to claim 1, characterized in that: After step S300, the plug-in chain is further configured to perform the following steps: S500: If it is determined not to be processed, the next plug-in connected to the current executing plug-in on the plug-in chain is updated to the current executing plug-in; and jump to "control the current executing plug-in to determine whether the current executing plug-in processes the pending alarm event based on the corresponding key tag and the event tag set corresponding to the pending alarm event" until the pending alarm event is processed.

5. The plug-in chain-based alarm processing system according to claim 3, characterized in that: The plug-in chain is used to perform the following steps to implement step S300: S310, if the tag attribute and attribute value of any event tag in the event tag set corresponding to the pending alarm event are identical to the tag attribute and attribute value of any key tag corresponding to the currently executed plug-in, then determine that the currently executed plug-in processes the pending alarm event; S320: If the attribute value of each event tag in the event tag set corresponding to the pending alarm event is different from the attribute value of each key tag corresponding to the currently executed plug-in, it is determined that the currently executed plug-in does not process the pending alarm event.

6. The plug-in chain-based alarm processing system according to claim 1, characterized in that: The plugin chain is also used to perform the following steps: S600: If the pending alarm event is not determined to be processed after the pending alarm event completes rotation on the plug-in chain, a corresponding plug-in is added to the plug-in pool according to the pending alarm event to complete the processing of the pending alarm event.

7. The plug-in chain-based alarm processing system according to claim 1, characterized in that: The pending alarm events are not given alarms, including the pending alarm events being aggregated with existing alarm categories, the pending alarm events being blocked, or the pending alarm events being restored.

8. A plug-in chain-based alarm processing method based on the plug-in chain-based alarm processing system according to any one of claims 1 to 7, characterized in that: The method comprises: S001, in response to receiving an alarm event to be processed, controlling the plug-in chain to obtain an event tag set corresponding to the alarm event to be processed; wherein the event tag set includes all event tags corresponding to the alarm event to be processed; S002, controlling the plug-in chain to determine the currently executed plug-in according to the pre-arranged plug-in sequence; S003, controlling the currently executed plug-in to determine whether the currently executed plug-in processes the pending alarm event based on the corresponding key tag and the event tag set corresponding to the pending alarm event; S004, if it is determined to be processed, the function corresponding to the currently executed plug-in is controlled to process the pending alarm event until the pending alarm event is processed; wherein, the completion of the processing of the pending alarm event includes determining that the pending alarm event will not be alarmed or determining that the pending alarm event will be alarmed and distributed to the corresponding alarm processing entity.

9. A non-transitory computer-readable storage medium, characterized in that The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the method according to claim 8.

10. An electronic device, characterized in that: The device comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 9.

Images