Alarm analysis report generation method, device, equipment and storage medium

Abstract

Embodiments of the present application provide a kind of alarm analysis report generation method, device and equipment and storage medium, the method comprises: receiving the alarm information to be analyzed, alarm information is parsed, obtains alarm name, alarm time and associated event information;Based on alarm name, from the pre-set troubleshooting knowledge base corresponding target troubleshooting configuration item is determined, and based on alarm time and associated event information, parameter filling is carried out to the query configuration information in target troubleshooting configuration item, generates the query task to be executed, wherein, target troubleshooting configuration item includes query configuration information and alarm suggestion information;The query result corresponding to the execution of the query task to be executed is obtained, and the alarm analysis report corresponding to the alarm information based on query result and alarm suggestion information is generated.The scheme realizes the automation of alarm troubleshooting process, reduces manual query and data integration operation.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for generating alarm analysis reports. Background Technology

[0002] As internet business systems expand, core functions such as payment, login, orders, and messaging typically have numerous monitoring metrics and alert rules configured. When the system experiences a decrease in success rate, an increase in the number of anomalies, or API call failures, the alerting platform will push alert information to engineers, including the alert name, alert time, related events, and number of anomalies. Engineers need to determine the business scenario in which the anomaly occurred based on the alert content and further combine this information with monitoring reports, database logs, user distribution, version information, and other data to pinpoint the cause of the alert.

[0003] In existing technologies, engineers typically receive alarms, manually read the alarm content, log into the monitoring platform, data backend, or database system, select query dimensions based on their personal experience, and manually write query statements to analyze relevant data such as error codes, regions, products, devices, or network addresses. This method requires switching repeatedly between multiple systems and relies on the engineer's experience in historical troubleshooting and mastery of business rules, resulting in lengthy alarm troubleshooting times, inconsistent troubleshooting paths, and poor accuracy and usability of alarm information. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for generating alarm analysis reports. It can parse alarm information to obtain alarm parameters, retrieve corresponding troubleshooting configurations based on alarm names, automatically generate and execute query tasks to obtain alarm-related data, and then combine the query results and alarm suggestion information to generate an alarm analysis report. This automates the alarm troubleshooting process, reduces manual queries and data integration operations, and effectively solves the problems of low efficiency, reliance on personal experience, and unstable analysis results in existing alarm troubleshooting methods.

[0005] In a first aspect, embodiments of this application provide a method for generating an alarm analysis report, the method comprising: Receive alarm information to be analyzed, parse the alarm information to obtain alarm name, alarm time and related event information; Based on the alarm name, the corresponding target investigation configuration item is determined from the preset investigation knowledge base, and based on the alarm time and the associated event information, the query configuration information in the target investigation configuration item is filled with parameters to generate a query task to be executed. The target investigation configuration item includes the query configuration information and alarm suggestion information. The query task to be executed is executed to obtain the corresponding query results, and an alarm analysis report corresponding to the alarm information is generated based on the query results and the alarm suggestion information.

[0006] In one embodiment, parsing the alarm information to obtain the alarm name, alarm time, and associated event information includes: The alarm information is input type identified, and if the alarm information belongs to a preset alarm type, the field identifier, time identifier and event description boundary in the alarm information are identified, and the alarm information is split into alarm basic information and alarm event description information. Based on the field constraints corresponding to the preset alarm type, the basic alarm information is extracted in a structured manner to obtain the alarm name and alarm time of the alarm information. The error object, abnormal value and abnormal description are extracted from the alarm event description information as the associated event information of the alarm information.

[0007] In one embodiment, determining the corresponding target investigation configuration item from a preset investigation knowledge base based on the alarm name includes: The alarm name is semantically decomposed to determine the business scenario, abnormal object, and abnormal occurrence stage indicated by the alarm name, and alarm retrieval information is generated based on the business scenario, the abnormal object, and the abnormal occurrence stage. Based on the alarm retrieval information, multiple candidate troubleshooting configuration items that are related to the current alarm scenario are recalled from the preset troubleshooting knowledge base; Based on the degree of scene matching, object matching, and process matching between each candidate investigation configuration item and the alarm name, the target investigation configuration item is determined from the multiple candidate investigation configuration items.

[0008] In one embodiment, the step of filling parameters into the query configuration information in the target investigation configuration item based on the alarm time and the associated event information to generate a query task to be executed includes: Based on the alarm time and the statistical period indicated by the query configuration information in the target investigation configuration item, determine the data query time range corresponding to the current alarm; Extract event parameters that match the query configuration information from the associated event information, and write the data query time range and the event parameters into the parameter field to be filled in the query configuration information to obtain the filled query configuration; Based on the data source information and investigation dimension information corresponding to the populated query configuration, the populated query configuration is encapsulated into a task to generate a query task to be executed.

[0009] In one embodiment, executing the query task to be executed and obtaining the corresponding query result includes: Perform security checks on the query parameters and database query statements in the query task to be executed; If the query task to be executed passes the security check, the query task to be executed is split into multiple query branches based on the data source information and investigation dimension information in the query task to be executed; For each query branch, parse its corresponding data source information, target data table and database query statement, and send a query request to the corresponding data source according to the database query statement, and receive the original query data returned by the corresponding data source; The original query data returned by each data source is processed by organizing fields and marking abnormal states to obtain the branch query results corresponding to each query branch. The branch query results are then associated and encapsulated with their corresponding investigation dimension information to obtain the query results corresponding to the query task to be executed.

[0010] In one embodiment, the security verification of the query parameters and database query statements in the query task to be executed includes: Based on the parameter type of the query parameters in the query task to be executed, the field length, character composition and value format of the query parameters are validated, and if the query parameters meet the preset length range, preset character rules and preset format rules of the corresponding parameter type, the query parameters are determined to pass the validation; The database query statement in the query task to be executed is compared with the preset query template to detect whether there are preset dangerous characters or preset dangerous statement fragments in the database query statement. If the database query statement is consistent with the preset query template and no preset dangerous characters or preset dangerous statement fragments are detected, the database query statement is determined to pass the verification. If both the query parameters and the database query statement pass the validation, the query task to be executed is determined to have passed the security check.

[0011] In one embodiment, generating an alarm analysis report corresponding to the alarm information based on the query results and the alarm suggestion information includes: According to the investigation direction in the alarm suggestion information, the query results are divided into data to be verified corresponding to each investigation direction, and the verification result corresponding to each investigation direction is determined based on the data to be verified corresponding to each investigation direction. Perform cross-dimensional aggregation analysis on the query results to determine the abnormal dimension information in the query results that meets the abnormal set conditions; Based on the verification results and the anomaly dimension information, the alarm cause and impact range corresponding to the alarm information are determined, and an alarm analysis report containing the alarm cause, the impact range, and the investigation basis is generated.

[0012] Secondly, embodiments of this application also provide an alarm analysis report generation apparatus, comprising: The parsing module is configured to receive alarm information to be analyzed, parse the alarm information, and obtain alarm name, alarm time, and related event information; The retrieval module is configured to determine the corresponding target investigation configuration item from a preset investigation knowledge base based on the alarm name, and to fill the query configuration information in the target investigation configuration item with parameters based on the alarm time and the associated event information to generate a query task to be executed. The target investigation configuration item includes the query configuration information and alarm suggestion information. The execution module is configured to execute the query task to be executed, obtain the corresponding query results, and generate an alarm analysis report corresponding to the alarm information based on the query results and the alarm suggestion information.

[0013] Thirdly, embodiments of this application also provide an alarm analysis report generation device, the device comprising: One or more processors; Storage device, configured to store one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the alarm analysis report generation method described in the embodiments of this application.

[0014] Fourthly, embodiments of this application also provide a non-volatile storage medium for storing computer-executable instructions, which, when executed by a computer processor, are configured to execute the alarm analysis report generation method described in embodiments of this application.

[0015] Fifthly, embodiments of this application also provide a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor of the device reads from the computer-readable storage medium and executes the computer program, causing the device to perform the alarm analysis report generation method described in embodiments of this application.

[0016] In this embodiment, alarm information is structured and parsed to extract alarm name, alarm time, and related event information. Based on the alarm name, target troubleshooting configuration items containing query configuration information and alarm suggestion information are retrieved from a preset troubleshooting knowledge base. Then, the alarm time and related event information are used to automatically populate query parameters, generate and execute query tasks, and obtain multi-dimensional query results related to the alarm. Furthermore, the query results and alarm suggestion information are combined for comprehensive analysis to generate an alarm analysis report. This automates and standardizes the alarm troubleshooting process, reducing manual platform switching, query writing, and data integration. Attached Figure Description

[0017] Figure 1 A flowchart illustrating an alarm analysis report generation method provided in this application embodiment; Figure 2 A flowchart illustrating a specific implementation process for alarm information parsing provided in this application embodiment; Figure 3 A flowchart illustrating a specific implementation process for determining target screening configuration items is provided in this application embodiment; Figure 4 A flowchart illustrating a specific implementation process for generating a query task to be executed, as provided in this application embodiment; Figure 5 A flowchart illustrating the specific implementation process of executing a query task to be executed, provided in this application embodiment; Figure 6 A flowchart illustrating a specific implementation process of security verification provided in this application embodiment; Figure 7 A flowchart illustrating a specific implementation process for generating an alarm analysis report, provided in this application embodiment; Figure 8 A structural block diagram of an alarm analysis report generation device provided in this application embodiment; Figure 9 This is a schematic diagram of the structure of an alarm analysis report generation device provided in an embodiment of this application. Detailed Implementation

[0018] The embodiments of this application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely illustrative of the embodiments of this application and are not intended to limit the scope of the embodiments. Furthermore, it should be noted that, for ease of description, only the parts relevant to the embodiments of this application are shown in the accompanying drawings, not the entire structure.

[0019] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and are not limited in number; for example, a first object can be one or more. The term "several" means one or more, and multiple means two or more. Furthermore, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0020] The alarm analysis report generation method provided in this application can be specifically applied to alarm troubleshooting scenarios in business systems, such as payment anomaly alarms, login failure alarms, interface call failure alarms, order anomaly alarms, or message push anomaly alarms. The aforementioned application scenarios are merely exemplary and illustrative. In practical applications, this alarm analysis report generation method can also be used in other scenarios, and this application does not limit these scenarios.

[0021] The alarm analysis report generation method provided in this application embodiment can be executed by a computer device. The computer device refers to any electronic device with data calculation, processing and storage capabilities, such as a server or other terminal device. This application embodiment does not limit this.

[0022] Figure 1 This is a flowchart illustrating an alarm analysis report generation method provided in an embodiment of this application. This alarm analysis report generation method can be applied to an alarm analysis module, which can be an independently running service module within an alarm analysis system, such as... Figure 1 As shown, the alarm analysis report generation method specifically includes the following steps: Step S101: Receive the alarm information to be analyzed, parse the alarm information, and obtain the alarm name, alarm time, and related event information.

[0023] The alarm information can be anomaly notifications pushed by alarm platforms, monitoring platforms, or business systems. It may include information such as alarm name, alarm time, alarm content, related events, abnormal values, maintainer, and notification policy. The alarm name can be used to identify the business scenario and anomaly type to which the current alarm belongs. The alarm time can be used to determine the time range for subsequent queries of alarm-related data. Related event information can be used to describe the specific abnormal event that triggered the alarm, such as the error object, abnormal value, and abnormal description.

[0024] Optionally, the alarm information can be parsed to obtain the alarm name, alarm time, and related event information in the following way: The alarm information is input into the parsing node of the large language model, where the large language model can be an LLM (Large Language Model, an artificial intelligence model that can understand and generate natural language content, which can be used for tasks such as text classification, information extraction, content generation, question answering, and summarizing). The large language model is instructed to extract the alarm name, alarm time, and related event fields from the alarm information through preset parsing prompts and output the parsing results according to a preset structured format. The parsing results are then checked for field integrity and format validity. If the alarm name, alarm time, and related event fields all exist and meet the corresponding format requirements, the alarm name, alarm time, and related event fields in the parsing results are determined as the alarm name, alarm time, and related event information of the alarm information, respectively.

[0025] In one embodiment, a specific implementation process for alarm information parsing is described. Please refer to [reference needed]. Figure 2 , Figure 2 This is a flowchart illustrating a specific implementation process for alarm information parsing provided in an embodiment of this application. For example... Figure 2 As shown, the specific implementation steps for alarm information parsing are as follows: Step S201: Identify the input type of the alarm information, and if the alarm information belongs to the preset alarm type, identify the field identifier, time identifier and event description boundary in the alarm information, and split the alarm information into alarm basic information and alarm event description information.

[0026] The preset alarm type can be an alarm information type that the system pre-supports parsing, corresponding to specific alarm field formats and event description formats. Field identifiers can be markers used to locate fields such as alarm name, alarm content, and alarm time. Time identifiers can be markers used to locate the alarm occurrence time or statistical time. Event description boundaries can be the separating positions between the basic alarm fields and the specific abnormal event description.

[0027] Optionally, the input type identification method for alarm information can be as follows: input the alarm information into the classification node of the large language model, and determine whether the alarm information is an alarm input based on the preset classification prompt words; if it is determined to be an alarm input, input the alarm information into the parsing node of the large model, identify the field identifiers corresponding to the alarm name, alarm time, alarm content and related events, and determine the event description boundary based on the text position between the field identifiers; use the content within the field range corresponding to the alarm name and alarm time as the basic alarm information, and use the content within the field range corresponding to the related events as the alarm event description information.

[0028] Step S202: Based on the field constraints corresponding to the preset alarm type, perform structured extraction of the basic alarm information to obtain the alarm name and alarm time of the alarm information, and extract the error object, abnormal value and abnormal description from the alarm event description information as the associated event information of the alarm information.

[0029] The field constraints can be field extraction rules set for preset alarm types, such as the position rules for the alarm name field, the format rules for the alarm time field, and the value rules for the abnormal value field. The error object can be the business object or abnormal object that triggered the alarm, such as an error code, product identifier, interface name, or business module. The abnormal value can be a statistical value that triggered the alarm, such as the number of failures, the number of abnormalities, or the failure rate. The abnormal description can be a textual description of the abnormal event.

[0030] Optionally, based on the field constraints corresponding to the preset alarm type, the alarm name and alarm time can be obtained by structurally extracting the basic alarm information. This can be done by: locating the alarm name field and alarm time field in the basic alarm information according to the field extraction rules corresponding to the preset alarm type; extracting the content of the corresponding fields to obtain candidate alarm names and candidate alarm times; cleaning up redundant characters in the candidate alarm names and performing format verification and standardization on the candidate alarm times; and, if the verification passes, determining the processed candidate alarm names and candidate alarm times as the alarm name and alarm time, respectively.

[0031] Optionally, the error object, abnormal value, and abnormal description can be extracted from the alarm event description information as associated event information of the alarm information in the following way: the alarm event description information is input into the large model parsing node, instructing the large model to identify the abnormal subject, abnormal statistical value, and abnormal cause description in the alarm event description information; from the identification results, at least one of the following can be extracted as the error object: error code, interface name, business object, or failure link; the number of abnormalities, failure rate, or number of impacts can be extracted as the abnormal value; and the text content used to characterize the abnormal performance can be extracted as the abnormal description; the error object, abnormal value, and abnormal description are encapsulated according to a preset structured format to obtain associated event information.

[0032] As can be seen from the above, this embodiment first identifies the input type of alarm information, and then splits and extracts the alarm information in a structured manner according to the field identifier, time identifier and event description boundary. This can accurately obtain the alarm name, alarm time and related event information required for subsequent retrieval and query, providing a stable data foundation for the subsequent automatic generation of query tasks.

[0033] Step S102: Based on the alarm name, determine the corresponding target investigation configuration item from the preset investigation knowledge base, and fill the query configuration information in the target investigation configuration item with parameters based on the alarm time and related event information to generate a query task to be executed. The target investigation configuration item includes query configuration information and alarm suggestion information.

[0034] The preset troubleshooting knowledge base can be a pre-existing knowledge base containing alarm troubleshooting experience, which can record troubleshooting configuration items corresponding to different alarm names or alarm scenarios. The target troubleshooting configuration item can be the troubleshooting configuration content that matches the current alarm information, including query configuration information and alarm suggestion information. Query configuration information can include data source information, target data table, database query statement, statistical period, fields to be filled in, and troubleshooting dimension information. Alarm suggestion information can be troubleshooting directions, common causes, or analysis tips given by expert experience.

[0035] Optionally, the method for determining the corresponding target investigation configuration from the preset investigation knowledge base based on the alarm name can be as follows: input the alarm name into the knowledge base retrieval node, and recall candidate investigation configuration items related to the alarm name from the preset investigation knowledge base through retrieval enhancement. The candidate investigation configuration items include query configuration information, alarm suggestion information, and common anomaly causes. Based on the degree of matching between the alarm name and each candidate investigation configuration item in terms of business scenario, abnormal object, and anomaly occurrence stage, the candidate investigation configuration items are sorted. The candidate investigation configuration items whose sorting results meet the preset matching conditions are determined as the target investigation configuration.

[0036] Optionally, based on the alarm time and related event information, the query configuration information in the target investigation configuration item is populated with parameters to generate a query task to be executed. This can be done by: first, reading the query configuration information in the target investigation configuration item and determining the data source, data table, query statement template, and parameter fields to be filled for each query configuration item; generating the query start and end time according to the alarm time and the statistical period in the query configuration information, and extracting key parameters from the error object, abnormal value, or abnormal description from the related event information; filling the query start and end time and key parameters into the corresponding query statement template to obtain the populated query configuration, and then encapsulating the populated query configuration into a query task to be executed according to the investigation dimensions.

[0037] In one embodiment, a specific implementation process for determining target screening configuration items is described. Please refer to [reference needed]. Figure 3 , Figure 3 This is a flowchart illustrating a specific implementation process for determining target screening configuration items, as provided in an embodiment of this application. Figure 3 As shown, the specific implementation steps for determining the target investigation configuration items are as follows: Step S301: Semantically decompose the alarm name to determine the business scenario, abnormal object, and abnormal occurrence stage indicated by the alarm name, and generate alarm retrieval information based on the business scenario, abnormal object, and abnormal occurrence stage.

[0038] The business scenario can be the business scope to which the alarm belongs, such as payment, login, order, or message push. The abnormal object can be the specific abnormal object reflected in the alarm, such as error code, product, interface, or channel. The abnormal occurrence stage can be the location in the business chain where the abnormality occurs, such as querying product information, initiating payment, returning results, or interface call stages. Alarm retrieval information can be the retrieval criteria obtained by combining the business scenario, abnormal object, and abnormal occurrence stage.

[0039] Optionally, semantic decomposition of alarm names to determine the business scenario, abnormal object, and abnormal occurrence stage indicated by the alarm name can be performed as follows: input the alarm name into the semantic parsing node of the large language model, and identify the business keywords, abnormal identifiers, and processing stage descriptions in the alarm name according to preset decomposition rules; determine the business keywords as the business scenario, the error code, interface name, or failure object as the abnormal object, and the text representing the operation stage or call stage as the abnormal occurrence stage; for example, for "Payment-iOS-21031-Query Product Information-Store Return Failure", the business scenario can be determined to be payment, the abnormal object includes error code 21031 and store return failure, and the abnormal occurrence stage is querying product information.

[0040] Optionally, the method for generating alarm retrieval information based on business scenarios, abnormal objects, and abnormal occurrence stages can be as follows: standardize the business scenarios, abnormal objects, and abnormal occurrence stages, remove non-core retrieval content such as platform version and statistical period, and combine the standardized business scenarios, abnormal objects, and abnormal occurrence stages into retrieval keywords in a preset order; further, concatenate the retrieval keywords with the alarm name to generate alarm retrieval information for retrieving alarm configurations in a preset investigation knowledge base.

[0041] Step S302: Based on alarm retrieval information, recall multiple candidate troubleshooting configuration items that are related to the current alarm from the preset troubleshooting knowledge base.

[0042] Among them, candidate investigation configuration items can be investigation configuration content from a preset investigation knowledge base that has a certain correlation with the current alarm. Scenario correlation can indicate that the candidate investigation configuration items and the current alarm have the same or similar relationship in terms of business scenario, abnormal object, or abnormal occurrence stage.

[0043] Optionally, based on alarm retrieval information, the method of recalling multiple candidate investigation configuration items that are related to the current alarm from a preset investigation knowledge base can be as follows: using alarm retrieval information as the initial recall condition, the investigation configuration corresponding to the same business scenario or similar anomaly type as the current alarm is searched in the preset investigation knowledge base, thereby obtaining multiple candidate investigation configuration items. By recalling candidates first, it is possible to avoid missed detections due to directly limiting to a single configuration, and it is also convenient to filter them according to the degree of matching later.

[0044] Step S303: Based on the degree of scene matching, object matching, and process matching between each candidate investigation configuration item and the alarm name, determine the target investigation configuration item from multiple candidate investigation configuration items.

[0045] Among them, scenario matching degree can be used to characterize the consistency between candidate investigation configuration items and the current alarm in the business scenario. Object matching degree can be used to characterize the consistency between candidate investigation configuration items and the current alarm in the abnormal object. Stage matching degree can be used to characterize the consistency between candidate investigation configuration items and the current alarm in the stage where the anomaly occurred.

[0046] Optionally, the method for determining the target investigation configuration item from multiple candidate investigation configuration items based on the degree of scenario matching, object matching, and process matching between each candidate investigation configuration item and the alarm name can be as follows: For each candidate investigation configuration item, the business scenario, abnormal object, and abnormal occurrence process corresponding to the alarm name are compared with the applicable scenario, applicable abnormal object, and investigation process in the candidate investigation configuration item to obtain the scenario matching score, object matching score, and process matching score; the scenario matching score, object matching score, and process matching score are weighted according to preset weights to obtain the comprehensive matching score of the candidate investigation configuration item; multiple candidate investigation configuration items are sorted from high to low according to the comprehensive matching score, and the candidate investigation configuration item with the highest comprehensive matching score and meeting the preset score threshold is determined as the target investigation configuration item.

[0047] As can be seen from the above, this embodiment improves the matching accuracy between the target investigation configuration item and the current alarm by semantically decomposing the alarm name and recalling and filtering the investigation configuration items from the preset investigation knowledge base based on the decomposed business scenario, abnormal object and abnormal occurrence link, so that the subsequent query tasks and report analysis are more in line with the actual alarm scenario.

[0048] In one embodiment, a specific implementation process for generating a query task to be executed is described. Please refer to [reference needed]. Figure 4 , Figure 4 This is a flowchart illustrating a specific implementation process for generating a query task to be executed, as provided in an embodiment of this application. Figure 4 As shown, the specific implementation steps for generating the query task to be executed are as follows: Step S401: Based on the alarm time and the statistical period indicated by the query configuration information in the target investigation configuration item, determine the data query time range corresponding to the current alarm.

[0049] The statistical period can be a preset data statistical range in the query configuration information, such as 10 minutes, 30 minutes, or 1 hour. The data query time range can be the time interval of the data to be queried, determined based on the alarm time.

[0050] Optionally, the data query time range corresponding to the current alarm can be determined based on the alarm time and the statistical period indicated by the query configuration information in the target investigation configuration item. This can be achieved by using the alarm time as the query end time or central time, and combining it with the statistical period indicated by the query configuration information to determine the start and end times that the query needs to cover. For example, if the alarm time is "20:15:00" and the statistical period is 30 minutes, then the data query time range can be "19:45:00 to 20:15:00".

[0051] Step S402: Extract the event parameters that match the query configuration information from the associated event information, and write the data query time range and event parameters into the parameter fields to be filled in the query configuration information to obtain the filled query configuration.

[0052] The event parameters can be parameters extracted from associated event information for querying, such as error objects, abnormal values, error codes in the abnormal description, product identifiers, interface names, or business object identifiers. The fields to be filled can be fields pre-set in the query configuration information that need to be supplemented by the current alarm information.

[0053] Optionally, the method to obtain a populated query configuration can be as follows: extract the corresponding event parameters from the associated event information based on the required fields in the query configuration information, and write the event parameters and the data query time range into the corresponding parameter fields to be filled. For example, write the error code into the error code field, the product identifier into the business object field, and the query time range into the time field.

[0054] Step S403: Based on the data source information and investigation dimension information corresponding to the populated query configuration, encapsulate the populated query configuration into a task and generate a query task to be executed.

[0055] The data source information indicates the data system or database location that the query task needs to access. The investigation dimension information indicates the analysis dimension corresponding to the query task, such as error code dimension, region dimension, product dimension, device dimension, or network address dimension.

[0056] Optionally, based on the data source information and investigation dimension information corresponding to the populated query configuration, the populated query configuration is encapsulated into a task to generate a query task to be executed. This can be done by: reading the data source address, target data table, database query statement, and investigation dimension identifier from the populated query configuration, and generating a corresponding query task identifier for each populated query configuration; grouping populated query configurations with the same data source or the same investigation dimension into the same task set; and encapsulating the query task identifier, data source information, database query statement, investigation dimension information, and query parameters into a query task to be executed, so that subsequent execution and result association of each query task can be performed according to the investigation dimension.

[0057] As can be seen from the above, this embodiment automatically fills in the fields of parameters to be filled in the query configuration information by combining alarm time, statistical period and related event information, and encapsulates the task according to data source information and investigation dimension information, which can transform the expert investigation configuration into an executable query task and reduce the operation of manually writing query conditions.

[0058] Step S103: Execute the query task to be executed, obtain the corresponding query results, and generate an alarm analysis report corresponding to the alarm information based on the query results and alarm suggestion information.

[0059] The query results can be alarm-related data retrieved from one or more data sources based on the query task to be executed. These results can include statistical results, detailed results, or anomaly marker results under different investigation dimensions. The alarm analysis report can be a text report generated after analyzing the current alarm. It can include the alarm cause, scope of impact, anomaly concentration dimensions, and investigation basis.

[0060] Optionally, the method for executing the query task to obtain the corresponding query results can be as follows: First, perform security verification on the query parameters and database query statements in the query task to be executed. After the verification is passed, split the query task to be executed into multiple query branches according to the data source information and investigation dimension information in the query task to be executed. For each query branch, parse the corresponding data source address, target data table and database query statement, and call the database query tool to send a query request to the corresponding data source. Receive the raw query data returned by each data source, and perform field organization, abnormal status marking and dimension association encapsulation on the raw query data to obtain the query results corresponding to the query task to be executed.

[0061] Optionally, the method for generating an alarm analysis report corresponding to the alarm information based on the query results and alarm suggestion information can be as follows: integrate the query results with the corresponding investigation dimension information and query configuration information to generate structured analysis data; input the structured analysis data and alarm suggestion information into the large language model analysis node, and perform verification analysis on the query results of each dimension according to the investigation direction in the alarm suggestion information to obtain verification results; after completing the verification analysis, aggregate, sort, and perform proportion analysis on the query results to determine the anomaly concentration dimensions; based on the verification results, anomaly concentration dimensions, and common anomaly causes, generate an alarm analysis report containing alarm causes, impact scope, investigation basis, and handling suggestions.

[0062] As can be seen from the above, the embodiments of this application obtain structured alarm parameters by parsing alarm information, determine target troubleshooting configuration items based on alarm names, generate and execute query tasks according to alarm parameters, and finally generate alarm analysis reports by combining query results and alarm suggestion information. This can reduce the operations of manually switching platforms, manually querying and manually integrating data, and improve the efficiency of alarm troubleshooting and the consistency of analysis results.

[0063] In one embodiment, a specific implementation process for executing a query task to be performed is described. Please refer to [reference needed]. Figure 5 , Figure 5 This is a flowchart illustrating the specific implementation process of a query task to be executed, as provided in an embodiment of this application. Figure 5 As shown, the specific implementation steps for executing the query task are as follows: Step S501: Perform security verification on the query parameters and database query statements in the query task to be executed.

[0064] The query parameters can be specific parameter values ​​that have already been populated into the query configuration information. The database query statement can be a statement used to retrieve alarm-related data from a data source. Security checks can be used to determine whether the query parameters and database query statement comply with preset security rules.

[0065] Optionally, the security verification of query parameters and database query statements in the query task to be executed can be performed by checking the length, character composition and format of the query parameters before actually accessing the data source, and detecting whether the database query statement conforms to the preset query template and whether it contains dangerous characters or dangerous statement fragments, thereby reducing the risk of abnormal input affecting the security of database queries.

[0066] In one embodiment, a specific implementation process for a security verification is described. Please refer to [reference needed]. Figure 6 , Figure 6 This is a flowchart illustrating a specific implementation process of a security verification method provided in an embodiment of this application. Figure 6As shown, the specific implementation steps of the security verification are as follows: Step S601: Based on the parameter type of the query parameters in the query task to be executed, verify the field length, character composition, and value format of the query parameters, and determine that the query parameters pass the verification if the query parameters meet the preset length range, preset character rules, and preset format rules of the corresponding parameter type.

[0067] The parameter type can be the purpose of the query parameter in the query task, such as time parameter, error object parameter, business object parameter, alarm name parameter, or statistical period parameter. The preset length range, preset character rules, and preset format rules can be pre-configured validation rules for different parameter types.

[0068] Optionally, depending on the parameter type of the query parameters in the query task to be executed, the validation methods for the field length, character composition, and value format of the query parameters can be as follows: for time parameters, check whether they conform to the preset time format; for error object parameters, check whether they contain only allowed numbers, letters, or separators; for alarm name parameters, check whether their length exceeds the limit and whether they contain disallowed special characters. Only when the query parameter simultaneously meets the corresponding length, character, and format requirements is the query parameter determined to have passed the validation.

[0069] Step S602: Compare the database query statement in the query task to be executed with the preset query template to detect whether there are preset dangerous characters or preset dangerous statement fragments in the database query statement. If the database query statement is consistent with the preset query template and no preset dangerous characters or preset dangerous statement fragments are detected, the database query statement is determined to pass the verification.

[0070] The preset query template can be a query statement template pre-configured in the target investigation configuration items. The preset dangerous characters can be characters that may change the query semantics or destroy the query structure. The preset dangerous statement fragments can be statement fragments used for illegal concatenation, unauthorized queries, or injection attacks.

[0071] Optionally, the database query statement in the query task to be executed can be compared with a preset query template to detect whether there are preset dangerous characters or preset dangerous statement fragments in the database query statement. This can be done by: comparing the structure of the current database query statement with the preset query template to confirm that it is formed only by the preset query template and valid query parameters; and simultaneously detecting whether there are delimiters, comment characters, abnormally concatenated statements, or other dangerous statement fragments in the database query statement. If the query statement structure is consistent and no dangerous content is detected, then the database query statement is determined to have passed the validation.

[0072] Step S603: If both the query parameters and the database query statement pass the verification, determine that the query task to be executed has passed the security verification.

[0073] In this context, the fact that a query task to be executed has passed the security check indicates that the query task is allowed to enter the subsequent query execution process.

[0074] Optionally, if both the query parameters and the database query statement pass the validation, the method to determine if the query task to be executed passes the security validation can be as follows: when both the query parameters and the database query statement in the query task pass the corresponding validation, a security validation pass result is generated; if any query parameter or database query statement fails the validation, the query task to be executed is not executed to prevent abnormal query requests from entering the data source.

[0075] As can be seen from the above, this embodiment can prevent abnormal parameters or abnormal query statements from entering the data source execution stage by validating the length, characters, and format of query parameters, and by performing template consistency comparison and dangerous content detection on database query statements, thereby improving the security and reliability of the automated query process.

[0076] Step S502: If the query task to be executed passes the security check, the query task to be executed is split into multiple query branches based on the data source information and investigation dimension information in the query task to be executed.

[0077] Query branches can be sub-query tasks derived from data sources or investigation dimensions. Different query branches can be used to query alarm-related data from different dimensions.

[0078] Optionally, based on the data source information and investigation dimension information in the query task to be executed, the query task to be executed can be split into multiple query branches as follows: when the query task to be executed contains multiple investigation dimensions or multiple data sources, it can be split into multiple query branches. For example, the same payment alarm can be split into an error code distribution query branch, a region distribution query branch, a product distribution query branch, and a network address distribution query branch.

[0079] Step S503: For each query branch, parse its corresponding data source information, target data table and database query statement, and send a query request to the corresponding data source according to the database query statement, and receive the original query data returned by the corresponding data source.

[0080] The target data table can be the data table that the query branch needs to access. The raw query data can be the query results directly returned by the data source, without field processing or exception status marking.

[0081] Optionally, for each query branch, its corresponding data source information, target data table, and database query statement are parsed, and a query request is initiated to the corresponding data source according to the database query statement. The method for receiving the raw query data returned by the corresponding data source can be as follows: read the data source address, connection credentials, target data table, database query statement, and query parameters encapsulated in the query branch; establish a query connection with the corresponding data source based on the data source address, and write the query parameters that have passed security verification into the database query statement; call the database query tool to initiate a query request to the target data table, and receive the record rows, statistical values, or query status information returned by the data source as the raw query data corresponding to the query branch.

[0082] Step S504: Organize the fields and mark the abnormal status of the raw query data returned by each data source to obtain the branch query results corresponding to each query branch, and associate and encapsulate each branch query result with its corresponding investigation dimension information to obtain the query results corresponding to the query task to be executed.

[0083] Field organization can involve standardizing the field names, formats, or order in the original query data. Anomaly marking can be used to mark data items in the query data that meet abnormal conditions. Branch query results can be the organized query results.

[0084] Optionally, the method for processing the fields and marking abnormal states of the raw query data returned by each data source to obtain the branch query results corresponding to each query branch can be as follows: Based on the investigation dimension information of the corresponding query branch, determine the target fields in the raw query data, and perform field name unification, null value handling, and data format conversion on the target fields; based on the alarm threshold, number of abnormalities, or percentage conditions corresponding to the query branch, determine the abnormal state of the processed data records, and add abnormal markers to the data records that meet the abnormal conditions; encapsulate the data records that have completed field processing and abnormal marking, along with the corresponding query branch identifier and investigation dimension information, to obtain the branch query results.

[0085] Optionally, the query results of each branch can be associated and encapsulated with their corresponding investigation dimension information to obtain the query results corresponding to the query task to be executed. This can be done by: reading the query branch identifier carried by each branch query result and determining the investigation dimension information corresponding to the query branch identifier; grouping the branch query results according to the investigation dimension information and adding data source information, target data table information, and query time range to each group of branch query results; and encapsulating the grouped branch query results into a structured result set as the query results corresponding to the query task to be executed, for subsequent analysis according to different investigation dimensions.

[0086] As can be seen from the above, this embodiment improves the efficiency and standardization of multi-dimensional alarm data acquisition by performing security verification before executing the query task and splitting the query branches according to the data source information and investigation dimension information after the verification is passed, and obtaining query results under different dimensions respectively. This can ensure the security of the query while improving the efficiency and standardization of multi-dimensional alarm data acquisition.

[0087] In one embodiment, a specific implementation process for generating an alarm analysis report is described. Please refer to [reference needed]. Figure 7 , Figure 7 This is a flowchart illustrating a specific implementation process for generating an alarm analysis report, as provided in an embodiment of this application. Figure 7 As shown, the specific implementation steps for generating the alarm analysis report are as follows: Step S701: According to the investigation direction in the alarm suggestion information, divide the query results into data to be verified corresponding to each investigation direction, and determine the verification result corresponding to each investigation direction based on the data to be verified corresponding to each investigation direction.

[0088] The alarm suggestion information can be expert advice in the target investigation configuration items used to guide the result analysis. The investigation direction can be the analysis path given in the expert advice, such as prioritizing the analysis of error distribution, regional distribution, product distribution, device distribution, or network address distribution. The data to be verified can be a subset of query results corresponding to a certain investigation direction. The verification result can be the judgment result on whether a certain investigation direction is valid.

[0089] Optionally, the method for dividing the query results into data to be verified corresponding to each investigation direction according to the investigation direction in the alarm suggestion information, and determining the verification result corresponding to each investigation direction based on the data to be verified corresponding to each investigation direction, can be as follows: parse each investigation direction in the alarm suggestion information to determine the target investigation dimension corresponding to each investigation direction; according to the investigation dimension information carried in the query results, classify the branch query results that match the target investigation dimension into the data to be verified for the corresponding investigation direction; judge the number, proportion, concentrated objects or distribution of anomalies in the data to be verified, and generate a verification result to indicate that the investigation direction is valid when the data to be verified meets the verification conditions of the corresponding investigation direction; otherwise, generate a verification result to indicate that the investigation direction is not valid or the evidence is insufficient.

[0090] Step S702: Perform cross-dimensional aggregation analysis on the query results to determine the abnormal dimension information in the query results that meets the abnormal concentration conditions.

[0091] Cross-dimensional aggregation analysis can involve joint statistical and correlation analysis of query results across multiple investigation dimensions. Anomaly concentration conditions can be preset conditions used to determine whether anomalies are significantly concentrated along a certain dimension. Anomaly dimension information can represent the dimensions where anomaly concentration occurs and their corresponding content, such as specific business objects, specific regions, specific network addresses, or specific device ranges.

[0092] Optionally, the method for performing cross-dimensional aggregation analysis on the query results to determine the abnormal dimension information that meets the abnormal clustering conditions in the query results can be as follows: group the query results according to at least two dimensions among business object, region, network address, device identifier and error description, and obtain the number and percentage of abnormalities under each dimension combination; compare the number and percentage of abnormalities with the corresponding preset clustering thresholds; if the number of abnormalities under any dimension combination reaches the preset number threshold and the percentage of abnormalities reaches the preset percentage threshold, then the dimension combination is determined as the abnormal dimension information that meets the abnormal clustering conditions.

[0093] Step S703: Based on the verification results and anomaly dimension information, determine the alarm cause and impact scope corresponding to the alarm information, and generate an alarm analysis report containing the alarm cause, impact scope and investigation basis.

[0094] The alarm cause can be an anomaly inferred from the query results and alarm suggestion information. The scope of impact can be the business objects, user range, geographical range, or device range affected by the alarm. The investigation basis can be query data or analysis results that support the determination of the alarm cause and scope of impact.

[0095] Optionally, the method for determining the alarm cause and scope of impact corresponding to the alarm information based on the verification results and anomaly dimension information, and generating an alarm analysis report containing the alarm cause, scope of impact, and investigation basis, can be as follows: The verification results are matched with the anomaly dimension information using rules; based on the established investigation direction and the dimension combination that meets the anomaly concentration conditions, the alarm cause is determined from the common error causes in the alarm suggestion information; the alarm impact scope is determined according to the business object, region, network address, or device range in the anomaly dimension information; the alarm cause, scope of impact, and the query data, verification results, and anomaly dimension information supporting this conclusion are compiled to generate an alarm analysis report.

[0096] As can be seen from the above, this embodiment verifies and analyzes the query results according to the alarm suggestion information, and further performs cross-dimensional aggregation analysis. It can extract the alarm cause, impact scope and investigation basis from the query results, thereby generating an alarm analysis report with data support and reducing the reliance of analysis conclusions on human experience.

[0097] As can be seen from the above, the embodiments of this application can automatically generate alarm analysis reports by parsing alarm information, determining target troubleshooting configuration items based on the knowledge base, automatically filling query parameters, executing query tasks after security verification, and verifying and aggregating the query results in conjunction with alarm suggestion information. This reduces manual troubleshooting operations and improves alarm location efficiency and consistency of analysis results.

[0098] Figure 8 This is a structural block diagram of an alarm analysis report generation device provided in an embodiment of this application. The device is configured to execute the alarm analysis report generation method provided in the above embodiment, and possesses the corresponding functional modules and beneficial effects of the method. Figure 8 As shown, the device specifically includes: The parsing module 801 is configured to receive alarm information to be analyzed, parse the alarm information, and obtain the alarm name, alarm time, and related event information. The retrieval module 802 is configured to determine the corresponding target investigation configuration item from the preset investigation knowledge base based on the alarm name, and to fill the query configuration information in the target investigation configuration item with parameters based on the alarm time and related event information to generate a query task to be executed. The target investigation configuration item includes query configuration information and alarm suggestion information. The execution module 803 is configured to execute the query task to be executed, obtain the corresponding query results, and generate an alarm analysis report corresponding to the alarm information based on the query results and alarm suggestion information.

[0099] As described above, by performing structured parsing of alarm information, the alarm name, alarm time, and related event information are extracted. Based on the alarm name, target troubleshooting configuration items containing query configuration information and alarm suggestion information are retrieved from a preset troubleshooting knowledge base. Then, the query parameters are automatically populated using the alarm time and related event information, generating and executing the query task to be executed, obtaining multi-dimensional query results related to the alarm. Furthermore, a comprehensive analysis is performed by combining the query results and alarm suggestion information to generate an alarm analysis report. This automates and standardizes the alarm troubleshooting process, reducing the need for manual platform switching, query writing, and data integration.

[0100] In one possible embodiment, the parsing module 801 is specifically configured as follows: The alarm information is input type identified, and when the alarm information belongs to the preset alarm type, the field identifier, time identifier and event description boundary in the alarm information are identified, and the alarm information is split into alarm basic information and alarm event description information. Based on the field constraints corresponding to the preset alarm type, the basic alarm information is extracted in a structured manner to obtain the alarm name and alarm time of the alarm information. The error object, abnormal value and abnormal description are extracted from the alarm event description information as the associated event information of the alarm information.

[0101] In one possible embodiment, the retrieval module 802 is specifically configured as follows: Semantically decompose the alarm name to determine the business scenario, abnormal object, and abnormal occurrence stage indicated by the alarm name, and generate alarm retrieval information based on the business scenario, abnormal object, and abnormal occurrence stage; Based on alarm retrieval information, multiple candidate troubleshooting configuration items that are related to the current alarm scenario are recalled from the preset troubleshooting knowledge base; Based on the degree of matching between each candidate investigation configuration item and the alarm name in terms of scenario, object, and process, the target investigation configuration item is determined from multiple candidate investigation configuration items.

[0102] In one possible embodiment, the retrieval module 802 is further configured as follows: Based on the alarm time and the statistical period indicated by the query configuration information in the target investigation configuration item, determine the data query time range corresponding to the current alarm; Extract event parameters that match the query configuration information from the associated event information, and write the data query time range and event parameters into the parameter fields to be filled in the query configuration information to obtain the populated query configuration; Based on the data source information and investigation dimension information corresponding to the populated query configuration, the populated query configuration is encapsulated into a task to generate a query task to be executed.

[0103] In one possible embodiment, execution module 803 is specifically configured as follows: Perform security checks on the query parameters and database query statements in the query task to be executed; If the query task to be executed passes the security check, the query task to be executed is split into multiple query branches based on the data source information and investigation dimension information in the query task to be executed; For each query branch, parse its corresponding data source information, target data table and database query statement, and send a query request to the corresponding data source according to the database query statement, and receive the raw query data returned by the corresponding data source; The raw query data returned by each data source is processed by organizing fields and marking abnormal states to obtain the branch query results corresponding to each query branch. The branch query results are then associated and encapsulated with their corresponding investigation dimension information to obtain the query results corresponding to the query task to be executed.

[0104] In one possible embodiment, the execution module 803 is further configured as follows: Based on the parameter type of the query parameters in the query task to be executed, the field length, character composition and value format of the query parameters are validated, and if the query parameters meet the preset length range, preset character rules and preset format rules of the corresponding parameter type, the query parameters are determined to pass the validation; The database query statement in the query task to be executed is compared with the preset query template to check whether there are preset dangerous characters or preset dangerous statement fragments in the database query statement. If the database query statement is consistent with the preset query template and no preset dangerous characters or preset dangerous statement fragments are detected, the database query statement is determined to pass the verification. If both the query parameters and the database query statement pass the validation, the query task to be executed is confirmed to have passed the security check.

[0105] In one possible embodiment, the execution module 803 is further configured as follows: According to the investigation direction in the alarm suggestion information, the query results are divided into data to be verified corresponding to each investigation direction, and the verification result corresponding to each investigation direction is determined based on the data to be verified corresponding to each investigation direction. Perform cross-dimensional aggregation analysis on the query results to identify abnormal dimension information in the query results that meets the abnormal clustering conditions; Based on the verification results and anomaly dimension information, the alarm cause and impact scope corresponding to the alarm information are determined, and an alarm analysis report containing the alarm cause, impact scope and investigation basis is generated.

[0106] Figure 9 A schematic diagram of an alarm analysis report generation device provided in this application embodiment is shown below. Figure 9 As shown, the device includes a processor 901, a memory 902, an input device 903, and an output device 904.

[0107] The number of processors 901 can be one or more. Figure 9 Taking a processor 901 as an example; the processor 901, memory 902, input device 903, and output device 904 can be connected via a bus or other means. Figure 9Taking a bus connection as an example, the memory 902, as a computer-readable storage medium, can be configured to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the alarm analysis report generation method in this embodiment. The processor 901 executes various functional applications and data processing of the device by running the software programs, instructions, and modules stored in the memory 902, thereby implementing the aforementioned alarm analysis report generation method. The input device 903 can be configured to receive input digital or character information and generate key signal inputs related to user settings and function control of the device. The output device 904 may include a display screen or other display device.

[0108] This application embodiment also provides a non-volatile storage medium containing computer-executable instructions. When executed by a computer processor, the computer-executable instructions are configured to execute an alarm analysis report generation method described in the above embodiments. The method includes: receiving alarm information to be analyzed; parsing the alarm information to obtain an alarm name, alarm time, and associated event information; determining a corresponding target investigation configuration item from a preset investigation knowledge base based on the alarm name; and filling the query configuration information in the target investigation configuration item with parameters based on the alarm time and associated event information to generate a query task to be executed. The target investigation configuration item includes query configuration information and alarm suggestion information. The method also includes executing the query task to obtain corresponding query results and generating an alarm analysis report corresponding to the alarm information based on the query results and alarm suggestion information.

[0109] It is worth noting that in the embodiments of the alarm analysis report generation device described above, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not configured to limit the protection scope of the embodiments of this application.

[0110] In some possible implementations, various aspects of the methods provided in this application can also be implemented as a program product comprising program code that, when run on a computer device, is configured to cause the computer device to perform the steps of the methods according to the various exemplary embodiments of this application described above. For example, the computer device may execute the alarm analysis report generation method described in the embodiments of this application. The program product may be implemented using a combination of one or more readable media.

Claims

1. A method for generating alarm analysis reports, characterized in that, include: Receive alarm information to be analyzed, parse the alarm information to obtain alarm name, alarm time and related event information; Based on the alarm name, the corresponding target investigation configuration item is determined from the preset investigation knowledge base, and based on the alarm time and the associated event information, the query configuration information in the target investigation configuration item is filled with parameters to generate a query task to be executed. The target investigation configuration item includes the query configuration information and alarm suggestion information. The query task to be executed is executed to obtain the corresponding query results, and an alarm analysis report corresponding to the alarm information is generated based on the query results and the alarm suggestion information.

2. The alarm analysis report generation method according to claim 1, characterized in that, The process of parsing the alarm information to obtain the alarm name, alarm time, and associated event information includes: The alarm information is input type identified, and if the alarm information belongs to a preset alarm type, the field identifier, time identifier and event description boundary in the alarm information are identified, and the alarm information is split into alarm basic information and alarm event description information. Based on the field constraints corresponding to the preset alarm type, the basic alarm information is extracted in a structured manner to obtain the alarm name and alarm time of the alarm information. The error object, abnormal value and abnormal description are extracted from the alarm event description information as the associated event information of the alarm information.

3. The alarm analysis report generation method according to claim 1, characterized in that, The step of determining the corresponding target investigation configuration item from the preset investigation knowledge base based on the alarm name includes: The alarm name is semantically decomposed to determine the business scenario, abnormal object, and abnormal occurrence stage indicated by the alarm name, and alarm retrieval information is generated based on the business scenario, the abnormal object, and the abnormal occurrence stage. Based on the alarm retrieval information, multiple candidate troubleshooting configuration items that are related to the current alarm scenario are recalled from the preset troubleshooting knowledge base; Based on the degree of scene matching, object matching, and process matching between each candidate investigation configuration item and the alarm name, the target investigation configuration item is determined from the multiple candidate investigation configuration items.

4. The alarm analysis report generation method according to claim 1, characterized in that, The step of filling in the query configuration information in the target investigation configuration item with parameters based on the alarm time and the associated event information to generate a query task to be executed includes: Based on the alarm time and the statistical period indicated by the query configuration information in the target investigation configuration item, determine the data query time range corresponding to the current alarm; Extract event parameters that match the query configuration information from the associated event information, and write the data query time range and the event parameters into the parameter field to be filled in the query configuration information to obtain the filled query configuration; Based on the data source information and investigation dimension information corresponding to the populated query configuration, the populated query configuration is encapsulated into a task to generate a query task to be executed.

5. The alarm analysis report generation method according to claim 1, characterized in that, The execution of the query task to be executed, and the corresponding query results obtained, include: Perform security checks on the query parameters and database query statements in the query task to be executed; If the query task to be executed passes the security check, the query task to be executed is split into multiple query branches based on the data source information and investigation dimension information in the query task to be executed; For each query branch, parse its corresponding data source information, target data table and database query statement, and send a query request to the corresponding data source according to the database query statement, and receive the original query data returned by the corresponding data source; The original query data returned by each data source is processed by organizing fields and marking abnormal states to obtain the branch query results corresponding to each query branch. The branch query results are then associated and encapsulated with their corresponding investigation dimension information to obtain the query results corresponding to the query task to be executed.

6. The alarm analysis report generation method according to claim 5, characterized in that, The security verification of the query parameters and database query statements in the query task to be executed includes: Based on the parameter type of the query parameters in the query task to be executed, the field length, character composition and value format of the query parameters are validated, and if the query parameters meet the preset length range, preset character rules and preset format rules of the corresponding parameter type, the query parameters are determined to pass the validation; The database query statement in the query task to be executed is compared with the preset query template to detect whether there are preset dangerous characters or preset dangerous statement fragments in the database query statement. If the database query statement is consistent with the preset query template and no preset dangerous characters or preset dangerous statement fragments are detected, the database query statement is determined to pass the verification. If both the query parameters and the database query statement pass the validation, the query task to be executed is determined to have passed the security check.

7. The alarm analysis report generation method according to claim 1, characterized in that, The step of generating an alarm analysis report corresponding to the alarm information based on the query results and the alarm suggestion information includes: According to the investigation direction in the alarm suggestion information, the query results are divided into data to be verified corresponding to each investigation direction, and the verification result corresponding to each investigation direction is determined based on the data to be verified corresponding to each investigation direction. Perform cross-dimensional aggregation analysis on the query results to determine the abnormal dimension information in the query results that meets the abnormal set conditions; Based on the verification results and the anomaly dimension information, the alarm cause and impact range corresponding to the alarm information are determined, and an alarm analysis report containing the alarm cause, the impact range, and the investigation basis is generated.

8. An alarm analysis report generation device, characterized in that, include: The parsing module is configured to receive alarm information to be analyzed, parse the alarm information, and obtain alarm name, alarm time, and related event information; The retrieval module is configured to determine the corresponding target investigation configuration item from a preset investigation knowledge base based on the alarm name, and to fill the query configuration information in the target investigation configuration item with parameters based on the alarm time and the associated event information to generate a query task to be executed. The target investigation configuration item includes the query configuration information and alarm suggestion information. The execution module is configured to execute the query task to be executed, obtain the corresponding query results, and generate an alarm analysis report corresponding to the alarm information based on the query results and the alarm suggestion information.

9. An alarm analysis report generation device, characterized in that, The device includes: one or more processors; and a storage device configured to store one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the alarm analysis report generation method according to any one of claims 1-7.

10. A non-volatile storage medium for storing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are configured to perform the alarm analysis report generation method according to any one of claims 1-7.

Images