Historical alarm merging method and device, equipment and storage medium

Abstract

The invention discloses a historical alarm merging method, and relates to the technical field of computers, and the method comprises the steps: obtaining a plurality of historical alarms stored during the switching-off period of an alarm merging switch in response to the switching-on of the alarm merging switch; classifying the plurality of historical alarms to obtain a plurality of original historical alarm sets; determining a merging period of the original historical alarm set according to the type and the alarm characteristics of the original historical alarm set; obtaining a to-be-merged historical alarm set according to the merging period and the original historical alarm set; and detecting the historical alarms in the to-be-merged historical alarm set, taking the historical alarms with the same and continuous identifiers as the to-be-merged historical alarms, and merging the to-be-merged historical alarms to obtain the merged historical alarm set. The technical problem that important historical alarm information is lost due to direct deletion is solved, the alarm data volume is greatly reduced, and meanwhile, the alarm key information is reserved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for merging historical alarms. Background Technology

[0002] With the rapid development of cloud computing and big data technologies, distributed storage systems are widely used in various application scenarios. Distributed storage systems typically consist of a large number of nodes, each potentially containing multiple storage units. When a system anomaly occurs, an alarm mechanism generates and reports corresponding alarm information. Current technologies for distributed storage system alarm mechanisms suffer from the following problems: First, there is the problem of historical alarm data bloat; when the cluster experiences anomalies, the system generates a large number of alarms. Second, there is the problem of wasted storage resources; the complete storage of a large number of duplicate or similar historical alarm messages consumes significant database storage resources. Finally, there is the problem of low query efficiency; a large historical alarm data table reduces query efficiency, affecting system monitoring and management efficiency. Existing solutions typically employ simple data archiving or periodic direct deletion strategies. Long-term archiving of a large number of historical alarms consumes storage resources, while direct deletion results in the loss of important historical alarm information, making it impossible to retain alarm information for a longer period. Since historical alarms serve as a reference for system evaluation, they are not crucial to the system itself; excessive historical alarm information puts pressure on system resources. However, historical alarms cannot be simply deleted, otherwise, backtracking is impossible.

[0003] Therefore, in view of the shortcomings of existing technical solutions, the present invention provides a method for merging historical alarms. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for merging historical alarms, in order to at least solve the problem in related technologies that long-term archiving of a large number of historical alarms will occupy storage resources, and direct deletion will result in the loss of important historical alarm information.

[0005] This application provides a method for merging historical alarms. The method includes: in response to an alarm merging switch being turned on, acquiring multiple historical alarms stored during the period when the alarm merging switch is turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; classifying the multiple historical alarms to obtain multiple original historical alarm sets; determining the merging period of the original historical alarm sets based on their type and alarm characteristics; obtaining a set of historical alarms to be merged based on the merging period and the original historical alarm sets; detecting historical alarms in the set of historical alarms to be merged, identifying consecutive historical alarms with the same identifier as historical alarms to be merged, and merging the historical alarms to be merged to obtain a merged set of historical alarms.

[0006] This application also provides a historical alarm merging device, comprising: a first processing module, configured to, in response to the activation of an alarm merging switch, acquire multiple historical alarms stored during the shutdown period of the alarm merging switch, wherein the multiple historical alarms include historical alarms from multiple nodes; a second processing module, configured to classify the multiple historical alarms to obtain multiple original historical alarm sets; a third processing module, configured to determine the merging period of the original historical alarm sets based on the type and alarm characteristics of the original historical alarm sets; a fourth processing module, configured to obtain a set of historical alarms to be merged based on the merging period and the original historical alarm sets; and a fifth processing module, configured to detect historical alarms in the set of historical alarms to be merged, identify consecutive historical alarms with the same identifier as historical alarms to be merged, merge the historical alarms to be merged, and obtain a merged set of historical alarms.

[0007] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the following steps: in response to an alarm merging switch being turned on, acquiring multiple historical alarms stored during the period when the alarm merging switch is turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; classifying the multiple historical alarms to obtain multiple original historical alarm sets; determining the merging period of the original historical alarm sets according to the type and alarm characteristics of the original historical alarm sets; obtaining a set of historical alarms to be merged according to the merging period and the original historical alarm sets; detecting historical alarms in the set of historical alarms to be merged, taking historical alarms with the same and consecutive identifiers as historical alarms to be merged, and merging the historical alarms to be merged to obtain a merged set of historical alarms.

[0008] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the following steps: in response to an alarm merging switch being turned on, acquiring multiple historical alarms stored during the period the alarm merging switch was turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; classifying the multiple historical alarms to obtain multiple original historical alarm sets; determining the merging period of the original historical alarm sets based on their type and alarm characteristics; obtaining a set of historical alarms to be merged based on the merging period and the original historical alarm sets; detecting historical alarms in the set of historical alarms to be merged, identifying consecutive historical alarms with the same identifier as historical alarms to be merged, and merging the historical alarms to be merged to obtain a merged set of historical alarms.

[0009] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements the following steps: in response to the alarm merging switch being turned on, acquiring multiple historical alarms stored during the period when the alarm merging switch is turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; classifying the multiple historical alarms to obtain multiple original historical alarm sets; determining the merging period of the original historical alarm sets according to the type and alarm characteristics of the original historical alarm sets; obtaining a set of historical alarms to be merged according to the merging period and the original historical alarm sets; detecting historical alarms in the set of historical alarms to be merged, identifying historical alarms with the same and consecutive identifiers as historical alarms to be merged, and merging the historical alarms to be merged to obtain a merged set of historical alarms.

[0010] This application utilizes a method that, in response to the activation of an alarm merging switch, acquires multiple historical alarms stored during the switch's deactivation period, including historical alarms from multiple nodes. These historical alarms are then categorized to obtain multiple original historical alarm sets. Based on the type and alarm characteristics of the original historical alarm sets, a merging period is determined. Based on the merging period and the original historical alarm sets, a set of historical alarms to be merged is obtained. Historical alarms in the set to be merged are detected, and consecutive historical alarms with the same identifier are identified as historical alarms to be merged. These historical alarms are then merged to obtain a merged set of historical alarms. Therefore, by merging identical historical alarms, the amount of alarm data can be significantly reduced while retaining key alarm information, without affecting subsequent problem analysis and statistics. Attached Figure Description

[0011] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A flowchart illustrating a historical alarm merging method provided in an embodiment of this application;

[0013] Figure 2 A schematic diagram of the merging process of a historical alarm merging method provided in an embodiment of this application;

[0014] Figure 3 A structural block diagram of a historical alarm merging device provided in an embodiment of this application;

[0015] Figure 4 This is an internal structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0017] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0018] It should be noted that the terms "S1," "S2," etc., are used only for descriptive purposes and do not specifically refer to the order or sequence, nor are they intended to limit this application. They are merely for the convenience of describing the method of this application and should not be construed as indicating the sequential order of the steps. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0019] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0020] The system implementing the historical alarm merging method can be a distributed storage system, including multiple nodes and a historical alarm merging service. The historical alarm merging service can be a standalone server or an application deployed on the nodes.

[0021] The embodiments of this application provide a method for merging historical alarms, and the method is described in detail below in conjunction with the execution flow of the method.

[0022] S101: In response to the alarm merging switch being turned on, retrieve multiple historical alarms stored during the period when the alarm merging switch was turned off, wherein the multiple historical alarms include historical alarms from multiple nodes.

[0023] Here, historical alarms include alarm identifier, alarm generation time, alarm end time, alarm corresponding node, alarm name, etc.

[0024] Among them, multiple nodes can be nodes in a distributed storage system, and each node will start a detection service to detect the alarm information generated by that node.

[0025] A node may choose not to generate historical alarms, generate one historical alarm, or generate multiple historical alarms.

[0026] The alarm merging switch can be opened or closed manually, or it can be opened or closed automatically through an algorithm.

[0027] In one embodiment, the alarm merging switch can be turned on during periods of low system load, such as at night, and turned off during periods of high system load.

[0028] Specifically, during the period when the alarm merging switch is off, multiple nodes will send the generated historical alarms and store the received historical alarms one by one in the original way without merging them. When the alarm merging switch is on, the stored historical alarms will be merged.

[0029] S102: Classify multiple historical alarms to obtain multiple original historical alarm sets.

[0030] Here, historical alarms can be categorized according to their cause, including hardware failures (such as hard drive errors, memory errors, etc.), software failures (such as operating system abnormalities, application abnormalities, or service abnormalities, etc.), and network problems (such as network connectivity issues, bandwidth issues, etc.).

[0031] In one embodiment, after classifying historical alarms, the system may further include preliminary processing of the historical alarms, such as checking whether the historical alarms are correct and whether there are any false alarms.

[0032] S103: Determine the merging cycle of the original historical alarm set based on its type and alarm characteristics.

[0033] Here, different historical alarm sets can correspond to different merging periods, or they can correspond to the same merging period.

[0034] The merging cycle can also be set manually.

[0035] For example, the merging period can be 1 day, 3 days, 7 days, etc.

[0036] S104: Based on the merging cycle and the original historical alarm set, obtain the historical alarm set to be merged.

[0037] Specifically, based on the merging cycle, zero or one set of historical alarms to be merged is obtained from the original historical alarm set. Historical alarms in the original historical alarm set that do not meet the requirements for a full merging cycle are not merged.

[0038] S105: Detect historical alarms in the set of historical alarms to be merged, select historical alarms with the same and consecutive identifiers as historical alarms to be merged, merge the historical alarms to be merged, and obtain the merged set of historical alarms.

[0039] Here, the set of historical alarms to be merged may include one set of historical alarms to be merged, or it may include multiple sets of historical alarms to be merged.

[0040] Specifically, assume there are multiple historical alarms: A1, A2, A3, B1, A4, A5, C1, A6, A7, A8; check each historical alarm in turn and find consecutive A1, A2, A3, a single B1, consecutive A4, A5, a single C1, and consecutive A6, A7, A8. Among them, A1A2A3 is a group of historical alarms to be merged, A4A5 is a group of historical alarms to be merged, and A6A7 is a group of historical alarms to be merged.

[0041] Here, the merged historical alarms can include the following information: start time (the earliest time among the merged alarms), end time (the latest time among the merged alarms), number of merges (the total number of similar alarms merged), and node (node ​​information involved in the merged alarms, etc.).

[0042] Specifically, suppose there are multiple historical alarms: A1, A2, A3, B1, A4, A5, C1, A6, A7, A8. A1A2A3 is a group of historical alarms to be merged, A4A5 is a group of historical alarms to be merged, and A6A7 is a group of historical alarms to be merged. Merge A1A2A3 into M1, merge A4A5 into M2, and merge A6A7 into A3. The merged historical alarms are M1, B1, M2, C1, and M3.

[0043] Specifically, delete historical alerts that have been merged.

[0044] In one embodiment, log information for each merge operation can also be recorded, including a comparison of the data volume before and after the merge, the storage space saved, etc., and a visual display of the merge effect can also be provided.

[0045] It should be noted that this application can significantly reduce the amount of alarm data by merging identical historical alarms, while retaining key alarm information and not affecting subsequent problem analysis and statistics.

[0046] In some specific implementations, the method further includes:

[0047] Obtain multiple historical alarms during the period when the alarm merging switch is off, and calculate multiple alarm metrics for the multiple historical alarms;

[0048] When at least one of the multiple alarm metrics exceeds the corresponding alarm threshold, the alarm merging switch is activated.

[0049] Here, alarm metrics may include alarm rate per unit time, alarm rate from the same source, total number of unrecovered alarms, alarm correlation, etc.

[0050] The alarm threshold can be a fixed value or dynamically adjusted. Specifically, it can be dynamically adjusted based on historical data, seasonal patterns, learned patterns (such as weekday / restday patterns), or the current system load.

[0051] Specifically, when all alarm metrics are below the alarm threshold, the historical alarm merging switch is turned off.

[0052] In this way, by intelligently turning on the historical alarm merging switch, noise reduction can be achieved, the number of historical alarms can be prevented from being too large, and alarm storms can also be suppressed.

[0053] In some specific implementations, the merging period of the original historical alarm set is determined based on the type and alarm characteristics of the original historical alarm set, including:

[0054] Based on the classification criteria, multiple original historical alarm sets are divided into the first historical alarm set, the second historical alarm set, and the third historical alarm set;

[0055] For the first historical alarm set, the entire period of all historical alarms in the first historical alarm set is taken as the merging period of the first historical alarm set;

[0056] For the second historical alarm set, the basic merging cycle of the second historical alarm set is determined based on the urgency of the historical alarms in the second historical alarm set;

[0057] Obtain the alarm characteristics of multiple historical alarms in the second historical alarm set;

[0058] Based on the alarm characteristics of multiple historical alarms, determine the health index of the second historical alarm set;

[0059] Based on the health index of the second historical alarm set, the basic merging period is dynamically adjusted to obtain the merging period of the second historical alarm set;

[0060] For the third historical alarm set, the general merging period is used as the merging period for the third historical alarm set.

[0061] Here, the classification criteria can be an alarm category mapping table, the identifier in the alarm information, etc.

[0062] Here, the first historical alarm set contains historical alarms that the user has specified not to participate in merging, the second historical alarm set contains historical alarms with different merging periods set according to different alarm levels, and the third historical alarm set contains historical alarms that have not been specified not to participate in merging or have not had merging periods set according to alarm levels.

[0063] The basic merging period corresponding to the second historical alarm collection can be obtained through a mapping table.

[0064] Specifically, the first set of historical alarms may contain alarms related to critical business operations, while the third set of historical alarms may contain newly added alarms.

[0065] Here, the higher the urgency of historical alarms, the longer the corresponding merging period, so as to retain individual alarm information for a longer period of time.

[0066] Here, the general merge cycle is a global merge cycle.

[0067] Each alarm set corresponds to an urgency level, and each urgency level corresponds to a merging cycle.

[0068] This improves the flexibility and accuracy of alarm merging cycles.

[0069] In some specific implementations, a health index for the second historical alarm set is determined based on the alarm characteristics of multiple historical alarms, including:

[0070] Based on multiple historical alarms in the second historical alarm set, obtain the number of alarms per unit time, alarm similarity, recovery success rate, and recovery time;

[0071] The health index of the second historical alarm set is calculated based on the number of alarms per unit time, alarm similarity, recovery success rate, and recovery time.

[0072] Here, the number of alarms per unit time can be obtained by counting the total number of alarms that occur within each time unit; alarm similarity can be quantified by comparing the description fields of different alarms using text similarity algorithms (such as cosine similarity, Jaccard similarity coefficient, etc.).

[0073] Among these methods, the health index can be calculated using machine learning, comprehensive scoring, anomaly detection, rule-based methods, or statistical analysis.

[0074] In this regard, the weight of each alarm feature can be configured according to its impact on the health index.

[0075] In this way, the health status of the system can be reflected more comprehensively and accurately from multiple dimensions.

[0076] In some specific implementations, a set of historical alarms to be merged is obtained based on the merging cycle and the original historical alarm set, including:

[0077] Obtain the time period of the original historical alarm set and compare the size of the time period with the merged period;

[0078] The merge operation ends when the time period is less than the merge period.

[0079] When the time period is greater than or equal to the merging period, the original historical alarm set is divided into at least one historical alarm set to be merged according to the merging period.

[0080] Here, the time period of the original historical alarm set begins with the start time of the earliest historical alarm and ends with the start time of the latest historical alarm.

[0081] This ensures the integrity and accuracy of alarm information and reduces unnecessary computation and resource consumption.

[0082] In some specific implementations, a set of historical alarms to be merged is obtained based on the merging cycle and the original historical alarm set, including:

[0083] Retrieve the start time of multiple historical alarms from the original historical alarm set;

[0084] Based on whether the start time is within the merging cycle, determine the set of historical alarms to be merged.

[0085] For example, assuming the merging period is 1 day (00:00-23:59), and assuming alarm X starts at 23:50 on Day 1 and recovers at 00:10 on Day 2, if the alarm X starts within the merging period when merging alarms from Day 1, alarm X will be included in the Day 1 merging. If the alarm X starts within the merging period when merging alarms from Day 2, alarm X will not be included in the Day 2 merging.

[0086] This enhances the traceability of historical alarms and optimizes alarm management.

[0087] In some specific implementations, historical alarms in the set of historical alarms to be merged are detected, and historical alarms with the same identifier are included as historical alarms to be merged, including:

[0088] Based on the start time of the historical alarms, the multiple historical alarms in the original historical alarm set are sorted in chronological order to obtain the historical alarm sequence to be merged.

[0089] The alarm identifiers of historical alarms in the sequence to be merged are checked sequentially to determine whether there are consecutive identical alarm identifiers in the sequence to be merged.

[0090] In response to the existence of consecutive identical alarm identifiers, the historical alarms corresponding to consecutive identical alarm identifiers are treated as historical alarms to be merged.

[0091] Specifically, for non-continuous alarms of the same type, i.e., those separated by other types of alarms, they are merged separately. Assuming the alarm sequence is A1, A2, B1, A3, A4, A1 and A2 are merged, and A3 and A4 are merged.

[0092] In one embodiment, the alarm identifier can be an identifier generated by extracting multiple key fields and using a hash algorithm.

[0093] In one embodiment, by extracting alarm identifiers and alarm context information, consecutive identical identifiers (e.g., identical hostnames, similar types, description text similarity greater than a preset value, structured field matching) can be detected as preliminary merging candidates. A sliding time window is set to determine whether preliminary merging candidates are within the same sliding time window. If a preliminary merging candidate is within the sliding time window, NLP technology is used to calculate the similarity of the preliminary merging candidates. Assuming the similarity of the preliminary merging candidates is greater than a threshold, frequency filtering is performed on the preliminary merging candidates. If a preliminary merging candidate appears more than a threshold number of times within a specified time, it is selected as the target merging candidate. This reduces false merging and missed merging.

[0094] In this way, by sorting and detecting consecutive identical alarm identifiers according to time sequence, historical alarms suitable for merging can be effectively identified.

[0095] In one embodiment, Figure 2 This is a schematic diagram of the merging process in an embodiment of this application, such as... Figure 2 As shown, the merging process in this application includes: initializing the configuration; determining whether the merging switch is enabled; if not, proceeding with the original logic; if yes, starting a scheduled task according to the strategy; acquiring alarms that meet the time conditions and sorting them in ascending order by their start time; performing merging processing according to the merging strategy and merging algorithm; writing to the database and deleting the original alarm; ending.

[0096] Specifically, the alarm merging process may include: S1 The system checks the status of the alarm merging switch; S2 If the switch is off, newly generated historical alarms are directly stored in the original historical alarm table; S3 If the switch is on, the system checks whether the preset merging period has been reached; S4 When the merging period is reached, the system starts the merging task and performs the following operations according to the configuration strategy: S4.1 Read alarm data that meets the time condition from the original historical alarm table; S4.2 Sort alarms in ascending order by start time; S4.3 Apply merging strategies and merging algorithms to process similar alarms; S5 Store the merged alarms in the merged historical alarm table; S6 Delete merged alarms from the original historical alarm table; S7 Record the merging operation log.

[0097] It should be understood that, although Figure 1 and Figure 2 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 and Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0098] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0099] An embodiment of this application also provides a historical alarm merging device, the device comprising: a first processing module 301, configured to, in response to the activation of an alarm merging switch, acquire multiple historical alarms stored during the shutdown period of the alarm merging switch, wherein the multiple historical alarms include historical alarms from multiple nodes; a second processing module 302, configured to classify the multiple historical alarms to obtain multiple original historical alarm sets; a third processing module 303, configured to determine the merging period of the original historical alarm sets based on the type and alarm characteristics of the original historical alarm sets; a fourth processing module 304, configured to obtain a historical alarm set to be merged based on the merging period and the original historical alarm sets; and a fifth processing module 305, configured to detect historical alarms in the historical alarm set to be merged, identify historical alarms with the same and consecutive identifiers as historical alarms to be merged, merge the historical alarms to be merged, and obtain a merged historical alarm set.

[0100] In a preferred embodiment of this application, the device further includes a switch module, which is specifically used to: acquire multiple historical alarms during the off period of the alarm merging switch, calculate multiple alarm indicators of the multiple historical alarms; and turn on the alarm merging switch in response to at least one of the multiple alarm indicators being greater than the corresponding alarm threshold.

[0101] In a preferred implementation, in this embodiment, the third processing module 303 is specifically used for: classifying multiple original historical alarm sets into a first historical alarm set, a second historical alarm set, and a third historical alarm set according to classification criteria; for the first historical alarm set, using all periods of historical alarms in the first historical alarm set as the merging period of the first historical alarm set; for the second historical alarm set, determining the basic merging period of the second historical alarm set based on the urgency of historical alarms in the second historical alarm set; obtaining alarm characteristics of multiple historical alarms in the second historical alarm set; determining the health index of the second historical alarm set based on the alarm characteristics of multiple historical alarms; dynamically adjusting the basic merging period based on the health index of the second historical alarm set to obtain the merging period of the second historical alarm set; and for the third historical alarm set, using the general merging period as the merging period of the third historical alarm set.

[0102] As a preferred implementation, in this embodiment of the application, the third processing module 303 is further configured to: obtain the number of alarms per unit time, alarm similarity, recovery success rate and recovery time based on multiple historical alarms in the second historical alarm set; and calculate the health index of the second historical alarm set based on the number of alarms per unit time, alarm similarity, recovery success rate and recovery time.

[0103] In a preferred embodiment of this application, the fourth processing module 304 is specifically used to: obtain the time period of the original historical alarm set, compare the size of the time period and the merging period; end the merging operation when the time period is less than the merging period; and divide the original historical alarm set into at least one historical alarm set to be merged according to the merging period when the time period is greater than or equal to the merging period.

[0104] As a preferred implementation, in this embodiment of the application, the fourth processing module 304 is specifically used to: obtain the start time of multiple historical alarms in the original historical alarm set; and determine the set of historical alarms to be merged corresponding to the historical alarms based on whether the start time is within the merging period.

[0105] In a preferred embodiment of this application, the fifth processing module 305 is specifically used to: sort multiple historical alarms in the original historical alarm set according to the start time of the historical alarms, and obtain a sequence of historical alarms to be merged; sequentially detect the alarm identifiers of the historical alarms in the sequence of historical alarms to be merged, and determine whether there are consecutive identical alarm identifiers in the sequence of historical alarms to be merged; in response to the existence of consecutive identical alarm identifiers, take the historical alarms corresponding to the consecutive identical alarm identifiers as historical alarms to be merged.

[0106] For a description of the features in the embodiment corresponding to the historical alarm merging device, please refer to the relevant description of the embodiment corresponding to the historical alarm merging method, which will not be repeated here.

[0107] Embodiments of this application also provide an electronic device, which may be a terminal, and its internal structure diagram may be as follows: Figure 4 As shown, the electronic device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a historical alarm merging method. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0108] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0109] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps: S1: In response to an alarm merging switch being turned on, acquire multiple historical alarms stored during the period when the alarm merging switch is turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; S2: Classify the multiple historical alarms to obtain multiple original historical alarm sets; S3: Determine the merging period of the original historical alarm sets according to the type and alarm characteristics of the original historical alarm sets; S4: Obtain a set of historical alarms to be merged according to the merging period and the original historical alarm sets; S5: Detect historical alarms in the set of historical alarms to be merged, identify historical alarms with the same and consecutive identifiers as historical alarms to be merged, merge the historical alarms to be merged, and obtain a merged set of historical alarms.

[0110] In one embodiment, when the processor executes the computer program, it further performs the following steps: acquiring multiple historical alarms during the period when the alarm merging switch is off, calculating multiple alarm indicators for the multiple historical alarms; and turning on the alarm merging switch in response to at least one of the multiple alarm indicators being greater than the corresponding alarm threshold.

[0111] In one embodiment, when the processor executes the computer program, it further performs the following steps: classifying multiple original historical alarm sets into a first historical alarm set, a second historical alarm set, and a third historical alarm set according to a classification criterion; for the first historical alarm set, using all periods of the historical alarms in the first historical alarm set as the merging period of the first historical alarm set; for the second historical alarm set, determining the basic merging period of the second historical alarm set based on the urgency of the historical alarms in the second historical alarm set; obtaining the alarm characteristics of multiple historical alarms in the second historical alarm set; determining the health index of the second historical alarm set based on the alarm characteristics of the multiple historical alarms; dynamically adjusting the basic merging period based on the health index of the second historical alarm set to obtain the merging period of the second historical alarm set; and for the third historical alarm set, using the general merging period as the merging period of the third historical alarm set.

[0112] In one embodiment, when the processor executes the computer program, it further performs the following steps: based on multiple historical alarms in the second historical alarm set, it obtains the number of alarms per unit time, alarm similarity, recovery success rate, and recovery duration; and calculates the health index of the second historical alarm set based on the number of alarms per unit time, alarm similarity, recovery success rate, and recovery duration.

[0113] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining the time period of the original historical alarm set, comparing the size of the time period and the merging period; ending the merging operation in response to the time period being less than the merging period; and dividing the original historical alarm set into at least one historical alarm set to be merged according to the merging period in response to the time period being greater than or equal to the merging period.

[0114] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining the start time of multiple historical alarms in the original historical alarm set; and determining the set of historical alarms to be merged corresponding to the historical alarms based on whether the start time is within the merging period.

[0115] In one embodiment, when the processor executes the computer program, it further implements the following steps: sorting multiple historical alarms in the original historical alarm set according to the start time of the historical alarms to obtain a sequence of historical alarms to be merged; sequentially detecting the alarm identifiers of the historical alarms in the sequence of historical alarms to be merged, and determining whether there are consecutive identical alarm identifiers in the sequence of historical alarms to be merged; in response to the existence of consecutive identical alarm identifiers, taking the historical alarms corresponding to the consecutive identical alarm identifiers as historical alarms to be merged.

[0116] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, performs the following steps: S1: In response to an alarm merging switch being turned on, acquire multiple historical alarms stored during the period when the alarm merging switch is turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; S2: Classify the multiple historical alarms to obtain multiple original historical alarm sets; S3: Determine the merging period of the original historical alarm sets based on the type and alarm characteristics of the original historical alarm sets; S4: Obtain a set of historical alarms to be merged based on the merging period and the original historical alarm sets; S5: Detect historical alarms in the set of historical alarms to be merged, identify historical alarms with the same and consecutive identifiers as historical alarms to be merged, merge the historical alarms to be merged, and obtain a merged set of historical alarms.

[0117] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: acquiring multiple historical alarms during the period when the alarm merging switch is off, calculating multiple alarm indicators for the multiple historical alarms; and turning on the alarm merging switch in response to at least one of the multiple alarm indicators being greater than the corresponding alarm threshold.

[0118] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: classifying multiple original historical alarm sets into a first historical alarm set, a second historical alarm set, and a third historical alarm set according to a classification criterion; for the first historical alarm set, using all periods of the historical alarms in the first historical alarm set as the merging period of the first historical alarm set; for the second historical alarm set, determining the basic merging period of the second historical alarm set based on the urgency of the historical alarms in the second historical alarm set; obtaining the alarm characteristics of multiple historical alarms in the second historical alarm set; determining the health index of the second historical alarm set based on the alarm characteristics of the multiple historical alarms; dynamically adjusting the basic merging period based on the health index of the second historical alarm set to obtain the merging period of the second historical alarm set; and for the third historical alarm set, using the general merging period as the merging period of the third historical alarm set.

[0119] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining the number of alarms per unit time, alarm similarity, recovery success rate, and recovery duration based on multiple historical alarms in the second historical alarm set; and calculating the health index of the second historical alarm set based on the number of alarms per unit time, alarm similarity, recovery success rate, and recovery duration.

[0120] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining the time period of the original historical alarm set, comparing the size of the time period and the merging period; ending the merging operation in response to the time period being less than the merging period; and dividing the original historical alarm set into at least one historical alarm set to be merged according to the merging period in response to the time period being greater than or equal to the merging period.

[0121] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining the start time of multiple historical alarms in the original historical alarm set; and determining the set of historical alarms to be merged corresponding to the historical alarms based on whether the start time is within the merging period.

[0122] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: sorting multiple historical alarms in the original historical alarm set according to the start time of the historical alarms to obtain a sequence of historical alarms to be merged; sequentially detecting the alarm identifiers of the historical alarms in the sequence of historical alarms to be merged, and determining whether there are consecutive identical alarm identifiers in the sequence of historical alarms to be merged; in response to the existence of consecutive identical alarm identifiers, taking the historical alarms corresponding to the consecutive identical alarm identifiers as historical alarms to be merged.

[0123] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0124] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for merging historical alarms, characterized in that, The method includes: In response to the alarm merging switch being turned on, acquire multiple historical alarms stored during the period when the alarm merging switch was turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; The multiple historical alarms are classified to obtain multiple original historical alarm sets; Based on the type and alarm characteristics of the original historical alarm set, the merging period of the original historical alarm set is determined; based on the merging period and the original historical alarm set, a historical alarm set to be merged is obtained. Detect historical alarms in the set of historical alarms to be merged, identify historical alarms with the same and consecutive identifiers as historical alarms to be merged, and merge the historical alarms to be merged to obtain the merged set of historical alarms.

2. The historical alarm merging method according to claim 1, characterized in that, The method further includes: Obtain multiple historical alarms during the period when the alarm merging switch is off, and calculate multiple alarm indicators for the multiple historical alarms; In response to at least one of the plurality of alarm indicators being greater than the corresponding alarm threshold, the alarm merging switch is activated.

3. The historical alarm merging method according to claim 1, characterized in that, The step of determining the merging period of the original historical alarm set based on its type and alarm characteristics includes: Based on the classification criteria, the multiple original historical alarm sets are divided into a first historical alarm set, a second historical alarm set, and a third historical alarm set; For the first historical alarm set, the entire period of the historical alarms in the first historical alarm set is taken as the merging period of the first historical alarm set; For the second historical alarm set, the basic merging period of the second historical alarm set is determined based on the urgency of the historical alarms in the second historical alarm set; Obtain the alarm characteristics of multiple historical alarms in the second historical alarm set; Based on the alarm characteristics of the multiple historical alarms, determine the health index of the second historical alarm set; Based on the health index of the second historical alarm set, the basic merging period is dynamically adjusted to obtain the merging period of the second historical alarm set; For the third historical alarm set, the general merging period is used as the merging period for the third historical alarm set.

4. The historical alarm merging method according to claim 3, characterized in that, The step of determining the health index of the second historical alarm set based on the alarm characteristics of the multiple historical alarms includes: Based on multiple historical alarms in the second historical alarm set, obtain the number of alarms per unit time, alarm similarity, recovery success rate, and recovery time; The health index of the second historical alarm set is calculated based on the number of alarms per unit time, the alarm similarity, the recovery success rate, and the recovery duration.

5. The historical alarm merging method according to claim 1, characterized in that, The step of obtaining the historical alarm set to be merged based on the merging period and the original historical alarm set includes: Obtain the time period of the original historical alarm set, and compare the size of the time period with the size of the merging period; The merging operation ends when the time period is less than the merging period. When the time period is greater than or equal to the merging period, the original historical alarm set is divided into at least one historical alarm set to be merged according to the merging period.

6. The historical alarm merging method according to claim 1, characterized in that, The step of obtaining the historical alarm set to be merged based on the merging period and the original historical alarm set includes: Obtain the start time of multiple historical alarms in the original historical alarm set; Based on whether the start time is within the merging period, determine the set of historical alarms to be merged corresponding to the historical alarms.

7. The historical alarm merging method according to claim 1, characterized in that, The step of detecting historical alarms in the set of historical alarms to be merged, and selecting historical alarms with the same and consecutive identifiers as historical alarms to be merged, includes: Based on the start time of the historical alarms, the multiple historical alarms in the original historical alarm set are sorted in chronological order to obtain the historical alarm sequence to be merged. The alarm identifiers of historical alarms in the sequence of historical alarms to be merged are detected sequentially to determine whether there are consecutive identical alarm identifiers in the sequence of historical alarms to be merged. In response to the existence of consecutive identical alarm identifiers, the historical alarms corresponding to the consecutive identical alarm identifiers are taken as historical alarms to be merged.

8. A historical alarm merging device, characterized in that, The device includes: The first processing module is configured to, in response to the alarm merging switch being turned on, acquire multiple historical alarms stored during the period when the alarm merging switch was turned off, wherein the multiple historical alarms include historical alarms from multiple nodes; The second processing module is used to classify the multiple historical alarms to obtain multiple original historical alarm sets; The third processing module is used to determine the merging period of the original historical alarm set based on the type and alarm characteristics of the original historical alarm set. The fourth processing module is used to obtain the set of historical alarms to be merged based on the merging period and the original historical alarm set. The fifth processing module is used to detect historical alarms in the set of historical alarms to be merged, select historical alarms with the same and consecutive identifiers as historical alarms to be merged, and merge the historical alarms to be merged to obtain the merged set of historical alarms.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing a computer program to implement the steps of the historical alarm merging method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer-readable storage medium stores a computer program, wherein when executed by a processor, the computer program implements the steps of the historical alarm merging method as claimed in any one of claims 1 to 7.

Images