Alarm information processing method and device and electronic equipment

Abstract

The application provides an alarm information processing method and device and electronic equipment, which can be applied to the technical field of network security. The method comprises the following steps: processing multi-dimensional fields of each alarm information in an alarm information stream based on a preset strategy to obtain initial aggregation information, wherein the preset strategy comprises an accuracy control strategy of selecting multiple dimension information from a candidate dimension set for aggregation based on a service type, and an efficiency control strategy of aggregating an information source field and a device field indicating an alarm source based on a device type; in the case that there is a candidate aggregation information matching the initial aggregation information in a candidate aggregation information set, and the candidate aggregation information is in an open state, adding the initial aggregation information to the candidate aggregation information and updating condition information to obtain updated aggregation information and updated condition information respectively; in the case that the number of alarms in the updated aggregation information is greater than a number threshold in the updated condition information, generating and sending alarm aggregation information.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to an alarm information processing method, apparatus, and electronic device. Background Technology

[0002] A single underlying failure in a monitoring system can easily lead to a massive, repetitive, or related number of alarm events within a short period, creating an alarm storm. This results in problems such as overwhelming critical alarms, overloading notification channels, and low operational efficiency. Regarding the handling of alarm storms, existing technologies suffer from low flexibility in alarm strategies and fixed alarm triggering conditions, making them difficult to apply to different alarm scenarios. Summary of the Invention

[0003] In view of the above problems, the present invention provides an alarm information processing method, apparatus and electronic device.

[0004] According to a first aspect of the present invention, an alarm information processing method is provided, comprising: processing multi-dimensional fields of each alarm information in an alarm information stream based on a preset strategy to obtain initial aggregate information, wherein the preset strategy includes a precision control strategy for selecting multiple dimension information from a candidate dimension set for aggregation based on service type, and an efficiency control strategy for aggregating information source fields and device fields indicating the alarm source based on device type; when there are candidate aggregate information matching the initial aggregate information in the candidate aggregate information set, and the candidate aggregate information is in an open state, adding the initial aggregate information to the candidate aggregate information and updating the condition information for triggering alarm operations in the preset strategy, thereby obtaining updated aggregate information and updated condition information respectively; and generating and sending alarm aggregate information when the number of alarms in the updated aggregate information is greater than the number threshold in the updated condition information.

[0005] According to embodiments of the present invention, a precision control strategy that flexibly selects and combines multiple dimensions of information from a candidate dimension set based on business type achieves refined and customizable aggregation of alarm information in specific scenarios, improving the adaptability and control precision of the strategy. Simultaneously, the efficiency control strategy, through device type-based aggregation logic, provides users with a simple aggregation scheme, lowering the usage threshold and improving processing efficiency. By updating the condition information used to trigger alarm operations, the aggregated events can more completely cover the continuously occurring fault cycle, avoiding unreasonable alarm splitting caused by fixed windows. A gradient triggering mechanism that generates and sends alarm aggregation information when the number of alarms exceeds a threshold achieves periodic gradient notifications. This avoids alarm storm interference and allows for continuous and quantitative perception of fault scale and development, thereby improving the manageability of alarm information while ensuring continuous monitoring of fault status.

[0006] According to an embodiment of the present invention, the multi-dimensional fields of each alarm information in the alarm information stream are processed based on a preset strategy to obtain initial aggregated information, including: when the service type field in the multi-dimensional field indicates that the alarm information is at least one of database type, environment type, and network type, the combined information obtained by combining at least two of the region field, information source field, device field, and priority field in the multi-dimensional field is used as the initial aggregated information; when the device type field in the multi-dimensional field indicates that the device corresponding to the alarm information is a specific device, the first combined field obtained by combining the information source field and the device identifier field in the device field is used as the aggregated information.

[0007] According to an embodiment of the present invention, the above method further includes: when the device type field indicates that multiple devices in the alarm information belong to the same device group, using the second combined field obtained by combining the information source field, the device identifier field, and the device grouping field in the device field as aggregated information.

[0008] According to an embodiment of the present invention, the method further includes: obtaining an alarm propagation graph with devices as nodes and relationship information as edges based on the device identification field and the relationship information between multiple devices; determining at least one connected subgraph from the alarm propagation graph where the correlation between nodes is greater than a correlation threshold, identifying the devices in the connected subgraph as a set of associated devices, the set of associated devices having a logical aggregation identifier; and updating the device identification field using the logical aggregation identifier when the device type field indicates that the device corresponding to the alarm information belongs to the set of associated devices, so as to obtain a first combination field or a second combination field based on the updated device identification field.

[0009] According to an embodiment of the present invention, adding initial aggregation information to candidate aggregation information and updating the condition information in a preset strategy for triggering aggregation alarm operations to obtain updated aggregation information and updated condition information respectively includes: adding the initial aggregation information as new aggregation information to candidate aggregation information to obtain updated aggregation information, the updated aggregation information having an additional width for extending the window width in the condition information, the window width being used to determine the open state of the candidate aggregation information; updating the window width in the condition information based on the added duration to obtain the updated window width, which is used as the updated condition information.

[0010] According to an embodiment of the present invention, the method further includes: performing convolution operation on the combined features obtained by combining the distribution features representing the interval between adjacent alarms, the intensity features representing the alarm outbreak state, the periodic features representing the alarm persistence state, and the current window width in the previous alarm information stream to obtain time-series features; using preset weights to perform weighted summation on the sub-features at each time point in the time-series features to obtain weighted features; and based on the scaling factor obtained by converting the weighted features and the preset window width range, obtaining an initial width representing the basic width of the recommended window, as the window width.

[0011] According to an embodiment of the present invention, the method further includes: in response to detecting that the number of times alarm aggregation information is sent within a preset time period is greater than a threshold, updating the window width to a first width, wherein the first width is smaller than the window width; and in response to detecting that the number of alarms in the alarm aggregation information is less than a preset threshold, updating the window width to a second width, wherein the second width is larger than the window width.

[0012] According to an embodiment of the present invention, generating and sending alarm aggregation information includes: inputting the update region field, the update information source field, the policy identifier and the number of aggregated alarms in the update aggregation information into a preset template, generating alarm aggregation information and sending it.

[0013] A second aspect of the present invention provides an alarm information processing apparatus, comprising: a processing module, configured to process multi-dimensional fields of each alarm information in an alarm information stream based on a preset strategy to obtain initial aggregate information, wherein the preset strategy includes a precision control strategy for selecting multiple dimensions of information from a candidate dimension set based on service type for aggregation, and an efficiency control strategy for aggregating information source fields and device fields indicating the alarm source based on device type; an information determination module, configured to add the initial aggregate information to the candidate aggregate information and update the condition information for triggering alarm operations in the preset strategy when there are candidate aggregate information matching the initial aggregate information in the candidate aggregate information set and the candidate aggregate information is in an open state, thereby obtaining updated aggregate information and updated condition information respectively; and a generation module, configured to generate and send alarm aggregate information when the number of alarms in the updated aggregate information is greater than the number threshold in the updated condition information.

[0014] A third aspect of the present invention provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0015] A fourth aspect of the present invention also provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0016] A fifth aspect of the present invention also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0017] The above-described features, other objects, and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0018] Figure 1 This diagram illustrates an application scenario of the alarm information processing method, apparatus, and electronic device according to embodiments of the present invention.

[0019] Figure 2 A flowchart illustrating an alarm information processing method according to an embodiment of the present invention is shown schematically.

[0020] Figure 3A This illustration schematically shows an example diagram of a window width update process according to an embodiment of the present invention;

[0021] Figure 3B A flowchart illustrating an alarm information processing method according to another embodiment of the present invention is shown schematically;

[0022] Figure 4 This schematic diagram illustrates the structural block diagram of an alarm information processing system according to an embodiment of the present invention;

[0023] Figure 5 This schematic diagram illustrates the structure of an alarm information processing apparatus according to an embodiment of the present invention.

[0024] Figure 6 A block diagram of an electronic device suitable for implementing an alarm information processing method according to an embodiment of the present invention is shown schematically. Detailed Implementation

[0025] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the invention. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the invention for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0029] In large-scale, highly complex network information architectures, monitoring systems are crucial for ensuring business stability. However, a single underlying failure (such as network device downtime or core service crash) can cause the monitoring system to generate a massive number of repetitive or related alarm events in a short period of time, creating an alarm storm.

[0030] Alarm storms can cause serious problems. For example, due to a large number of duplicate alarm notifications, it becomes difficult for operations and maintenance personnel to identify the true root cause of the fault, thus drowning out critical alarms. For example, overloaded notification channels (email, SMS, instant messaging, etc.) can lead to delays or loss of important alarms and low operational efficiency.

[0031] One example employs a fixed time window or simple grouping strategy. For instance, within a fixed 5-minute window, alarms with the same name in an alarm storm are merged into a single alarm. However, this approach has the following drawbacks: the fixed window is inflexible; if alarms continue to be generated at the end of the window, they may be split into two aggregation groups, failing to accurately reflect a continuous fault event; threshold handling is coarse, setting only a static silence or suppression threshold, simply discarding or notifying all alarms when exceeded, lacking a tiered, intelligent notification mechanism; and aggregation dimensions are limited, with most alarm methods only supporting aggregation by single dimensions such as alarm name, host address, and identifier, lacking multi-dimensional, customizable combination conditions, resulting in poor adaptability to different alarm scenarios.

[0032] In view of this, embodiments of the present invention provide an alarm information processing method, apparatus, and electronic device. The method includes: processing multi-dimensional fields of each alarm information in an alarm information stream based on a preset strategy to obtain initial aggregated information, wherein the preset strategy includes a precision control strategy for selecting multiple dimension information from a candidate dimension set based on service type for aggregation, and an efficiency control strategy for aggregating information source fields and device fields indicating the alarm source based on device type; when there are candidate aggregated information matching the initial aggregated information in the candidate aggregated information set, and the candidate aggregated information is in an open state, adding the initial aggregated information to the candidate aggregated information and updating the condition information used to trigger alarm operations in the preset strategy, respectively obtaining updated aggregated information and updated condition information; when the number of alarms in the updated aggregated information is greater than the number threshold in the updated condition information, generating and sending alarm aggregated information.

[0033] According to embodiments of the present invention, a precision control strategy that flexibly selects and combines multiple dimensions of information from a candidate dimension set based on business type achieves refined and customizable aggregation of alarm information in specific scenarios, improving the adaptability and control precision of the strategy. Simultaneously, the efficiency control strategy, through device type-based aggregation logic, provides users with a simple aggregation scheme, lowering the usage threshold and improving processing efficiency. By updating the condition information used to trigger alarm operations, the aggregated events can more completely cover the continuously occurring fault cycle, avoiding unreasonable alarm splitting caused by fixed windows. A gradient triggering mechanism that generates and sends alarm aggregation information when the number of alarms exceeds a threshold achieves periodic gradient notifications. This avoids alarm storm interference and allows for continuous and quantitative perception of fault scale and development, thereby improving the manageability of alarm information while ensuring continuous monitoring of fault status.

[0034] Figure 1 The diagram illustrates an application scenario of the alarm information processing method, apparatus, and electronic device according to embodiments of the present invention.

[0035] like Figure 1 As shown, application scenario 100 according to this embodiment may include an alarm device 101, a network 102, and a server 103. The network 102 is used as a medium to provide a communication link between the alarm device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0036] Users can use alarm device 101 to interact with server 103 via network 102 to receive or send messages, etc. Various communication client applications can be installed on alarm device 101, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0037] Alarm device 101 can refer to various devices capable of generating and reporting raw alarm information, such as business servers, network routers, switches, firewalls, and IoT sensing devices. Alarm device 101 is used to generate raw alarm information containing multi-dimensional fields based on its own monitoring status (such as CPU utilization, network packet loss, interface failure, etc.). These fields include at least a field identifying the device type, a field identifying the service type, an information source field indicating the source of the alarm, and a device field, and are the source of the raw alarm data.

[0038] Server 103 can refer to a physical or virtual server that deploys and runs the alarm information processing method, and is the processor for alarm aggregation processing. For example, server 103 loads and processes the alarm information stream received from alarm device 101 via network 102 according to a preset strategy. For each alarm, server 103 simultaneously applies a precision control strategy (dynamically selecting multiple dimensions from a predefined candidate dimension set and combining them based on the business type field in the alarm) and an efficiency control strategy (fixedly combining them based on device type, information source field, and device field) to generate a key value representing the aggregation group, i.e., the initial aggregation information.

[0039] For example, server 103 maintains a candidate aggregation information set in memory, where each entry represents an aggregation event that is in an open state (i.e., its associated sliding window timer has not expired). When new initial aggregation information is generated, server 103 searches the candidate aggregation information set for a matching entry. If a matching entry exists and is in an open state, an addition operation is performed (increasing the alarm count), and the condition information associated with the entry is updated (e.g., refreshing the end time of the sliding window).

[0040] It should be noted that the alarm information processing method provided in the embodiments of the present invention can generally be executed by server 103. Correspondingly, the alarm information processing device provided in the embodiments of the present invention can generally be located in server 103. The alarm information processing method provided in the embodiments of the present invention can also be executed by a server or server cluster that is different from server 103 but can communicate with alarm device 101 and / or server 103. Correspondingly, the alarm information processing device provided in the embodiments of the present invention can also be located in a server or server cluster that is different from server 103 but can communicate with alarm device 101 and / or server 103.

[0041] It should be understood that Figure 1 The number of alarm devices, networks, and servers shown is merely illustrative. Any number of alarm devices, networks, and servers can be included depending on implementation needs.

[0042] Figure 2A flowchart illustrating an alarm information processing method according to an embodiment of the present invention is shown.

[0043] like Figure 2 As shown, the alarm information processing method of this embodiment includes operations S210 to S230.

[0044] In operation S210, the multi-dimensional fields of each alarm information in the alarm information stream are processed based on preset strategies to obtain initial aggregated information. Among them, the preset strategies include a precision control strategy that selects multiple dimensions of information from the candidate dimension set for aggregation based on service type, and an efficiency control strategy that aggregates the information source field and device field indicating the source of the alarm based on device type.

[0045] In operation S220, if there is candidate aggregation information in the candidate aggregation information set that matches the initial aggregation information and the candidate aggregation information is in an open state, the initial aggregation information is added to the candidate aggregation information and the condition information used to trigger alarm operation in the preset strategy is updated, thereby obtaining updated aggregation information and updated condition information respectively.

[0046] In operation S230, if the number of alarms in the updated aggregate information is greater than the number threshold in the updated condition information, alarm aggregate information is generated and sent.

[0047] In embodiments of the present invention, a preset strategy can be used to guide how alarm information streams are grouped and aggregated, for example, by setting the aggregation dimensions, time windows, and conditions for triggering alarm notifications. A precision control strategy can allow for the free selection and combination of multiple dimensions from a set of candidate dimensions to form custom composite aggregation conditions that meet actual alarm requirements. An efficiency control strategy can use the information source field (identifying the monitoring system) and the device field (identifying the host) as aggregation keys, and can selectively add device types for filtering.

[0048] Multidimensional fields can refer to multiple attribute fields included in alarm information, such as service type, device type, region, information source, device (including device identifier), priority, etc. Initial aggregation information can refer to the logical grouping identifier obtained by extracting corresponding dimension values ​​from the multidimensional fields of an alarm arriving at the current time, based on its matched preset strategy, and calculating or combining them; this can be an aggregation key value. The candidate aggregation information set can refer to the set of all currently open aggregation events. This set can be stored in a state repository, where each element (candidate aggregation information) represents an ongoing aggregation group, containing its aggregation key, alarm count, window timer, and other state information.

[0049] An open state refers to the state where the dynamic sliding time window associated with a candidate aggregation information (i.e., an aggregation event) has not yet timed out. As long as matching alarms are continuously added within the time window of this event, the window's end time will be continuously extended, and the event will remain in an open state. Updating aggregation information refers to the aggregation event information after adding updated alarms to the matching candidate aggregation information, updating its cumulative alarm count and other statuses. Updating condition information refers to updating (extending) the sliding window end time of the aggregation event after adding alarms. Alarm aggregation information can be a compressed notification digest generated and sent by the notification gateway when the number of alarms within an aggregation event reaches an integer multiple of a threshold.

[0050] Taking monitoring a production database using monitoring tool A as an example, an efficiency control strategy is adopted, with the information source field selected as "A-Production", the device field selected as "Host M Cluster", the window T = 5 minutes, and the number threshold N = 50. At a certain moment, the disk of database host db-master-01 begins to report errors. The first alarm arrives at 10:00, and its initial aggregation information is calculated as (A-Production, db-master-01). No candidate aggregation information matching the initial aggregation information is found in the candidate aggregation information set. Therefore, an update aggregation information is created, with a window of 10:00-10:05. Subsequent alarms continue to be generated. After alarms arrive at 10:02 and 10:03, they all match the update aggregation information and are in an open state, and are added to the update aggregation information. The window is refreshed to 10:08 and 10:13 each time. The alarm count continues to increase. When the alarm count reaches 50 at 10:05, an alarm aggregation information is generated and sent.

[0051] Taking the monitoring of transaction service latency in a financial application as an example, a precision control strategy is adopted. The initial aggregation information is "Application Name (dimension derived from alarm label) + Interface Name (dimension derived from alarm label) + Alarm Level". Window T = 3 minutes, N = 20. When the latency of the "Create Order" interface of "Payment Service" is found to exceed the duration threshold, an alarm is generated. The alarm label is app=payment, api=create_order, and the level is "Warning". Initial aggregation information (payment, create_order, warning) can be generated based on the above information. Since the initial aggregation information appears for the first time, an updated aggregation information is created. In the next 3 minutes, alarm information streams for the same service and interface are generated and aggregated into the updated aggregation information. When the number of alarms reaches an integer multiple of 20 (e.g., 40), alarm aggregation information is sent, indicating that the warning-level latency of the "Payment Service - Create Order Interface" is accumulating.

[0052] According to embodiments of the present invention, a precision control strategy that flexibly selects and combines multiple dimensions of information from a candidate dimension set based on business type achieves refined and customizable aggregation of alarm information in specific scenarios, improving the adaptability and control precision of the strategy. Simultaneously, the efficiency control strategy, through device type-based aggregation logic, provides users with a simple aggregation scheme, lowering the usage threshold and improving processing efficiency. By updating the condition information used to trigger alarm operations, the aggregated events can more completely cover the continuously occurring fault cycle, avoiding unreasonable alarm splitting caused by fixed windows. A gradient triggering mechanism that generates and sends alarm aggregation information when the number of alarms exceeds a threshold achieves periodic gradient notifications. This avoids alarm storm interference and allows for continuous and quantitative perception of fault scale and development, thereby improving the manageability of alarm information while ensuring continuous monitoring of fault status.

[0053] According to an embodiment of the present invention, the multi-dimensional fields of each alarm information in the alarm information stream are processed based on a preset strategy to obtain initial aggregated information, including: when the service type field in the multi-dimensional field indicates that the alarm information is at least one of database type, environment type, and network type, the combined information obtained by combining at least two of the region field, information source field, device field, and priority field in the multi-dimensional field is used as the initial aggregated information; when the device type field in the multi-dimensional field indicates that the device corresponding to the alarm information is a specific device, the first combined field obtained by combining the information source field and the device identifier field in the device field is used as the initial aggregated information.

[0054] In embodiments of the present invention, the service type field can be used to characterize the classification identifier of the service category or application scenario to which the alarm belongs. The device type field can be used to characterize the identifier of the hardware or logical device category that generated the alarm. The combined information can be information obtained by selecting at least two from the candidate dimension set of the region field, information source field, device field, and priority field of the multi-dimensional field when the service type field indicates a specific type (e.g., database, network, etc.). The first combined field can be information obtained by fixedly combining the information source field with the device identifier field in the device field when the device type field indicates a specific device.

[0055] For example, when a user-defined multidimensional field has an aggregation key (Key), including but not limited to a combination of at least two fields such as region field, information source field, device group field, device identifier field (e.g., host name), alarm level field, and alarm identifier field, alarm aggregation will only be performed if all aggregation key values ​​of the alarm match exactly.

[0056] For example, users can select multiple dimensions from a predefined pool of field dimensions to form a composite aggregation key. This pool of dimensions includes, but is not limited to, region fields, information source fields, device grouping fields, device identifier fields, alarm level fields, and alarm identifier fields.

[0057] The Region field can be used to identify the physical or logical data center region from which the alarm originated. The Source field can be used to identify the type and instance of the monitoring system from which the alarm originated (e.g., City A node, Prometheus - Production Environment). The Device Identifier field can be used to identify the unique hostname or IP address of the entity device (e.g., server) that generated the alarm. The Alarm Level field can be used to identify the severity of the alarm (e.g., Fatal, Warning, Informational). The Alarm Identifier field can be key-value pairs used to indicate contextual information (e.g., service=mysql, env=prod).

[0058] For example, an e-commerce system monitoring system generates a slow database query alarm. The multidimensional fields include: Business Type = "Database Type", Region = "East China - Availability Zone A", Information Source = "DB Monitoring", Device = {"Device Identifier": "db-node-07", "Device Type": "MySQL"}, and Priority = "Warning". By identifying the multidimensional fields, the Business Type field can be determined to be "Database Type". Based on a preset strategy (e.g., combining the Region, Information Source, and Priority fields for database type alarms), the values ​​"East China - Availability Zone A", "DB Monitoring", and "Warning" are selected from these fields and combined to obtain the combined information: (East China - Availability Zone A, DB Monitoring, Warning), which serves as the initial aggregation information for this alarm.

[0059] For example, a data center monitoring system generates a hardware alarm for server C due to overheating. Its multidimensional fields include: Business Type = "Instrumentation", Device Type = "Server C", Region = "North China", Information Source = "Hardware Monitoring", Device = {"Device Identifier": "host-12"}, and Priority = "Critical". By parsing the multidimensional fields, it is found that the Device Type field is "Server C" (a specific device). Then, using an efficiency control strategy, the Information Source field "Hardware Monitoring" and the Device Identifier field "host-12" from the Device field are extracted and combined into the first combined field: ("Hardware Monitoring, host-12"), which serves as the initial aggregated information for this alarm.

[0060] In related technologies, fine-grained aggregation is achieved by writing complex aggregation rules for each scenario, which leads to complex management. The embodiments of this invention encapsulate flexibility after the judgment of the business type field. Users only need to predefine the combination of dimensions they are interested in for alarms of different business types (e.g., "database type, region of interest, and priority"), and it will be automatically applied. This provides a flexible and efficient shortcut for common, standard device monitoring scenarios (identified by the device type field), achieving a balance between fine-grained and fast processing. It can handle complex business monitoring needs while processing a large number of infrastructure alarms, thus optimizing overall operational efficiency.

[0061] According to an embodiment of the present invention, the method further includes: when the device type field indicates that multiple devices in the alarm information belong to the same device group, using the second combined field obtained by combining the information source field, the device identifier field, and the device grouping field in the device field as the initial aggregation information.

[0062] In embodiments of the present invention, the information source field can refer to the field in the alarm information used to uniquely identify which monitoring system and its instance the alarm originates from. The device group field can be used to identify logical server groups (e.g., server group B node) divided according to business functions and environment. The second combination field can be a unique string or composite key formed by concatenating or combining the values ​​of the information source field, the device identifier field, and the device group field in sequence, under the condition that "the devices belong to the same device group".

[0063] For example, if a node named node-05.prod.com under a "Production Environment Worker Node" group experiences memory exhaustion, the generated alarm message includes: Information Source field = "Production k", Device Type field = "K Node" (implicitly indicating the existence of a device group), and Device field = {Device Identifier: "node-05.prod.com", Device Group: "prod-k-worker"}. By parsing the Device Type field as "K Node" and confirming that its Device Group field (prod-k-worker) meets the preset conditions, the three fields are combined: ("Production k", "node-05.prod.com", "prod-k-worker") as the initial aggregation information.

[0064] Using the information source field + device identifier field as the aggregation key, with the device grouping field as an optional aggregation key, simplifies configuration and is suitable for efficient aggregation at the infrastructure level. For example, by employing a preset, mandatory aggregation key combination (information source field + host identifier field), the need to quickly identify "which specific device under which monitoring system" has failed can be met. To further refine the grouping, embodiments of this invention use the device grouping field as an optional enhanced filtering condition.

[0065] For example, in scenarios where the data source instance is small or the device grouping is not important, the device grouping field can be omitted, and alarm information with the same device identifier (e.g., hostname) under the selected information source can be aggregated, regardless of which logical group these hosts belong to.

[0066] For example, in scenarios where it is necessary to quickly identify faults within a specific business device group (such as all database hosts), a filter condition can be added during aggregation. Alarm information will only be aggregated if it simultaneously meets the following conditions: it comes from a specified information source, belongs to a specified device group, and has the same hostname.

[0067] Understandably, by using fixed and optional dimensions, the cognitive load and usage threshold for users are reduced, achieving efficient one-click deployment while retaining necessary flexibility and improving the user experience.

[0068] In related technologies, relying solely on a combination of information source and device identifier can easily lead to mixed alarms from different services when devices are shared across multiple business groups, interfering with judgment. While precision control strategies are flexible, they are complex to configure. The embodiments of this invention introduce a device grouping field as a mandatory aggregation dimension into the efficiency control strategy, providing a new device aggregation mode oriented towards business groups. This eliminates the need to customize complex rules for each business scenario; instead, it utilizes existing business grouping tags on the device to automatically upgrade the aggregation granularity from physical devices to physical devices within business units. This maintains the simplicity of the efficiency control strategy while achieving isolation at the business dimension, meeting the needs of complex monitoring environments with multi-tenant and multi-service sharing of devices without increasing configuration complexity.

[0069] According to an embodiment of the present invention, the method further includes: obtaining an alarm propagation graph with devices as nodes and relationship information as edges based on the device identification field and the relationship information between multiple devices; determining at least one connected subgraph from the alarm propagation graph where the correlation between nodes is greater than a correlation threshold, identifying the devices in the connected subgraph as a set of associated devices, the set of associated devices having a logical aggregation identifier; and updating the device identification field using the logical aggregation identifier when the device type field indicates that the device corresponding to the alarm information belongs to the set of associated devices, so as to obtain a first combination field or a second combination field based on the updated device identification field.

[0070] In embodiments of the present invention, relational information can refer to information about logical, physical, or business dependencies between devices. The alarm propagation graph can be a graph-like data structure constructed using devices identified by the device identification field as nodes and dependencies or connections defined by the relational information as edges. It can reflect potential paths along which faults in the system may propagate along inter-device dependencies. A connected subgraph can be a subgraph extracted from the alarm propagation graph, where any two nodes are directly or indirectly connected by edges, and their correlation degree satisfies a condition greater than a correlation degree threshold.

[0071] A set of associated devices can be a collection of all nodes (devices) in a connected subgraph, where these devices are strongly coupled in terms of topology and function. A logical aggregation identifier is a unique identifier assigned to an associated device set to logically represent this device group. Updating the device identifier field means that when an alarm's device type field indicates that its corresponding device belongs to a certain associated device set, the logical aggregation identifier of that set can be used to replace or overlay the original device identifier field of the alarm.

[0072] For example, for a certain e-commerce application, relationship information (such as "order service calls payment service" and "payment service calls inventory service") can be obtained from service mesh or tracing data. The device identification field of each microservice instance (such as pod-order-svc-abc123, pod-payment-svc-def456) can be used as nodes and the call relationship can be used as edges to build an alarm propagation graph.

[0073] Through graph analysis, it was found that the call relationships between the three device nodes of order service, payment service and inventory service are close, forming a connected subgraph. Their internal correlation (such as call frequency and latency) is much higher than the correlation threshold, so they are defined as a set of related devices and assigned the logical aggregation identifier "Transaction Core Link-L01".

[0074] The inventory service pod-inventory-svc-789 experienced a database slowdown, which propagated upstream, causing timeout alerts to be generated in the payment service pod-payment-svc-def456 and the order service pod-order-svc-abc123. Since these three devices belong to the "Transaction Core Link - L01" set, the device identifier field in the alert information was uniformly updated to the logical aggregation identifier before aggregation.

[0075] Assuming an efficiency control strategy is adopted (generating the first combined field), the aggregation key for these three alarms will become (Prometheus-Production, Transaction Core Link-L01), thus being aggregated into the same dynamic sliding window event. The alarm aggregation information can be displayed as "Transaction Core Link-L01 has generated 3 alarms," ​​indicating that these 3 alarms represent a distributed fault that runs through the core link, rather than three independent issues.

[0076] Traditional methods aggregate data using fixed dimensions (such as hostnames or service groups), making it difficult to identify the interconnected effects of physically independent but logically and topologically tightly coupled devices during failures. Embodiments of this invention construct alarm propagation graphs and analyze connected subgraphs to automatically and dynamically identify highly correlated groups of devices (sets of associated devices). During aggregation, a logical aggregation identifier is used to uniformly represent this group, intelligently converging a series of alarms across multiple physical devices caused by the same root cause (such as network partitioning or core dependency failures) into a single aggregated event. This changes the granularity of alarm aggregation, shifting from post-event manual correlation analysis to pre-event intelligent pre-correlation, thus improving the accuracy of alarm aggregation for complex failures in distributed systems and microservice architectures.

[0077] According to an embodiment of the present invention, adding initial aggregation information to candidate aggregation information and updating the condition information for triggering alarm operations in a preset strategy to obtain updated aggregation information and updated condition information respectively includes: adding the initial aggregation information as new aggregation information to candidate aggregation information to obtain updated aggregation information, the updated aggregation information having an additional width for extending the window width in the condition information, the window width being used to determine the open state of the candidate aggregation information; updating the window width in the condition information based on the additional width to obtain an updated window width, which is used as updated condition information.

[0078] In embodiments of the present invention, the condition information may be rule information in a preset strategy used to control the lifecycle of aggregated events and trigger notifications, such as time conditions used to determine the open state of aggregated events. The window width may refer to the time length T of the sliding time window (aggregation window) defined in the condition information, which is the basis for determining whether the aggregated event is still in an open state where it can receive new alarm information.

[0079] The added width can be a fixed, sequential extension period. For example, whenever new aggregated information is added, the expiration time of the aggregated event can be shifted forward by a full window width T. The updated window width can be a dynamically calculated result. For example, based on the current time and the added width T, the new expiration time of the aggregated event is recalculated, causing the end time of the window to be shifted forward by T.

[0080] For example, define an aggregation window with a duration of T = 5 minutes. This aggregation window is sliding, and its starting point is not fixed. Starting from the first alarm message that meets the aggregation criteria, all alarms meeting the same aggregation criteria will be aggregated into the same event within the next T minutes. Whenever a new alarm is aggregated into this event, the window's end time is automatically extended by T minutes until no new alarms are generated within T minutes, at which point the aggregation window officially closes.

[0081] Taking the dynamic window extension under continuous database server failure as an example, an aggregation event already exists for host DB-Server-01. Its candidate aggregation information is: aggregation key = (Prometheus, DB-Server-01), alarm count = 45, and the window expiration time in the condition information is 10:10:00 (i.e., window width T = 5 minutes). At 10:08:00, this host generates another CPU overload alarm. By calculating its initial aggregation information, which is also (Prometheus, DB-Server-01), the above aggregation event is matched.

[0082] This alarm can then be added as a new aggregated information, updating the alarm count in the aggregated information to 46. Based on the preset window width T=5 minutes, the expiration time is extended by 5 minutes from 10:10:00 (adding width), resulting in an updated window width of 10:13:00, which is the updated expiration time. This time is then written into the update condition information.

[0083] It is understandable that as the number of alarms increases, the window end time of the aggregated event is reset. As long as the fault continues and alarms continue to arrive before 10:13:00, the window will continue to be extended to ensure that all relevant alarms are aggregated.

[0084] Figure 3A The illustration shows an example diagram of a window width update process according to an embodiment of the present invention.

[0085] like Figure 3A As shown, the dynamic sliding window width update process 30 includes: the first alarm message 31 is generated at 10:00, the window is opened, and the window width 311 is preset to 5 minutes, that is, from 10:00 to 10:05.

[0086] At 10:04, the second alarm message 32 was generated, indicating that the fault was still ongoing. In response to the new alarm, the window end time was postponed to 10:09, and the first updated window width 321 was from 10:00 to 10:09.

[0087] At 10:08, the third alarm message 33 was generated, and the window end time was postponed again to 10:13. The second update window width 331 is from 10:00 to 10:13.

[0088] No new alarm messages were generated between 10:08 and 10:13, and the window was closed.

[0089] Understandably, the active window mechanism can prevent the fault from being fragmented due to the fault spanning two fixed time points; the closing time of the window depends on the actual stopping time of the fault, rather than a fixed time point set by the user, thus ensuring the integrity of the fault life cycle and facilitating root cause localization and severity assessment.

[0090] For example, for each newly generated alarm message, initial aggregate information (aggregate key value) can be calculated according to a preset strategy, thereby searching in memory for whether there is an open sliding window aggregate event and whether its aggregate key value matches the aggregate key value of the current alarm message.

[0091] If it exists, the current alarm information is compressed into the aggregated event, and the sliding window timer of the aggregated event is updated (e.g., the window end time is postponed by T minutes). If it does not exist, a new aggregated event is created for the current alarm information, and a sliding time window is initialized.

[0092] It should be noted that the preset strategy must follow the exact match principle. An alarm will only be compressed into an existing aggregate event if all the aggregate key values ​​configured in a newly generated alarm event completely match the key values ​​of that existing aggregate event. This is to ensure the accuracy of the aggregation behavior, especially in scenarios where specific types of alarms (such as specific level database alarms from a specific business cluster) are tracked independently.

[0093] Traditional fixed-window solutions have boundary limitations. For example, a 6-minute fault occurring at the boundary of two 5-minute windows (e.g., the first 4 minutes in the second window and the last 2 minutes in the first window) can be incorrectly segmented into two independent aggregated events, easily misjudged as two brief faults. The embodiments of this invention employ a "new alarm trigger window extension" mechanism, decoupling the window's closing time from its natural time point and instead linking it to the fault's active state. As long as the fault persists (alarms are generated), the window width T is continuously added as a new width, and the window's end time is continuously extended (updating condition information). This allows the aggregation results to accurately and intuitively reflect the fault's duration and severity, improving the accuracy and interpretability of alarm information.

[0094] According to an embodiment of the present invention, the method further includes: performing convolution operation on the combined features obtained by combining the distribution features representing the interval between adjacent alarms, the intensity features representing the alarm outbreak state, the periodic features representing the alarm persistence state, and the current window width in the previous alarm information stream to obtain time-series features; using preset weights to perform weighted summation on the sub-features at each time point in the time-series features to obtain weighted features; and based on the scaling factor obtained by converting the weighted features and the preset window width range, obtaining an initial width representing the basic width of the recommended window, as the window width.

[0095] In embodiments of the present invention, distribution features can characterize the statistical distribution (such as mean, variance, quantile) of the time intervals between adjacent alarms, used to quantify the sparsity or density of alarms. Intensity features can characterize the severity of alarm outbreaks, such as the number of alarm peaks per unit time and the gradient of alarm rate changes, which can be used to identify burst traffic. Periodic features can characterize the repetitive or periodic patterns of alarm persistence, which can be extracted through Fourier transform or autocorrelation analysis, used to discover regular alarms caused by timed tasks or periodic loads.

[0096] The combined features can be data from multiple dimensions, such as distribution features, intensity features, periodic features, and the current window width, which are aligned and concatenated according to the time series to form a multidimensional temporal tensor. Temporal features can be higher-level abstract feature representations obtained after convolution operations, indicating the deep temporal patterns related to the window width setting in the original combined features. Preset weights can be used to evaluate the importance of sub-features at different historical moments (i.e., slices of temporal features at each time step) to the current window width decision.

[0097] Weighted features can be a comprehensive feature vector obtained by weighting and summing the sub-features of each time step in the time series features with preset weights. It is a condensed summary of effective information within the entire historical analysis period. The scaling factor can be a scaling factor obtained by transforming the weighted features through a fully connected layer or scaling function. The preset window width range can be a valid window width interval set according to business needs, such as [T_min, T_max], which is a constraint condition. The initial width or recommended basic window width can be a basic recommended value obtained by applying the scaling factor to the current window width, and then constraining it (e.g., through the Clip function) within the preset window width range, resulting in a suggested window width value that can be directly used by the strategy.

[0098] Taking the automatic recommendation of window width for slow query alerts in databases as an example, by parsing the slow query alert information stream of the "production MySQL cluster" in the past 24 hours, the distribution characteristics are calculated as "average interval of 5 seconds, large variance, and sudden occurrence", the intensity characteristics are "10 alerts per second during an outbreak", and the periodic characteristics are "no significant periodicity". The current window width is the default 5 minutes.

[0099] The above features are combined into a composite feature, which is then input into a pre-trained convolutional neural network for convolution operations to obtain time-series features. Preset weights indicate a greater focus on the burst patterns of the most recent hour. After weighted summation, a weighted feature is obtained, and the output scaling factor after transformation is 2.5 (the model determines that such sudden, dense alarms require a wider window to accommodate a complete fault batch). Therefore, 5 minutes × 2.5 = 12.5 minutes is calculated. Checking the preset window width range of [1, 30] minutes, 12.5 minutes falls within this range, and an initial window width of 12.5 minutes is recommended.

[0100] For sudden, dense alarms, traditional fixed window widths may be too short, causing the same fault to be split; for sparse, long-period alarms, the window may be too long, causing irrelevant alarms to be merged, resulting in low aggregation accuracy. The embodiments of this invention analyze the distribution, intensity, and periodic characteristics of historical alarms and utilize convolutional operations for automatic learning. This allows for the recommendation of the most suitable window width for different types of alarm streams, making the aggregation window configuration adaptive to the alarm behavior itself, fundamentally improving the accuracy and rationality of subsequent aggregation logic.

[0101] According to an embodiment of the present invention, the method further includes: in response to detecting that the number of times alarm aggregation information is sent within a preset time period is greater than a threshold, updating the window width to a first width, wherein the first width is smaller than the window width; and in response to detecting that the number of alarms in the alarm aggregation information is less than a preset threshold, updating the window width to a second width, wherein the second width is larger than the window width.

[0102] In embodiments of the present invention, the preset time period can be a set time length for observation and statistics, such as the past hour or the most recent 30 minutes. The frequency threshold can characterize the maximum number of times alarm aggregation information is allowed to be sent within the preset time period. Alarm aggregation information can refer to a compressed notification summary generated and sent by the notification gateway when the number of alarms in the aggregated event reaches an integer multiple of the preset threshold N. Its format can include summary information such as information source, policy identifier, aggregation key, and the number of compressed alarm messages.

[0103] The alarm count can refer to the original number of alarms aggregated in a single alarm aggregation message. For example, if the alarm aggregation message displays "100 alarms compressed," then its alarm count is 100. The first width can be the new value to which the window width will be updated when notification overload is detected; a first width smaller than the window width indicates a reduction in window width. The second width can be the new value to which the window width will be updated when insufficient aggregation is detected; a second width greater than the window width indicates an expansion of window width.

[0104] For example, a server crashes, generating hundreds of related alarms per second. The current window width is 5 minutes, and the alarm count threshold N=100. Due to the high alarm generation rate, the number of alarms within the same aggregate event reaches N=100 within 2 minutes, triggering the first alarm aggregation message. In the following 3 minutes, due to the continuous accumulation of alarms, 4 more alarm notifications are triggered. That is, a total of 5 notifications are sent within the preset 5-minute time period. The preset alarm count threshold M is 3 (i.e., no more than 3 alarm notifications per hour). When 5>3 is detected, it is determined as "notification overload," and the window width is updated from 5 minutes to a first width of 3 minutes (first width < original window width).

[0105] Understandably, by reducing the window width, individual events will time out after 3 minutes, preventing alarms from accumulating indefinitely. Although the total number of events may increase, the rate at which each event accumulates to N=100 events slows down, thus significantly reducing the frequency of notifications triggered per unit of time and avoiding the impact of alarm storms on the operations and maintenance system.

[0106] For example, a network link experiences intermittent high latency, generating 1-2 alarm messages per minute. The current window width is 2 minutes, and the alarm count threshold N=20. Due to the slow alarm generation rate, only 3-5 alarms accumulate when a 2-minute window closes, far below N=20. Alarm aggregation messages are still sent, but the number of alarms is only in the single digits. If the number of alarms in the continuously detected aggregated alarm messages is consistently less than the preset threshold N (e.g., only 25% of N), it is determined that aggregation is insufficient, and the window fails to effectively compress the alarms. In response to the detection of insufficient aggregation, the window width can be updated from 2 minutes to a second width of 5 minutes (second width > original window width).

[0107] Understandably, expanding the window allows for the aggregation of sparse alarms (potentially 10-15 in total) generated over a longer period (e.g., 5 minutes) with the same root cause into a single event. While still not reaching N=20, the aggregation ratio is significantly improved, reducing the number of scattered notifications and making fault signals more concentrated and clear.

[0108] In related technologies, the initially preset window width (even if intelligently recommended) is a predicted width based on historical patterns, while the actual alarm information flow may change over time and with changes in business operations. The embodiments of this invention improve real-time adaptability to actual alarm situations by continuously monitoring the aggregation effect (frequency and density of aggregated alarm information) during runtime and dynamically adjusting the window width. Whether facing sudden storms or sparse, continuous alarms, it can automatically adjust parameters to achieve a balance between storm suppression and effective aggregation, realizing online adaptive and continuous optimization of parameter configuration and significantly improving the system's robustness under different pressure scenarios.

[0109] According to an embodiment of the present invention, generating and sending alarm aggregation information includes: inputting the update region field, the update information source field, the policy identifier and the number of aggregated alarms in the update aggregation information into a preset template, generating alarm aggregation information and sending it.

[0110] In embodiments of the present invention, the update region field can be a value extracted from the update aggregation information that identifies the geographical or logical region associated with the alarm, such as the "cloud center" or "region" dimension. The update information source field can be a value extracted from the update aggregation information that identifies the monitoring system and instance from which the alarm originates, such as the data source dimension.

[0111] The strategy identifier can be a unique name or ID assigned to the precision control strategy and efficiency control strategy in the preset strategy, such as "MySQL core library alarm aggregation strategy" or "Strategy_DB_01". The preset template can be a predefined message format framework containing fixed text and placeholders for inserting dynamic variables.

[0112] For example, if the number of alarms exceeds a threshold, an alarm aggregation message is generated and sent to a designated object. This alarm aggregation message does not contain all alarm details, but rather a highly summarized summary.

[0113] For example, the format is: "Title: Compressed alarm reaches storm threshold reminder; Body: [xxxxx]; Cloud center update area field: [specific name]; Update information source field: [type]-[name]; Policy identifier: [policy name]; Alarms have been compressed [X] (where X=N×k, k=1,2,3...)".

[0114] For example, if a worker node fails, alarms will continue to be generated. When the number of alarms in the aggregated event reaches N=100, an aggregated alarm message will be generated.

[0115] In the updated aggregate information, the updated region field = "City A-Region a1", the updated information source field = "Pxx-prod", and the aggregated alarm count = 100. The policy identifier of the preset policy matched by this event is "Worker Node Monitoring (Emergency)". Therefore, the preset template associated with this policy can be called. The preset template content is: "[Emergency Compressed Alarm]\n; Region: {Region}\n; Data Source: {Information Source}\n; Policy: {Policy Identifier}\n; Summary: The target resource continues to be abnormal, and {Aggregated Alarm Count} related alarms have been compressed. Please handle immediately."

[0116] Input the update region field, update information source field, policy identifier, and number of aggregated alarms from the update aggregation information into the preset template to generate alarm aggregation information: [Emergency Compression Alarm]\n; Region: City A-Region a1\n; Information Source: Pxx-prod\n; Policy: Kxx-Worker Node Monitoring (Emergency)\n; Summary: The target resource is continuously abnormal, and 100 related alarms have been compressed. Please handle it immediately.

[0117] Traditional alarms often consist of long texts containing a list of original alarm titles, with key information (such as location, source, and scale) buried in the alarm storm, resulting in time-consuming parsing. Embodiments of this invention use preset templates to force key metadata (region, information source, policy identifier, number of aggregations) to be explicitly presented in structured field format. This ensures that alarm aggregation information follows a unified and standardized format, reducing the cognitive load of information parsing and accelerating situation assessment.

[0118] Figure 3B A flowchart illustrating an alarm information processing method according to another embodiment of the present invention is shown.

[0119] like Figure 3B As shown, the alarm information processing method includes operations S301 to S308.

[0120] When operating S301, receive alarm information streams sent in real time by alarm devices.

[0121] In operation S302, multiple dimension fields of each alarm message are extracted to generate initial aggregate information. For example, the initial aggregate information is "Business System A_CPU_Alarm".

[0122] In operation S303, query whether there is candidate aggregation information in the candidate aggregation information set that matches the initial aggregation information, and determine whether the candidate aggregation information is in an open state. If yes, execute operation S304; if no, execute operation S308.

[0123] In operation S304, the initial aggregation information is added to the candidate aggregation information to obtain the updated aggregation information.

[0124] In operation S305, the window width used to trigger the alarm operation is updated based on the updated aggregation information to obtain the updated window width.

[0125] In operation S306, determine whether the number of alarms in the updated aggregate information is greater than the number threshold. If yes, proceed to operation S307; otherwise, continue with operation S301.

[0126] During operation S307, aggregated alarm information is generated and sent.

[0127] In operation S308, new aggregated information is generated.

[0128] In one feasible embodiment, taking host group A1 in monitoring system A as an example, the preset aggregation strategy can be to select the "control by same hostname" mode, select "monitoring system A - city C 192.168.1.1" as the data source, and select "host group A1" as the host group identifier. The aggregation window width is set to 5 minutes. The storm threshold can be set to 100 entries.

[0129] Suppose that Host-A11 in host group A1 generates an alarm message at 10:00, create an aggregate event Event-A11 with an initial window width of 10:00-10:05.

[0130] At 10:04, Host-A11 generated new alarm information, which was aggregated into Event-A11, and the window width was updated to 10:00-10:09.

[0131] At 10:08, the number of alarms reached 100, exceeding the threshold. The window width was updated to 10:00-10:13. An alarm notification was sent: "100 alarms have been compressed."

[0132] Alarms continued to be generated, and at 10:13 the number of alarms reached 200, exceeding the threshold again. The window width was updated to 10:00-10:18. A second notification was sent: "Alarms have been reduced by 200".

[0133] The last alarm was generated at 10:18. No alarms were generated between 10:18 and 10:23, and the window was closed at 10:23. Event-A11 ultimately aggregated 230 alarms.

[0134] It is understandable that the operations and maintenance personnel only received 2 compressed notification emails during this period, instead of 230 alarm SMS messages, which effectively avoided the storm. It can be known that the faulty host was Host-A11, and the failure lasted for about 18 minutes, which had a serious impact.

[0135] Figure 4 A schematic diagram of the alarm information processing system according to an embodiment of the present invention is shown.

[0136] The alarm information processing method in this embodiment of the invention can be implemented using the alarm information processing system 40. For example... Figure 4 As shown, the alarm information processing system 40 may include a policy management module 41, an alarm information processing device 500, a status storage module 43, and a notification module 44.

[0137] The policy management module 41 can be used to provide a configuration interface and store user-defined aggregation policies. For example, it can provide a graphical configuration interface, offering users an intuitive web graphical user interface for defining, editing, and deleting preset policies for alarm aggregations. This interface can guide users in configuring preset policies, aggregation keys, the window width of the sliding window, the number threshold, notification channels, and the list of object information.

[0138] The policy management module 41 can also be used to perform syntax and logic validity checks on the policy parameters input by the user (e.g., the window duration must be a positive number, and the threshold must be an integer). After successful verification, the preset policy is persistently stored in a relational database or configuration database in a structured data format. Alternatively, the effective preset policy configuration can be distributed to the alarm information processing device 500 in real time or near real time. The policy management module 41 can support hot updates of preset policies, applying changes without restarting the entire system.

[0139] The alarm information processing device 500 can be used to receive alarm information streams and perform alarm information stream processing, such as receiving raw alarm messages asynchronously or synchronously from an external monitoring system through various adapters (e.g., message queue consumers, API clients, etc.).

[0140] For example, the alarm information processing device 500 can quickly match the applicable preset strategy for each incoming alarm message based on its attributes (such as tags and sources). One alarm message can be matched with multiple strategies. According to the aggregation method defined by the matched preset strategy, the corresponding field values ​​are extracted from the alarm data, and a unique aggregation key is calculated as the logical group identifier for the alarm.

[0141] For example, the alarm information processing device 500 interacts with the state storage module 43 to execute sliding window logic, including: querying whether there is an active aggregate event based on the calculated aggregate key. If it exists, the current alarm is assigned to that aggregate event, and a delay operation of the window width is triggered. If it does not exist, a new aggregate event is created, and the timer for the sliding window width is initialized.

[0142] For example, if the number of alarms in the updated aggregated event reaches or exceeds an integer multiple of the number threshold, the alarm information processing device 500 generates a trigger event and publishes it to the notification gateway.

[0143] The state storage module 43 is responsible for maintaining the real-time state of all aggregated events. For example, the state storage module 43 adopts a high-performance key-value storage structure. The Key is a unique identifier composed of the "preset policy ID" and the "calculated aggregate key"; the Value is a structured object containing the following state information: an alarm counter, used to determine the total number of compressed alarms for the current aggregated event; a window expiration time, used to indicate the next expiration timestamp of the sliding window for this aggregated event; and the last update time, used for health checks and state cleanup.

[0144] The state storage module 43 can choose a memory-based database, Redis, which not only ensures real-time performance but also utilizes its inherent expired key cleanup mechanism. Each key has a set lifespan, synchronized with the remaining duration of the sliding window. If no new alarm information is generated within the window width, the key will automatically expire and be deleted, thus achieving automatic resource reclamation. The state storage module 43 supports distributed deployment; multiple alarm information processing devices 500 can share the same centralized state storage module 43, thereby achieving horizontal system scalability.

[0145] The notification module 44 can be a system output interface used to generate and send alarm aggregation information. For example, the notification module 44 has a built-in configurable message template. When a number threshold trigger event is received from the alarm information processing device 500, the notification module 44 can obtain a preset template according to a preset policy ID, and dynamically input the update region field, the update information source field, the policy identifier in the preset policy, and the number of aggregated alarms into the preset template to generate alarm aggregation information. The notification module 44 supports sending alarm aggregation information through multiple channels, including but not limited to: email, instant messaging, SMS, and internal alarm platforms. To avoid storms in the notification channels themselves, the notification module 44 can also implement additional rate limiting mechanisms, such as short-term deduplication of consecutive notifications of the same aggregation event, or limiting the frequency of notifications sent to the same recipient within a unit of time.

[0146] Based on the above alarm information processing method, the present invention also provides an alarm information processing device. The following will be combined with... Figure 5 The device is described in detail.

[0147] Figure 5 A schematic block diagram of an alarm information processing apparatus according to an embodiment of the present invention is shown.

[0148] like Figure 5 As shown, the alarm information processing device 500 of this embodiment includes a processing module 510, an information determination module 520, and a generation module 530.

[0149] The processing module 510 is used to process the multi-dimensional fields of each alarm information in the alarm information stream based on a preset strategy to obtain initial aggregated information. The preset strategy includes a precision control strategy for aggregating multiple dimensions of information from a candidate dimension set based on service type, and an efficiency control strategy for aggregating the information source field and device field indicating the alarm source based on device type. In one embodiment, the processing module 510 can be used to execute the operation S210 described above, which will not be repeated here.

[0150] The information determination module 520 is used to add the initial aggregation information to the candidate aggregation information and update the condition information for triggering alarm operations in the preset strategy when there is candidate aggregation information in the candidate aggregation information set that matches the initial aggregation information and the candidate aggregation information is in an open state, thereby obtaining updated aggregation information and updated condition information respectively. In one embodiment, the information determination module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0151] The generation module 530 is used to generate and send alarm aggregation information when the number of alarms in the updated aggregation information is greater than the threshold number in the update condition information. In one embodiment, the generation module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0152] According to embodiments of the present invention, based on the processing module 510, information determination module 520, and generation module 530 in the alarm information processing device 500, a precision control strategy is implemented to flexibly select and combine multiple dimension information from candidate dimensions based on business type. This achieves refined and customizable aggregation of alarm information in specific scenarios, improving the adaptability and control precision of the strategy. Simultaneously, the efficiency control strategy provides users with a simple aggregation scheme through device type-based aggregation logic, lowering the usage threshold and improving processing efficiency. By updating the condition information used to trigger alarm operations, the aggregated events can more completely cover the continuously occurring fault cycle, avoiding unreasonable alarm splitting caused by fixed windows. A gradient triggering mechanism generates and sends alarm aggregation information when the number of alarms exceeds a threshold, realizing periodic gradient notifications. This avoids the interference of alarm storms and continuously and quantitatively perceives the scale and development of faults, thereby improving the manageability of alarm information while ensuring continuous monitoring of fault status.

[0153] According to an embodiment of the present invention, the processing module 510 includes: a first combination submodule and a second combination submodule. The first combination submodule is used to, when the service type field in the multidimensional field indicates that the alarm information is at least one of database type, environment type, and network type, use the combined information obtained by combining at least two of the region field, information source field, device field, and priority field in the multidimensional field as initial aggregation information; the second combination submodule is used to, when the device type field in the multidimensional field indicates that the device corresponding to the alarm information is a specific device, use the first combination field obtained by combining the information source field and the device identifier field in the device field as initial aggregation information.

[0154] According to an embodiment of the present invention, the above-mentioned apparatus further includes: a combination module, used to take a second combined field obtained by combining the information source field, the device identifier field and the device grouping field in the device field as initial aggregation information when the device type field indicates that multiple devices in the alarm information belong to the same device group.

[0155] According to an embodiment of the present invention, the above-mentioned apparatus further includes: a graph determination module, a subgraph determination module, and an update module. The graph determination module is used to obtain an alarm propagation graph with devices as nodes and relationship information as edges based on a device identification field and relationship information between multiple devices. The subgraph determination module is used to determine at least one connected subgraph from the alarm propagation graph where the correlation between nodes is greater than a correlation threshold, and to determine the devices in the connected subgraph as a set of associated devices, wherein the set of associated devices has a logical aggregation identifier. The update module is used to update the device identification field using the logical aggregation identifier when the device type field indicates that the device corresponding to the alarm information belongs to the set of associated devices, so as to obtain a first combination field or a second combination field based on the updated device identification field.

[0156] According to an embodiment of the present invention, the information determination module 520 includes an adding submodule and a width determination submodule. The adding submodule is used to add initial aggregation information as new aggregation information to candidate aggregation information to obtain updated aggregation information. The updated aggregation information has an additional width for extending the window width in the condition information, and the window width is used to determine the open state of the candidate aggregation information. The width determination submodule is used to update the window width in the condition information based on the additional width to obtain an updated window width, which is used as the updated condition information.

[0157] According to an embodiment of the present invention, the above-mentioned apparatus further includes: a calculation submodule, a weighting submodule, and a width determination submodule. The calculation submodule is used to perform convolution operations on the combined features obtained by combining the distribution features representing the interval duration between adjacent alarms, the intensity features representing the alarm outbreak state, the periodic features representing the alarm persistence state, and the current window width in the previous alarm information stream to obtain temporal features; the weighting submodule is used to perform weighted summation of the sub-features at each time point in the temporal features using preset weights to obtain weighted features; the width determination submodule is used to obtain an initial width representing the basic width of the recommended window, based on the proportional coefficient obtained by converting the weighted features and a preset window width range, as the window width.

[0158] According to an embodiment of the present invention, the above-described apparatus further includes: a first update module and a second update module. The first update module is configured to update the window width to a first width, wherein the first width is smaller than the window width, in response to detecting that the number of times alarm aggregation information is sent within a preset time period is greater than a threshold value; the second update module is configured to update the window width to a second width, wherein the second width is larger than the window width, in response to detecting that the number of alarms in the alarm aggregation information is less than a preset threshold value.

[0159] According to an embodiment of the present invention, the generation module 530 includes: an input submodule, used to input the update region field, the update information source field, the policy identifier and the number of aggregated alarms in the update aggregation information into a preset template, generate alarm aggregation information and send it.

[0160] According to embodiments of the present invention, any plurality of modules among the processing module 510, information determination module 520, and generation module 530 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of the present invention, at least one of the processing module 510, information determination module 520, and generation module 530 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the processing module 510, information determination module 520, and generation module 530 may be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0161] Figure 6A block diagram of an electronic device suitable for implementing an alarm information processing method according to an embodiment of the present invention is shown schematically.

[0162] like Figure 6 As shown, an electronic device 600 according to an embodiment of the present invention includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0163] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in said one or more memories.

[0164] According to an embodiment of the present invention, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0165] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0166] According to embodiments of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of the present invention, a computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0167] Embodiments of the present invention also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the alarm information processing method provided in the embodiments of the present invention.

[0168] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this invention. According to embodiments of the invention, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0169] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0170] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this embodiment of the invention. According to embodiments of the invention, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0171] According to embodiments of the present invention, program code for executing the computer programs provided in the embodiments of the present invention can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0172] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0173] Those skilled in the art will understand that the features described in the various embodiments of the present invention can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments of the present invention can be combined and / or combined in various ways without departing from the spirit and teachings of the present invention. All such combinations and / or combinations fall within the scope of the present invention.

[0174] The embodiments of the present invention have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

Claims

1. A method for processing alarm information, characterized in that, The method includes: The multi-dimensional fields of each alarm information in the alarm information stream are processed based on a preset strategy to obtain initial aggregated information. The preset strategy includes a precision control strategy that selects multiple dimensions of information from the candidate dimension set based on the service type for aggregation, and an efficiency control strategy that aggregates the information source field and the device field indicating the alarm source based on the device type. If a candidate aggregation information matching the initial aggregation information exists in the candidate aggregation information set, and the candidate aggregation information is in an open state, the initial aggregation information is added to the candidate aggregation information, and the condition information used to trigger alarm operations in the preset strategy is updated to obtain updated aggregation information and updated condition information, respectively. This includes: adding the initial aggregation information as new aggregation information to the candidate aggregation information to obtain updated aggregation information with an additional width for extending the window width in the condition information; updating the window width used to determine the open state of the candidate aggregation information in the condition information based on the additional width to obtain an updated window width, which is used as the updated condition information. If the number of alarms in the updated aggregate information is greater than the number threshold or an integer multiple of the number threshold in the updated condition information, alarm aggregate information is generated and sent.

2. The method according to claim 1, characterized in that, Based on a preset strategy, the multi-dimensional fields of each alarm message in the alarm information stream are processed to obtain initial aggregated information, including: When the business type field in the multidimensional field indicates that the alarm information is at least one of database type, environment type and network type, the combined information obtained by combining at least two of the region field, information source field, device field and priority field in the multidimensional field is used as the initial aggregated information. When the device type field in the multidimensional field indicates that the device corresponding to the alarm information is a specific device, the first combined field obtained by combining the information source field and the device identifier field in the device field is used as the initial aggregated information.

3. The method according to claim 2, characterized in that, The method further includes: When the device type field indicates that multiple devices in the alarm information belong to the same device group, the second combined field obtained by combining the information source field, the device identifier field, and the device group field in the device field is used as the initial aggregation information.

4. The method according to claim 3, characterized in that, The method further includes: Based on the device identification field and the relationship information between the multiple devices, an alarm propagation graph is obtained with devices as nodes and the relationship information as edges; From the alarm propagation graph, at least one connected subgraph where the correlation between nodes is greater than the correlation threshold is determined, and the devices in the connected subgraph are identified as a set of associated devices, wherein the set of associated devices has a logical aggregation identifier. When the device type field indicates that the device corresponding to the alarm information belongs to the associated device set, the device identifier field is updated using the logical aggregation identifier to obtain a first combination field or a second combination field based on the updated device identifier field.

5. The method according to claim 1, characterized in that, The method further includes: The temporal features are obtained by convolutional operation on the combined features obtained by combining the distribution features representing the interval between adjacent alarms, the intensity features representing the alarm outbreak state, the periodic features representing the alarm duration state, and the current window width in the previous alarm information stream. The sub-features at each time step in the time series feature are weighted and summed using preset weights to obtain the weighted feature; Based on the scaling factor obtained by converting the weighted features and the preset window width range, an initial width representing the basic width of the recommended window is obtained, which is used as the window width.

6. The method according to claim 1, characterized in that, The method further includes: In response to detecting that the number of times the alarm aggregation information is sent within a preset time period is greater than a threshold, the window width is updated to a first width, where the first width is smaller than the window width; In response to detecting that the number of alarms in the alarm aggregation information is less than a preset threshold, the window width is updated to a second width, which is greater than the window width.

7. The method according to claim 1, characterized in that, Generate and send alarm aggregation information, including: Input the update region field, update information source field, policy identifier, and number of aggregated alarms from the update aggregation information into the preset template, generate the alarm aggregation information, and send it.

8. An alarm information processing device, characterized in that, The device includes: The processing module is used to process the multi-dimensional fields of each alarm information in the alarm information stream based on a preset strategy to obtain initial aggregated information. The preset strategy includes a precision control strategy for selecting multiple dimension information from the candidate dimension set based on the service type for aggregation, and an efficiency control strategy for aggregating the information source field and device field indicating the alarm source based on the device type. The information determination module is used to add the initial aggregation information to the candidate aggregation information and update the condition information in the preset strategy used to trigger alarm operations when there is candidate aggregation information in the candidate aggregation information set that matches the initial aggregation information and the candidate aggregation information is in an open state. This results in updated aggregation information and updated condition information, respectively. The module includes: adding the initial aggregation information as new aggregation information to the candidate aggregation information to obtain updated aggregation information with an additional width for extending the window width in the condition information; and updating the window width in the condition information used to determine the open state of the candidate aggregation information based on the additional width to obtain an updated window width, which is used as the updated condition information. The generation module is used to generate and send alarm aggregation information when the number of alarms in the updated aggregation information is greater than the number threshold or an integer multiple of the number threshold in the update condition information.

9. An electronic device, characterized in that, The electronic device includes: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

Images