Method for monitoring alarm information and related equipment

Abstract

The invention relates to the technical field of wind power plant network operation and maintenance, in particular to a method and related equipment for monitoring alarm information, and the method comprises the steps: inputting basic information of a physical machine and a virtual machine, including an equipment model, an IP address, a deployment position and specified field information; a resource binding threshold value is set, and the resource binding threshold value covers the space utilization rate of a CPU, a memory and a disk; monitoring resource use conditions in real time, performing natural language processing on alarm information, and extracting key features; matching the key features with historical data by using a preset classification model, dividing alarm levels and allocating the alarm levels to corresponding processing queues in combination with a resource threshold exceeding degree; and pushing alarm information to the contact person through a multi-mode notification channel according to the alarm level.

Description

Technical Field

[0001] This invention relates to the field of wind farm network operation and maintenance technology, specifically to a method and related equipment for monitoring alarm information. Background Technology

[0002] Traditional monitoring systems in wind power systems (such as Zabbix and Nagios) can only collect basic resource metrics (CPU / memory / disk usage) of physical / virtual machines, lacking end-to-end tracing capabilities from infrastructure to the application layer. In the current IT infrastructure monitoring field, with the widespread application of cloud computing technology, the number of physical and virtual machines in data centers has increased dramatically, posing significant challenges to monitoring systems. Existing monitoring systems suffer from the following problems when processing large volumes of alarm information: 1. Low efficiency in alarm information processing: Traditional monitoring systems often rely on fixed thresholds to trigger alarms, lacking personalized monitoring strategies for different devices and scenarios. This leads to an overabundance of alarm information, making it difficult for maintenance personnel to distinguish the urgency of alarms in a timely and effective manner, thereby reducing the speed of fault response.

[0003] Second, the false alarm rate is high: When judging whether the resource usage has reached the alarm conditions, the existing monitoring system usually uses static thresholds, which fails to take into account factors such as the operating status of the equipment and load changes, which easily leads to false alarms or missed alarms, increasing the workload of operation and maintenance personnel.

[0004] Third, difficulty in fault location: When an alarm occurs, traditional monitoring systems can usually only provide simple alarm information, lack in-depth root cause analysis of the fault, and cannot quickly locate the problem, which prolongs the fault recovery time and reduces the availability and stability of the system.

[0005] IV. Insufficient knowledge accumulation and sharing: In existing monitoring systems, the solutions and associated configuration change records of historical alarm events are often unstructured, which is not conducive to knowledge accumulation and rapid retrieval. When faced with similar faults, maintenance personnel need to re-investigate and cannot make full use of existing experience, which affects maintenance efficiency.

[0006] 5. Limited notification channels: Traditional monitoring systems typically send alarm notifications via email or SMS. This method suffers from problems such as high latency and slow feedback, and may not be able to deliver important or urgent alarm information to maintenance personnel in a timely manner.

[0007] VI. Imperfect threshold adjustment mechanism: Existing monitoring systems often rely on human experience when setting alarm thresholds for monitoring indicators, lacking an intelligent dynamic adjustment mechanism. This makes them unable to adapt to changes in equipment resource usage, resulting in unreasonable alarm threshold settings.

[0008] In summary, existing IT infrastructure monitoring systems have many problems when processing large amounts of alarm information and can no longer meet the large-scale and complex monitoring needs of data centers in a cloud computing environment. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to provide a method and related equipment for monitoring alarm information, which addresses the shortcomings of the prior art and solves the technical problems of insufficient monitoring and information silos in existing alarm systems.

[0010] The objective of this invention is achieved through the following technical solutions: In a first aspect, the present invention provides a method for monitoring alarm information, comprising: Enter the basic information and specified field information of the physical machine and virtual machine. The basic information includes the device model, IP address, and deployment location. The specified field information includes the entity ID and corresponding contact information. Alarm thresholds are bound to the resources of the physical machine and the virtual machine, and the alarm thresholds include CPU utilization threshold, memory occupancy threshold, and disk space utilization threshold; Real-time monitoring of the resource usage of the physical machines and virtual machines; natural language processing of the received alarm information to extract key features from the alarm text; Based on a preset classification model, the key features are matched with historical alarm data. Combined with the degree to which resource usage exceeds the alarm threshold, the alarm information is divided into different alarm levels and assigned to the corresponding processing queue. Based on the alarm level, a multimodal notification channel is selected to push alarm information to the contact information in the specified field. The alarm information includes: device name, device IP address, abnormal resource type, threshold standard value, actual exceedance value, alarm occurrence time, and name of the unit to which it belongs.

[0011] As a further improvement of the present invention, the alarm threshold is bound through a visual configuration interface, and supports setting differentiated thresholds for different physical machines and virtual machines. After adjustment, the thresholds take effect without restarting the monitoring system.

[0012] As a further improvement of the present invention, the real-time monitoring frequency is once every 1 to 5 minutes, and the key feature extraction includes at least one of the following: device name, error code, and keywords.

[0013] As a further improvement of the present invention, the alarm information is divided into different alarm levels, including: When resource usage exceeds 120% of the alarm threshold, it is classified as an emergency alarm based on the classification model; when resource usage exceeds the alarm threshold but does not reach 120% of the alarm threshold, it is classified as an important alarm or a normal alarm based on the classification model.

[0014] As a further improvement of the present invention, the multimodal notification channel includes: When the alarm level is an emergency alarm, SMS, enterprise communication tool notifications and audible and visual alarms are triggered simultaneously. When the alarm level is critical, trigger SMS and enterprise communication tool notifications. When the alarm level is a normal alarm, it is only pushed to the operations and maintenance group.

[0015] As a further improvement of the present invention, it also includes determining whether the alarm push is normal based on the status code returned by the interface. If the push is determined to be abnormal, the abnormal status information is recorded to the system log. If the push fails several times in a row, a failure alarm SMS is automatically sent to the preset system administrator's contact number.

[0016] As a further improvement of the present invention, it also includes adjusting the alarm threshold, including: Historical time series data of monitoring indicators are collected, and a time series prediction model is used to make real-time predictions of the monitoring indicators. The alarm thresholds of the monitoring indicators are dynamically adjusted based on the deviation between the predicted and actual values. Based on graph neural network correlation analysis, alarm information is linked to log fragments and performance trend graphs of related devices to trace the root cause of the fault. Build an alarm knowledge graph to store historical alarm events, solutions, and related configuration change records in a structured manner. When a new alarm is triggered, it will automatically match similar historical cases and recommend a solution.

[0017] Secondly, the present invention provides a system for monitoring alarm information, which implements the above-described method for monitoring alarm information, comprising: The device information management module allows users to input basic information and specified fields for physical and virtual machines. The basic information includes the device model, IP address, and deployment location. The specified fields include the entity ID and corresponding contact information. The resource threshold configuration module binds alarm thresholds to the resources of the physical machine and the virtual machine. The alarm thresholds include CPU utilization threshold, memory occupancy threshold, and disk space utilization threshold. The real-time resource monitoring module monitors the resource usage of the physical machines and virtual machines in real time, performs natural language processing on the received alarm information, and extracts key features from the alarm text. The alarm information processing module, based on a preset classification model, matches the key features with historical alarm data, and, combined with the degree to which resource usage exceeds the threshold, classifies the alarm information into different alarm levels and assigns them to the corresponding processing queues. The multimodal notification module selects a multimodal notification channel based on the alarm level to push alarm information to the contact number in the specified field information. The alarm information includes: device name, device IP address, abnormal resource type, threshold standard value, actual exceedance value, alarm occurrence time, and name of the unit to which it belongs.

[0018] Thirdly, the present invention provides a computer-readable storage medium for storing one or more programs, the one or more programs including instructions that, when executed by a computing device, cause the computing device to perform the above-described method for monitoring alarm information.

[0019] Fourthly, the present invention provides a computing device, comprising: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including steps for performing the methods described above for monitoring alarm information.

[0020] The beneficial effects of this invention are as follows: This invention provides a method for monitoring alarm information. By uniformly recording basic information such as device model, IP address, and deployment location, a complete asset ledger is constructed, facilitating rapid location of device physical locations and configuration details, and reducing maintenance search costs. By associating entity IDs and contact information, a direct mapping between devices and responsible persons is achieved, ensuring that alarm information accurately reaches the corresponding personnel and avoiding processing delays caused by ambiguous responsibilities. Long-term resource usage data accumulation provides a basis for capacity assessment, such as predicting expansion needs through disk usage trends, avoiding business interruptions due to resource exhaustion. Extracting key features from alarm texts (such as abnormal resource types and exceeding limits) allows for rapid analysis of the core problem, reducing manual screening and information extraction time. Multimodal notifications via SMS, email, and WeChat Work adapt to different response needs in different scenarios (such as SMS reminders in offline states), ensuring 100% alarm information delivery. This invention reduces the risk of business interruptions due to resource issues, ultimately ensuring high availability and cost optimization of IT infrastructure. Furthermore, the method for monitoring alarm information in this invention significantly improves the system's intelligence level and operational efficiency. By dynamically adjusting alarm thresholds and multimodal notification strategies, the timeliness and accuracy of alarm information are ensured, the false alarm rate is reduced, and the excessive consumption of critical resources is effectively avoided. The fault root cause tracing and solution recommendation mechanism based on graph neural networks and alarm knowledge graphs greatly shortens the time for problem localization and resolution, reducing the workload of operation and maintenance personnel. In addition, the 3D visualization display supported by WebGL technology makes the system status clear at a glance, facilitating rapid understanding of monitoring data in complex environments. Overall, this method not only improves the operation and maintenance management level of data centers but also provides strong technical support for the stable operation of services. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic flowchart of a method for monitoring alarm information in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the alarm threshold and alarm classification method in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives and technical solutions of this invention clearer and easier to understand, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. The specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention.

[0024] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings and specific embodiments. The described embodiments are only some embodiments of the present invention, and not all embodiments.

[0025] Example 1 like Figure 1 , Figure 2As shown, this monitoring and alarm information method is implemented based on an integrated monitoring platform, encompassing a data acquisition layer, a processing and analysis layer, a notification response layer, and a knowledge accumulation layer. The data acquisition layer is responsible for the real-time collection of basic information about physical machines and virtual machines, as well as resource usage data. The processing and analysis layer uses technologies such as natural language processing and machine learning models to complete alarm classification, root cause tracing, and dynamic threshold adjustment. The notification response layer pushes information through multimodal channels based on the alarm level. The knowledge accumulation layer achieves the reuse and inheritance of historical experience by constructing an alarm knowledge graph. The specific implementation method is as follows.

[0026] A method for monitoring alarm information includes inputting basic information and specified fields of physical machine virtual machines (VMs). The basic information includes device model, IP address, and deployment location. Resource thresholds are bound to the physical machine VMs, including CPU utilization thresholds, memory usage thresholds, and disk space usage thresholds, with dynamic adjustment supported. Real-time monitoring of the physical machine VMs' resource usage is performed. Natural Language Processing (NLP) is applied to the received alarm information to extract key features from the alarm text. Based on a preset classification model, the key features are matched with historical alarm data, and the degree to which resource usage exceeds the thresholds is considered to automatically classify the alarm information as urgent or important. Alarms can be classified as either normal or normal and assigned to the corresponding processing queue. Based on the alarm level, a multimodal notification channel is selected to push alarm information to the contact number specified in the designated field. Historical time-series data of monitoring indicators are collected, and a time-series prediction model is used to predict the monitoring indicators in real time. The alarm thresholds of the monitoring indicators are dynamically adjusted based on the deviation between the predicted and actual values. Based on graph neural networks (GNNs), alarm information is correlated with log fragments and performance trend charts of related devices to trace the root cause of the fault. An alarm knowledge graph is constructed to structurally store historical alarm events, solutions, and related configuration change records. When a new alarm is triggered, similar historical cases are automatically matched and a handling solution is recommended.

[0027] This embodiment integrates multiple monitoring methods and intelligent analysis algorithms to achieve comprehensive monitoring of IT resources and rapid fault location, improving operational efficiency. In principle, it utilizes NLP technology to extract key information from unstructured alarm text, combines this with machine learning models for intelligent alarm classification, and then uses GNN to analyze the correlation between alarms, thereby more accurately identifying the source of the fault. In terms of effectiveness, this embodiment significantly reduces the response time of operations and maintenance personnel, improves fault handling speed, and reduces the risk of business interruption. In other embodiments, the accuracy of fault diagnosis can be further improved by introducing more dimensions of data, such as network traffic and application logs.

[0028] Furthermore, the basic information also includes equipment operating status, initial values, operating system version, and the time of the most recent maintenance. This embodiment ensures the comprehensiveness and accuracy of the monitoring system by expanding the scope of basic information collection. In principle, information such as equipment operating status and maintenance time helps to understand the current condition of the equipment more deeply and provides additional clues for fault analysis. In terms of effect, this embodiment can help the operation and maintenance team to identify potential problems more quickly, prevent equipment failures in advance, and reduce business impact. In other embodiments, the equipment status assessment system can be further improved by collecting hardware health indicators, software version information, etc. Specified field information includes the entity ID and corresponding contact information, which includes the unit to which the equipment belongs, the person to which it belongs, and the contact number. Information is entered through the form entry module of the system management interface, supporting both batch import and single addition modes. When importing in batches, an Excel spreadsheet must be filled out according to a preset template, with each table field corresponding to a different field in the system form. After importing, the system automatically verifies the data format, highlights fields that do not meet the requirements in red, and supports online modification.

[0029] The entered information is stored in a relational database, establishing a mapping between the device's unique identifier and various information items to ensure efficient information retrieval and updates.

[0030] Furthermore, alarm thresholds are bound through a visual configuration interface, and differentiated thresholds can be set individually for different physical machines and virtual machines. Adjustments take effect without requiring a system restart. Technically, this embodiment employs a flexible threshold configuration mechanism to adapt to the specific needs of different devices and environments. In principle, the visual interface simplifies the configuration process, while differentiated thresholds take into account differences in device performance and workload. In terms of effectiveness, this embodiment allows operations and maintenance personnel to flexibly adjust monitoring strategies according to actual conditions, avoiding false alarms and missed alarms, and improving alarm accuracy. In other embodiments, automated tools can be used to automatically set thresholds based on device performance, further reducing the workload of operations and maintenance personnel.

[0031] Furthermore, the real-time monitoring frequency is once every 1-5 minutes, and key feature extraction includes at least one of the following: device name, error code, and keywords. This embodiment achieves rapid response and accurate analysis of alarm information through high-frequency monitoring and the application of NLP technology. In principle, high-frequency monitoring can promptly capture changes in resource usage, while key feature extraction helps to quickly locate the problem. In terms of effectiveness, this embodiment can significantly shorten the fault detection time and reduce the possibility of business interruption. In other embodiments, real-time analysis and response to alarm information can also be achieved by introducing streaming data processing technology.

[0032] Furthermore, when resource usage exceeds 120% of the threshold, the alarm level is determined as an emergency alarm based on the classification model; when resource usage exceeds the threshold but does not reach 120%, it is determined as an important alarm or a normal alarm based on the classification model. This embodiment achieves hierarchical alarm processing by setting different alarm thresholds. In principle, by comparing the ratio of resource usage to the preset threshold and combining the intelligent determination of the classification model, maintenance resources can be allocated more rationally. In terms of effectiveness, this embodiment can ensure that emergency situations are prioritized and effectively control the scope of the fault's impact. In other embodiments, user-defined logical rules can be introduced to further refine the alarm classification criteria and meet the needs of specific scenarios.

[0033] Furthermore, the multimodal notification channels include emergency alarms triggering SMS, enterprise communication tool notifications, and audible and visual alarms simultaneously; important alarms trigger SMS and enterprise communication tool notifications; and ordinary alarms are only pushed to the operations and maintenance group. This embodiment ensures timely delivery of alarm information by integrating multiple notification methods. In principle, selecting different notification channels based on different alarm levels enables the delivery of critical information to relevant personnel in the shortest possible time. In terms of effectiveness, this embodiment can improve alarm response speed and reduce fault handling time. In other embodiments, the diversity of notification channels can be expanded by integrating instant messaging applications, social media platforms, etc., to adapt to the communication habits of different organizations.

[0034] Furthermore, the pushed alarm information includes the device name, device IP address, abnormal resource type, threshold standard value, actual exceedance value, alarm occurrence time, and the name of the unit to which the alarm belongs. This embodiment improves the readability and usability of the information by standardizing the alarm information format. In principle, detailed information helps maintenance personnel quickly understand the alarm background and accelerates fault location. In terms of effectiveness, this embodiment ensures the complete delivery of alarm information and avoids processing delays caused by missing information. In other embodiments, the content of the alarm information can be further enriched by adding geographical location information, fault impact range, etc., to improve the targeting of fault handling.

[0035] Furthermore, the time series forecasting model is either an ARIMA model or an LSTM model. This embodiment achieves intelligent forecasting of monitoring indicators by applying advanced forecasting algorithms. In principle, ARIMA and LSTM models can predict future resource usage based on the trends and periodic changes in historical data. In terms of effectiveness, this embodiment can provide early warnings of potential resource bottlenecks, giving the operations team ample time to take preventative measures. In other embodiments, other time series forecasting models, such as Prophet and XGBoost, can be tried to improve the accuracy and stability of the forecasts.

[0036] The classification model is constructed using the random forest algorithm, and the model parameters are optimized through cross-validation to ensure the accuracy of alarm classification.

[0037] Furthermore, this embodiment also includes overlaying alarm information with the system architecture topology diagram, log timeline, and performance indicator dashboard using WebGL-based 3D visualization. This 3D visualization technology provides an intuitive tool for fault location and analysis. In principle, WebGL technology can transform complex data structures into an easy-to-understand graphical interface, helping operations personnel quickly understand the system status. In terms of effectiveness, this embodiment can significantly improve the efficiency of fault analysis and reduce the complexity of manual troubleshooting. In other embodiments, augmented reality (AR) or virtual reality (VR) technologies can be introduced to provide a more immersive fault analysis experience.

[0038] Furthermore, if an alarm is not manually confirmed within a preset time, the notification scope is automatically escalated or a predefined emergency script is triggered. This embodiment ensures timely alarm processing by setting an automatic escalation mechanism. In principle, unconfirmed alarms within a preset time will trigger the system to automatically escalate notifications or execute emergency operations to prevent the fault from spreading. In terms of effectiveness, this embodiment can effectively avoid delays caused by human negligence and ensure the stable operation of the system. In other embodiments, an intelligent decision engine can be introduced to automatically adjust the escalation strategy based on the historical response to alarms, thereby improving processing efficiency.

[0039] This embodiment also supports modifying, deleting, or adding basic information or specified field information that has been entered through the management terminal, with modifications synchronized to the monitoring system in real time. This embodiment ensures the accuracy of the monitoring system's data by providing flexible information management functions. In principle, a real-time update channel is established between the management terminal and the monitoring system, enabling immediate reflection of changes in equipment and the environment. In terms of effectiveness, this embodiment reduces false alarms caused by information lag, improving system reliability. In other embodiments, a data verification mechanism can be introduced to automatically detect the integrity of the entered information, further improving data quality.

[0040] Upon triggering an alarm, the alarm information is displayed in real-time on the system monitoring interface. This information includes the device identifier, anomaly type, priority, and processing status. Technically, this embodiment achieves real-time feedback of alarm information by optimizing the system monitoring interface. In principle, the real-time alarm display helps maintenance personnel quickly grasp the current system status and accelerate problem response. Effectively, this embodiment significantly improves the collaboration efficiency of the maintenance team and reduces fault handling time. In other embodiments, an interactive alarm panel can be introduced, allowing maintenance personnel to directly confirm or handle alarms on the interface, further simplifying the operation process.

[0041] This embodiment also determines whether the alarm push is normal based on the status code returned by the interface. If the push is determined to be abnormal, the abnormal status information is recorded in the system log. If three consecutive pushes fail, a failure alarm SMS is automatically sent to the preset system administrator contact number. Technically, this embodiment ensures the reliability of the notification channel by establishing an anomaly detection mechanism for alarm pushes. In principle, status code checks can promptly detect push failures, while automatic notification escalation ensures the delivery of critical information. In terms of effectiveness, this embodiment can effectively avoid delays in fault handling caused by notification failures, ensuring the stable operation of the system. In other embodiments, the robustness of alarm notifications can be further enhanced by introducing backup notification channels, such as email or telephone call centers.

[0042] Example 2 This embodiment provides a system for monitoring alarm information, which implements the method for monitoring alarm information in Embodiment 1. The system includes: The device information management module allows users to input basic information and specified fields for physical and virtual machines. The basic information includes the device model, IP address, and deployment location. The specified fields include the entity ID and corresponding contact information. The resource threshold configuration module binds alarm thresholds to the resources of the physical machine and the virtual machine. The alarm thresholds include CPU utilization threshold, memory occupancy threshold, and disk space utilization threshold. The real-time resource monitoring module monitors the resource usage of the physical machines and virtual machines in real time, performs natural language processing on the received alarm information, and extracts key features from the alarm text. The alarm information processing module, based on a preset classification model, matches the key features with historical alarm data, and, combined with the degree to which resource usage exceeds the threshold, classifies the alarm information into different alarm levels and assigns them to the corresponding processing queues. The multimodal notification module selects a multimodal notification channel based on the alarm level to push alarm information to the contact number in the specified field information. The alarm information includes: device name, device IP address, abnormal resource type, threshold standard value, actual exceedance value, alarm occurrence time, and name of the unit to which it belongs.

[0043] Based on the above implementation methods, the working process of this application is as follows: First, maintenance personnel input basic information and specified field information of physical machines and virtual machines through the management terminal. This information is synchronized to the monitoring system in real time for subsequent resource monitoring and alarm processing. Then, the system monitors key indicators such as CPU utilization, memory usage, and disk space utilization of physical machines and virtual machines in real time according to pre-set resource usage thresholds. Once resource usage exceeds the threshold, an alarm process is immediately initiated. The alarm information is first processed by NLP to extract key features such as device name and error code. Then, a classification model is used to determine the urgency level, and the alarm information is assigned to the corresponding processing queue based on the judgment result. At the same time, the system selects an appropriate multimodal notification channel according to the alarm level to push the alarm information to the relevant responsible persons to ensure timely communication. In addition, the system also performs time series prediction on historical data of monitoring indicators and dynamically adjusts the alarm thresholds based on the prediction results to adapt to the constantly changing business environment. For alarms that have already occurred, the system will use GNN technology to analyze log fragments and performance trend graphs of related devices to trace the root cause of the fault. Simultaneously, it will automatically match historical cases in the alarm knowledge graph to recommend handling solutions and accelerate fault recovery. Throughout the process, the system also features real-time display of alarm information, anomaly detection for alarm push notifications, and an automatic escalation notification mechanism, ensuring the efficiency and accuracy of fault handling.

[0044] Example 3 In another embodiment of the present invention, a computer-readable storage medium is provided as a storage component within a terminal device, the function of which is to store programs and data. It should be noted that the computer-readable storage medium here encompasses not only the built-in storage components of the terminal device but also extended storage components supported by the device. Essentially, it is a tangible medium capable of containing or storing programs that can be invoked by or in conjunction with an instruction execution system, device, or apparatus. This storage medium provides storage areas for the terminal's operating system and stores one or more instructions suitable for processor loading and execution, which can constitute one or more computer programs containing program code.

[0045] Specifically, examples of computer-readable storage media (a non-exclusive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable optical disc read-only memory, optical storage devices, magnetic storage devices, or any reasonable combination of the above types.

[0046] The storage medium may also include data signals propagated as part of a baseband portion or a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any reasonable combination of both. Furthermore, computer-readable storage medium may also refer to other readable media besides conventional readable storage media, capable of sending, propagating, or transmitting programs for use or operation by an instruction execution system, apparatus, or device. Program code on the storage medium can be transmitted via any suitable medium, including but not limited to wireless, wired, optical fiber, or any reasonable combination thereof.

[0047] The program code used to implement the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C. The execution modes of the program code include: running entirely on the user's computing device, running partially on the user's device as a standalone software package, running partially in a distributed manner on both the user's device and a remote computing device, or running entirely on a remote computing device or server. When a remote computing device is involved, the device can be connected to the user's computing device via any type of network such as a local area network (LAN) or a wide area network (WAN), or connected to an external computing device via the Internet through an Internet service provider.

[0048] The processor is capable of loading and executing one or more instructions stored in a computer-readable storage medium to implement the corresponding steps of the method for monitoring alarm information described in Embodiment 1.

[0049] Example 4 Figure 3 This is a schematic diagram of a computer device provided according to an embodiment of the present invention.

[0050] Please see Figure 3 The terminal device is a computer device. In this embodiment, the computer device 60 includes a processor 61, a memory 62, and a computer program 63 stored in the memory 62 and executable on the processor 61. When the processor 61 executes the computer program 63, it implements the method for monitoring alarm information as described in the embodiment. To avoid repetition, these details are not elaborated here. Alternatively, when the processor 61 executes the computer program 63, it implements the functions of each model / unit in the computing system that constitute the method for monitoring alarm information as described in the embodiment. To avoid repetition, these details are not elaborated here.

[0051] Computer device 60 can be a desktop computer, laptop, handheld computer, cloud server, or other computing device. Computer device 60 may include, but is not limited to, a processor 61 and a memory 62. Those skilled in the art will understand that... Figure 3This is merely an example of computer device 60 and does not constitute a limitation on computer device 60. It may include more or fewer components than shown, or combine certain components, or different components. For example, computer device may also include input / output devices, network access devices, buses, etc.

[0052] The processor 61 may be a central processing unit (CPU), or other general-purpose processors, CPUs, graphics processing units (GPUs), digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, quantum computing-based data processing logic units, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0053] The memory 62 can be an internal storage unit of the computer device 60, such as a hard disk or RAM of the computer device 60. The memory 62 can also be an external storage device of the computer device 60, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc., equipped on the computer device 60.

[0054] Furthermore, the memory 62 may include both internal storage units of the computer device 60 and external storage devices. The memory 62 is used to store computer programs and other programs and data required by the computer device. The memory 62 can also be used to temporarily store data that has been output or will be output.

[0055] Any references to memory, databases, or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0056] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

Claims

1. A method for monitoring alarm information, characterized in that, include: Enter the basic information and specified field information of the physical machine and virtual machine. The basic information includes the device model, IP address, and deployment location. The specified field information includes the entity ID and corresponding contact information. Alarm thresholds are bound to the resources of the physical machine and the virtual machine, and the alarm thresholds include CPU utilization threshold, memory occupancy threshold, and disk space utilization threshold; Real-time monitoring of the resource usage of the physical machines and virtual machines; natural language processing of the received alarm information to extract key features from the alarm text; Based on a preset classification model, the key features are matched with historical alarm data. Combined with the degree to which resource usage exceeds the alarm threshold, the alarm information is divided into different alarm levels and assigned to the corresponding processing queue. Based on the alarm level, a multimodal notification channel is selected to push alarm information to the contact information in the specified field. The alarm information includes: device name, device IP address, abnormal resource type, threshold standard value, actual exceedance value, alarm occurrence time, and name of the unit to which it belongs.

2. The method for monitoring alarm information according to claim 1, characterized in that, The alarm thresholds are bound through a visual configuration interface, and it supports setting differentiated thresholds for different physical machines and virtual machines. After adjustment, the changes will take effect without restarting the monitoring system.

3. The method for monitoring alarm information according to claim 1, characterized in that, The real-time monitoring frequency is once every 1 to 5 minutes, and the key feature extraction includes at least one of the following: device name, error code, and keywords.

4. The method for monitoring alarm information according to claim 1, characterized in that, The alarm information is divided into different alarm levels, including: When resource usage exceeds 120% of the alarm threshold, it is classified as an emergency alarm based on the classification model; when resource usage exceeds the alarm threshold but does not reach 120% of the alarm threshold, it is classified as an important alarm or a normal alarm based on the classification model.

5. The method for monitoring alarm information according to claim 4, characterized in that, Multimodal notification channels include: When the alarm level is an emergency alarm, SMS, enterprise communication tool notifications and audible and visual alarms are triggered simultaneously. When the alarm level is critical, trigger SMS and enterprise communication tool notifications. When the alarm level is a normal alarm, it is only pushed to the operations and maintenance group.

6. The method for monitoring alarm information according to claim 5, characterized in that, It also includes determining whether the alarm push is normal based on the status code returned by the interface. If the push is determined to be abnormal, the abnormal status information is recorded to the system log. If the push fails several times in a row, a failure alarm SMS is automatically sent to the preset system administrator's contact number.

7. The method for monitoring alarm information according to claim 1, characterized in that, This also includes adjusting alarm thresholds, including: Historical time series data of monitoring indicators are collected, and a time series prediction model is used to make real-time predictions of the monitoring indicators. The alarm thresholds of the monitoring indicators are dynamically adjusted based on the deviation between the predicted and actual values. Based on graph neural network correlation analysis, alarm information is linked to log fragments and performance trend graphs of related devices to trace the root cause of the fault. Build an alarm knowledge graph to store historical alarm events, solutions, and related configuration change records in a structured manner. When a new alarm is triggered, it will automatically match similar historical cases and recommend a solution.

8. A system for monitoring alarm information, used to implement the method for monitoring alarm information as described in any one of claims 1 to 7, characterized in that, include: The device information management module allows users to input basic information and specified fields for physical and virtual machines. The basic information includes the device model, IP address, and deployment location. The specified fields include the entity ID and corresponding contact information. The resource threshold configuration module binds alarm thresholds to the resources of the physical machine and the virtual machine. The alarm thresholds include CPU utilization threshold, memory occupancy threshold, and disk space utilization threshold. The real-time resource monitoring module monitors the resource usage of the physical machines and virtual machines in real time, performs natural language processing on the received alarm information, and extracts key features from the alarm text. The alarm information processing module, based on a preset classification model, matches the key features with historical alarm data, and, combined with the degree to which resource usage exceeds the threshold, classifies the alarm information into different alarm levels and assigns them to the corresponding processing queues. The multimodal notification module selects a multimodal notification channel based on the alarm level to push alarm information to the contact number in the specified field information. The alarm information includes: device name, device IP address, abnormal resource type, threshold standard value, actual exceedance value, alarm occurrence time, and name of the unit to which it belongs.

9. A computer-readable storage medium for storing one or more programs, characterized in that, The one or more programs include instructions that, when executed by a computing device, cause the computing device to perform the method for monitoring alarm information as described in any one of claims 1 to 7.

10. A computing device, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including steps for performing the method for monitoring alarm information according to any one of claims 1 to 7.

Images