CN111092758A - Method and device for reducing alarm and recovering false alarm and electronic equipment - Google Patents
Method and device for reducing alarm and recovering false alarm and electronic equipment Download PDFInfo
- Publication number
- CN111092758A CN111092758A CN201911271373.1A CN201911271373A CN111092758A CN 111092758 A CN111092758 A CN 111092758A CN 201911271373 A CN201911271373 A CN 201911271373A CN 111092758 A CN111092758 A CN 111092758A
- Authority
- CN
- China
- Prior art keywords
- alarm
- recovery
- false
- matching
- queue
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
Abstract
The embodiment of the disclosure provides a method, a device and an electronic device for reducing alarm and recovering false alarm, belonging to the technical field of data processing, wherein the method comprises the following steps: inputting the monitoring metadata to an alarm rule matching algorithm module, and entering an alarm processing module if the matching is successful after the algorithm matching is finished, or entering a recovery processing module if the matching is not successful; the alarm processing module receives the rule matching success information, records the alarm times for one time, generates an alarm message if the alarm times are greater than the false alarm factor, puts the alarm information into an alarm queue, resets the alarm times and resets the recovery times; the recovery processing receives rule matching failure information, and records the recovery times; and generating an alarm queue, and taking the message stored in the recovery queue as the message subjected to false alarm processing. By the processing scheme, the efficiency of alarming and recovering the false alarm can be improved.
Description
Technical Field
The present disclosure relates to the field of data processing technologies, and in particular, to a method and an apparatus for reducing alarm and recovering false alarm, and an electronic device.
Background
At present, the informatization construction of enterprises is continuously improved, and the health state examination of some IT servers is also more important, for example, the detection of the utilization rates of basic servers such as CPU, memory and disks can timely give out early warning, track problems and process problems, but the following problems exist:
1. the number of alarms is too large, and the manager receives hundreds and thousands of alarm mails or short messages every day
2. Most of the alarm information is false alarm and cannot reflect the state of the server in time
3. The administrator needs to verify whether the alarm is false or not from the alarm information which is so much every day, so that the burden of the administrator is increased
Disclosure of Invention
In view of the above, embodiments of the present disclosure provide a method, an apparatus, and an electronic device for reducing an alarm and recovering a false alarm, so as to at least partially solve the problems in the prior art.
In a first aspect, an embodiment of the present disclosure provides a method for reducing an alarm and recovering a false alarm, including:
inputting the monitoring metadata to an alarm rule matching algorithm module, and entering an alarm processing module if the matching is successful after the algorithm matching is finished, or entering a recovery processing module if the matching is not successful;
the alarm processing module receives the rule matching success information, records the alarm times for one time, generates an alarm message if the alarm times are greater than the false alarm factor, puts the alarm information into an alarm queue, resets the alarm times and resets the recovery times;
the recovery processing receives rule matching failure information, records recovery times once, generates a piece of recovery information if the recovery times are greater than a false alarm factor, puts the recovery information into a recovery queue, resets the recovery times and resets the alarm times;
and generating an alarm queue, and taking the message stored in the recovery queue as the message subjected to false alarm processing.
According to a specific implementation manner of the embodiment of the present disclosure, the monitoring metadata is data collected by a monitoring system.
According to a specific implementation manner of the embodiment of the disclosure, the alarm rule matching algorithm is a specific algorithm for generating alarm information, algorithm matching is performed according to input monitoring metadata, matching is successful, and an alarm is generated, otherwise, no alarm is generated.
According to a specific implementation manner of the embodiment of the present disclosure, the alarm processing is used for judging whether to perform alarm convergence according to a set false alarm factor.
According to a specific implementation manner of the embodiment of the present disclosure, the recovery processing is used to determine whether to perform recovery convergence according to a set false alarm factor.
According to a specific implementation manner of the embodiment of the present disclosure, the alarm queue is used for storing alarm information that is finally subjected to false alarm processing and converged.
According to a specific implementation manner of the embodiment of the disclosure, the recovery queue is used for storing recovery information which is finally subjected to false alarm processing and converged;
the false alarm factor is used as a threshold for alarming or recovering convergence, and the larger the threshold is, the higher the convergence rate is and the lower the false alarm rate is.
In a second aspect, an embodiment of the present disclosure provides an apparatus for reducing an alarm and recovering a false alarm, including:
the input module is used for inputting the monitoring metadata to the alarm rule matching algorithm module, and after the algorithm matching is finished, if the matching is successful, the input module enters the alarm processing module, otherwise, the input module enters the recovery processing module;
the matching module is used for receiving the rule matching success information by the alarm processing module, recording the number of times of one alarm, generating an alarm message if the number of times of the alarm is greater than a false alarm factor, putting the alarm message into an alarm queue, resetting the number of times of the alarm, and resetting the number of times of recovery;
the recovery module is used for recovering and processing the received rule matching failure information, recording the recovery times for one time, generating a piece of recovery information if the recovery times are greater than the false alarm factor, putting the recovery information into a recovery queue, resetting the recovery times and resetting the alarm times;
and the generating module is used for generating an alarm queue and taking the message stored in the recovery queue as the message subjected to false alarm processing.
In a third aspect, an embodiment of the present disclosure further provides an electronic device, where the electronic device includes:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of reducing alarms and recovering false alarms of the first aspect or any implementation of the first aspect.
In a fourth aspect, the embodiments of the present disclosure further provide a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the method for reducing an alarm and recovering a false alarm in the first aspect or any implementation manner of the first aspect.
In a fifth aspect, the embodiments of the present disclosure further provide a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the method for reducing alarms and recovering false alarms in the foregoing first aspect or any implementation manner of the first aspect.
The scheme for reducing the alarm and recovering the false alarm in the embodiment of the disclosure comprises the steps of inputting monitoring metadata to an alarm rule matching algorithm module, and entering an alarm processing module if the matching is successful after the algorithm matching is finished, or entering a recovery processing module if the matching is not successful; the alarm processing module receives the rule matching success information, records the alarm times for one time, generates an alarm message if the alarm times are greater than the false alarm factor, puts the alarm information into an alarm queue, resets the alarm times and resets the recovery times; the recovery processing receives rule matching failure information, records recovery times once, generates a piece of recovery information if the recovery times are greater than a false alarm factor, puts the recovery information into a recovery queue, resets the recovery times and resets the alarm times; and generating an alarm queue, and taking the message stored in the recovery queue as the message subjected to false alarm processing. By the processing scheme, the management personnel can flexibly adjust the false alarm factor, improve the false alarm rate, reduce the number of alarm information and reduce the maintenance cost.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings needed to be used in the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present disclosure, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a flow chart of a method for reducing alarms and recovering false alarms according to an embodiment of the present disclosure;
FIG. 2 is a flow chart of another method for reducing alarms and recovering false alarms provided by the embodiments of the present disclosure;
fig. 3 is a schematic structural diagram of an apparatus for reducing alarm and recovering false alarm according to an embodiment of the present disclosure;
fig. 4 is a schematic view of an electronic device provided in an embodiment of the present disclosure.
Detailed Description
The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.
The embodiments of the present disclosure are described below with specific examples, and other advantages and effects of the present disclosure will be readily apparent to those skilled in the art from the disclosure in the specification. It is to be understood that the described embodiments are merely illustrative of some, and not restrictive, of the embodiments of the disclosure. The disclosure may be embodied or carried out in various other specific embodiments, and various modifications and changes may be made in the details within the description without departing from the spirit of the disclosure. It is to be noted that the features in the following embodiments and examples may be combined with each other without conflict. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.
It is noted that various aspects of the embodiments are described below within the scope of the appended claims. It should be apparent that the aspects described herein may be embodied in a wide variety of forms and that any specific structure and/or function described herein is merely illustrative. Based on the disclosure, one skilled in the art should appreciate that one aspect described herein may be implemented independently of any other aspects and that two or more of these aspects may be combined in various ways. For example, an apparatus may be implemented and/or a method practiced using any number of the aspects set forth herein. Additionally, such an apparatus may be implemented and/or such a method may be practiced using other structure and/or functionality in addition to one or more of the aspects set forth herein.
It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present disclosure, and the drawings only show the components related to the present disclosure rather than the number, shape and size of the components in actual implementation, and the type, amount and ratio of the components in actual implementation may be changed arbitrarily, and the layout of the components may be more complicated.
In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects may be practiced without these specific details.
The embodiment of the disclosure provides a method for reducing alarm and recovering false alarm. The method for reducing alarm and recovering false alarm provided by the embodiment can be executed by a computing device, the computing device can be implemented as software, or implemented as a combination of software and hardware, and the computing device can be integrally arranged in a server, a client, and the like.
Referring to fig. 1 and fig. 2, a method for reducing an alarm and recovering a false alarm in the embodiment of the present disclosure may include the following steps:
s101, inputting monitoring metadata to an alarm rule matching algorithm module, and after the algorithm matching is finished, if the matching is successful, entering an alarm processing module, otherwise, entering a recovery processing module;
s102, the alarm processing module receives the rule matching success information, records the alarm times for one time, generates an alarm message if the alarm times are greater than the false alarm factor, puts the alarm information into an alarm queue, clears the alarm times and clears the recovery times;
s103, receiving rule matching failure information by recovery processing, recording the recovery times, generating a piece of recovery information if the recovery times are greater than a false alarm factor, putting the recovery information into a recovery queue, resetting the recovery times, and resetting the alarm times;
and S104, generating an alarm queue, and taking the message stored in the recovery queue as the message subjected to false alarm processing.
In the process of implementing steps S101 to S104, referring to fig. 2, the main object of the present invention is to provide a method and an apparatus for reducing alarms and recovering false alarms, which mainly include five parts, i.e., monitoring metadata, an alarm rule matching algorithm, alarm processing, recovery processing, an alarm queue, a recovery queue, a false alarm factor, and the like, and are specifically described as follows:
1. monitoring metadata: generally refers to data collected by a monitoring system, such as the utilization rate of a CPU of a certain device.
2. And (3) an alarm rule matching algorithm: and generating a specific algorithm of the alarm information, matching the algorithms according to the input monitoring metadata, generating an alarm if the matching is successful, or generating no alarm.
3. And alarm processing, namely judging whether alarm convergence is carried out or not according to the set false alarm factor.
4. And (3) recovery processing: and judging whether to recover convergence or not according to the set false alarm factor.
5. And (3) alarm queue: and storing the alarm information which is finally subjected to false alarm processing and converged.
6. And (3) restoring the queue: storing the recovered information after final false alarm processing and convergence
7. False alarm factor: and (3) carrying out alarm or recovering convergence, wherein the larger the threshold value is, the higher the convergence rate is, and the lower the false alarm rate is.
The scheme mainly comprises the following steps:
1. and inputting the monitoring metadata to an alarm rule matching algorithm module, and after the algorithm matching is finished, if the matching is successful, entering an alarm processing module, otherwise, entering a recovery processing module.
2. And the alarm processing module receives the rule matching success information, records the alarm times once, generates an alarm message if the alarm times are greater than the false alarm factor, puts the alarm message into an alarm queue, resets the alarm times and resets the recovery times.
3. And the recovery processing receives rule matching failure information, records recovery times once, generates a piece of recovery information if the recovery times are greater than the false alarm factor, puts the recovery information into a recovery queue, clears the recovery times and clears the alarm times at the same time.
4. And finally, alarming the queue, wherein the message stored in the recovery queue is the message subjected to false alarm processing, and the greater the setting of the false alarm factor is, the less the message is, and the lower the false alarm rate is.
Referring to fig. 2, fig. 2 is a process flow chart of the present invention, and the specific process flow is as follows:
and monitoring metadata entering alarm rule matching module for algorithm matching.
And (4) entering an alarm processing module after the matching is successful, adding 1 to the alarm frequency, judging whether the alarm frequency is greater than a false alarm factor, if so, generating alarm information and sending the alarm information to an alarm queue, and setting the alarm frequency to be zero. Otherwise, the number of recovery times is set to zero.
And (3) adding 1 to the recovery frequency of the failed matching, judging whether the recovery frequency is greater than the false alarm factor, if so, generating recovery information and sending the recovery information to a recovery queue, and setting the recovery frequency to be zero. Otherwise, setting the alarm times to be zero.
And after the process is finished, the alarm and recovery queue stores final information.
According to a specific implementation manner of the embodiment of the present disclosure, the monitoring metadata is data collected by a monitoring system.
According to a specific implementation manner of the embodiment of the disclosure, the alarm rule matching algorithm is a specific algorithm for generating alarm information, algorithm matching is performed according to input monitoring metadata, matching is successful, and an alarm is generated, otherwise, no alarm is generated.
According to a specific implementation manner of the embodiment of the present disclosure, the alarm processing is used for judging whether to perform alarm convergence according to a set false alarm factor.
According to a specific implementation manner of the embodiment of the present disclosure, the recovery processing is used to determine whether to perform recovery convergence according to a set false alarm factor.
According to a specific implementation manner of the embodiment of the present disclosure, the alarm queue is used for storing alarm information that is finally subjected to false alarm processing and converged.
According to a specific implementation manner of the embodiment of the disclosure, the recovery queue is used for storing recovery information which is finally subjected to false alarm processing and converged;
the false alarm factor is used as a threshold for alarming or recovering convergence, and the larger the threshold is, the higher the convergence rate is and the lower the false alarm rate is.
Corresponding to the above method embodiment, referring to fig. 3, the embodiment of the present disclosure further provides an apparatus 30 for reducing an alarm and recovering a false alarm, including:
the input module 301 is used for inputting the monitoring metadata to the alarm rule matching algorithm module, and after the algorithm matching is finished, if the matching is successful, the alarm processing module is entered, otherwise, the recovery processing module is entered;
a matching module 302, configured to receive rule matching success information, record the number of times of a single alarm, generate an alarm message if the number of times of the alarm is greater than a false alarm factor, place the alarm message in an alarm queue, clear the number of times of the alarm, and clear the number of times of recovery;
a recovery module 303, configured to recover the rule matching failure information received, record the recovery times for one time, generate a piece of recovery information if the recovery times are greater than the false alarm factor, place the recovery information in a recovery queue, clear the recovery times, and clear the alarm times;
and the generating module 304 is configured to generate an alarm queue, and use the message stored in the recovery queue as a message after performing false alarm processing.
For parts not described in detail in this embodiment, reference is made to the contents described in the above method embodiments, which are not described again here.
Referring to fig. 4, an embodiment of the present disclosure also provides an electronic device 60, including:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of reducing alarms and recovering false alarms of the above method embodiments.
The disclosed embodiments also provide a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method for reducing alarms and recovering false alarms in the aforementioned method embodiments.
The disclosed embodiments also provide a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the method of reducing alarms and recovering false alarms of the aforementioned method embodiments.
Referring now to FIG. 4, a block diagram of an electronic device 60 suitable for use in implementing embodiments of the present disclosure is shown. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., car navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 4 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.
As shown in fig. 4, the electronic device 60 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 601 that may perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM)602 or a program loaded from a storage means 608 into a Random Access Memory (RAM) 603. In the RAM 603, various programs and data necessary for the operation of the electronic apparatus 60 are also stored. The processing device 601, the ROM602, and the RAM 603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
Generally, the following devices may be connected to the I/O interface 605: input devices 606 including, for example, a touch screen, touch pad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 607 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 608 including, for example, tape, hard disk, etc.; and a communication device 609. The communication means 609 may allow the electronic device 60 to communicate with other devices wirelessly or by wire to exchange data. While the figures illustrate an electronic device 60 having various means, it is to be understood that not all illustrated means are required to be implemented or provided. More or fewer devices may alternatively be implemented or provided.
In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via the communication means 609, or may be installed from the storage means 608, or may be installed from the ROM 602. The computer program, when executed by the processing device 601, performs the above-described functions defined in the methods of the embodiments of the present disclosure.
It should be noted that the computer readable medium in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer readable signal medium may comprise a propagated data signal with computer readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.
The computer readable medium may be embodied in the electronic device; or may exist separately without being assembled into the electronic device.
The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: acquiring at least two internet protocol addresses; sending a node evaluation request comprising the at least two internet protocol addresses to node evaluation equipment, wherein the node evaluation equipment selects the internet protocol addresses from the at least two internet protocol addresses and returns the internet protocol addresses; receiving an internet protocol address returned by the node evaluation equipment; wherein the obtained internet protocol address indicates an edge node in the content distribution network.
Alternatively, the computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: receiving a node evaluation request comprising at least two internet protocol addresses; selecting an internet protocol address from the at least two internet protocol addresses; returning the selected internet protocol address; wherein the received internet protocol address indicates an edge node in the content distribution network.
Computer program code for carrying out operations for aspects of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units described in the embodiments of the present disclosure may be implemented by software or hardware. Where the name of a unit does not in some cases constitute a limitation of the unit itself, for example, the first retrieving unit may also be described as a "unit for retrieving at least two internet protocol addresses".
It should be understood that portions of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof.
The above description is only for the specific embodiments of the present disclosure, but the scope of the present disclosure is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present disclosure should be covered within the scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be subject to the protection scope of the claims.
Claims (10)
1. A method for reducing alarm and recovering false alarm is characterized by comprising the following steps:
inputting the monitoring metadata to an alarm rule matching algorithm module, and entering an alarm processing module if the matching is successful after the algorithm matching is finished, or entering a recovery processing module if the matching is not successful;
the alarm processing module receives the rule matching success information, records the alarm times for one time, generates an alarm message if the alarm times are greater than the false alarm factor, puts the alarm information into an alarm queue, resets the alarm times and resets the recovery times;
the recovery processing receives rule matching failure information, records recovery times once, generates a piece of recovery information if the recovery times are greater than a false alarm factor, puts the recovery information into a recovery queue, resets the recovery times and resets the alarm times;
and generating an alarm queue, and taking the message stored in the recovery queue as the message subjected to false alarm processing.
2. The method of claim 1, wherein:
the monitoring metadata is data collected by a monitoring system.
3. The method of claim 1, wherein:
the alarm rule matching algorithm is a concrete algorithm for generating alarm information, and according to the input monitoring metadata, algorithm matching is carried out, matching is successful, and an alarm is generated, otherwise, no alarm is generated.
4. The method of claim 1, wherein:
and the alarm processing is used for judging whether alarm convergence is carried out or not according to the set false alarm factor.
5. The method of claim 1, wherein:
and the recovery processing is used for judging whether to recover convergence according to the set false alarm factor.
6. The method of claim 1, wherein:
the alarm queue is used for storing alarm information which is finally subjected to false alarm processing and convergence.
7. The method of claim 1, wherein:
the recovery queue is used for storing recovery information which is finally subjected to false alarm processing and convergence;
the false alarm factor is used as a threshold for alarming or recovering convergence, and the larger the threshold is, the higher the convergence rate is and the lower the false alarm rate is.
8. An apparatus for reducing alarms and recovering false alarms, comprising:
the input module is used for inputting the monitoring metadata to the alarm rule matching algorithm module, and after the algorithm matching is finished, if the matching is successful, the input module enters the alarm processing module, otherwise, the input module enters the recovery processing module;
the matching module is used for receiving the rule matching success information by the alarm processing module, recording the number of times of one alarm, generating an alarm message if the number of times of the alarm is greater than a false alarm factor, putting the alarm message into an alarm queue, resetting the number of times of the alarm, and resetting the number of times of recovery;
the recovery module is used for recovering and processing the received rule matching failure information, recording the recovery times for one time, generating a piece of recovery information if the recovery times are greater than the false alarm factor, putting the recovery information into a recovery queue, resetting the recovery times and resetting the alarm times;
and the generating module is used for generating an alarm queue and taking the message stored in the recovery queue as the message subjected to false alarm processing.
9. An electronic device, characterized in that the electronic device comprises:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of reducing alarms and recovering false alarms of any of the preceding claims 1-7.
10. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method of reducing alarms and recovering false alarms of any of the preceding claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911271373.1A CN111092758A (en) | 2019-12-06 | 2019-12-06 | Method and device for reducing alarm and recovering false alarm and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911271373.1A CN111092758A (en) | 2019-12-06 | 2019-12-06 | Method and device for reducing alarm and recovering false alarm and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111092758A true CN111092758A (en) | 2020-05-01 |
Family
ID=70394973
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911271373.1A Pending CN111092758A (en) | 2019-12-06 | 2019-12-06 | Method and device for reducing alarm and recovering false alarm and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111092758A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113595797A (en) * | 2021-08-02 | 2021-11-02 | 北京汇钧科技有限公司 | Alarm information processing method and device, electronic equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101291256A (en) * | 2008-06-02 | 2008-10-22 | 杭州华三通信技术有限公司 | Method and system for upgrading system log to alarm |
| CN106713049A (en) * | 2017-02-04 | 2017-05-24 | 杭州迪普科技股份有限公司 | Alarm method and device of monitor |
| CN107026761A (en) * | 2017-05-12 | 2017-08-08 | 网宿科技股份有限公司 | A kind of method and device for determining alarm source |
| CN107562556A (en) * | 2017-08-14 | 2018-01-09 | 腾讯科技（深圳）有限公司 | Restoration methods, recovery device and the storage medium of failure |
| US20190251085A1 (en) * | 2016-11-25 | 2019-08-15 | Alibaba Group Holding Limited | Method and apparatus for matching names |
-
2019
- 2019-12-06 CN CN201911271373.1A patent/CN111092758A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101291256A (en) * | 2008-06-02 | 2008-10-22 | 杭州华三通信技术有限公司 | Method and system for upgrading system log to alarm |
| US20190251085A1 (en) * | 2016-11-25 | 2019-08-15 | Alibaba Group Holding Limited | Method and apparatus for matching names |
| CN106713049A (en) * | 2017-02-04 | 2017-05-24 | 杭州迪普科技股份有限公司 | Alarm method and device of monitor |
| CN107026761A (en) * | 2017-05-12 | 2017-08-08 | 网宿科技股份有限公司 | A kind of method and device for determining alarm source |
| CN107562556A (en) * | 2017-08-14 | 2018-01-09 | 腾讯科技（深圳）有限公司 | Restoration methods, recovery device and the storage medium of failure |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113595797A (en) * | 2021-08-02 | 2021-11-02 | 北京汇钧科技有限公司 | Alarm information processing method and device, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114091617A (en) | Federal learning modeling optimization method, electronic device, storage medium, and program product | |
| CN110865898B (en) | Method, device, medium and equipment for converging crash call stack | |
| CN111198859B (en) | Data processing method, device, electronic equipment and computer readable storage medium | |
| CN111274503B (en) | Data processing method, device, electronic equipment and computer readable medium | |
| CN111338834B (en) | Data storage method and device | |
| CN111327913B (en) | Message processing method and device and electronic equipment | |
| CN110059064B (en) | Log file processing method and device and computer readable storage medium | |
| CN112291121B (en) | Data processing method and related equipment | |
| US20140365393A1 (en) | Transportation capacity augmentation program methods, apparatuses and media | |
| CN111858381B (en) | Application fault tolerance capability test method, electronic device and medium | |
| CN111092758A (en) | Method and device for reducing alarm and recovering false alarm and electronic equipment | |
| US11068282B2 (en) | Apparatuses, methods and systems for persisting values in a computing environment | |
| CN111198853B (en) | Data processing method, device, electronic equipment and computer readable storage medium | |
| CN109542743B (en) | Log checking method and device, electronic equipment and computer readable storage medium | |
| CN111177260A (en) | Database remote copying method and device and electronic equipment | |
| CN110727558A (en) | Information prompting method and device, storage medium and electronic equipment | |
| CN111309406A (en) | Event processing method and device of application program and electronic equipment | |
| CN111241368B (en) | Data processing method, device, medium and equipment | |
| CN109522133B (en) | Data splicing method and device, electronic equipment and storage medium | |
| CN111274104B (en) | Data processing method, device, electronic equipment and computer readable storage medium | |
| CN111209739A (en) | Electronic form, electronic device, storage medium, and electronic form verification method | |
| CN110262756B (en) | Method and device for caching data | |
| CN115470292B (en) | Block chain consensus method, device, electronic equipment and readable storage medium | |
| CN116820539B (en) | System software operation maintenance system and method based on Internet | |
| CN115689444B (en) | Logistics automatic monitoring method, device, equipment and medium based on historical cases |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20200501 |
|
| RJ01 | Rejection of invention patent application after publication |