Alarm processing method and device, equipment and storage medium
By preprocessing, risk assessment, and security assessment of cloud platform alarms, the problem of insufficient reliability in alarm processing in existing technologies is solved, realizing automated and reliable alarm processing and improving operation and maintenance efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-26
- Publication Date
- 2026-03-31
AI Technical Summary
Existing machine learning-based alarm handling methods lack reliability, making it difficult for operations and maintenance personnel to trust the processing results, requiring manual confirmation, and reducing operational efficiency.
By receiving raw alarm information, preprocessing is performed to generate preprocessing results, including key alarm information and correlation, risk assessment is conducted, processing decision types are generated, and processing instructions are security assessed to ensure the reliability and security of automated processing.
It improves the automation of alarm handling, reduces manual intervention, shortens response and processing delays, enhances operation and maintenance efficiency, and avoids the risk of misoperation through security assessment, thereby improving the reliability of processing.
Smart Images
Figure CN121770967A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of operation and maintenance technology, and in particular to alarm processing methods, devices, equipment and storage media. Background Technology
[0002] With the widespread application of cloud computing technology, the scale of cloud platforms has grown exponentially, and the complexity of operation and maintenance has also increased significantly. There are highly coupled dependencies among the servers, networks, storage, cloud services, and applications on a cloud platform. In a cloud environment, the failure of any single component may lead to business system interruption or performance degradation, thus posing a serious threat to business continuity and user experience. Therefore, real-time monitoring of the cloud platform, timely and accurate reporting of alerts, and rapid processing of alerts are core aspects of ensuring the stability, reliability, and security of the cloud platform.
[0003] In recent years, machine learning technology has been applied to the field of operations and maintenance (O&M) to achieve more intelligent fault prediction and handling, especially with significant progress in using machine learning models for anomaly detection. However, in existing alarm handling methods based on machine learning technology, many machine learning models are like "black boxes," lacking convincing reasons for their diagnostic conclusions or handling suggestions. This makes it difficult for O&M personnel to trust the results, ultimately requiring manual confirmation and operation, leading to low O&M efficiency.
[0004] Therefore, there is an urgent need for an alarm handling method to improve the reliability and automation of alarm handling and enhance operational efficiency. Summary of the Invention
[0005] This invention provides an alarm processing method and apparatus to improve the reliability and automation of alarm processing and enhance operation and maintenance efficiency.
[0006] This invention provides an alarm processing method, the method comprising: Receive the original alarm information; The original alarm information is preprocessed to generate the alarm preprocessing result; the alarm preprocessing result includes key alarm information, alarm type, and correlation with historical alarms; Based on the preprocessing results of the alarm, a risk assessment is performed on the alarm, and a processing decision type for the alarm is generated based on the risk assessment results; the processing strategy type includes generating an alarm processing plan and automated processing; If the alarm's processing decision type is automated processing, then a processing instruction for the alarm is generated; A security assessment is performed on the alarm processing instructions. If the security assessment passes, the alarm processing instructions are executed.
[0007] Optionally, the original alarm information is preprocessed to generate a preprocessed result for the alarm, including: The core entity of the alarm is extracted from the original alarm information to obtain the key alarm information; Based on the key alarm information, the carrier in which the alarm occurred is determined, and the alarm type is obtained; The potential correlation between the alarm and historical alarms is analyzed to obtain the correlation degree between the alarm and historical alarms.
[0008] Optionally, a risk assessment is performed on the alarm based on the preprocessing results, including: Based on the preprocessing results of the alarm, retrieve historical alarm processing solutions related to the alarm from the operation and maintenance knowledge base; The impact of the alarms on the business, the processing complexity, and the scope of impact are assessed based on the historical alarm handling scheme. The risk assessment result is obtained by combining the assessment results of the impact of the alarm on the business, the assessment results of the processing complexity, and the assessment results of the scope of impact.
[0009] Optionally, a security assessment is performed on the processing instructions for the alarm, including: The operation execution steps are generated based on the original alarm information and processing instructions of the alarm. Find supporting evidence for each step in the operation execution steps; If each step is supported by evidence, the security assessment passes; if any step lacks supporting evidence or there are contradictions between the steps, the security assessment fails.
[0010] Optionally, the method further includes: If the alarm's processing decision type is to generate an alarm processing plan or fail the security assessment, then a natural language alarm processing suggestion for the alarm is generated based on the original alarm information, preprocessing results, and historical alarm processing plans related to the alarm. The alarm handling suggestions in the natural language include root cause analysis, handling steps, and rollback schemes.
[0011] Optionally, generating processing instructions for the alarm includes: Based on the original alarm information, preprocessing results, historical alarm processing schemes related to the alarm, and descriptions of each tool, a tool suitable for the alarm is selected, and a structured tool invocation command is generated; the tool invocation command includes the name of the tool to be invoked and a list of required parameters.
[0012] The present invention also provides an alarm processing device, the device comprising: The receiving module is used to receive the original alarm information. The processing module is used to preprocess the original alarm information to generate the preprocessing result of the alarm; the preprocessing result of the alarm includes key alarm information, alarm type and correlation with historical alarms; The processing module is further configured to perform a risk assessment on the alarm based on the preprocessing results of the alarm, and generate a processing decision type for the alarm based on the risk assessment level; the processing strategy type includes generating an alarm processing plan and automated processing; An execution module is used to generate processing instructions for the alarm if the processing decision type of the alarm is automated processing. The execution module is also used to perform a security assessment on the alarm processing instructions. If the security assessment passes, the alarm processing instructions are executed.
[0013] Optionally, the processing module is also used to extract the core entity of the alarm from the original alarm information to obtain the key alarm information; Based on the key alarm information, the carrier in which the alarm occurred is determined, and the alarm type is obtained; The potential correlation between the alarm and historical alarms is analyzed to obtain the correlation degree between the alarm and historical alarms.
[0014] Optionally, the processing module is also used to retrieve historical alarm processing solutions related to the alarm from the operation and maintenance knowledge base based on the preprocessing results of the alarm. The impact of the alarms on the business, the processing complexity, and the scope of impact are assessed based on the historical alarm handling scheme. The risk assessment level is obtained by combining the assessment results of the impact of the alarm on the business, the assessment results of the processing complexity, and the assessment results of the scope of impact.
[0015] Optionally, the processing module is also used to generate operation execution steps based on the original alarm information and processing instructions of the alarm; Find supporting evidence for each step in the operation execution steps; If each step is supported by evidence, the security assessment passes; if any step lacks supporting evidence or there are contradictions between the steps, the security assessment fails.
[0016] Optionally, the processing module is further configured to generate a natural language alarm processing suggestion for the alarm based on the original alarm information, preprocessing results and historical alarm processing schemes related to the alarm if the alarm processing decision type is to generate an alarm processing scheme or the security assessment fails. The alarm handling suggestions in the natural language include root cause analysis, handling steps, and rollback schemes.
[0017] Optionally, the processing module is also used to select a tool suitable for the alarm based on the original alarm information, preprocessing results, historical alarm processing schemes related to the alarm, and descriptions of each tool, and generate a structured tool invocation command; the tool invocation command includes the name of the tool to be invoked and a list of required parameters.
[0018] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the alarm processing method as described above.
[0019] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the alarm processing method as described above.
[0020] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the alarm processing method as described above.
[0021] This invention provides an alarm handling method that, by constructing a standardized alarm handling process, improves the automation level of alarm handling, reduces reliance on manual intervention, shortens alarm response and processing delays, and enhances operational efficiency. For alarms that can be handled automatically, a security assessment step is added to the alarm handling instructions to avoid the risk of misoperation caused by directly executing instructions, thereby improving the reliability of alarm handling. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0023] Figure 1 This is a flowchart illustrating an alarm processing method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of an alarm processing system architecture provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an alarm processing device provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.
[0025] In embodiments of the present invention, "multiple" refers to two or more. Terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.
[0026] This invention provides an alarm processing method for the automated analysis, processing, and fault recovery of alarms on cloud platforms.
[0027] Figure 1 This is a flowchart illustrating an alarm processing method provided in an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes the following steps: Step 110: Receive the original alarm information.
[0028] In this embodiment of the invention, the original alarm information comes from a cloud platform, such as cloud platforms in various fields such as manufacturing, energy, and transportation.
[0029] Step 120: Preprocess the original alarm information to generate alarm preprocessing results.
[0030] In this embodiment, after receiving the original alarm information, a lightweight, low-latency large language model can be used to preprocess the original alarm information, performing preliminary understanding and structuring of the unstructured original alarm information. The preprocessing results of the alarm include key alarm information, alarm type, and correlation with historical alarms.
[0031] In one possible implementation, preprocessing the original alarm information to generate a preprocessed alarm result includes the following steps: Step 121: Extract the core entity of the alarm from the original alarm information to obtain the key alarm information.
[0032] Extract core entities from the original alarm information text, such as the alarm source host IP, service name, error code, metric name, and anomaly description, to obtain key alarm information.
[0033] Step 122: Determine the carrier of the alarm based on the key alarm information to obtain the alarm type.
[0034] Based on the key alarm information, determine the carrier that caused the alarm (such as network, storage, computing, and application). Set the type of the carrier that caused the alarm as the alarm type (such as network type alarm, storage type alarm, computing type alarm, and application type alarm).
[0035] Step 123: Analyze the potential correlation between alarms and historical alarms to obtain the correlation degree between alarms and historical alarms.
[0036] Analyze whether there is a potential correlation between this alarm and recent historical alarms, obtain the correlation degree between the alarm and historical alarms, and determine whether the alarm is an isolated event or part of a potential fault chain based on the correlation degree, so as to clarify the fault propagation path.
[0037] After preprocessing, a structured preprocessed result is generated, providing high-quality input for subsequent in-depth analysis.
[0038] Step 130: Perform a risk assessment on the alarm based on the preprocessing results, and generate a processing decision type for the alarm based on the risk assessment results.
[0039] The processing strategy types include generating alarm processing solutions and automated processing. First, a risk assessment is performed on the alarm based on the preprocessing results. Then, a processing decision type is generated based on the risk assessment results. This allows the alarm to be distributed to different downstream processing agencies for further processing according to the processing decision type, optimizing the collaborative process. In one possible implementation, the risk assessment of the alarm based on the preprocessing results includes the following steps: Step 131: Based on the preprocessing results of the alarms, retrieve historical alarm processing solutions related to the alarms from the operation and maintenance knowledge base.
[0040] The operations and maintenance knowledge base can include historical fault databases, operations and maintenance manuals, and best practice documents. Specifically, based on the key alarm information and alarm type in the preprocessing results, the most relevant historical alarm handling solutions and context information can be retrieved from the operations and maintenance knowledge base through keyword matching and semantic similarity queries.
[0041] Step 132: Assess the impact of alarms on business, processing complexity, and scope of impact based on historical alarm handling plans.
[0042] By combining retrieved historical alarm handling solutions, the attributes of alarms are further enriched, including assessing the degree of impact, processing complexity, and scope of impact of the alarm on business. For example, the degree of impact on business is assessed into three levels: high, medium, and low, with the impact level on core business being higher than that on non-core business; the technical difficulty and resource consumption required to resolve the alarm are assessed into three processing complexities: difficult, medium, and easy; and the level and scope of the alarm's impact are assessed to determine the scope of impact, such as whether the alarm affects other hardware, cloud services, networks, storage, or applications.
[0043] It should be noted that the assessment level and scope can be set according to actual needs. For example, the impact of alarms on business can be assessed to obtain four levels: top, high, medium and low. This invention does not make specific limitations on this.
[0044] Step 133: The risk assessment result is obtained by combining the assessment results of the impact of alarms on business, the assessment results of processing complexity, and the assessment results of the scope of impact.
[0045] Specifically, a risk assessment result is obtained by comprehensively evaluating the impact of alarms on business, the processing complexity, and the scope of impact based on pre-defined processing rules. For example, the pre-defined processing rules include: if the processing complexity of an alarm is "easy" or "medium," and the impact on business is of "low" risk level with a controllable scope (e.g., affecting only a single service), then the risk assessment result for the alarm is: it can be handled automatically; otherwise, the risk assessment result for the alarm is: it requires handling by operations and maintenance personnel. For instance, if alarm A has a processing complexity of "medium" level, and the impact on business is of "low" risk level, affecting only a single cloud service, then the risk assessment result for the alarm is: it can be handled automatically; if alarm B has a processing complexity of "medium" level, and the impact on business is of "low" risk level, affecting both cloud services and the network, then the risk assessment result for the alarm is: it requires handling by operations and maintenance personnel; if alarm C has a processing complexity of "high" level, then the risk assessment result for the alarm is: it requires handling by operations and maintenance personnel. The processing rules can be set according to actual needs.
[0046] If the risk assessment result indicates that the alarm requires handling by operations and maintenance personnel, the generated alarm handling decision type is "Generate Alarm Handling Solution"; if the risk assessment result indicates that the alarm can be handled automatically, the generated alarm handling decision type is "Automatic Handling". If the alarm handling decision type is "Automatic Handling", proceed to step 140; if the alarm handling decision type is "Generate Alarm Handling Solution", proceed to step 160.
[0047] Step 140: If the alarm processing decision type is automated processing, then generate processing instructions for the alarm.
[0048] If the alarm handling decision type is automated processing, then based on the original alarm information, preprocessing results, historical alarm handling schemes related to the alarm, and descriptions of each tool, the appropriate tool is selected, and a structured tool invocation command is generated. The description of each tool includes the functions, invocation methods, parameter descriptions, etc. of various operation and maintenance APIs and scripts; the tool invocation command includes the name of the tool being invoked and the list of required parameters.
[0049] Step 150: Perform a security assessment on the alarm processing instructions. If the security assessment passes, execute the alarm processing instructions.
[0050] To ensure the safety and reliability of automated operations and avoid adverse effects from misoperation, the alarm processing instructions are not executed immediately after they are generated. Instead, a safety assessment is performed on the alarm processing instructions.
[0051] In one possible implementation, a security assessment is performed on the alarm processing instructions, including the following steps: Step 151: Generate operation execution steps based on the original alarm information and processing instructions.
[0052] The original alarm information and processing instructions are reorganized into a detailed, step-by-step operation execution procedure.
[0053] Step 152: Find supporting evidence for each step in the operation execution process.
[0054] For each step in the operation execution process, conduct a web search or knowledge base retrieval to find supporting evidence. If each step has supporting evidence, the security assessment passes; if any step lacks supporting evidence or there are contradictions between the steps, the security assessment fails.
[0055] In the above technical solution, by tracing the handling basis of similar alarms in the operation and maintenance knowledge base and historical cases, the rationality and feasibility of the generated alarm handling instructions are verified, ensuring the safety and reliability of automated operation and maintenance operations, and avoiding undue impact caused by incorrect operation and maintenance operations.
[0056] For alarm handling instructions that pass the security assessment, the alarm handling instructions are executed automatically, and the authorized execution tool calls the command to complete the alarm closed-loop processing; if the alarm handling instructions fail the security assessment, step 160 is executed.
[0057] Step 160: Generate alarm handling suggestions in natural language based on the original alarm information, preprocessing results, and historical alarm handling schemes related to the alarm.
[0058] If the alarm handling decision type is to generate an alarm handling plan or the alarm handling instruction fails the security assessment, then a clear and actionable natural language alarm handling suggestion will be generated based on the original alarm information, preprocessing results, and related historical alarm handling plans for reference by operations and maintenance personnel. The natural language alarm handling suggestion includes root cause analysis, handling steps, and rollback plan.
[0059] In the above technical solution, for alarms that are not suitable for automated operation and maintenance, natural language suggestions are provided, including root cause analysis, handling steps, and rollback solutions. This provides operation and maintenance personnel with clear and practical operation guidance, reduces the time cost of troubleshooting and decision-making for operation and maintenance personnel, and improves the efficiency of operation and maintenance.
[0060] After each operation and maintenance process is completed, record the full-chain log of this process, including the original alarm information, preprocessing results, knowledge base retrieval records, tool call commands, security assessment process, performance monitoring data and processing results, form a new case and archive it to the operation and maintenance knowledge base.
[0061] Based on the same technological concept Figure 2 An architecture diagram of alarm processing provided in an embodiment of the present invention is shown below. Figure 2 As shown, it includes an alarm preprocessing agent 210, an alarm analysis agent 220, a solution generation agent 230, a tool invocation agent 240, and a security assessment agent 250.
[0062] Alarm preprocessing agent 210 is used to receive the original alarm information, preprocess the original alarm information to generate the alarm preprocessing result, and send the alarm preprocessing result to alarm analysis agent 220.
[0063] Alarm analysis agent 220 is used to perform risk assessment on alarms based on the preprocessing results of alarms, and generate a handling decision type for the alarm based on the risk assessment level result. If the handling decision type of the alarm is to generate an alarm handling plan, the existing information is input into the plan generation agent 230; if the handling decision type of the alarm is to automate the process, the existing information is input into the tool invocation agent 240.
[0064] The scheme generation agent 230 is used to generate alarm processing suggestions in natural language based on the original alarm information, preprocessing results and historical alarm processing schemes related to the alarm.
[0065] The tool invokes agent 240 to generate processing instructions for the alarm and sends the processing instructions for the alarm to security assessment agent 250.
[0066] Security assessment agent 250 is used to perform security assessments on alarm processing instructions.
[0067] If the security assessment passes, the alarm processing instructions are executed; if the security assessment passes, the existing information is input into the solution generation agent 230.
[0068] An AI agent is an AI system that integrates perception, decision-making, action, and learning capabilities based on a large model. The specific AI model used by each agent can be selected based on actual needs. For example, a Large Language Model (LLM). By constructing a multi-agent collaborative model, alarms are classified, and alarms of different decision types are distributed to different agents for analysis. Based on the analysis results and alarm handling strategies, different tools are invoked to handle alarms or generate alarm handling solutions, thereby improving the automation level of cloud platform alarm handling. This has significant application value in ensuring cloud platform stability and improving operational efficiency.
[0069] It should be noted that the alarm processing system architecture provided in this embodiment of the invention can implement all the method steps implemented in the above-mentioned alarm processing method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.
[0070] To better understand the technical solution of the present invention, a specific example is given below to illustrate the processing flow of the present invention.
[0071] A data center cloud platform monitoring system detected a critical alarm for an application database (Service-ID: MySQL-Prod-01): "CPU utilization has consistently exceeded 95% for 5 minutes." This alarm was pushed to the multi-agent processing system described in this patent in real time.
[0072] System component and tool configuration: External knowledge base: including "MySQL Operation and Maintenance Manual", "Cloud Platform Emergency Response Plan", and historical failure case library.
[0073] • Available toolset (for tools to call upon intelligent agents): tool_query_slow_log: Queries the database slow log.
[0074] tool_kill_query(connection_id): Terminates the specified database session.
[0075] tool_scale_compute(service_id, cpu_core): Adjusts the computing scale.
[0076] Processing procedure: Step 1: Alarm Access and Preprocessing The alarm preprocessing agent received the original alarm text: "CRITICAL: Host [MySQL-Prod-01] CPU usage > 95% for 5 minutes".
[0077] 1) Key information extraction: Key entities extracted: Alarm source: MySQL-Prod-01, Metric: CPU usage, Value: >95%, Duration: 5 minutes, Level: CRITICAL.
[0078] 2) Basic Classification: Based on the keywords "MySQL" and "CPU", label them with database and computing type tags.
[0079] 3) Correlation analysis: Querying recent alarms revealed a "high disk I / O latency" alarm from the same host 10 minutes ago, indicating a correlation.
[0080] Step Two: In-depth Alarm Analysis and Strategy Formulation The alarm analysis agent receives the preprocessed results.
[0081] 1) Knowledge Base Retrieval: A search was conducted using keywords and semantics such as "MySQL CPU consistently high" and "IO latency." To improve search accuracy, tag categorization was used as a filtering condition. The knowledge base returned multiple relevant records, one of which, a historical case, indicated: "Slow concurrent queries are a common cause; it is recommended to first check the slow query logs and terminate abnormal queries; if this is ineffective, temporary capacity expansion can be considered." The retrieved database's handling rules were also identified: risk level "high," processing complexity "medium," and impact scope "core applications."
[0082] 2) Strategy Decision: According to the predefined rule: "If the alarm risk is high and the processing complexity is medium or low, then the tool should be invoked for automated alarm processing, but execution must be performed after a security assessment." Therefore, the decision is to generate a tool invocation command and submit it to the security assessment agent for review before execution.
[0083] Step 3: Task Distribution and Specific Processing Since the generation strategy automates alarm processing, the task is dispatched to the tool's invoking agent, which analyzes the context and performs the following steps: 1. Tool selection: First, select the tool_query_slow_log tool to diagnose the problem.
[0084] 2. Command generation: Generates the command to invoke this tool: tool_query_slow_log(service_id="MySQL-Prod-01", time_window="10m").
[0085] After executing the call, the returned results showed that there were indeed multiple long-running SELECT query statements that were blocked.
[0086] Step 4: Security Assessment and Automated Execution The tool invokes the agent to perform the next operation: terminate the abnormal session and execute the tool: tool_kill_query(connection_id="12345"). Before the command is executed, it is sent to the security assessment agent for evaluation. The evaluation process is as follows: 1. Operation Step Reorganization: The evaluation agent reorganizes the operation into a plan: "Step 1: Query the slow log to confirm the problem (completed). Step 2: Terminate the discovered abnormal query session (connection_id=12345)." 2. Knowledge Verification and Source Tracing: The evaluation agent verifies the "Step 2: Terminate Session" procedure. A search of the knowledge base reveals that the *MySQL Operations and Maintenance Manual* clearly states: "When CPU resources are exhausted by long-running queries, terminating the session is an effective emergency recovery measure." The historical case database also contains multiple records of successfully resolving similar issues using `kill_query`.
[0087] 3. Assessment and Execution: The security assessment agent passed the assessment. The system automatically executes the command `tool_kill_query(connection_id="12345")`.
[0088] 4. Result Verification and Closed Loop: After the command was executed, the system monitored that the CPU utilization of MySQL-Prod-01 rapidly decreased to 30% within 3 minutes. The alarm status automatically changed to "Recovered". The system automatically recorded the entire fault handling log and archived it to the knowledge base, forming a new case for subsequent learning.
[0089] This invention provides an alarm handling method that, by constructing a standardized alarm handling process, improves the automation level of alarm handling, reduces reliance on manual intervention, shortens alarm response and processing delays, and enhances operational efficiency. For alarms that can be handled automatically, a security assessment step is added to the alarm handling instructions to avoid the risk of misoperation caused by directly executing instructions, thereby improving the reliability of alarm handling.
[0090] The alarm processing apparatus provided by the present invention will be described below. The alarm processing apparatus described below can be referred to in correspondence with the alarm processing apparatus described above.
[0091] Figure 3 This is a schematic diagram of the structure of an alarm processing device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the device 300 includes: The receiving module 310 is used to receive the original alarm information of the alarm; The processing module 320 is used to preprocess the original alarm information to generate a preprocessing result of the alarm; the preprocessing result of the alarm includes key alarm information, alarm type and correlation with historical alarms; The processing module 320 is further configured to perform a risk assessment on the alarm based on the preprocessing result of the alarm, and generate a processing decision type for the alarm based on the risk assessment result; the processing strategy type includes generating an alarm processing plan and automated processing; The execution module 330 is used to generate a processing instruction for the alarm if the processing decision type of the alarm is automated processing. The execution module 330 is also used to perform a security assessment on the alarm processing instructions. If the security assessment passes, the alarm processing instructions are executed.
[0092] The processing module 320 is also used to extract the core entity of the alarm from the original alarm information to obtain the key alarm information; Based on the key alarm information, the carrier in which the alarm occurred is determined, and the alarm type is obtained; The potential correlation between the alarm and historical alarms is analyzed to obtain the correlation degree between the alarm and historical alarms.
[0093] The processing module 320 is also used to retrieve historical alarm processing solutions related to the alarm from the operation and maintenance knowledge base based on the preprocessing results of the alarm. The impact of the alarms on the business, the processing complexity, and the scope of impact are assessed based on the historical alarm handling scheme. The risk assessment level is obtained by combining the assessment results of the impact of the alarm on the business, the assessment results of the processing complexity, and the assessment results of the scope of impact.
[0094] The processing module 320 is also used to generate operation execution steps based on the original alarm information and processing instructions of the alarm; Find supporting evidence for each step in the operation execution steps; If each step is supported by evidence, the security assessment passes; if any step lacks supporting evidence or there are contradictions between the steps, the security assessment fails.
[0095] The processing module 320 is further configured to generate a natural language alarm processing suggestion for the alarm based on the original alarm information, preprocessing results and historical alarm processing schemes related to the alarm if the alarm processing decision type is to generate an alarm processing scheme or the security assessment fails. The alarm handling suggestions in the natural language include root cause analysis, handling steps, and rollback schemes.
[0096] The processing module 320 is also used to select a tool suitable for the alarm based on the original alarm information, preprocessing results, historical alarm processing schemes related to the alarm, and descriptions of each tool, and generate a structured tool invocation command; the tool invocation command includes the name of the tool to be invoked and a list of required parameters.
[0097] It should be noted that the alarm processing device provided in this embodiment of the invention can implement all the method steps implemented in the above-mentioned alarm processing method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.
[0098] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute alarm processing methods.
[0099] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0100] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the alarm processing methods provided by the above methods.
[0101] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the alarm processing methods provided by the above methods.
[0102] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0103] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. An alarm processing method characterized by comprising: The method comprises: receiving original alarm information of an alarm; preprocessing the original alarm information to generate preprocessing results of the alarm; the preprocessing results of the alarm comprise alarm key information, an alarm type and a correlation degree with historical alarms; risk assessment is performed on the alarm according to the preprocessing results of the alarm, and a processing decision type for the alarm is generated based on the risk assessment results; the processing strategy type comprises generating an alarm processing scheme and automatic processing; if the processing decision type of the alarm is automatic processing, a processing instruction for the alarm is generated; security assessment is performed on the processing instruction of the alarm, and if the security assessment passes, the processing instruction of the alarm is executed.
2. The alert processing method of claim 1, wherein, The preprocessing of the original alarm information to generate the preprocessing results of the alarm comprises: extracting core entities of the alarm from the original alarm information to obtain the alarm key information; determining a carrier where the alarm occurs based on the alarm key information to obtain the alarm type; analyzing potential correlations between the alarm and historical alarms to obtain the correlation degree between the alarm and historical alarms.
3. The alert processing method of claim 1, wherein, The risk assessment on the alarm according to the preprocessing results of the alarm comprises: based on the preprocessing results of the alarm, retrieving historical alarm processing schemes related to the alarm from an operation and maintenance knowledge base; evaluating the influence degree on a service, the processing complexity and the influence range of the alarm according to the historical alarm processing schemes; comprehensively obtaining the risk assessment results from the evaluation results of the influence degree on the service, the evaluation results of the processing complexity and the evaluation results of the influence range.
4. The alert processing method of claim 1, wherein, The security assessment on the processing instruction of the alarm comprises: generating operation execution steps according to the original alarm information and the processing instruction of the alarm; finding evidence support for each step in the operation execution steps; if there is evidence support for each step, the security assessment passes; if there is a lack of evidence support for any step or there is a contradiction between the operations of the steps, the security assessment does not pass.
5. The alert processing method of claim 3, wherein, The method further comprises: if the processing decision type of the alarm is to generate an alarm processing scheme or the security assessment does not pass, generating an alarm processing suggestion in natural language for the alarm based on the original alarm information, the preprocessing results of the alarm and the historical alarm processing schemes related to the alarm; the alarm processing suggestion in natural language comprises fault root cause analysis, processing steps and rollback schemes.
6. The alert handling method of claim 1, wherein, The generation of the processing instruction for the alarm comprises: based on the original alarm information, the preprocessing results of the alarm, the historical alarm processing schemes related to the alarm and the description of each tool, selecting a tool suitable for the alarm to generate a structured tool calling command; the tool calling command comprises a tool name to be called and a required parameter list.
7. An alarm processing apparatus characterized by comprising: The device comprises: a receiving module configured to receive original alarm information of an alarm; a processing module configured to preprocess the original alarm information to generate preprocessing results of the alarm; the preprocessing results of the alarm comprise alarm key information, an alarm type and a correlation degree with historical alarms; The processing module is further configured to perform risk assessment on the alarm according to a pre-processing result of the alarm, and generate a processing decision type for the alarm based on a risk assessment level; the processing decision type includes generating an alarm processing scheme and automatic processing. The execution module is configured to generate a processing instruction for the alarm if the processing decision type of the alarm is automatic processing. The execution module is further configured to perform security assessment on the processing instruction of the alarm, and execute the processing instruction of the alarm if the security assessment is passed.
8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, The processor executes the computer program to implement the alarm processing method in any one of claims 1 to 6. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the alarm processing method in any one of claims 1 to 6.
10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the alarm processing method in any one of claims 1 to 6.