Alarm processing method and data center monitoring system

Abstract

The invention provides an alarm processing method and a data center monitoring system, and relates to the technical field of computers. The method comprises the following steps: monitoring whether an alarm event occurs; if the alarm event is monitored, determining at least one alarm convergence rule matched with the alarm event; wherein the alarm convergence rule predefines a master cause alarm event and a slave cause alarm event which are associated and convergence effective time; and determining the event type of the alarm event in the alarm convergence rule, and converging the alarm event based on the event type of the alarm event and the effective convergence time. According to the method, the alarm events which meet the timeliness requirement and have causal relevance are converged according to the predefined alarm convergence rule, the number of redundant alarms is reduced, and the alarm processing efficiency is improved; meanwhile, the fault is quickly positioned through the main cause alarm event, and the fault operation and maintenance efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an alarm processing method and a data center monitoring system. Background Technology

[0002] Alarm technology is widely used in computer system operation and maintenance and business assurance. With the implementation of new technologies such as cloud computing and clustering, computer systems are becoming increasingly large-scale, and correspondingly, the number of alarm messages to be processed is increasing dramatically. For example, in data center scenarios, a large number of alarm messages may be received in a short period of time, such as UPS shutdown alarms and UPS mains power failure alarms generated by uninterruptible power supplies (UPS), as well as server downtime alarms and server network failure alarms generated by multiple servers connected to them. When there are many alarm messages, operation and maintenance personnel need to spend a lot of time analyzing them one by one, which may also lead to problems not being resolved in a timely manner, resulting in business losses.

[0003] Therefore, there is an urgent need for a solution to improve alarm management efficiency and enhance fault maintenance efficiency. Summary of the Invention

[0004] This application provides an alarm processing method and a data center monitoring system to address the problems of reduced efficiency in alarm management and fault maintenance.

[0005] In a first aspect, embodiments of this application provide an alarm processing method, the method comprising: monitoring whether an alarm event has occurred; if the alarm event is detected to have occurred, determining at least one alarm convergence rule matching the alarm event; wherein the alarm convergence rule predefines associated primary alarm events and secondary alarm events, as well as a convergence validity time; determining the event type of the alarm event in the alarm convergence rule, and converging the alarm event based on the event type of the alarm event and the convergence validity time.

[0006] In this embodiment, alarm events that meet both timeliness requirements and causal correlation are converged according to predefined alarm convergence rules, reducing the number of redundant alarms and improving alarm processing efficiency; at the same time, faults can be quickly located through the main cause alarm events, improving fault maintenance efficiency.

[0007] In one possible implementation, the step of converging the alarm event based on the event type of the alarm event and the convergence validity time includes: when the event type of the alarm event is a primary cause alarm event, caching the alarm event; when the caching duration of the alarm event is less than the convergence validity time, monitoring whether a secondary cause alarm event associated with the alarm event has occurred; if a secondary cause alarm event associated with the alarm event is detected, then converging the alarm event and the associated secondary cause alarm event.

[0008] The above provides a convergence process for when a primary cause alarm event occurs. First, the primary cause alarm event is cached, and then the secondary cause alarm event is waited for to occur within its effective convergence time to achieve convergence of alarm events.

[0009] In one possible implementation, after caching the alarm event, the method further includes: determining whether there are cached non-expired secondary alarm events associated with the alarm event; if there are cached non-expired secondary alarm events associated with the alarm event, then converging the alarm event and the associated non-expired secondary alarm events; if there are no cached non-expired secondary alarm events associated with the alarm event, then performing the step of monitoring whether the secondary alarm events associated with the alarm event have occurred when the caching duration of the alarm event is less than the effective convergence time.

[0010] The above takes into account that there may be secondary cause alarm events that occur before the primary cause alarm event. Therefore, it checks whether there are any secondary cause alarm events that have not yet expired in the cache to avoid omissions.

[0011] In one possible implementation, after caching the alarm event, the method further includes: determining the secondary alarm events associated with the alarm event in the alarm convergence rules; identifying the alarm generating device of the secondary alarm event associated with the alarm event, and detecting the alarm generating device to determine whether the secondary alarm event has occurred; and converging the secondary alarm events that have occurred.

[0012] After detecting the primary cause alarm time, the device proactively detects potential secondary cause alarm events, promptly identifying secondary cause alarm events that may not have been transmitted due to data collection delays or loss, thereby improving alarm convergence reliability and reducing omissions.

[0013] In one possible implementation, the step of converging the alarm event based on the event type of the alarm event and the convergence validity time includes: when the type of the alarm event is a secondary alarm event, determining whether there is a cached primary alarm event associated with the alarm event that has not expired; if there is a cached primary alarm event associated with the alarm event that has not expired, then converging the alarm event and the associated primary alarm event that has not expired.

[0014] The above provides a convergence process for cause alarm events. First, it checks if there is a cause alarm event that occurred earlier and has not expired in the cache. If so, it converges directly without caching, thus achieving convergence of alarm events.

[0015] In one possible implementation, the step of converging the alarm event and the associated non-expired primary cause alarm events if there are cached primary cause alarm events associated with the alarm event includes: if there are multiple non-expired primary cause alarm events associated with the alarm event in the cache, obtaining a convergence judgment factor between the alarm event and each primary cause alarm event; determining the convergence confidence between the alarm event and each primary cause alarm event based on the convergence judgment factor; determining a target primary cause alarm event from the multiple primary cause alarm events based on the convergence confidence, and converging the alarm event and the target primary cause alarm event.

[0016] The above considers that a secondary alarm event may be related to multiple primary alarm events. By introducing convergence judgment factors, such as time difference, equipment control relationship, and historical co-occurrence frequency, the primary alarm event with the highest probability of causing the secondary alarm event is identified, thereby achieving effective convergence.

[0017] In one possible implementation, after determining whether there is a cached non-expired primary cause alarm event associated with the alarm event, the method further includes: if there is no cached non-expired primary cause alarm event associated with the alarm event, then cache the alarm event; when the cache duration of the alarm event is less than the convergence validity time, monitor whether a primary cause alarm event associated with the alarm event has occurred; if a primary cause alarm event associated with the alarm event is detected, then converge the alarm event and the associated primary cause alarm event.

[0018] The above provides a convergence process for when a secondary cause alarm event occurs. If there is no primary cause alarm event that has occurred before and has not yet expired, the secondary cause alarm event is cached first. During its effective convergence time, it waits for the primary cause alarm event to occur, thereby achieving convergence of alarm events.

[0019] In one possible implementation, after monitoring whether the primary alarm event associated with the alarm event has occurred, the method further includes: if no primary alarm event associated with the alarm event is detected, then when the cache duration of the alarm event reaches the convergence effective time, the alarm event is reported and the alarm event in the cache is cleared.

[0020] The aforementioned secondary alarm events that were not detected within the effective convergence time will be reported as independent alarms to avoid missed reports.

[0021] In one possible implementation, after converging the alarm event based on the event type of the alarm event and the effective convergence time, the method further includes: obtaining the convergence result of converging the alarm event; and reporting the number of primary alarm events and secondary alarm events in the convergence result.

[0022] The above provides a method for reporting convergence results, which reports the number of primary and secondary alarm events in the convergence results. Compared with the method of merging primary and secondary alarm events for reporting, this simplifies the reporting content, helps improve alarm processing efficiency, quickly locates faults, and improves fault maintenance efficiency.

[0023] Secondly, embodiments of this application provide an alarm processing apparatus, comprising: a monitoring module for monitoring whether an alarm event occurs; a processing module for determining at least one alarm convergence rule matching the alarm event if the alarm event is detected to have occurred; wherein the alarm convergence rule predefines associated primary alarm events and secondary alarm events, as well as a convergence validity time; the processing module is further configured to determine the event type of the alarm event in the alarm convergence rule, and converge the alarm event based on the event type of the alarm event and the convergence validity time.

[0024] Thirdly, embodiments of this application provide a data center monitoring system, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the alarm processing method described in the first aspect above.

[0025] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described in the first aspect or any possible implementation thereof.

[0026] It is understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0027] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0028] Figure 1 This is an application scenario diagram of the alarm processing method provided in the embodiments of this application; Figure 2 This is a flowchart illustrating the implementation of an alarm processing method provided in an embodiment of this application. Figure 3 This is a flowchart of an alarm processing procedure for a primary cause alarm event provided in an embodiment of this application; Figure 4 This is a flowchart of an alarm processing procedure based on an alarm event, provided in an embodiment of this application. Figure 5 This is a schematic diagram of the alarm processing device provided in the embodiments of this application; Figure 6 This is a schematic diagram of the data center monitoring system provided in the embodiments of this application. Detailed Implementation

[0029] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0030] Alarm technology is widely used in data center system operation and maintenance and business assurance. With the implementation of new technologies such as cloud computing and clustering, data center systems are becoming increasingly large-scale, leading to a surge in the number of alarm messages to be processed. For example, in a data center scenario, a large number of alarm messages may be received in a short period, such as UPS shutdown alarms from uninterruptible power supplies (UPS) and server downtime alarms from multiple connected servers. When there are many alarm messages, administrators need to spend a significant amount of time analyzing them one by one, which may also lead to problems not being resolved in a timely manner, resulting in business losses. Therefore, there is an urgent need for a solution to improve the accuracy of alarm monitoring and management and enhance the efficiency of fault operation and maintenance.

[0031] Based on the above issues, and considering that some alarm events are related to the same root cause, the root cause alarm event can be called the primary cause alarm event, and the related non-root cause alarm events can be called secondary cause alarm events. Furthermore, considering that alarm events triggered by the same root cause will occur successively within a certain period, exhibiting timeliness, this application embodiment uses predefined alarm convergence rules to converge alarm events that meet both timeliness requirements and causal relationships. This avoids alarm storms caused by each alarm event being reported independently, improving alarm management efficiency by reducing the number of alarm event reports. Simultaneously, primary cause alarm events allow for rapid fault location, thereby improving fault maintenance efficiency.

[0032] Figure 1 This diagram illustrates an application scenario for the alarm processing method provided in the embodiments of this application. For example... Figure 1 As shown, the equipment involved in this application scenario includes a data center monitoring system; and multiple monitored devices connected to the data center monitoring system, such as... Figure 1 The devices shown are 1, 2 to n; maintenance terminal equipment.

[0033] When devices 1 through n malfunction, the data center monitoring system detects the corresponding alarm events. The data center monitoring system processes and converges the alarm events according to the alarm processing method provided in this application embodiment, so that related alarm events are converged together.

[0034] Optionally, the alarm events in the convergence results can be merged to form an alarm event set, which can then be sent to the maintenance terminal device for maintenance personnel to review. This eliminates the need to analyze each alarm event individually to find the root cause; by focusing on the primary alarm event in the alarm event set, the root cause can be quickly and accurately located, and the fault can be resolved.

[0035] It should be noted that the above application scenarios are only shown to facilitate understanding of the principles of this application, and the implementation of this application is not limited in any way in this respect. The implementation of this application can be applied to any applicable scenario.

[0036] The following is combined Figure 1 For application scenarios, see Figures 2 to 4 This application describes an alarm processing method provided according to an exemplary embodiment. The method can be implemented by a computer program, such as application software. The executing entity of the method can be a monitoring system that integrates or has the relevant computer program installed. The executing entity can also be a medium storing the relevant computer program, such as a USB flash drive or cloud drive; alternatively, the executing entity can be implemented by a physical device that integrates or has the relevant computer program installed, such as a computer or server. The following description uses a data center monitoring system as an example of the executing entity.

[0037] Figure 2 This is a flowchart illustrating the implementation of an alarm handling method provided in an embodiment of this application. Figure 2 As shown, the method may include the following steps: S201. Monitor whether alarm events occur.

[0038] Here, an alarm event is a notification or record generated by the data center monitoring system when it detects that the status of a monitored device or a certain indicator exceeds a preset normal threshold. Alarm events can originate from the monitored device or from pre-defined device measurement points.

[0039] Optionally, an alarm event may include a device type and alarm content, for example, an alarm event with device type = "UPS" and alarm content "shutdown"; an alarm event may also include a device measurement point and alarm content, for example, an alarm event with device measurement point = "A" and alarm content "network anomaly".

[0040] S202. If an alarm event is detected, at least one alarm convergence rule matching the alarm event is determined; wherein, the alarm convergence rule predefines the associated primary alarm event and secondary alarm event, as well as the effective convergence time.

[0041] In this step, operations and maintenance personnel set up multiple alarm convergence rules based on actual business scenarios. Each alarm convergence rule predefines the primary and secondary alarm events to be converged. By comparing the monitored current alarm events with the alarm events in the alarm convergence rules, the alarm convergence rules containing the current alarm events are determined.

[0042] A primary cause alarm event can generate multiple secondary cause alarm events; conversely, a secondary cause alarm event can also be associated with multiple primary cause alarm events. Therefore, an alarm event may be included in multiple alarm convergence rules. For example, for a primary cause alarm event, multiple alarm convergence rules can be configured, with different rules containing different secondary cause alarm events to meet different monitoring needs.

[0043] Optionally, in some embodiments, independent alarm convergence is performed for each alarm convergence rule. If the same alarm event conforms to multiple corresponding alarm convergence rules, it is converged into different alarm event sets respectively. In other embodiments, when the same alarm event conforms to multiple corresponding alarm convergence rules, one of the alarm convergence rules can be selected for convergence.

[0044] In this step, the alarm convergence rule typically includes one primary cause alarm event and multiple secondary cause alarm events. In some embodiments, if the same root cause of a problem generates multiple primary cause alarm events, and the secondary cause alarm events associated with each primary cause alarm event have a high degree of overlap, then these multiple primary cause alarm events can be aggregated into a single alarm convergence rule. This approach does not affect the fault location by maintenance personnel and can further reduce the number of alarm events.

[0045] In this step, the predefined primary and secondary relationship between the primary and secondary alarm events in the alarm convergence rules can be determined based on network connectivity and service call relationships between monitored devices; it can also be determined through temporal causal analysis of historical alarm events; or it can be determined based on the severity level of the alarm event, for example, defining high-severity alarm events as primary alarm events and low-severity alarm events as secondary alarm events; or alarm information sent from the infrastructure can be used as primary alarm events. This application embodiment does not limit the method for determining the event type of alarm events.

[0046] In this step, the alarm convergence rules also include a convergence validity period. On one hand, the convergence validity period limits the validity of each alarm event. Optionally, an alarm event becomes invalid and ceases to be converged when its duration exceeds the convergence validity period. On the other hand, the convergence validity period also limits the duration of the convergence process. During convergence, secondary alarm events generated during the validity period of the primary alarm event are converged together. Convergence of secondary alarm events stops after the primary alarm event becomes invalid, and the convergence process ends.

[0047] Optionally, the alarm convergence rule may also include a convergence name and a rule effective time. The convergence name identifies the alarm convergence rule and reveals the content of the alarm convergence; for example, the convergence name could be "UPS power failure caused server crash". The rule effective time includes the rule's start and end times, limiting the alarm convergence rule to activation only within a specific time frame. Therefore, when determining the alarm convergence rule for the current alarm event, it is necessary to select from the effective alarm convergence rules.

[0048] S203. Determine the event type of the alarm event in the alarm convergence rules, and converge the alarm event based on the event type and the effective convergence time.

[0049] Considering that there may be multiple alarm convergence rules determined in step 202, in some embodiments, the same alarm event may be a primary alarm event under one alarm convergence rule and a secondary alarm event under another. Furthermore, the convergence processes for primary and secondary alarm events differ. Therefore, after determining the alarm convergence rule corresponding to the current alarm event, it is further determined whether the event type of the current alarm event within that alarm convergence rule is a primary or secondary alarm event.

[0050] Here, we will take the alarm convergence processing of a primary alarm event and a secondary alarm event as an example to explain the role of the effective convergence time. When the primary alarm event occurs before its associated secondary alarm event, the timer starts from the moment the primary alarm event occurs. If the secondary alarm event occurs within the effective convergence time, the primary alarm event and the secondary alarm event are converged into an alarm event set and reported to the operation and maintenance terminal device. If the secondary alarm event does not occur within the effective convergence time, the primary alarm event will be reported to the operation and maintenance terminal device independently to avoid missed reports.

[0051] Optionally, the difference in the convergence process between primary and secondary alarm events can be reflected in the difference in the effective convergence time. Since primary alarm events are usually more severe and have a wider impact than secondary alarm events, and have a larger number of associated secondary alarm events, the effective convergence time of primary alarm events can be extended to converge as many associated secondary alarm events as possible.

[0052] Optionally, the difference in the convergence process between primary and secondary alarm events can also be reflected in the convergence steps. It can be understood that secondary alarm events converge following primary alarm events. When a secondary alarm event occurs before the primary alarm event, the secondary alarm event can be stored in a preset cache area. After the primary alarm event occurs, both the primary and secondary alarm events are then stored in the alarm convergence area, for example, converged into the alarm event set. Primary alarm events, on the other hand, can be directly stored in the alarm convergence area.

[0053] In this embodiment, alarm events that meet both timeliness requirements and causal correlation are converged according to predefined alarm convergence rules, avoiding alarm storms caused by each alarm event being reported independently. This improves alarm management efficiency by reducing the number of alarm events reported. At the same time, faults can be quickly located through the main cause alarm events, thereby improving fault maintenance efficiency.

[0054] The following is combined Figure 3 and Figure 4 The alarm handling process for primary cause alarm events and secondary cause alarm events is illustrated by examples.

[0055] Figure 3 This is a flowchart illustrating the alarm processing of a primary cause alarm event, as provided in an embodiment of this application; Figure 3 As shown, the method in this embodiment of the application, based on the event type and convergence validity time of the alarm event, may include: S301. When the event type of the alarm event is a primary cause alarm event, the alarm event is cached.

[0056] Here, when an alarm event matches a predefined primary cause alarm event in the current alarm convergence rule, the alarm event is treated as the primary cause alarm event and subsequent alarm processing steps are executed. Optionally, in step S301, the primary cause alarm event can be stored in a pre-defined alarm storage area for easy retrieval when a secondary cause alarm event is detected later.

[0057] S302. When the cache duration of an alarm event is less than the effective convergence time, monitor whether the associated cause alarm event has occurred.

[0058] Optionally, this step limits the cache duration by defining the effective convergence time, thereby limiting the validity of alarm events. Optionally, an alarm event is written to the cache immediately after it occurs. The cache duration of the alarm event represents how long ago the alarm event occurred.

[0059] Based on the principle that primary and secondary alarm events caused by the same root cause will occur successively within a certain period of time, secondary alarm events detected in this step during the period when the cache duration of the primary alarm event is less than the effective convergence time can be considered to be generated in association with the primary alarm event.

[0060] The effective convergence time can be determined based on experience in handling historical alarm events, or by analyzing the relationships between alarm events, such as business link relationships and call relationships. For different alarm convergence rules, the effective convergence time can be set based on various factors such as alarm severity level and device type.

[0061] It should be noted that although the alarm convergence rules predefine which alarm events are associated, a secondary alarm event may be triggered by a primary alarm event in different alarm convergence rules. Therefore, by limiting the effective convergence time in step S302, it is possible to determine that the detected secondary alarm events are more likely to be caused by the same root cause as the current primary alarm event.

[0062] S303. If a secondary alarm event associated with the alarm event is detected, then the alarm event and the associated secondary alarm events are converged.

[0063] Based on the foregoing analysis, secondary cause alarm events detected within a period when the cache duration of the primary cause alarm event is less than the effective convergence time can be considered to be caused by the same root cause as the primary cause alarm event. Therefore, convergence can be triggered.

[0064] Optionally, the steps to trigger convergence can be to aggregate the secondary cause alarm event and the primary cause alarm event into the same alarm event set, or to store them in the same alarm convergence area.

[0065] Optionally, for cached primary cause alarm events, if the cache duration is greater than or equal to the convergence validity time, the primary cause alarm event is deleted or marked as invalid in the cache area to prevent it from being retrieved again.

[0066] In one possible implementation, after caching the alarm event in step S301, the method further includes: S304. Determine whether there are any non-expired secondary alarm events associated with the alarm event that are cached.

[0067] It should be noted that for a secondary cause alarm event that has occurred earlier, but whose associated primary cause alarm event has not yet occurred, the secondary cause alarm event can be cached in a pre-defined alarm storage area. Its cache duration is also limited by the convergence validity period. Therefore, when the cache duration of the secondary cause alarm event is less than the convergence validity period, it is considered an unexpired secondary cause alarm event. Conversely, when the cache duration of the secondary cause alarm event is greater than or equal to the convergence validity period, it is considered an expired secondary cause alarm event.

[0068] If there are cached, non-expired secondary cause alarm events associated with the alarm event, then proceed to step S305: converge the alarm event and the associated non-expired secondary cause alarm events.

[0069] Considering that the order of alarm events caused by the same root cause is not fixed, the primary cause alarm event may occur before the secondary cause alarm event, and the secondary cause alarm event may occur before the primary cause alarm event. Step S305 realizes the convergence of secondary cause alarm events that occur before the primary cause alarm event, which improves the convergence efficiency and reduces the false negative probability.

[0070] If there are no cached, non-expired secondary cause alarm events associated with the primary cause alarm event, then step S302 is executed: when the cache duration of the alarm event is less than the convergence validity period, monitor whether the secondary cause alarm events associated with the primary cause alarm event have occurred. In other words, there may be no secondary cause alarm events that occurred before the primary cause alarm event, so step S302 waits for the secondary cause alarm events that occur later within the validity period of the primary cause alarm event.

[0071] In some embodiments, if no associated secondary alarm events are detected during the period when the cache duration of the primary alarm event is less than the effective convergence time in step S302, and if it is determined in step S304 that there are no cached secondary alarm events associated with the alarm event that have not expired, then the primary alarm event can be reported separately.

[0072] In one possible implementation, after caching the alarm event in step S301, the method further includes: (1) Determine the causal alarm events associated with the alarm event in the alarm convergence rules; (2) Identify the alarm generating device that is associated with the alarm event and detect the alarm generating device to determine whether a secondary alarm event has occurred; (3) Converge the alarm events that have occurred.

[0073] Considering that equipment failures may prevent alarm events from being sent in a timely manner, this implementation, upon detecting a primary alarm event, can determine potential secondary alarm events based on the corresponding alarm convergence rules. It then proactively initiates detection on the devices generating these secondary alarm events to determine whether they have actually occurred. Converging alarm events that have already occurred accelerates alarm processing and prevents missed alarms.

[0074] This application provides an alarm processing method for primary cause alarm events. It converges both earlier and later related secondary cause alarm events, and ensures the correlation between monitored primary and secondary cause alarm events by using a convergence validity period, thereby improving the reliability of alarm convergence. This application improves alarm processing efficiency by reducing the number of alarms; simultaneously, it enables rapid fault location through primary cause alarm events, improving fault maintenance efficiency.

[0075] Figure 4 This application provides an embodiment of an alarm processing flowchart based on an alarm event; as shown below. Figure 4 As shown, the method in this embodiment of the application, which converges alarm events based on the event type and convergence validity time of the alarm event, may include: S401. When the type of alarm event is a cause alarm event, determine whether there is a cached cause alarm event that is not expired and is associated with the alarm event.

[0076] Here, based on the foregoing Figure 3 The alarm handling process for primary cause alarm events shows that when a primary cause alarm event is detected, it is cached. Primary cause alarm events with a cache duration shorter than the convergence validity period are the non-expired primary cause alarm events that step S401 needs to query. Primary cause alarm events with a cache duration greater than or equal to the convergence validity period will not be queried in step S401.

[0077] S402. If there are cached, non-expired primary cause alarm events associated with alarm events, then converge the alarm events and associated non-expired primary cause alarm events.

[0078] In other words, if the primary cause alarm event associated with the current secondary cause alarm event occurs first, the current secondary cause alarm event can be directly converged, for example, by writing it into the corresponding alarm convergence region or alarm event set.

[0079] Since there may be multiple alarm convergence rules determined based on the secondary cause alarm events, multiple associated primary cause alarm events may be queried through step S401. In some embodiments, the secondary cause alarm event is written into the alarm convergence region or alarm event set corresponding to each primary cause alarm event to achieve convergence; in other embodiments, one primary cause alarm event is selected for convergence of secondary cause alarm events. Compared with the two types of embodiments, the former provides more comprehensive alarm convergence results, while the latter provides more accurate alarm convergence results, enabling rapid fault location.

[0080] Optionally, if step S402 has cached, non-expired root cause alarm events associated with the alarm event, then the alarm event and the associated non-expired root cause alarm events are converged, including: (1) If there are multiple non-expired primary cause alarm events associated with the alarm event in the cache, then obtain the convergence judgment factor between the alarm event and each primary cause alarm event; (2) Determine the convergence confidence between the alarm event and each main cause alarm event based on the convergence judgment factor; (3) Based on the convergence confidence, determine the target main cause alarm event from multiple main cause alarm events, and converge the alarm events and the target main cause alarm event.

[0081] In step (1), the convergence criterion factor may include the time difference between the occurrence of the primary cause alarm event and the secondary cause alarm event. Generally, the smaller the time difference, the higher the probability that the secondary cause alarm event and the primary cause alarm event originate from the same root cause of the problem.

[0082] Optionally, the convergence judgment factor in step (1) may also include the number or proportion of times the primary cause alarm event and the secondary cause alarm event co-occur in the same fault event in the historical period. The higher the number or proportion of times the primary cause alarm event and the secondary cause alarm event co-occur in the historical alarm events, the higher the probability that the secondary cause alarm event and the primary cause alarm event come from the same root cause of the problem in the current period.

[0083] Optionally, the convergence judgment factor in step (1) may also include the logical distance between the primary cause alarm event and the secondary cause alarm event. If there is a direct control relationship between the alarm generating devices corresponding to the primary cause alarm event and the secondary cause alarm event, compared with the indirect control relationship of the multi-layer control network, the probability that the secondary cause alarm event and the primary cause alarm event with a direct control relationship come from the same root cause is higher.

[0084] Furthermore, when there are multiple convergence judgment factors in step (1), they can be accumulated based on different weight coefficients to obtain the convergence confidence in step (2). The higher the convergence confidence, the higher the probability that the cause alarm event and the main cause alarm event are caused by the same root cause.

[0085] Optionally, in step (3), the primary cause alarm event with the highest convergence confidence can be selected as the target primary cause alarm event, or the primary cause alarm event with a convergence confidence within a preset range can be selected as the target primary cause alarm event. Here, the number of target primary cause alarm events can be one or more. Converging the primary cause alarm events into a set of alarm events corresponding to multiple primary cause alarm events can make the alarm convergence results more comprehensive.

[0086] In one possible implementation, after determining in step S401 whether there is a cached non-expired primary cause alarm event associated with the alarm event, the method further includes: S403. If there is no cached primary cause alarm event associated with the alarm event that has not expired, then cache the alarm event.

[0087] In other words, since none of the primary cause alarm events associated with the current secondary cause alarm event have occurred yet, the current secondary cause alarm event can be stored in a pre-defined alarm storage area for easy retrieval when related primary cause alarm events are detected later. Here, it can correspond to... Figure 3 Step S304.

[0088] S404. When the cache duration of an alarm event is less than the effective convergence time, monitor whether the main cause alarm event associated with the alarm event has occurred. S405. If a primary alarm event associated with an alarm event is detected, then the alarm event and the associated primary alarm event are converged.

[0089] In step S404, the cache duration is limited by the convergence validity time to restrict the validity of alarm events. Based on the principle that primary and secondary alarm events caused by the same root cause will occur successively within a certain period of time, in step S405, if an associated primary alarm event is detected within a period when the cache duration of the secondary alarm event is less than the convergence validity time, it can be considered that the primary alarm event and the secondary alarm event are likely to originate from the same root cause, and therefore, convergence can be triggered.

[0090] Optionally, the steps to trigger convergence can be to aggregate the secondary cause alarm event and the primary cause alarm event into the same alarm event set, or to store them in the same alarm convergence area.

[0091] Optionally, for cached cause alarm events, if the cache duration is greater than or equal to the convergence validity time, the cause alarm event is deleted or marked as invalid in the cache area to avoid being queried repeatedly.

[0092] In one possible implementation, after step S404 monitors whether the primary alarm event associated with the alarm event has occurred, the method further includes: S406. If no primary alarm event associated with the alarm event is detected, the alarm event will be reported and the alarm event in the cache will be cleared when the cache duration of the alarm event reaches the convergence effective time.

[0093] In other words, if there is no primary cause alarm event that occurred before the current secondary cause alarm event, and there is also no primary cause alarm event that occurred after it, then the secondary cause alarm event that has not been converged will be reported separately to the operation and maintenance terminal device through step S406 to avoid missed reporting.

[0094] In one possible implementation, after converging alarm events based on the event type and convergence validity time, the following is also included: (1) Obtain the convergence result of the alarm event convergence; (2) Report the number of primary cause alarm events and secondary cause alarm events in the convergence results.

[0095] The above implementation simplifies the convergence result. The convergence result includes the converged primary cause alarm event and multiple secondary cause alarm events. In some embodiments, the alarm events in the convergence result can be summarized and reported. In contrast, step (2) of this implementation reports the primary cause alarm event in the convergence result and the number of converged secondary cause alarm events, simplifying the reporting content, improving the alarm processing speed of operation and maintenance personnel, and enabling rapid fault location.

[0096] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0097] The following are device embodiments of this application. For details not described in detail, please refer to the corresponding method embodiments described above.

[0098] Figure 5 A schematic diagram of the alarm processing device provided in an embodiment of this application is shown, as follows: Figure 5 As shown, the alarm processing device 500 includes a monitoring module 501 and a processing module 502.

[0099] Monitoring module 501 is used to monitor whether an alarm event occurs; The processing module 502 is used to determine at least one alarm convergence rule that matches the alarm event if an alarm event is detected; wherein the alarm convergence rule predefines the associated main cause alarm event and secondary cause alarm event and the effective convergence time. The processing module 502 is also used to determine the event type of the alarm event in the alarm convergence rule, and to converge the alarm event based on the event type and the effective convergence time.

[0100] In one possible implementation, the processing module 502 is specifically used to cache the alarm event when the event type of the alarm event is a primary cause alarm event; The processing module 502 is further used to monitor whether a secondary alarm event associated with the alarm event has occurred when the cache duration of the alarm event is less than the effective convergence time. The processing module 502 is further used to converge the alarm event and the associated secondary alarm events if a secondary alarm event associated with the alarm event is detected.

[0101] In one possible implementation, after caching the alarm event, the processing module 502 is also used to determine whether there are any non-expired secondary alarm events associated with the alarm event that are cached. The processing module 502 is also used to converge the alarm event and the associated non-expired secondary alarm events if there are cached secondary alarm events associated with the alarm event. The processing module 502 is further configured to, if there is no cached non-expired secondary cause alarm event associated with the alarm event, perform the step of monitoring whether the secondary cause alarm event associated with the alarm event has occurred when the cache duration of the alarm event is less than the convergence validity time.

[0102] In one possible implementation, after caching the alarm event, the processing module 502 is also used to determine the dependent alarm events associated with the alarm event in the alarm convergence rules. The processing module 502 is also used to identify the alarm generating device of the secondary alarm event associated with the alarm event, and to detect the alarm generating device to determine whether a secondary alarm event has occurred. The processing module 502 is also used to converge the occurrence of cause alarm events.

[0103] In one possible implementation, the processing module 502 is specifically used to determine whether there is a cached primary cause alarm event associated with the alarm event when the type of the alarm event is a cause alarm event. The processing module 502 is further used to converge the alarm event and the associated non-expired main cause alarm event if there are cached main cause alarm events associated with the alarm event.

[0104] In one possible implementation, the processing module 502 is specifically used to obtain the convergence judgment factor between the alarm event and each main cause alarm event if there are multiple non-expired main cause alarm events associated with the alarm event in the cache. The processing module 502 is further used to determine the convergence confidence between the alarm event and each main cause alarm event based on the convergence judgment factor. The processing module 502 is further configured to determine the target primary cause alarm event from multiple primary cause alarm events based on the convergence confidence, and to converge the alarm events and the target primary cause alarm event.

[0105] In one possible implementation, after determining whether there is a non-expired primary cause alarm event associated with the alarm event, the processing module 502 is further configured to cache the alarm event if there is no non-expired primary cause alarm event associated with the alarm event. The processing module 502 is also specifically used to monitor whether the main cause alarm event associated with the alarm event has occurred when the cache duration of the alarm event is less than the effective convergence time. The processing module 502 is further used to converge the alarm event and the associated main alarm event if a main cause alarm event associated with the alarm event is detected.

[0106] In one possible implementation, after monitoring whether the primary alarm event associated with the alarm event has occurred, the processing module 502 is further configured to, if no primary alarm event associated with the alarm event is detected, report the alarm event and clear the alarm event in the cache when the cache duration of the alarm event reaches the convergence effective time.

[0107] In one possible implementation, after the processing module 502 converges the alarm events based on the event type and the effective convergence time of the alarm events, it is also used to obtain the convergence result of the alarm events; the processing module 502 is also used to report the number of the main cause alarm events in the convergence result and the number of the secondary cause alarm events in the convergence result.

[0108] Figure 6 This is a schematic diagram of the data center monitoring system provided in an embodiment of this application. Figure 6As shown, the data center monitoring system 600 of this embodiment includes a processor 601 and a memory 602. The memory 602 stores a computer program 603. When the processor 601 executes the computer program 603, it implements the steps in the various method embodiments described above. Alternatively, when the processor 601 executes the computer program 603, it implements the functions of each module / unit in the various device embodiments described above.

[0109] For example, computer program 603 may be divided into one or more modules / units, which are stored in memory 602 and executed by processor 601 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of computer program 603 in data center monitoring system 600.

[0110] The data center monitoring system 600 may include, but is not limited to, a processor 601 and a memory 602. Those skilled in the art will understand that... Figure 6 This is merely an example of a data center monitoring system 600 and does not constitute a limitation on the data center monitoring system 600. It may include more or fewer components than shown, or combine certain components, or different components. For example, the data center monitoring system 600 may also include input / output devices, network access devices, buses, etc.

[0111] Processor 601 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0112] The memory 602 can be an internal storage unit of the data center monitoring system 600, such as a hard drive or memory of the data center monitoring system 600. The memory 602 can also be an external storage device of the data center monitoring system 600, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the data center monitoring system 600. Furthermore, the memory 602 can include both internal storage units and external storage devices of the data center monitoring system 600. The memory 602 is used to store the computer program 603 and other programs and data required by the data center monitoring system 600. The memory 602 can also be used to temporarily store data that has been output or will be output.

[0113] For the sake of simplicity and clarity, only the above-described functional modules / units are used as examples. In practical applications, the functions described above can be assigned to different functional modules / units as needed. These modules / units can be implemented in hardware, software, or a combination of both.

[0114] This application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the methods described in the above-described method embodiments.

[0115] This application also provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the methods in the above-described method embodiments.

[0116] Computer programs include computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. Computer-readable media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0117] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not detailed or described in a particular embodiment can be referred to in the relevant descriptions of other embodiments. Unless otherwise specified or in conflict with logic, the terminology and / or descriptions between different embodiments are consistent and can be referenced interchangeably. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0118] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An alarm processing method, characterized in that, include: Monitor for alarm events; If the alarm event is detected, at least one alarm convergence rule matching the alarm event is determined; wherein the alarm convergence rule predefines the associated primary alarm event and secondary alarm event, as well as the effective convergence time. The event type of the alarm event in the alarm convergence rule is determined, and the alarm event is converged based on the event type of the alarm event and the effective convergence time.

2. The alarm processing method according to claim 1, characterized in that, The process of converging alarm events based on the event type and the effective convergence time includes: When the event type of the alarm event is a primary cause alarm event, the alarm event is cached; When the cache duration of the alarm event is less than the convergence effective time, monitor whether the associated cause alarm event has occurred. If a secondary alarm event associated with the alarm event is detected, then the alarm event and the associated secondary alarm event are converged.

3. The alarm processing method according to claim 2, characterized in that, After caching the alarm event, the method further includes: Determine whether there are any non-expired secondary alarm events associated with the alarm event cached; If there are cached, non-expired secondary cause alarm events associated with the alarm event, then convergence is performed on the alarm event and the associated non-expired secondary cause alarm events. If there is no cached non-expired secondary alarm event associated with the alarm event, then the step of monitoring whether the secondary alarm event associated with the alarm event has occurred when the cache duration of the alarm event is less than the convergence validity time is executed.

4. The alarm processing method according to claim 2 or 3, characterized in that, After caching the alarm event, the method further includes: Identify the dependent alarm events associated with the alarm event in the alarm convergence rules; Identify the alarm generating device associated with the cause alarm event and detect the alarm generating device to determine whether the cause alarm event has occurred; The aforementioned cause-related alarm events that have already occurred are converged.

5. The alarm processing method according to claim 1, characterized in that, The process of converging alarm events based on the event type and the effective convergence time includes: When the type of the alarm event is a cause alarm event, determine whether there is a cached non-expired primary cause alarm event associated with the alarm event; If there are cached, non-expired primary cause alarm events associated with the alarm event, then convergence is performed on the alarm event and the associated non-expired primary cause alarm events.

6. The alarm processing method according to claim 5, characterized in that, If there are cached, non-expired primary cause alarm events associated with the alarm event, then the alarm event and the associated non-expired primary cause alarm events are converged, including: If there are multiple non-expired primary cause alarm events associated with the alarm event in the cache, then obtain the convergence judgment factor between the alarm event and each primary cause alarm event; Based on the convergence judgment factor, determine the convergence confidence between the alarm event and each of the main cause alarm events; Based on the convergence confidence, a target primary cause alarm event is determined from the plurality of primary cause alarm events, and the alarm event and the target primary cause alarm event are converged.

7. The alarm processing method according to claim 5, characterized in that, After determining whether there is a cached, non-expired primary cause alarm event associated with the alarm event, the method further includes: If there is no cached primary cause alarm event associated with the alarm event that has not expired, then the alarm event is cached. When the cache duration of the alarm event is less than the effective convergence time, monitor whether the main cause alarm event associated with the alarm event has occurred; If a primary alarm event associated with the alarm event is detected, then the alarm event and the associated primary alarm event are converged.

8. The alarm processing method according to claim 7, characterized in that, After monitoring whether the primary alarm event associated with the alarm event has occurred, the method further includes: If no primary alarm event associated with the alarm event is detected, the alarm event is reported and cleared from the cache when the cache duration of the alarm event reaches the convergence effective time.

9. The alarm processing method according to claim 1, characterized in that, After converging the alarm events based on the event type and the convergence validity time, the process further includes: Obtain the convergence result for the alarm event; The number of primary cause alarm events and secondary cause alarm events in the convergence results shall be reported.

10. A data center monitoring system, characterized in that, The system includes a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the alarm processing method as described in any one of claims 1 to 9.

Images