CN107707380B - A kind of monitoring alarm method and apparatus - Google Patents
A kind of monitoring alarm method and apparatus Download PDFInfo
- Publication number
- CN107707380B CN107707380B CN201710642112.0A CN201710642112A CN107707380B CN 107707380 B CN107707380 B CN 107707380B CN 201710642112 A CN201710642112 A CN 201710642112A CN 107707380 B CN107707380 B CN 107707380B
- Authority
- CN
- China
- Prior art keywords
- monitoring alarm
- alarm information
- monitoring
- monitored item
- sent
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Alarm Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present invention provides a kind of monitoring alarm method and apparatus.It is related to computer network field；Solve the problems, such as that alarm burst causes system overload and operation maintenance personnel failure judgement difficult.This method includes：The a plurality of monitoring alarm information with same alike result being collected into is merged, a merging monitoring alarm information is obtained；Monitoring alarm information table is generated, the monitoring alarm information table includes the monitoring alarm information that merges monitoring alarm information and/or can not merge；Situation is submitted according to current alarm, the monitoring alarm information table is sent, is alerted.Technical solution provided by the invention is suitable for network monitoring system, realizes the transmission of the merging to a plurality of monitoring alarm information.
Description
Technical field
The present invention relates to computer network field more particularly to a kind of monitoring alarm method and apparatus.
Background technology
For the stable operation of Logistics networks system, monitoring system is indispensable at present.In large-scale cluster system
Under scene, monitoring system can be collected, be handled, issuing monitoring alarm information.Once the number of monitoring alarm information exceeds O&M people
The processing capacity range of member, will be greatly reduced the effect of monitoring, risk is brought to system.
For example, every server is required for the monitoring for having to basic monitored item, such as disk utilization, cpu, bandwidth
Deng the same monitored item for being susceptible to large number of equipment occurs abnormal, and moment generates a large amount of monitoring alarms.
Likewise, for distributed system, how same application goes wrong, and also will appear a large amount of alarms, O&M
Personnel can not grasp overall condition as early as possible, if the alarm amount sent out exceeds monitoring system ability to bear, can also influence monitoring system
The availability of system itself.
In prior art, monitoring alarm is monitored, judges and is accused as granularity using equipment or equipment-monitored item
It is alert, when same problem occurs in the identical monitored item of large number of equipment, same node point large number of equipment goes wrong, same application/system
Largely when something goes wrong, each equipment can all be directed to the monitored item and generate a monitoring alarm information, and it is prominent to will produce monitoring alarm
Hair, operation maintenance personnel failure judgement range is difficult and leads to the possibility of failure with monitoring system overload.
In prior art, monitoring data collection is periodically to execute, and failure occurs into failover procedure, can be every
Every a time cycle, monitoring alarm information is all sent out, for the failure that do not repaired across several periods, can all be weighed during reparation
Monitoring alarm information is sent in recurrence, influences the troubleshooting work of monitor system performance and operation maintenance personnel.
Invention content
Present invention seek to address that problem as described above.
According to an aspect of the present invention, a kind of monitoring alarm method is provided, including：
The a plurality of monitoring alarm information with same alike result being collected into is merged, a merging monitoring alarm is obtained
Information；
Monitoring alarm information table is generated, the monitoring alarm information table includes to merge monitoring alarm information and/or can not close
And monitoring alarm information；
Situation is submitted according to current alarm, the monitoring alarm information table is sent, is alerted.
Preferably, the monitoring alarm information includes at least any or arbitrary multinomial in following parameter：
Alarm equipment, monitored item, monitoring data, alarm conditions, alarm level,
Wherein, the equipment that alarm equipment instruction monitoring alarm information is directed toward, monitored item indicate the monitoring alarm information needle
To monitoring project, the obtained data of monitoring data instruction monitoring, alarm conditions instruction and the monitored item be associated need into
The value of row alarm, alarm level indicate that the priority of current monitor warning information, the alarm equipment are table with monitored item parameter
The parameter of the bright monitoring alarm information attribute；
The monitoring alarm information that merges is including at least any or arbitrary multinomial in following parameter：
Alarming node alerts application/systematic name, alarm equipment list, monitored item, monitoring data, alarm conditions, merging
Alarm level, alarm equipment accounting in node, using alarm equipment accounting in/system,
Wherein, alarming node indicates that the node device that combined monitoring alarm information is directed toward, alarm application/systematic name refer to
Show application/system that the monitoring alarm information of merging is directed toward, in node the instruction of alarm equipment accounting be incorporated into merging monitoring and accuse
The number of devices that monitoring alarm information in alert information is related to accounts for the ratio of armamentarium in the node device, using/system
The number of devices that the monitoring alarm information that interior alarm equipment accounting instruction is incorporated into the merging monitoring alarm information is related to accounts for institute
The ratio of armamentarium in application/system is stated, the priority that alarm level instruction merges monitoring alarm information is merged.
Preferably, it is specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical.
Preferably, a plurality of monitoring alarm information with same alike result being collected into is merged, obtains a merging
The step of monitoring alarm information includes：
The number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to is calculated to account in node device
Or in application/system armamentarium ratio；
According to the ratio, determines and merge alarm level；
It generates and merges monitoring alarm information.
Preferably, the step of submitting situation according to current alarm, sending the monitoring alarm information table, alerted is wrapped
It includes：
Query warning task interface accumulation monitoring alarm information list to be sent at present；
Newly-generated monitoring alarm information table is incorporated to the accumulation monitoring alarm information list, monitoring to be sent is generated and accuses
Alert information list；
Sending strategy is determined according to the number of entries in the monitoring alarm information list to be sent；
The monitoring alarm information list to be sent is sent according to the sending strategy.
Preferably, the step of determining sending strategy according to the number of entries in the monitoring alarm information list to be sent is wrapped
It includes：
Judge number of entries in the monitoring alarm information list to be sent whether monitoring alarm transmission interface property
Within the scope of energy limit；
Number of entries in the monitoring alarm information list to be sent is more than the property of the monitoring alarm transmission interface
When energy limit, selected section entry is preferentially sent.
Preferably, the step of selected section entry is preferentially sent include：
When the continuous alarm time of an entry is more than six threshold values, judge that often generating N same item only sends once, N
For the positive integer more than or equal to 2；
When the continuous alarm time of an entry is more than seven threshold values, the higher partial entry of alarm level is selected preferentially to send out
It send.
According to another aspect of the present invention, a kind of monitoring alarm device is provided, including：
Monitoring alarm information merging module, for being carried out to a plurality of monitoring alarm information with same alike result being collected into
Merge, obtains a merging monitoring alarm information；
List Generating Module, for generating monitoring alarm information table, the monitoring alarm information table includes to merge monitoring to accuse
Alert information and/or the monitoring alarm information that can not merge；
Sending module is alerted, for submitting situation according to current alarm, the monitoring alarm information table is sent, is accused
It is alert.
Preferably, it is specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical,
The monitoring alarm information merging module includes：
Statistic unit, the number of devices being related to for calculating a plurality of monitoring alarm information with same alike result being collected into
Account in node device or in application/system armamentarium ratio；
Rank confirmation unit, for according to the ratio, determining and merging alarm level；
Information generating unit merges monitoring alarm information for generating.
Preferably, the alarm sending module includes：
Accumulation task confirmation unit, the accumulation monitoring alarm information to be sent at present for query warning task interface row
Table；
Information generating unit to be sent is believed for newly-generated monitoring alarm information table to be incorporated to the accumulation monitoring alarm
List is ceased, monitoring alarm information list to be sent is generated；
Sending strategy confirmation unit, for determining hair according to the number of entries in the monitoring alarm information list to be sent
Send strategy；
Execution unit is sent, for sending the monitoring alarm information list to be sent according to the sending strategy.
Preferably, the sending strategy confirmation unit includes：
Quantity confirms subelement, for judging whether the number of entries in the monitoring alarm information list to be sent is supervising
Within the scope of the performance boundary of the alert transmission interface of charge；
Subelement is screened, is accused more than the monitoring for the number of entries in the monitoring alarm information list to be sent
When the performance boundary of alert transmission interface, selected section entry is preferentially sent, specifically：
When the continuous alarm time of an entry is more than six threshold values, judge that often generating N same item only sends once, N
For the positive integer more than or equal to 2,
When the continuous alarm time of an entry is more than seven threshold values, the higher partial entry of alarm level is selected preferentially to send out
It send.
The present invention provides a kind of monitoring alarm method and apparatus, are accused to a plurality of monitoring with same alike result being collected into
Alert information merges, and obtains a merging monitoring alarm information, generates monitoring alarm information table, feelings are submitted according to current alarm
Condition sends the monitoring alarm information table, is alerted.The transmission of the merging to a plurality of monitoring alarm information is realized, is reduced
Monitoring alarm information content solves the problems, such as that alarm burst causes system overload and operation maintenance personnel failure judgement difficult.
Being described below for exemplary embodiment is read with reference to the drawings, other property features of the invention and advantage will
It is apparent from.
Description of the drawings
It is incorporated into specification and the attached drawing of a part for constitution instruction shows the embodiment of the present invention, and with
Principle for explaining the present invention together is described.In the drawings, similar reference numeral is for indicating similar element.Under
Attached drawing in the description of face is some embodiments of the present invention, rather than whole embodiments.Those of ordinary skill in the art are come
It says, it without creative efforts, can be obtain other attached drawings according to these attached drawings.
Fig. 1 schematically illustrates a kind of flow of monitoring alarm method of the offer of the embodiment of the present invention one；
Fig. 2 schematically illustrates a kind of structure of monitoring alarm device of the offer of the embodiment of the present invention two；
Fig. 3 schematically illustrates the structure of monitoring alarm information merging module 201 in Fig. 2；
Fig. 4 schematically illustrates the structure that sending module 203 is alerted in Fig. 2；
Fig. 5 schematically illustrates the structure of sending strategy confirmation unit 403 in Fig. 4.
Specific implementation mode
In order to make the object, technical scheme and advantages of the embodiment of the invention clearer, below in conjunction with the embodiment of the present invention
In attached drawing, technical scheme in the embodiment of the invention is clearly and completely described, it is clear that described embodiment is
A part of the embodiment of the present invention, instead of all the embodiments.Based on the embodiments of the present invention, those of ordinary skill in the art
The every other embodiment obtained without making creative work, shall fall within the protection scope of the present invention.It needs
Illustrate, in the absence of conflict, the features in the embodiments and the embodiments of the present application mutually can be combined arbitrarily.
In prior art, monitoring alarm is monitored, judges and is accused as granularity using equipment or equipment-monitored item
It is alert, when same problem occurs in the identical monitored item of large number of equipment, same node point large number of equipment goes wrong, same application/system
Largely when something goes wrong, each equipment can all be directed to the monitored item and generate a monitoring alarm information, and it is prominent to will produce monitoring alarm
Hair, operation maintenance personnel failure judgement range is difficult and leads to the possibility of failure with monitoring system overload.
In prior art, monitoring data collection is periodically to execute, and failure occurs into failover procedure, can be every
Every a time cycle, monitoring alarm information is all sent out, for the failure that do not repaired across several periods, can all be weighed during reparation
Monitoring alarm information is sent in recurrence, influences the troubleshooting work of monitor system performance and operation maintenance personnel.
To solve the above-mentioned problems, the embodiment provides a kind of monitoring alarm method and apparatus, are accused to monitoring
Alert information merges transmission, reduces monitoring alarm quantity, improves the precision of alarm.When sending monitoring alarm information, root
According to information such as the time of monitoring alarm, state, rank, alarm sending port loads, it is timely that dynamic adjusts transmission sequence, range
Prolong, reduce system alarm pressure, keep monitoring alarm information more acurrate effectively, is conducive to operation maintenance personnel and obtains monitoring alarm letter in time
It ceases and intervenes processing.
First in conjunction with attached drawing, the embodiment of the present invention one is illustrated.
An embodiment of the present invention provides a kind of monitoring alarm methods, and the flow of monitoring system alarm is completed such as using this method
Shown in Fig. 1, including：
Step 101 merges a plurality of monitoring alarm information with same alike result being collected into, and obtains a merging
Monitoring alarm information；
In the embodiment of the present invention, the monitoring alarm information includes at least any or arbitrary multinomial in following parameter：
Alarm equipment, monitored item, monitoring data, alarm conditions, alarm level,
Wherein, the equipment that alarm equipment instruction monitoring alarm information is directed toward, monitored item indicate the monitoring alarm information needle
To monitoring project, the obtained data of monitoring data instruction monitoring, alarm conditions instruction and the monitored item be associated need into
The value of row alarm, alarm level indicate that the priority of current monitor warning information, the alarm equipment are table with monitored item parameter
The parameter of the bright monitoring alarm information attribute；
The monitoring alarm information that merges is including at least any or arbitrary multinomial in following parameter：
Alarming node alerts application/systematic name, alarm equipment list, monitored item, monitoring data, alarm conditions, merging
Alarm level, alarm equipment accounting in node, using alarm equipment accounting in/system,
Wherein, alarming node indicates that the node device that combined monitoring alarm information is directed toward, alarm application/systematic name refer to
Show application/system that the monitoring alarm information of merging is directed toward, in node the instruction of alarm equipment accounting be incorporated into merging monitoring and accuse
The number of devices that monitoring alarm information in alert information is related to accounts for the ratio of armamentarium in the node device, using/system
The number of devices that the monitoring alarm information that interior alarm equipment accounting instruction is incorporated into the merging monitoring alarm information is related to accounts for institute
The ratio of armamentarium in application/system is stated, the priority that alarm level instruction merges monitoring alarm information is merged.
Merging the monitoring data in monitoring alarm information can be the form of list, including the monitoring alarm letter being all merged
Monitoring data involved in breath.
It is specifically referred to same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical.
This step specifically includes：
1, it calculates the number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to and accounts for node device
The ratio of armamentarium in interior or application/system；
Preferably, threshold value can be set, for determine whether to reach can the condition of convergence, i.e., whether cope with monitoring alarm information into
Row merges.
2, it according to the ratio, determines and merges alarm level；
3, it generates and merges monitoring alarm information.
Step 102, generate monitoring alarm information table, the monitoring alarm information table include merge monitoring alarm information and/
Or the monitoring alarm information that can not merge；
In this step, after having executed the merging to annexable monitoring alarm information, final monitoring alarm letter is generated
Table is ceased, contains merge monitoring alarm information wherein, also contain the monitoring alarm information that can not merge.
Step 103 submits situation according to current alarm, sends the monitoring alarm information table, is alerted；
This step specifically includes：
1, query warning task interface accumulation monitoring alarm information list to be sent at present.
2, newly-generated monitoring alarm information table is incorporated to the accumulation monitoring alarm information list, generates monitoring to be sent
Warning information list.
3, sending strategy is determined according to the number of entries in the monitoring alarm information list to be sent；
First, it is determined that whether the number of entries in the monitoring alarm information list to be sent is in monitoring alarm transmission interface
Performance boundary within the scope of, number of entries in the monitoring alarm information list to be sent is sent more than the monitoring alarm
When the performance boundary of interface, selected section entry is preferentially sent.
It is the citing of two kinds of selected section entries below：
When the continuous alarm time of an entry is more than six threshold values, judge that often generating N same item only sends once, N
For the positive integer more than or equal to 2；
When the continuous alarm time of an entry is more than seven threshold values, the higher partial entry of alarm level is selected preferentially to send out
It send.
4, the monitoring alarm information list to be sent is sent according to the sending strategy.
Below in conjunction with the accompanying drawings, the embodiment of the present invention two is illustrated.
An embodiment of the present invention provides a kind of monitoring alarm devices, and structure is as shown in Fig. 2, include：
Monitoring alarm information merging module 201, for a plurality of monitoring alarm information with same alike result to being collected into
It merges, obtains a merging monitoring alarm information；
List Generating Module 202, for generating monitoring alarm information table, the monitoring alarm information table includes to merge to monitor
Warning information and/or the monitoring alarm information that can not merge；
Sending module 203 is alerted, for submitting situation according to current alarm, the monitoring alarm information table is sent, carries out
Alarm.
Preferably, it is specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical,
It is described as shown in figure 3, including：
Statistic unit 301, the equipment being related to for calculating a plurality of monitoring alarm information with same alike result being collected into
Quantity account in node device or in application/system armamentarium ratio；
Rank confirmation unit 302, for according to the ratio, determining and merging alarm level；
Information generating unit 303 merges monitoring alarm information for generating.
Preferably, the structure of the alarm sending module 203 is as shown in figure 4, include：
Accumulation task confirmation unit 401, the accumulation monitoring alarm information to be sent at present for query warning task interface
List；
Information generating unit 402 to be sent is accused for newly-generated monitoring alarm information table to be incorporated to the accumulation monitoring
Alert information list, generates monitoring alarm information list to be sent；
Sending strategy confirmation unit 403, for true according to the number of entries in the monitoring alarm information list to be sent
Determine sending strategy；
Execution unit 404 is sent, for sending the monitoring alarm information list to be sent according to the sending strategy.
Preferably, the structure of the sending strategy confirmation unit 403 is as shown in figure 5, include：
Quantity confirms subelement 501, for whether judging the number of entries in the monitoring alarm information list to be sent
Within the scope of the performance boundary of monitoring alarm transmission interface；
Subelement 502 is screened, is more than the prison for the number of entries in the monitoring alarm information list to be sent
When the performance boundary of the alert transmission interface of charge, selected section entry is preferentially sent, specifically：
When the continuous alarm time of an entry is more than six threshold values, judge that often generating N same item only sends once, N
For the positive integer more than or equal to 2,
When the continuous alarm time of an entry is more than seven threshold values, the higher partial entry of alarm level is selected preferentially to send out
It send.
Below in conjunction with the accompanying drawings, the embodiment of the present invention three is illustrated.
An embodiment of the present invention provides a kind of monitoring alarm methods, before the transmission of monitoring alarm information, to same type
Monitoring alarm information, which merges convergence, reduces quantity, and judges the time of monitoring alarm, state, rank, alerts sending port
The information such as load, dynamic adjust transmission sequence, range and time delay, achieve the purpose that reduce unit interval monitoring alarm quantity, protect
Barrier O&M to monitoring be effectively treated and the stability of monitoring system.Detailed process is as follows：
1, monitoring data is obtained, determines whether to reach monitoring alarm threshold value
1) monitoring data is obtained every a time cycle, and stored；
2) monitoring data of each monitored item is compared with the monitoring alarm threshold value set in advance, if meeting monitoring
Monitored item is then set to alarm status by alarm conditions；
3) according to monitoring alarm information model, the monitoring alarm information that monitored item is alarm status is obtained respectively, forms prison
The alert information table of charge.Monitoring alarm information includes " alarm equipment, monitored item, monitoring data, alarm conditions, alarm level " etc.
Deng.
Citing：
- there are equipment dev1, dev2, dev3, monitored item is DF (disk utilization rate), when alarm conditions are that DF is more than 90
Alarm；
- obtain monitoring data dev1：DF=95, dev2：DF=95, dev3：DF=95；
- because alarm data meets alarm conditions, then the DF of dev1, dev2, dev3 are set to alarm status；
The monitoring alarm information table of-DF monitored item is：Alarm equipment, monitored item, monitoring data, alarm conditions, alert level
Not；
- monitoring alarm information table is：
Dev1DF 95 is alerted more than 90 three-levels；
Dev2DF 95 is alerted more than 90 three-levels；
Dev3DF 95 is alerted more than 90 three-levels；
2, monitoring alarm information table is restrained, is formed and merges monitoring alarm
Three kinds of monitoring alarm information Unite principles with same alike result are illustrated below, three kinds of situations are respectively：
Monitored item content of parameter is identical；
Monitoring alarm information is directed toward same node device and monitored item content of parameter is identical；
Monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical.
1) monitored item content of parameter is identical.
Judge whether the alarm equipment of identical monitored item in monitoring alarm information table is more than first threshold, if it is greater than then sentencing
This fixed monitored item is that can restrain monitored item, and the monitoring alarm information comprising this monitored item is merged into a monitoring alarm information,
And it preserves.
A. the monitoring alarm information bar number for including specified monitored item in Statistical monitor warning information table is extracted respectively.
B. judge that this monitored item can be received if the monitoring alarm information bar number comprising specified monitored item is more than first threshold
It holds back.
C. can convergent monitored item be merged into " merge monitoring alarm information ", remaining can not convergent monitoring alarm information
Directly retain, ultimately forms and merge monitoring alarm information table；Merging monitoring alarm information format is：Alarm equipment list, monitoring
Item, monitoring data, alarm conditions, alarm equipment accounting, alarm level.
D. wherein alarm level is obtained by the monitored item-alarm equipment accounting-alarm level mapping relations pre-set
It takes, and replaces the alarm level of original single monitoring alarm information.
DF is more than 90% Level 1Alarming；
Such as：
Dev1, dev2, dev3DF 95,95,95 is more than 90 100% Level 1Alarmings.
2) monitoring alarm information is directed toward same node device and monitored item content of parameter is identical.
Judge whether the quantity of the identical monitored item alarm of same node point equipment in monitoring alarm information table is more than the second threshold
Monitoring alarm information comprising this monitored item is merged into one by value if it is greater than then judging that this monitored item is that can restrain monitored item
Monitoring alarm information, and preserve.
A. query node list of devices extracts the same node for including specified monitored item in Statistical monitor warning information table respectively
Equipment (node up to standard) item number.
B. if being more than second threshold with the monitoring alarm information bar number of node device comprising specified monitored item direction and reaching
It marks node total number and is less than third threshold value, then judge that the monitored item of this node device can restrain (if node up to standard is more than third threshold
Value, then can only be restrained according to identical monitored item).
C. can convergent node device monitored item be merged into " merge monitoring alarm information ", remaining convergent can not be monitored
Warning information directly retains, and ultimately forms and merges monitoring alarm information table；Merging monitoring alarm information format is：Alarming node,
Alarm equipment accounting, alarm level in alarm equipment list, monitored item, monitoring data, alarm conditions, node.
D. wherein alarm level is obtained by the monitored item-alarm equipment accounting-alarm level mapping relations pre-set
It takes, and replaces the alarm level of original single monitoring alarm information.
DF single nodes are more than 80% Level 1Alarming；
DF single nodes are alerted more than 40% two level；
Such as：
Dev1 and dev2 is that same node point equipment node1, node1 share 4 equipment；
Node1dev1, dev2DF 95 is alerted more than 90 50% two levels；
Dev3DF 95 is alerted more than 90 three-levels；
3) monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical.
Judge whether the identical monitored item alarm of same application/system equipment in monitoring alarm information table is more than the first threshold
Monitoring alarm information comprising this monitored item is merged into one by value if it is greater than then judging that this monitored item is that can restrain monitored item
Monitoring alarm information, and preserve.
A. application/system equipment list is inquired, is extracted respectively in Statistical monitor warning information table comprising specified monitored item
Same application/system equipment item number.
B. if same application/system equipment article number comprising specified monitored item is more than the 4th threshold value, judge this application/be
The monitored item of system can restrain.
C. can convergent application/system equipment monitored item be merged into " merge monitoring alarm information ", remaining can not be restrained
Monitoring alarm information directly retain, ultimately form merge monitoring alarm information table；Merging monitoring alarm information format is：It answers
With alarm equipment accounting, alert level in/systematic name, alarm equipment list, monitored item, monitoring data, alarm conditions, node
Not.
D. wherein alarm level is obtained by the monitored item-alarm equipment accounting-alarm level mapping relations pre-set
It takes, and replaces the alarm level of original single monitoring alarm information.
DF single systems are more than 80% great alarm；
DF single systems are more than 40% Level 1Alarming；
Such as：
Dev1 and dev2 is same application/system call system equipment, and scheduling system shares 4 equipment；
Scheduling system dev1, dev2DF 95 is more than 90 50% Level 1Alarmings；
Dev3DF 95 is alerted more than 90 three-levels；
3, judgement merges monitoring alarm information state, adjustment alarm transmission sequence, range and time delay.
1) query history merges monitoring alarm information table, confirms the time that monitoring alarm information continuously alerts.
Query history merges in monitoring alarm information table, and monitoring alarm information is identical and continuous alert arrives current time
Time interval, be continuous alarm time.
2) the monitoring alarm information transmission task that current mail transmission interface is left, which is added to be used as with newly-increased transmission task, to be waited for
Send number of tasks, judge number of tasks to be sent whether be more than transmission interface performance boundary.
A. query task interface obtains accumulation number of tasks at present, each entry in list corresponds to a task.
B. query monitor warning information table obtains and increases monitoring alarm information bar number newly, i.e. this monitoring alarm generated letter
The number of entries for including in breath table.
C. number of tasks and the summation of newly-increased monitoring alarm information bar number will be accumulated, number of tasks to be sent is formed.
D. judging whether number of tasks to be sent is more than the 5th threshold value, the 5th threshold value is the performance boundary numerical value of transmission interface,
If it is greater, then assert that current monitoring alarm transmission interface will overload.When transmission interface has overload danger, need to formulate
Corresponding sending strategy mitigates transmission interface pressure, ensures that alarm is normally carried out.
3) adjustment transmission delay, range, sequence are determined a need for, ensures that transmission interface and monitoring system are stablized.
A. judge whether continuous alarm time is more than the 6th threshold value, if it is greater, then only transmission is primary for alarm per n times, N is
Integer more than or equal to 2, such as N values are 5.
B. judge whether continuous alarm time is more than the 7th threshold value, if it is greater, then range of transmission is revised as emergent small
Group personnel.
C. judgement current monitor alarm transmission interface will overload, then according to the descending sequence of failure rank, choose
The monitoring alarm information of Rational number is sent.If significant trouble alreadys exceed performance boundary, preferential send merges monitoring
Warning information is sent if still exceeded according to information table sequencing.Ensure in performance range.
4) monitoring alarm information table will be merged according to detection time point, file and merge monitoring alarm information table for history.
4, according to range of transmission, monitoring alarm is sent.
The embodiment provides a kind of monitoring alarm method and apparatus, more with same alike result to what is be collected into
Monitoring alarm information merges, and obtains a merging monitoring alarm information, generates monitoring alarm information table, is accused according to current
It is alert to submit situation, the monitoring alarm information table is sent, is alerted.Realize the hair of the merging to a plurality of monitoring alarm information
It send, reduces monitoring alarm information content, solving alarm burst causes system overload and operation maintenance personnel failure judgement difficult
Problem.By merging convergence to the monitoring alarm information with same alike result, reduces by 90% monitoring alarm quantity, improve alarm
Precision.When sending monitoring alarm information, according to the time of monitoring alarm, state, rank, alarm sending port load etc.
Information, dynamic generation sending strategy, adjustment transmission sequence, range and time delay eliminate the overload of 99% monitoring alarm transmission interface
Problem.
Descriptions above can combine implementation individually or in various ways, and these variants all exist
Within protection scope of the present invention.
Finally it should be noted that：The above embodiments are merely illustrative of the technical solutions of the present invention, rather than its limitations.Although
Present invention has been described in detail with reference to the aforementioned embodiments, it will be understood by those of ordinary skill in the art that：It still may be used
With technical scheme described in the above embodiments is modified or equivalent replacement of some of the technical features；
And these modifications or replacements, various embodiments of the present invention technical solution that it does not separate the essence of the corresponding technical solution spirit and
Range.
Claims (10)
1. a kind of monitoring alarm method, which is characterized in that including：
The a plurality of monitoring alarm information with same alike result being collected into is merged, one is obtained and merges monitoring alarm letter
Breath；
Monitoring alarm information table is generated, the monitoring alarm information table includes to merge monitoring alarm information and/or can not merge
Monitoring alarm information；
Situation is submitted according to current alarm, the monitoring alarm information table is sent, is alerted,
Wherein, the merging monitoring alarm information at least also includes to be accused in alarm equipment accounting and/or application/system in node
Equipment accounting is warned, alarm equipment accounting indicates that the monitoring alarm information being incorporated into the merging monitoring alarm information is related in node
Number of devices account for the ratio of armamentarium in the node device, be incorporated into this using alarm equipment accounting instruction in/system
Merge the ratio that the number of devices that the monitoring alarm information in monitoring alarm information is related to accounts for armamentarium in the application/system
Example,
Wherein, a plurality of monitoring alarm information with same alike result being collected into is merged, obtains one and merges monitoring announcement
The step of alert information includes：
The number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to is calculated to account in node device or answer
With the ratio of armamentarium in/system；
According to the ratio, determines and merge alarm level；
It generates and merges monitoring alarm information,
Wherein, a plurality of monitoring alarm information with same alike result being collected into is merged, obtains one and merges monitoring announcement
The step of alert information further includes：
When monitoring alarm information is directed toward same node device and identical monitored item content of parameter, judge in monitoring alarm information table
Same node point equipment identical monitored item alarm quantity whether be more than second threshold, then judge if it is greater than second threshold described in
Identical monitored item is that can restrain monitored item, and the monitoring alarm information comprising the identical monitored item is merged into a monitoring alarm
Information；And/or
When monitoring alarm information is directed toward same node device and identical monitored item content of parameter, if in monitoring alarm information table
The quantity of the identical monitored item alarm of same node point equipment is more than second threshold and is less than third threshold value, then judges the identical prison
It controls Xiang Weike and restrains monitored item, the monitoring alarm information comprising the identical monitored item is merged into a monitoring alarm information,
If the quantity of the identical monitored item alarm of same node point equipment is more than third threshold value in monitoring alarm information table, only according to phase
It is merged with monitored item；And/or
When monitoring alarm information is directed toward same node device and identical monitored item content of parameter in same application or system, sentence
Whether the quantity for determining the identical monitored item alarm of same application/system equipment in monitoring alarm information table is more than first threshold, such as
Fruit then judges that the identical monitored item is that can restrain monitored item more than first threshold, will be accused comprising the monitoring of the identical monitored item
Alert information is merged into a monitoring alarm information.
2. monitoring alarm method according to claim 1, which is characterized in that
The monitoring alarm information at least also includes any or arbitrary multinomial in following parameter：
Alarm equipment, monitored item, monitoring data, alarm conditions,
Wherein, the equipment that alarm equipment instruction monitoring alarm information is directed toward, monitored item indicate what the monitoring alarm information was directed to
Monitoring project, the obtained data of monitoring data instruction monitoring, alarm conditions instruction with the monitored item is associated is accused
Alert value, the alarm equipment and monitored item parameter are to show the parameter of the monitoring alarm information attribute；
It is described to merge monitoring alarm information at least also comprising any or arbitrary multinomial in following parameter：
Alarming node, alarm application/systematic name, alarm equipment list, monitored item, monitoring data, alarm conditions,
Wherein, alarming node indicates that the node device that combined monitoring alarm information is directed toward, alarm application/systematic name instruction close
And monitoring alarm information be directed toward application/system.
3. monitoring alarm method according to claim 2, which is characterized in that be specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical.
4. monitoring alarm method according to any one of claims 1 to 3, which is characterized in that situation is submitted according to current alarm,
The step of sending the monitoring alarm information table, being alerted include：
Query warning task interface accumulation monitoring alarm information list to be sent at present；
Newly-generated monitoring alarm information table is incorporated to the accumulation monitoring alarm information list, generates monitoring alarm letter to be sent
Cease list；
Sending strategy is determined according to the number of entries in the monitoring alarm information list to be sent；
The monitoring alarm information list to be sent is sent according to the sending strategy.
5. monitoring alarm method according to claim 4, which is characterized in that arranged according to the monitoring alarm information to be sent
The step of number of entries in table determines sending strategy include：
Judge the number of entries in the monitoring alarm information list to be sent whether in the performance pole of monitoring alarm transmission interface
It limits in range；
Number of entries in the monitoring alarm information list to be sent is more than the performance pole of the monitoring alarm transmission interface
In limited time, selected section entry is preferentially sent.
6. monitoring alarm method according to claim 5, which is characterized in that the step of selected section entry is preferentially sent is wrapped
It includes：
When the continuous alarm time of an entry is more than six threshold values, judge that often generating N same item only sends once, N is big
In the positive integer equal to 2；
When the continuous alarm time of an entry is more than seven threshold values, the higher partial entry of alarm level is selected preferentially to send.
7. a kind of monitoring alarm device, which is characterized in that including：
Monitoring alarm information merging module, for being closed to a plurality of monitoring alarm information with same alike result being collected into
And obtain a merging monitoring alarm information；
List Generating Module, for generating monitoring alarm information table, the monitoring alarm information table includes to merge monitoring alarm letter
Breath and/or the monitoring alarm information that can not merge；
Sending module is alerted, for according to current alarm submission situation, sending the monitoring alarm information table, being alerted,
Wherein, the merging monitoring alarm information at least also includes to be accused in alarm equipment accounting and/or application/system in node
Equipment accounting is warned, alarm equipment accounting indicates that the monitoring alarm information being incorporated into the merging monitoring alarm information is related in node
Number of devices account for the ratio of armamentarium in the node device, be incorporated into this using alarm equipment accounting instruction in/system
Merge the ratio that the number of devices that the monitoring alarm information in monitoring alarm information is related to accounts for armamentarium in the application/system
Wherein,
Wherein, the monitoring alarm information merging module includes：
Statistic unit accounts for section for calculating the number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to
The ratio of armamentarium in point device or in application/system；
Rank confirmation unit, for according to the ratio, determining and merging alarm level；
Information generating unit merges monitoring alarm information for generating,
Wherein, the monitoring alarm information merging module is additionally operable to：
When monitoring alarm information is directed toward same node device and identical monitored item content of parameter, judge in monitoring alarm information table
Same node point equipment identical monitored item alarm quantity whether be more than second threshold, then judge if it is greater than second threshold described in
Identical monitored item is that can restrain monitored item, and the monitoring alarm information comprising the identical monitored item is merged into a monitoring alarm
Information；And/or
When monitoring alarm information is directed toward same node device and identical monitored item content of parameter, if in monitoring alarm information table
The quantity of the identical monitored item alarm of same node point equipment is more than second threshold and is less than third threshold value, then judges the identical prison
It controls Xiang Weike and restrains monitored item, the monitoring alarm information comprising the identical monitored item is merged into a monitoring alarm information,
If the quantity of the identical monitored item alarm of same node point equipment is more than third threshold value in monitoring alarm information table, only according to phase
It is merged with monitored item；And/or
When monitoring alarm information is directed toward same node device and identical monitored item content of parameter in same application or system, sentence
Whether the quantity for determining the identical monitored item alarm of same application/system equipment in monitoring alarm information table is more than first threshold, such as
Fruit then judges that the identical monitored item is that can restrain monitored item more than first threshold, will be accused comprising the monitoring of the identical monitored item
Alert information is merged into a monitoring alarm information.
8. monitoring alarm device according to claim 7, which is characterized in that be specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information is directed toward same application or same node device in system and monitored item content of parameter is identical.
9. monitoring alarm device according to claim 7, which is characterized in that the alarm sending module includes：
Accumulation task confirmation unit, the accumulation monitoring alarm information list to be sent at present for query warning task interface；
Information generating unit to be sent is arranged for newly-generated monitoring alarm information table to be incorporated to the accumulation monitoring alarm information
Table generates monitoring alarm information list to be sent；
Sending strategy confirmation unit sends plan for being determined according to the number of entries in the monitoring alarm information list to be sent
Slightly；
Execution unit is sent, for sending the monitoring alarm information list to be sent according to the sending strategy.
10. monitoring alarm device according to claim 9, which is characterized in that the sending strategy confirmation unit includes：
Whether quantity confirms subelement, for judging the number of entries in the monitoring alarm information list to be sent in monitoring announcement
Within the scope of the performance boundary of alert transmission interface；
Subelement is screened, is sent out more than the monitoring alarm for the number of entries in the monitoring alarm information list to be sent
When sending the performance boundary of interface, selected section entry is preferentially sent, specifically：
When the continuous alarm time of an entry is more than six threshold values, judge that often generating N same item only sends once, N is big
In the positive integer equal to 2,
When the continuous alarm time of an entry is more than seven threshold values, the higher partial entry of alarm level is selected preferentially to send.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710642112.0A CN107707380B (en) | 2017-07-31 | 2017-07-31 | A kind of monitoring alarm method and apparatus |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710642112.0A CN107707380B (en) | 2017-07-31 | 2017-07-31 | A kind of monitoring alarm method and apparatus |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107707380A CN107707380A (en) | 2018-02-16 |
| CN107707380B true CN107707380B (en) | 2018-10-23 |
Family
ID=61170118
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710642112.0A Active CN107707380B (en) | 2017-07-31 | 2017-07-31 | A kind of monitoring alarm method and apparatus |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107707380B (en) |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108710334A (en) * | 2018-04-20 | 2018-10-26 | 高新兴科技集团股份有限公司 | A kind of alarm monitoring platform |
| CN109167681B (en) * | 2018-08-07 | 2021-08-17 | 北京云迹科技有限公司 | State monitoring method and device |
| CN109191023A (en) * | 2018-11-07 | 2019-01-11 | 广东电网有限责任公司 | A kind of power grid warning information immediate processing method and device |
| CN109194532B (en) * | 2018-11-07 | 2020-05-01 | 广东电网有限责任公司 | Method and device for pushing power grid alarm information |
| CN109686043A (en) * | 2018-12-19 | 2019-04-26 | 广东电网有限责任公司 | A kind of the information association alarm method and device of intelligent power distribution room monitoring system |
| CN110113208A (en) * | 2019-05-08 | 2019-08-09 | 深圳前海微众银行股份有限公司 | Alarm information processing method, device, equipment and computer readable storage medium |
| CN111245779B (en) * | 2019-12-17 | 2022-05-03 | 北京威努特技术有限公司 | Industrial control firewall alarm message merging method and device |
| CN113377559A (en) * | 2020-03-10 | 2021-09-10 | 北京同邦卓益科技有限公司 | Big data based exception handling method, device, equipment and storage medium |
| CN112104480B (en) * | 2020-08-05 | 2022-10-21 | 福建天泉教育科技有限公司 | Method and system for improving alarm quality |
| CN112564951B (en) * | 2020-11-27 | 2023-01-20 | 广东电网有限责任公司广州供电局 | Method, device, computer equipment and storage medium for avoiding alarm storm |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101247269A (en) * | 2008-03-05 | 2008-08-20 | 中兴通讯股份有限公司 | Method for automatically discovering association rule for judging redundant alarm |
| CN103618635A (en) * | 2013-12-11 | 2014-03-05 | 广东电网公司汕头供电局 | Classified association management and control system of informationized equipment |
| CN105656696A (en) * | 2016-03-21 | 2016-06-08 | 上海天跃科技股份有限公司 | Maintenance system and method |
| CN105763387A (en) * | 2016-05-16 | 2016-07-13 | 北京百度网讯科技有限公司 | Network traffic monitoring method and device |
| CN105991337A (en) * | 2015-03-02 | 2016-10-05 | 中国移动通信集团广东有限公司 | Alarm compression method and alarm compression device |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101582807B (en) * | 2009-07-02 | 2011-10-05 | 北京讯风光通信技术开发有限责任公司 | Method and system based on northbound interface to realize network management |
| CN101931558B (en) * | 2010-09-02 | 2012-11-14 | 罗显平 | Large-area fault intercept system and realization method thereof |
| CN103067884B (en) * | 2011-10-21 | 2016-03-30 | 阿里巴巴集团控股有限公司 | A kind of processing method of warning message and device |
| CN102340422A (en) * | 2011-10-28 | 2012-02-01 | 青岛海信传媒网络技术有限公司 | Alarm processing method and system |
| US9055112B2 (en) * | 2012-09-18 | 2015-06-09 | Amazon Technologies, Inc. | Dynamically allocating network addresses |
| CN103023695B (en) * | 2012-11-28 | 2015-04-15 | 绍兴电力局 | Master station system monitoring model based on power dispatching automation |
| CN103684880A (en) * | 2013-12-31 | 2014-03-26 | 上海斐讯数据通信技术有限公司 | Alarming control method and alarming device |
| CN106713049B (en) * | 2017-02-04 | 2020-08-04 | 杭州迪普科技股份有限公司 | Monitoring alarm method and device |
-
2017
- 2017-07-31 CN CN201710642112.0A patent/CN107707380B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101247269A (en) * | 2008-03-05 | 2008-08-20 | 中兴通讯股份有限公司 | Method for automatically discovering association rule for judging redundant alarm |
| CN103618635A (en) * | 2013-12-11 | 2014-03-05 | 广东电网公司汕头供电局 | Classified association management and control system of informationized equipment |
| CN105991337A (en) * | 2015-03-02 | 2016-10-05 | 中国移动通信集团广东有限公司 | Alarm compression method and alarm compression device |
| CN105656696A (en) * | 2016-03-21 | 2016-06-08 | 上海天跃科技股份有限公司 | Maintenance system and method |
| CN105763387A (en) * | 2016-05-16 | 2016-07-13 | 北京百度网讯科技有限公司 | Network traffic monitoring method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107707380A (en) | 2018-02-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107707380B (en) | A kind of monitoring alarm method and apparatus | |
| CN109039833B (en) | Method and device for monitoring bandwidth state | |
| JP6647824B2 (en) | Error diagnosis system and error diagnosis method | |
| CN106961352A (en) | Monitoring system and monitoring method | |
| CN105872061B (en) | A kind of server set group managing means, apparatus and system | |
| CN110740061B (en) | Fault early warning method and device and computer storage medium | |
| WO2015090098A1 (en) | Method and apparatus for realizing fault location | |
| CN104778111A (en) | Alarm method and alarm device | |
| CN103227662B (en) | A kind of electric power communication device safety detection method based on mode control and system | |
| CN106655158A (en) | Smart grid based distribution network self-healing control system and method | |
| CN106161090A (en) | The monitoring method of a kind of subregion group system and device | |
| CN106685676A (en) | Node switching method and device | |
| CN105871581A (en) | Method and device for processing of alarm information in cloud calculation | |
| CN104808602B (en) | Execution standardization behavior in the host device | |
| CN109005076A (en) | A kind of intelligent substation switch monitoring system and interchanger monitoring method | |
| CN107360025A (en) | A kind of distributed memory system cluster monitoring method and apparatus | |
| CN108039971A (en) | A kind of alarm method and device | |
| CN109412902B (en) | Intelligent monitoring method, storage device, terminal and system of power dispatching data network system | |
| CN106444685A (en) | Distributed control system and method of distributed control system for dynamic scheduling resources | |
| CN103905271B (en) | A kind of alarm windstorm suppressing method | |
| CN106789278B (en) | The power failure restorative procedure of power failure repair system and the application system | |
| CN108460517A (en) | A kind of power distribution network management-control method and device | |
| CN104331353A (en) | Method for guaranteeing software high availability | |
| CN116795643A (en) | Alarm management method | |
| CN115941441A (en) | System link automation monitoring operation and maintenance method, system, equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 100015 5 floor, block E, 201 IT tower, electronic city, 10 Jiuxianqiao Road, Chaoyang District, Beijing. Patentee after: Guizhou Baishan cloud Polytron Technologies Inc Address before: 100015 5 floor, block E, 201 IT tower, electronic city, 10 Jiuxianqiao Road, Chaoyang District, Beijing. Patentee before: Guizhou white cloud Technology Co., Ltd. |
|
| CP01 | Change in the name or title of a patent holder |