CN112564951A - Method, device, computer equipment and storage medium for avoiding alarm storm - Google Patents
Method, device, computer equipment and storage medium for avoiding alarm storm Download PDFInfo
- Publication number
- CN112564951A CN112564951A CN202011360309.3A CN202011360309A CN112564951A CN 112564951 A CN112564951 A CN 112564951A CN 202011360309 A CN202011360309 A CN 202011360309A CN 112564951 A CN112564951 A CN 112564951A
- Authority
- CN
- China
- Prior art keywords
- alarm
- sampling
- sampling period
- determining
- alarm record
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
- H04L41/0622—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on time
-
- G—PHYSICS
- G08—SIGNALLING
- G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
- G08B21/00—Alarms responsive to a single specified undesired or abnormal condition and not otherwise provided for
- G08B21/18—Status alarms
- G08B21/182—Level alarms, e.g. alarms responsive to variables exceeding a threshold
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0681—Configuration of triggering conditions
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Business, Economics & Management (AREA)
- Emergency Management (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Alarm Systems (AREA)
Abstract
The application relates to a method, a device, computer equipment and a storage medium for avoiding alarm storm. The method comprises the following steps: determining a current sampling time range; sampling alarm data generated by monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point; determining an alarm record generation condition according to a preset threshold range; when the sampling time in the multiple measurement values is continuous and the number of the target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period; and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met. The method can improve the reliability of alarm judgment.
Description
Technical Field
The application relates to the technical field of operation and maintenance of power distribution networks, in particular to a method, a device, computer equipment and a storage medium for avoiding an alarm storm.
Background
With the development of the platform of the internet of things, the basic functions of the platform of the internet of things also present a diversified development trend. The main basic functions of the existing internet of things platform comprise five modules of equipment access, equipment management, a rule engine, monitoring operation and maintenance and log service. The analysis is carried out from the angle of distribution network operation and maintenance, the monitoring operation and maintenance module of the existing Internet of things platform is utilized, the alarming and early warning of the environment, equipment and personnel behaviors can be carried out based on the collected real-time data, and the working efficiency of operation and maintenance personnel is effectively improved.
For monitoring operation and maintenance, an alarm processing mechanism adopted by the existing power grid internet of things platform is further realized mainly based on a preset fixed threshold. The operation and maintenance monitoring process based on the preset fixed threshold specifically comprises the following steps: firstly, carrying out quantitative processing on monitored real-time data, and determining an alarm measurement value; and secondly, triggering an alarm when the calculated alarm measurement value is equal to a preset fixed threshold. However, when data quantization is performed, quantization errors are indirectly generated; the alarm is also considered to be successfully triggered in the special case that the alarm measurement value does not reach but is close to the preset fixed threshold. Therefore, once the monitoring range is enlarged, the formation of an alarm storm is very easy to result.
Disclosure of Invention
In view of the foregoing, it is desirable to provide a method, an apparatus, a computer device, and a storage medium for avoiding an alarm storm, which can improve reliability of alarm determination.
A method of avoiding an alarm storm, the method comprising:
determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining an alarm record generation condition according to a preset threshold range;
when the sampling time in the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period;
and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the alarm record generation condition includes:
the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
In one embodiment, the method further comprises:
determining whether an iteration end condition is met according to the total number of the alarm records generated in the alarm record generation process each time, and/or,
and combining the alarm records generated in the last sampling period and the current sampling period to judge the end of iteration.
In one embodiment, the performing, by combining the alarm record generated in the previous sampling period and the alarm record generated in the current sampling period, the iteration ending determination includes:
and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In one embodiment, the performing, by combining the alarm record generated in the previous sampling period and the alarm record generated in the current sampling period, the iteration ending determination includes:
under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period;
and when the times of continuously not meeting the judgment condition is equal to the times of continuously sampling, determining that an iteration ending condition is met, and exiting the alarm generation process if triggering.
In one embodiment, the number of the monitoring devices is multiple, and the method further includes:
determining the equipment type corresponding to each monitoring equipment and the generated alarm record level;
and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
An apparatus for evading an alert storm, the apparatus comprising:
the device comprises a first setting module, a second setting module and a control module, wherein the first setting module is used for determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
the sampling module is used for sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
the second setting module is used for determining an alarm record generation condition according to a preset threshold range;
the alarm record generating module is used for generating an alarm record of a corresponding level when the sampling time of the plurality of measurement values has continuity and the number of the target measurement values meeting the alarm record generating condition is the number of times, and entering the next sampling period;
and the iterative computation module is used for determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the alarm record generation condition includes:
the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
A computer device comprising a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program:
determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining an alarm record generation condition according to a preset threshold range;
when the sampling time in the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period;
and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
A computer-readable storage medium, on which a computer program is stored which, when executed by a processor, carries out the steps of:
determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining an alarm record generation condition according to a preset threshold range;
when the sampling time in the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period;
and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
The method, the device, the computer equipment and the storage medium for avoiding the alarm storm judge the generation of the alarm record based on the continuity of the target measurement value in time, thereby avoiding the generation of abnormal alarm records. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
Drawings
FIG. 1 is a diagram of an application environment of a method for avoiding an alarm storm in one embodiment;
FIG. 2 is a flow diagram of a method for avoiding an alert storm in one embodiment;
FIG. 3 is a first front-end interface layout diagram of a method for avoiding an alarm storm in one embodiment;
FIG. 4 is a second front-end interface layout diagram of a method for avoiding an alarm storm in one embodiment;
FIG. 5 is a flowchart illustrating a method for avoiding an alert storm in accordance with another embodiment;
FIG. 6 is a flow node diagram of a method for avoiding an alarm storm in one embodiment;
FIG. 7 is a block diagram of an apparatus for avoiding an alarm storm in one embodiment;
FIG. 8 is a diagram illustrating an internal structure of a computer device according to an embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
The method for avoiding the alarm storm can be applied to the application environment shown in fig. 1. Wherein the monitoring device 102 communicates with the computer device 104 over a network. First, a current sampling time range is determined by the computer device based on a preset sampling interval and the number of consecutive samples. Secondly, the alarm data of the determined current sampling time range is sampled by the monitoring equipment, and the obtained sample is further transmitted to the computer equipment through the network. Secondly, a plurality of measurement values are obtained by the computer equipment based on the collected alarm data. Finally, the computer equipment generates alarm records of corresponding levels according to the obtained multiple measurement values and the alarm record generation conditions; and when entering the next sampling period, repeatedly executing the steps until the iteration end condition is met, and exiting the alarm record generation process.
The computer device 104 may specifically be a terminal or a server, and the terminal may specifically be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices. The server may be implemented as a stand-alone server or as a server cluster consisting of a plurality of servers.
In one embodiment, as shown in fig. 2, a method for avoiding an alarm storm is provided, which is described by taking the method as an example applied to the computer device in fig. 1, and comprises the following steps:
step S202, determining a current sampling time range based on a preset sampling interval and the number of consecutive samples.
When the preset sampling interval is T and the continuous sampling frequency is n, determining the current sampling time range T by the following formula:
T＝n×t； (1)
it should be noted that, based on the formula (1), in other embodiments, other formulas may be adopted to calculate the sampling time range; alternatively, the sampling time range may be calculated by expanding the formula (1), for example, multiplying the formula by a weight coefficient on the basis of "n × t", and calculating the sampling time range based on the expanded formula, which is not limited by the embodiment of the present application.
Step S204, sampling alarm data generated by the monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point.
Specifically, the alarm data is sampled by the computer device within a sampling time range. And carrying out quantitative calculation based on the acquired alarm data to further obtain a corresponding measurement value. It should be noted that the quantitative calculation of the alarm data is to quantize the alarm data into a specific numerical value.
The alarm data comprises concrete, non-concrete or fuzzy data factors, and the purpose of analysis and comparison is achieved based on quantitative calculation of the alarm data. The measured value is the corresponding monitoring index value.
In one embodiment, firstly, the computer device obtains alarm rule configuration data within a sampling time range, and further calculates to obtain a corresponding measurement value after performing quantitative analysis on the obtained alarm rule configuration data. And finally, the computer equipment further judges whether an alarm record of a corresponding level needs to be generated in the current sampling period according to the calculated measurement value.
In the current embodiment, the collected alarm data is subjected to quantization processing, so that the data analysis process is simplified, and the data analysis efficiency is improved.
Step S206, determining alarm record generating conditions according to a preset threshold range.
Wherein, the alarm record generating conditions comprise: the measured value is equal to at least one of an upper value defined by the threshold range, the measured value is equal to a lower value defined by the threshold range, and the measured value is equal to any value within the threshold range. For example, when the measurement value obtained by sampling based on step S204 is equal to the upper limit value determined by the threshold range, it is determined that an alarm record of a corresponding level needs to be generated currently, so as to achieve the purpose of warning. The alarm record may be sent to a terminal device held by the user in a short message manner, or the alarm record may be displayed on a terminal display screen provided at the user, which is not limited in the embodiment of the present application.
As shown in fig. 3-4, they are respectively the first and second front-end interface design diagrams of the method for avoiding the alarm storm in one embodiment. In a specific application scenario, when the threshold range is not set, the user may input the relevant parameter (for example, the sampling period, the consecutive times, and the like) according to the front-end display interface shown in fig. 3. For example, in order to further calculate the sampling time range, a user may input a value corresponding to the sampling period into the sampling period input box and a value corresponding to the consecutive times into the consecutive times input box in advance, and then the computer device may obtain the relevant parameters input by the user through the input box, and calculate the sampling time range based on the called execution program. In addition, for a special implementation scenario of setting a threshold range, a user may input related parameters according to the front-end display interface shown in fig. 4, thereby implementing calculation of a sampling time range and the like. In summary, the front-end display interfaces shown in fig. 3 and fig. 4 provide an input channel for the computer device to input relevant parameters, and the computer device can further implement the calculation of the sampling time range, the measurement value, and the like according to the relevant parameters input by the user, such as the sampling period, the alarm value, the number of consecutive times, and the like.
Step S208, when the sampling time of the plurality of measurement values has continuity and the number of target measurement values meeting the alarm record generation condition is the number of times, generating the alarm record of the corresponding level, and entering the next sampling period.
Specifically, it is determined by the computer device whether the number of target measurement values, of the plurality of measurement values, for which the sampling time is continuous and which satisfy the alarm record generation condition is the number of continuous sampling times set in advance in step S202. And, in case the number of the target measured values satisfies the aforementioned consecutive sampling times, an alarm record of a corresponding level is generated.
In one embodiment, the setting of the quantity threshold is performed in advance by the computer device for different alarm levels (for example, a medium alarm level, a high alarm level, and the like, and the embodiment of the present application is not limited thereto). In a specific embodiment, the number of consecutive samples is pre-set by the computer device to 8, the number threshold corresponding to a medium alarm level to 10, and the number threshold corresponding to a high alarm level to 15. When the number of the calculated target measurement values is 11, a medium-level alarm record can be generated currently. In other cases, when the number of the calculated target measurement values is 16, a high-level alarm record may be generated at present, and so on in other cases, which is not described in detail in this embodiment of the present application.
In the current embodiment, the alarm record generation is judged based on the time continuity of the target measurement value, so that the generation of abnormal alarm records is avoided, and the reliability of alarm generation judgment is improved.
Step S210, determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
Specifically, after the sampling time range corresponding to the next sampling period is determined by the computer device based on step S202, for the next period, step S204-step S210 will be further performed to generate the corresponding alarm record. After a plurality of repeated loop iterations, the end of the iteration can be judged according to the total number of the alarm records generated in the alarm record generation process each time and/or by combining the alarm records generated in the last sampling period and the current sampling period. And exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the performing the iteration ending judgment by combining the alarm records generated in the last sampling period and the current sampling period includes: and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In another embodiment, the performing the iteration ending judgment in combination with the alarm record generated in the last sampling period and the current sampling period includes: under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period; and when the continuous times of not meeting the judgment condition are equal to the continuous sampling times, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In the current embodiment, the alarm records generated in different sampling periods are adapted, so that the alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In the method for avoiding the alarm storm, the generation of the alarm record is judged based on the time continuity of the target measurement value, so that the generation of the abnormal alarm record is avoided. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In another embodiment, the number of the monitoring devices communicating with the computer device is multiple, as shown in fig. 5, or the method is applied to the computer device in fig. 1 as an example, and the method further includes the following steps:
step S502, determining the device type corresponding to each monitoring device and the generated alarm record level.
Wherein the calculation of the alarm recording level may be performed based on step S208. The alarm rule configuration data includes the relevant configuration and factory information of the monitoring device. Therefore, in a specific embodiment, the device type corresponding to the monitoring device may be confirmed based on the alarm rule configuration data; in another embodiment, the user may also input the device type through the terminal, and the computer device performs the classification and aggregation of the monitoring devices based on the received device types.
Step S504, aiming at the monitoring equipment of the same type, the alarm records corresponding to the same level are merged, and unified alarm is carried out on the monitoring equipment of the same type according to the merged alarm records.
Specifically, firstly, the computer device classifies and summarizes the alarm records of the same level for the monitoring devices and the monitoring devices of the same type according to the obtained device types respectively corresponding to the monitoring devices. And secondly, combining the alarm records of the same type and corresponding to the same level by the computer equipment. And finally, the computer equipment performs unified alarm on the monitoring equipment of the same type according to the merged alarm records.
In one embodiment, the alarm records of the same type and the same level are merged by data compression, and in a specific embodiment, the alarm records of the same type and the same level are used as initial alarm records, and the initial alarm records are merged by computer equipment. In the current embodiment, the alarm records of the same type and the same level are adapted, so that the generation quantity of the alarm records is further reduced, and the avoiding efficiency of the alarm storm is further improved. In another embodiment, the alarm records generated by different types of monitoring devices in the same monitoring range can be combined according to a preset monitoring range, and in the current embodiment, the configuration of the alarm rule is further reduced by adapting the alarm records generated by different types of monitoring devices.
Referring to fig. 6, which is a schematic view of a process node of a method for avoiding an alarm storm, a specific implementation process of the present application may be summarized as the following steps:
firstly, reading alarm rule configuration information, and judging whether a measurement value in a current sampling period needs to generate an alarm record of a corresponding level according to the read alarm rule configuration.
Secondly, judging whether unprocessed alarm records exist at present, if so, dividing the following two conditions:
1) when the alarm records of the corresponding levels need to be generated based on the measurement values in the current sampling period, updating the total number of the alarm records generated in the current alarm record generation process;
2) and when the alarm records of the corresponding levels are determined not to be required to be generated, eliminating the alarm rule configuration corresponding to the corresponding measurement values, compressing the acquired alarm rule configuration information and simplifying the alarm process.
Finally, judging whether the total number of the alarm records generated in the alarm record generation process each time exceeds a preset maximum alarm frequency or not; if not, continuing to sample the alarm data generated by the monitoring equipment, otherwise, exiting the alarm record generation process.
Wherein, it also needs to judge whether the monitoring device has the corresponding alarm generation policy (i.e. the execution logic of step S208), and under the condition that no alarm generation policy is set, the alarm record is generated directly based on the obtained measurement value; and under the condition that the alarm generation strategy is set, judging whether the total number of the alarm records generated in the alarm record generation process each time exceeds the preset maximum alarm times.
It should be understood that although the various steps in the flow charts of fig. 2-3 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 2-3 may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed in turn or alternately with other steps or at least some of the other steps.
In one embodiment, as shown in fig. 7, there is provided an avoidance alert storm apparatus 700 including: a first setting module 701, a sampling module 702, a second setting module 703, an alarm record generating module 704 and an iterative computation module 705, wherein:
a first setting module 701, configured to determine a current sampling time range based on a preset sampling interval and a number of consecutive samples.
A sampling module 702, configured to sample alarm data generated by a monitoring device within a sampling time range to obtain multiple measurement values; wherein each measurement value corresponds to a different sampling time point.
The second setting module 703 determines an alarm record generation condition according to a preset threshold range.
And an alarm record generating module 704, configured to generate an alarm record of a corresponding level when the number of target measurement values that satisfy the alarm record generation condition and have continuity in sampling time among the plurality of measurement values is the number of times, and enter a next sampling period.
And an iterative computation module 705, configured to determine a sampling time range corresponding to the next sampling period, and return to the sampling time range, and perform sampling on alarm data generated by the monitoring device to obtain multiple measurement values, and exit the alarm record generation process until an iteration end condition is met.
In an embodiment, the iteration calculating module 705 is further configured to determine whether an iteration end condition is met according to the total number of alarm records generated in the alarm record generation process each time, and/or perform iteration end judgment in combination with the alarm records generated in the previous sampling period and the current sampling period.
In an embodiment, the iterative computation module 705 is further configured to determine that an iteration end condition is met and trigger exiting of the alarm record generation process when an alarm record is generated in a last sampling period, but no alarm record is generated in a current sampling period, and a sampling period and the number of consecutive samples are not set in the current sampling period.
In one embodiment, the iterative computation module 705 is further configured to determine a sampling period and a number of consecutive samples in a current sampling period when an alarm record is generated in a previous sampling period but no alarm record is generated in the current sampling period; and when the continuous times of not meeting the judgment condition are equal to the continuous sampling times, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In one embodiment, the apparatus 700 for avoiding an alarm storm is further configured to determine a device type corresponding to each monitoring device, and a generated alarm record level; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
For specific limitations on the device for avoiding the storm warning, reference may be made to the above limitations on the method for avoiding the storm warning, and details are not described herein again. All or part of each module in the above-mentioned storm avoiding alarm storm device can be realized by software, hardware and their combination. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.
The device for avoiding the alarm storm judges the generation of the alarm record based on the time continuity of the target measurement value, thereby avoiding the generation of the abnormal alarm record. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In one embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as shown in fig. 8. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method of circumventing alarm storms.
Those skilled in the art will appreciate that the architecture shown in fig. 8 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory and a processor, the memory having a computer program stored therein, the processor implementing the following steps when executing the computer program: determining the current sampling time range based on a preset sampling interval and the number of continuous sampling; sampling alarm data generated by monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point; determining an alarm record generation condition according to a preset threshold range; when the sampling time in the multiple measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period; and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the processor, when executing the computer program, further performs the steps of: the alarm record generation conditions include: the measured value is equal to at least one of an upper value defined by the threshold range, the measured value is equal to a lower value defined by the threshold range, and the measured value is equal to any value within the threshold range.
In one embodiment, the processor, when executing the computer program, further performs the steps of: and determining whether an iteration ending condition is met or not according to the total number of the alarm records generated in the alarm record generation process each time, and/or judging the iteration ending by combining the alarm records generated in the last sampling period and the current sampling period.
In one embodiment, the processor, when executing the computer program, further performs the steps of: and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In one embodiment, the processor, when executing the computer program, further performs the steps of: under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period; and when the continuous times of not meeting the judgment condition are equal to the continuous sampling times, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In one embodiment, the processor, when executing the computer program, further performs the steps of: determining the equipment type corresponding to each monitoring equipment and the generated alarm record level, wherein the number of the monitoring equipment is multiple; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
The computer equipment judges the generation of the alarm record based on the time continuity of the target measurement value, and avoids the generation of abnormal alarm records. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of: determining the current sampling time range based on a preset sampling interval and the number of continuous sampling; sampling alarm data generated by monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point; determining an alarm record generation condition according to a preset threshold range; when the sampling time in the multiple measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period; and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the computer program when executed by the processor further performs the steps of: the alarm record generation conditions include: the measured value is equal to at least one of an upper value defined by the threshold range, the measured value is equal to a lower value defined by the threshold range, and the measured value is equal to any value within the threshold range.
In one embodiment, the computer program when executed by the processor further performs the steps of: and determining whether an iteration ending condition is met or not according to the total number of the alarm records generated in the alarm record generation process each time, and/or judging the iteration ending by combining the alarm records generated in the last sampling period and the current sampling period.
In one embodiment, the computer program when executed by the processor further performs the steps of: and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In one embodiment, the computer program when executed by the processor further performs the steps of: under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period; and when the continuous times of not meeting the judgment condition are equal to the continuous sampling times, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In one embodiment, the computer program when executed by the processor further performs the steps of: determining the equipment type corresponding to each monitoring equipment and the generated alarm record level, wherein the number of the monitoring equipment is multiple; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
The computer readable storage medium judges the generation of the alarm record based on the continuity of the target measurement value in time, and avoids the generation of abnormal alarm records. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware related to instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database or other medium used in the embodiments provided herein can include at least one of non-volatile and volatile memory. Non-volatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical storage, or the like. Volatile Memory can include Random Access Memory (RAM) or external cache Memory. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), among others.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above examples only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. A method of avoiding an alarm storm, the method comprising:
determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining an alarm record generation condition according to a preset threshold range;
when the sampling time in the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period;
and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
2. The method of claim 1, wherein the alarm record generation condition comprises: the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
3. The method of claim 1, further comprising:
determining whether an iteration end condition is met according to the total number of the alarm records generated in the alarm record generation process each time, and/or,
and combining the alarm records generated in the last sampling period and the current sampling period to judge the end of iteration.
4. The method of claim 3, wherein the determining the end of iteration based on the alarm log generated in the previous sampling period and the current sampling period comprises:
and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
5. The method of claim 3, wherein the determining the end of iteration based on the alarm log generated in the previous sampling period and the current sampling period comprises:
under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period;
and when the times of continuously not meeting the judgment condition is equal to the times of continuously sampling, determining that an iteration ending condition is met, and exiting the alarm generation process if triggering.
6. The method of any one of claims 1-5, wherein the number of monitoring devices is plural, the method further comprising:
determining the equipment type corresponding to each monitoring equipment and the generated alarm record level;
and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
7. An apparatus for avoiding an alarm storm, the apparatus comprising:
the device comprises a first setting module, a second setting module and a control module, wherein the first setting module is used for determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
the sampling module is used for sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
the second setting module is used for determining an alarm record generation condition according to a preset threshold range;
the alarm record generating module is used for generating an alarm record of a corresponding level when the sampling time of the plurality of measurement values has continuity and the number of the target measurement values meeting the alarm record generating condition is the number of times, and entering the next sampling period;
and the iterative computation module is used for determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
8. The apparatus of claim 7, wherein the alarm record generation condition comprises: the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method of any of claims 1 to 6.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011360309.3A CN112564951B (en) | 2020-11-27 | 2020-11-27 | Method, device, computer equipment and storage medium for avoiding alarm storm |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011360309.3A CN112564951B (en) | 2020-11-27 | 2020-11-27 | Method, device, computer equipment and storage medium for avoiding alarm storm |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112564951A true CN112564951A (en) | 2021-03-26 |
| CN112564951B CN112564951B (en) | 2023-01-20 |
Family
ID=75046446
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011360309.3A Active CN112564951B (en) | 2020-11-27 | 2020-11-27 | Method, device, computer equipment and storage medium for avoiding alarm storm |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112564951B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113411672A (en) * | 2021-06-15 | 2021-09-17 | 北京房江湖科技有限公司 | Communication quality evaluation method and device, readable storage medium and electronic equipment |
| CN113808376A (en) * | 2021-09-18 | 2021-12-17 | 中国工商银行股份有限公司 | Safety monitoring method and device for self-service teller machine equipment |
| CN114448716A (en) * | 2022-02-28 | 2022-05-06 | 奇安信科技集团股份有限公司 | Industrial control safety control method, electronic device and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011026342A1 (en) * | 2009-09-01 | 2011-03-10 | 中兴通讯股份有限公司 | Processing method and processing device for alarm storm |
| CN104735719A (en) * | 2015-03-13 | 2015-06-24 | 京信通信技术(广州)有限公司 | Overload control method and device |
| CN107707380A (en) * | 2017-07-31 | 2018-02-16 | 贵州白山云科技有限公司 | A kind of monitoring alarm method and apparatus |
| CN108986418A (en) * | 2018-09-18 | 2018-12-11 | 广东电网有限责任公司 | intelligent alarm method, device, equipment and storage medium |
| CN109412852A (en) * | 2018-10-29 | 2019-03-01 | 京信通信系统（中国）有限公司 | Alarm method, device, computer equipment and storage medium |
| CN111813638A (en) * | 2020-06-30 | 2020-10-23 | 厦门科灿信息技术有限公司 | Alarm information processing method and device and terminal equipment |
-
2020
- 2020-11-27 CN CN202011360309.3A patent/CN112564951B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011026342A1 (en) * | 2009-09-01 | 2011-03-10 | 中兴通讯股份有限公司 | Processing method and processing device for alarm storm |
| CN104735719A (en) * | 2015-03-13 | 2015-06-24 | 京信通信技术(广州)有限公司 | Overload control method and device |
| CN107707380A (en) * | 2017-07-31 | 2018-02-16 | 贵州白山云科技有限公司 | A kind of monitoring alarm method and apparatus |
| CN108986418A (en) * | 2018-09-18 | 2018-12-11 | 广东电网有限责任公司 | intelligent alarm method, device, equipment and storage medium |
| CN109412852A (en) * | 2018-10-29 | 2019-03-01 | 京信通信系统（中国）有限公司 | Alarm method, device, computer equipment and storage medium |
| CN111813638A (en) * | 2020-06-30 | 2020-10-23 | 厦门科灿信息技术有限公司 | Alarm information processing method and device and terminal equipment |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113411672A (en) * | 2021-06-15 | 2021-09-17 | 北京房江湖科技有限公司 | Communication quality evaluation method and device, readable storage medium and electronic equipment |
| CN113808376A (en) * | 2021-09-18 | 2021-12-17 | 中国工商银行股份有限公司 | Safety monitoring method and device for self-service teller machine equipment |
| CN114448716A (en) * | 2022-02-28 | 2022-05-06 | 奇安信科技集团股份有限公司 | Industrial control safety control method, electronic device and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112564951B (en) | 2023-01-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112564951B (en) | Method, device, computer equipment and storage medium for avoiding alarm storm | |
| CN111092852B (en) | Network security monitoring method, device, equipment and storage medium based on big data | |
| US10558545B2 (en) | Multiple modeling paradigm for predictive analytics | |
| CN110377569B (en) | Log monitoring method, device, computer equipment and storage medium | |
| CN109992473B (en) | Application system monitoring method, device, equipment and storage medium | |
| CN111694718A (en) | Method and device for identifying abnormal behavior of intranet user, computer equipment and readable storage medium | |
| CN113407371A (en) | Data anomaly monitoring method and device, computer equipment and storage medium | |
| CN111585837B (en) | Internet of things data link monitoring method and device, computer equipment and storage medium | |
| CN111897700B (en) | Application index monitoring method and device, electronic equipment and readable storage medium | |
| CN110866634A (en) | Underground cable fault early warning method and device based on model selection | |
| CN114443441B (en) | Storage system management method, device and equipment and readable storage medium | |
| CN111800807A (en) | Method and device for alarming number of base station users | |
| CN111835536A (en) | Flow prediction method and device | |
| CN111241155B (en) | Time sequence data abnormality detection method, device, equipment and storage medium | |
| CN116644437A (en) | Data security assessment method, device and storage medium | |
| CN110838940A (en) | Underground cable inspection task configuration method and device | |
| CN115795928A (en) | Accelerated degradation test data processing method and device based on gamma process | |
| CN116187423A (en) | Behavior sequence anomaly detection method and system based on unsupervised algorithm | |
| CN116126859A (en) | Data management method and device, electronic equipment and storage medium | |
| CN116781568A (en) | Data monitoring alarm method, device, equipment and storage medium | |
| CN115409345A (en) | Service index calculation method and device, computer equipment and storage medium | |
| CN113689042A (en) | Fault source prediction method for monitoring node | |
| CN114860543A (en) | Anomaly detection method, device, equipment and computer readable storage medium | |
| CN113672449A (en) | Intelligent operation and maintenance abnormity monitoring method and device, computer equipment and storage medium | |
| CN112256529A (en) | Web crawler monitoring method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |