CN112965880A

CN112965880A - Information processing method, device, storage medium and equipment

Info

Publication number: CN112965880A
Application number: CN202110335605.6A
Authority: CN
Inventors: 尤祖兴; 弋鹏玮; 杜思雨
Original assignee: Beijing Zitiao Network Technology Co Ltd
Current assignee: Beijing Zitiao Network Technology Co Ltd
Priority date: 2021-03-29
Filing date: 2021-03-29
Publication date: 2021-06-15

Abstract

The embodiment of the disclosure discloses an information processing method, an information processing device, a storage medium and equipment. The method comprises the following steps: the method comprises the steps of splitting alarm rule elements of an original alarm rule expression corresponding to original alarm rule source code information, screening target alarm rule elements containing adjustable items from the split alarm rule elements, carrying out visual output processing on changes of historical data corresponding to the target alarm rule elements so that a user can input corresponding adjustable item adjustment target information according to visual output results, adjusting corresponding adjustable items according to received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements. By adopting the technical scheme, a user can check the variation trend of the historical data more intuitively, so that the reasonable target value of the adjustable project can be set quickly, and the debugging efficiency of the alarm rule source code is improved.

Description

Information processing method, device, storage medium and equipment

Technical Field

The disclosed embodiments relate to the field of computer technologies, and in particular, to an information processing method, an information processing apparatus, a storage medium, and a device.

Background

With the rapid development of the mobile internet technology, the maintenance, management, monitoring and the like of mass data become more and more important. At present, monitoring of various data or indexes and the like can be realized in a monitoring platform or a monitoring system, and such a monitoring platform can generally have functions of acquiring and monitoring abnormal data and performing abnormal alarm when abnormality occurs.

At present, the alarm modes of the data anomaly monitoring platform are all based on alarm rules, for example, if the numerical value of a certain data index exceeds a corresponding threshold value, an alarm is given, if the number of times of a certain error occurrence reaches more than a preset number, and the like, developers can compile various alarm rules according to different business requirements. The alarm rules usually include adjustable items such as thresholds, and developers can adjust the adjustable items to achieve a more ideal monitoring effect. However, in the prior art, developers can generally set specific values of adjustable projects only according to experience, or repeatedly adjust the adjustable projects according to monitoring results after trying different values for many times, and it is difficult to quickly and accurately obtain appropriate alarm rules.

Disclosure of Invention

The embodiment of the disclosure provides an information processing method, an information processing device, a storage medium and equipment, which can optimize the existing information processing scheme.

In a first aspect, an embodiment of the present disclosure provides an information processing method, including:

acquiring an original alarm rule expression corresponding to original alarm rule source code information;

splitting alarm rule elements of the original alarm rule expression, and screening target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements comprise adjustable items;

acquiring historical data corresponding to the target alarm rule elements, and performing visual output processing on the change of the historical data so that a user can input corresponding adjusting target information of the adjustable project according to a visual output result;

and adjusting the corresponding adjustable item according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements.

In a second aspect, an embodiment of the present disclosure provides an information processing apparatus, including:

the regular expression obtaining module is used for obtaining an original alarm regular expression corresponding to the original alarm regular source code information;

the target alarm rule element determining module is used for splitting alarm rule elements of the original alarm rule expression and screening target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements comprise adjustable items;

the visualization processing module is used for acquiring historical data corresponding to the target alarm rule elements and performing visualization output processing on the change of the historical data so that a user can input corresponding adjustment target information of the adjustable project according to a visualization output result;

and the target alarm rule source code generation module is used for adjusting the corresponding adjustable items according to the received adjustment target information and generating target alarm rule source code information according to the adjusted alarm rule elements.

In a third aspect, the disclosed embodiments provide a computer-readable storage medium, on which a computer program is stored, which when executed by a processor implements an information processing method as provided by the disclosed embodiments.

In a fourth aspect, the present disclosure provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the information processing method provided by the embodiments of the present disclosure when executing the computer program.

According to the information processing scheme provided by the embodiment of the disclosure, the original alarm rule expression corresponding to the original alarm rule source code information is subjected to alarm rule element splitting, a target alarm rule element containing an adjustable project is screened out from the alarm rule elements obtained through splitting, the change of historical data corresponding to the target alarm rule element is subjected to visual output processing, so that a user can input the adjustment target information of the corresponding adjustable project according to a visual output result, the corresponding adjustable project is adjusted according to the received adjustment target information, and the target alarm rule source code information is generated according to the adjusted alarm rule element. By adopting the technical scheme, the adjustable items in the alarm rule source codes can be automatically screened out, the change of the historical data corresponding to the alarm rule elements to which the adjustable items belong is visually processed, so that a user can more visually check the change trend of the historical data, further the reasonable target value of the adjustable items is quickly set, after the adjustment is completed, the adjusted target alarm rule source code information is automatically generated, and the debugging efficiency of the alarm rule source codes is improved.

Drawings

Fig. 1 is a schematic flowchart of an information processing method according to an embodiment of the present disclosure;

fig. 2 is a schematic flowchart of another information processing method provided in the embodiment of the present disclosure;

fig. 3 is a schematic flowchart of another information processing method according to an embodiment of the disclosure;

FIG. 4 is a diagram illustrating a syntax tree structure provided by an embodiment of the present disclosure;

FIG. 5 is a diagram illustrating another syntax tree structure provided by an embodiment of the present disclosure;

fig. 6 is a schematic diagram illustrating a split of an alarm rule element based on a syntax tree according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram of a display interface provided by an embodiment of the present disclosure;

FIG. 8 is a schematic view of another display interface provided by embodiments of the present disclosure;

FIG. 9 is a schematic view of yet another display interface provided by an embodiment of the present disclosure;

FIG. 10 is a schematic diagram illustrating a split of an element of another alarm rule based on a syntax tree according to an embodiment of the present disclosure;

fig. 11 is a block diagram of an information processing apparatus according to an embodiment of the present disclosure;

fig. 12 is a block diagram of a computer device according to an embodiment of the present disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but rather are provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the disclosure are for illustration purposes only and are not intended to limit the scope of the disclosure.

It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order, and/or performed in parallel. Moreover, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.

The term "include" and variations thereof as used herein are open-ended, i.e., "including but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions for other terms will be given in the following description.

It should be noted that the terms "first", "second", and the like in the present disclosure are only used for distinguishing different devices, modules or units, and are not used for limiting the order or interdependence relationship of the functions performed by the devices, modules or units.

It is noted that references to "a", "an", and "the" modifications in this disclosure are intended to be illustrative rather than limiting, and that those skilled in the art will recognize that "one or more" may be used unless the context clearly dictates otherwise.

The names of messages or information exchanged between devices in the embodiments of the present disclosure are for illustrative purposes only, and are not intended to limit the scope of the messages or information.

In the following embodiments, optional features and examples are provided in each embodiment, and various features described in the embodiments may be combined to form a plurality of alternatives, and each numbered embodiment should not be regarded as only one technical solution.

Fig. 1 is a flowchart illustrating an information processing method according to an embodiment of the present disclosure, where the method may be executed by an information processing apparatus, where the apparatus may be implemented by software and/or hardware, and may be generally integrated in a computer device. As shown in fig. 1, the method includes:

step 101, obtaining an original alarm rule expression corresponding to original alarm rule source code information.

In the embodiment of the present disclosure, the alarm rule source code information may include text information that can embody an alarm policy and is written by a developer (hereinafter, may be referred to as a user) using a preset programming language, and the monitoring platform or the monitoring system may support identification of the alarm rule source code information and then apply the alarm rule source code information, where a specific type of the preset programming language and a writing syntax of the original alarm rule source code information are not limited, and may be selected according to actual needs. The source of the original alarm rule source code information is not limited, and may be currently written by a user, or acquired from a network or other equipment, or may be initially written alarm rule source code information, or may be alarm rule source code information after one or more times of debugging.

The monitoring system used in the embodiment of the present disclosure is not limited, and may be Bosun, for example. Bosun, an open source monitoring and alarm system, has an expressive domain-specific language for evaluating alarms and creating detailed notifications that allow users to test alarms based on historical records for a faster development experience, and will be described below by way of example. It will be appreciated that other similar monitoring systems are equally suitable, such as Cabot et al, Bosun being illustrated only schematically.

In the embodiment of the present disclosure, the alarm rule expression may be understood as an expression corresponding to a complete alarm rule, and may be formed by connecting a plurality of expressions through mathematical relationship symbols and/or logical operation symbols, and the like, and a boolean expression may be generally obtained finally, and the alarm rule expression corresponding to the original alarm rule source code information is recorded as an original alarm rule expression. In some cases, if the developer writes the alarm rule source code in the same way as the alarm rule expression, the original alarm rule source code information may be the same as the original alarm rule expression.

And 102, splitting alarm rule elements of the original alarm rule expression, and screening target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements comprise adjustable items.

For example, the alarm rule elements can be understood as important components in the alarm rules, and can be freely set according to the compiling mode of the alarm rules. For example, the alarm rule elements may include data source observation indicators, time series data monitoring targets, alarm trigger thresholds, alarm trigger conditions, alarm trigger condition combinations, and the like. It should be noted that, only a few alarm rule elements that may exist in an alarm rule are listed here, but this does not mean that all alarm rule requirements described above need to be included in an alarm rule, that is, the original alarm rule expression may include one or more alarm rule elements described above. In addition, more alarm rule elements can be designed, such as alarm function closing conditions and the like, and the alarm triggering threshold value can be further divided, such as a variable threshold value and a constant threshold value in the alarm triggering threshold value.

For example, the data source observation index may be understood as a name corresponding to original data in a data source to be monitored, and may be defined according to actual conditions, where the data source may include a metric class library or a database, such as Metrics or infiluxdb. The Metrics is a measurement class library of monitoring indexes, and provides a plurality of tools to help developers to complete monitoring of various data; InfluxDB is an open source distributed time sequence, event and index database written in the Go language. Taking Metrics as an example, a data source observation index may be named Metrics, go { psm }. numGos represents the number of events of the service psm (service name).

For example, the time series data monitoring target may be understood as a monitoring target set based on time series data retrieved from a data source observation index, and may be denoted as target, where the time series data may refer to time series data, and the time series data may refer to data columns recorded in time sequence by the same unified index. For example, q ("sum: rate: go. { psm }. numGos", "5m", "2m") represents the increase per second of goroutine inquiring for approximately 5-2 minutes of psm.

By way of example, an alarm trigger threshold may be understood as a threshold for triggering an alarm, which may be denoted as threshold. For example, avg (q ("sum: rate: go., { psm }. num gos", "5m", "2m")) >120, where 120 is an alarm trigger threshold, indicates that when the average of the increase amount per second of goroutine for 5 minutes to 2 minutes of psm is greater than 120, an alarm may be triggered (whether an alarm is triggered or not may be determined according to the subsequent alarm trigger condition combination).

By way of example, an alarm triggering condition may be understood as a condition that triggers an alarm, which may be denoted as condition, such as avg (q ("sum: rate: go }. num gos", "5m", "2m") >120, as a whole, may be considered an alarm triggering condition.

Illustratively, as the alarm rule becomes more complex, a plurality of alarm trigger conditions may need to exist, and an alarm trigger condition combination mode may be understood as a combination of a plurality of alarm trigger conditions, which may be denoted as trigger, and when the current situation meets the requirement of the alarm trigger condition combination mode, an alarm is triggered. For example, condition1& & condition2, i.e., when both the alarm triggering condition1 and the alarm triggering condition2 are satisfied, an alarm is performed.

In the embodiment of the disclosure, after the original alarm rule expression is subjected to alarm rule element splitting, a plurality of alarm rule elements can be generally obtained, and a target alarm rule element containing an adjustable item is screened from the alarm rule elements obtained by splitting. The adjustable items may include items in the alarm rule that allow the user to adjust, such as alarm trigger thresholds, time ranges in the time series data monitoring target (e.g., 5 minutes and 2 minutes as described above), and the like. The number of target alarm rule elements may be one or more, and the number of adjustable items included in one target alarm rule element may also be one or more.

103, acquiring historical data corresponding to the target alarm rule elements, and performing visual output processing on the change of the historical data so that a user can input corresponding adjustment target information of the adjustable project according to a visual output result.

For example, the historical data may include data generated during actual operation of the service, or may also include data generated during trial operation in the service test phase, and the like, which is not limited specifically.

In the prior art, when alarm rules are debugged, a user can only see historical data corresponding to all alarm rule expressions corresponding to each time point, and when the alarm rules are complex, the data volume of the historical data corresponding to one time point is large, so that currently concerned data is difficult to screen.

In the embodiment of the disclosure, the historical data corresponding to the target alarm rule element is obtained in a targeted manner, so that a user can only pay attention to the historical data condition of the concerned alarm rule element, and the interference of other data is reduced. After the historical data corresponding to the target alarm rule elements are obtained, the change of the historical data is visually output and processed, so that a user can visually see the change condition of the historical data, rules can be summarized conveniently, and further, the adjustable items can be adjusted more quickly and reasonably. The form of the visualization output processing is not particularly limited, and for example, a table or a statistical chart may be drawn and displayed on a display interface.

For example, an input control corresponding to an adjustable item may be displayed in the display interface, and a user may input adjustment target information of the adjustable item by using the input control, where the adjustment target information may be an adjustment mode or a specific numerical value.

And 104, adjusting the corresponding adjustable item according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements.

Illustratively, after receiving the adjustment target information input by the user, the corresponding adjustable item is adjusted according to the adjustment target information. For example, when the adjustment target information includes an adjustment manner, the adjustable item may be adjusted in the adjustment manner, such as increased or decreased; when the adjustment target information includes a specific numerical value, the value of the adjustable item may be modified to the specific numerical value.

For example, as the service is complicated and diversified, more and more data or indexes to be monitored are required, and the alarm rule is more and more complex, in order to facilitate flexible writing, some monitoring systems may allow developers to add custom variables in the process of writing the alarm rule source code, for example, Bosun support provides the capability of defining variables as described above. The custom variables herein can be understood as variables that can be named and designed by a developer at his or her own discretion with respect to variables that have been specified by the actual usage scenario. For example, in go { psm }. numGos in the above example, the values corresponding to different time points may be different and may be considered as a variable, but generally already well-defined writing in the monitoring system, and thus may be considered as a non-custom variable. While developers can customize variables such as: $ metrics ═ sum: rate: { psm }. numGos ", where $ metrics may be considered custom variables. For ease of illustration, the variables appearing hereinafter are to be understood as the custom variables described.

When the original alarm rule source code information contains the custom variable, the original alarm rule source code information can be subjected to the de-variation quantization processing, namely, the custom variable contained in the original alarm rule source code information is removed, so that the original alarm rule source code information becomes a pure operation expression. In some embodiments, the obtaining the original alarm rule expression corresponding to the original alarm rule source code information includes: and carrying out replacement processing of the custom variable on the original alarm rule source code information to obtain an original alarm rule expression, wherein in the replacement processing process, the position information of the custom variable contained in the original alarm rule source code information in the original alarm rule expression is recorded. Correspondingly, the generating of the target alarm rule source code information according to the adjusted alarm rule elements includes: and generating target alarm rule source code information according to the adjusted alarm rule elements and the position information. The method has the advantages that the user-defined variable is replaced, the expression corresponding to the complete alarm rule depended on by the monitoring system in actual operation can be obtained, in the replacement process, the position information of the user-defined variable in the original alarm rule expression is recorded, the original user-defined variable can be accurately restored in subsequent operation, and accurate source code information of the target alarm rule is finally obtained.

Illustratively, when the original alarm rule source code information is subjected to replacement processing of the custom variable, for a certain custom variable, the certain custom variable can be replaced by the expression corresponding to the previously-appeared custom variable. That is, for a custom variable, the custom variable may be referenced among other custom variables. For example, $ q1 ═ 1+1, $ q2 $ 2+ $ q1, for the latter expression, it can be considered that $ q1 is referenced in $ q2, and $ q1 in the expression of $ q2 can be replaced by the previously appearing expression 1+1 of $ q1, and then $ q2 $ 2+1+1 can be obtained.

In some embodiments, said splitting the alarm rule element of the original alarm rule expression comprises: constructing a syntax tree based on the original alarm rule expression; and splitting the elements of the alarm rule according to the expression corresponding to each node in the grammar tree. Correspondingly, the adjusting the corresponding adjustable item according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements includes: adjusting corresponding adjustable items in the grammar tree according to the received adjustment target information; and generating target alarm rule source code information according to the adjusted syntax tree and the position information. The method has the advantages that the original alarm rule expression can be better analyzed by constructing the syntax tree corresponding to the original alarm rule expression, and the mathematical relation and the logical relation contained in the original alarm rule expression are cleared, so that the splitting of the alarm rule elements is more reasonably and accurately realized. After the corresponding adjustable items in the grammar tree are adjusted, target alarm rule source code information can be directly generated according to the adjusted grammar tree and the position information of the user-defined variable in the original alarm rule expression.

Illustratively, the alarm rule elements comprise time sequence data monitoring targets, alarm trigger thresholds, alarm trigger conditions and alarm trigger condition combination modes. The splitting of the alarm rule elements according to the expressions corresponding to the nodes in the syntax tree comprises the following steps: determining a first expression corresponding to a first node in the syntax tree as an alarm triggering condition, wherein the first expression comprises a mathematical relation symbol; determining one side of the mathematical relationship symbols in the first expression as a time sequence data monitoring target, and determining the other side of the mathematical relationship symbols in the first expression as an alarm triggering threshold; and determining a second expression corresponding to a second node in the syntax tree as an alarm triggering condition combination mode, wherein the second expression comprises alarm triggering conditions, and when the second expression comprises at least two alarm triggering conditions, the at least two alarm triggering conditions are connected by a logic operation symbol. This has the advantage that the alarm rule elements can be identified more accurately.

Illustratively, the mathematical relationship symbols may include, for example, ">" (greater than), "<" (less than), "> (greater than or equal to)," < "(less than or equal to)," ═ equal to "(equal to), and" |! The part associated with the mathematical relationship symbol may generally describe a condition that triggers an alarm, and so a first expression containing the mathematical relationship symbol may be determined as the alarm-triggering condition, and the number of first nodes corresponding to the first expression may be one or more. For the alarm triggering condition, the general programming mode is that the left side is a time sequence data monitoring target and the right side is an alarm triggering threshold, and certainly, the method can be determined according to the actual programming condition. The logical operation symbols may include, for example, "& &" (logical AND), "|" (logical OR), and "! "(logical not), etc., the portion associated with the logical operator may generally describe a logical relationship between a plurality of conditions, and thus, the second expression comprising the logical operator may be determined as the alarm-triggering condition combination. It should be noted that, for some simple alarm rules, there may be only one alarm triggering condition, and the combination of the alarm triggering conditions may be regarded as the same as the alarm triggering conditions.

Fig. 2 is a schematic flow chart of another information processing method provided in the embodiment of the present disclosure, which is optimized based on the above optional embodiments, and is applicable to a case where the original alarm rule source code information includes a custom variable, as shown in fig. 2, the method may include:

step 201, performing replacement processing on the original alarm rule source code information on the custom variable to obtain an original alarm rule expression, wherein in the process of performing the replacement processing, position information of the custom variable contained in the original alarm rule source code information in the original alarm rule expression is recorded.

For example, when performing the replacement processing, a mapping (map) of each definition variable (which can be represented by a variable name) and an expression may be constructed first, the original alarm rule source code information is segmented according to a line feed symbol (such as '\ n'), so as to obtain a plurality of lines of source code information, and each line is traversed for the replacement processing. In performing the replacement process for each line, the variable name and the expression may be distinguished by a regular expression or other form of recognition method, for example, by '(\$ \ w +)/s ═ or'. Judging whether the expression of the current variable contains other variables, if so, replacing the other variables in the expression of the current variable by adopting the corresponding expressions related to the other variables in the mapping map, and recording the relative positions (which can also be understood as offset) of the replaced other variables in the current variable. That is, the relative position of the first custom variable contained in the original alarm rule source code information in the preset type expression corresponding to the second custom variable is recorded. The second customized variable here can be understood as the current variable described above, and the first customized variable can be understood as the other variables described above. As exemplified above, $ q1 may be regarded as the first custom variable, $ q2 may be regarded as the second custom variable, it is determined that the expression 2+ $ q1 of the second custom variable $ q2 includes the first custom variable $ q1, $ q1 in the expression of $ q2 is replaced with the expression 1+1 associated with $ q1 in the map, and the relative position of $ 1 in the preset type expression 2+1+1 of $ q2 is recorded. Subsequently, the map may be stored with the correspondence of the current variable to the new expression, e.g., the correspondence of $ q2 and 2+1+1 is stored in the map, facilitating the replacement of $ q2 when the subsequent process references the line on which the variable of $ q2 resides. For the line where the variable containing no other variables in the expression is located, the next line can be skipped and processed.

Illustratively, after traversing all rows, traversing all the custom variables contained in the original alarm rule source code information, determining the position information of each custom variable in the original alarm rule expression according to the relative position, and recording the position information, thereby realizing the recording of the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression.

It should be noted that, in the embodiment of the present disclosure, a syntax tree may be constructed based on an original alarm rule expression, and before performing replacement processing, brackets may be added to an expression corresponding to each user-defined variable in original alarm rule source code information, so as to avoid that the original expression cannot be restored after the syntax tree is constructed. For example, the above expression of $ q1 may be (1+1), and the substitution-processed expression of $ q2 may be 2+ (1+ 1). For special cases, such as where the referenced variable is present in the last alarm (war) statement, brackets may not be added.

Step 202, constructing a syntax tree based on the original alarm rule expression.

Optionally, before step 202, the method may further include: determining a user-defined variable corresponding to each position in the original alarm rule expression according to the position information to obtain first information; and summarizing the preset type expression corresponding to each user-defined variable to obtain second information. The advantage of setting up like this is, record the association between variable and expression more accurately, facilitate the variable name that every node corresponds to in the subsequent reduction syntax tree.

Optionally, after the syntax tree is constructed, the user-defined variable corresponding to each node in the syntax tree is determined according to the first information and the second information. The method has the advantage that target alarm rule source code information can be conveniently and accurately generated in the follow-up process according to the adjusted grammar tree and the user-defined variables corresponding to the nodes in the grammar tree.

For example, any node in the syntax tree may be marked as a third node, and in this case, the determining a custom variable corresponding to each node in the syntax tree according to the first information and the second information may include: inquiring the first information according to the first position of the leftmost leaf node of the third node to obtain a candidate custom variable corresponding to the first position; and querying a preset type expression corresponding to the candidate custom variable in the second information, and recording the custom variable corresponding to the first preset type expression as the custom variable corresponding to the third node when the queried first preset type expression is consistent with the preset type expression of the third node. The advantage of this arrangement is that the variable names corresponding to the nodes in the syntax tree can be accurately restored.

And step 203, splitting the alarm rule elements according to the expression corresponding to each node in the syntax tree.

The specific splitting manner can refer to the above related description.

And 204, screening target alarm rule elements from the alarm rule elements obtained by splitting, wherein the target alarm rule elements comprise adjustable items.

And step 205, acquiring historical data corresponding to the target alarm rule elements.

And step 206, carrying out visual output processing on the change of the historical data so that a user can input the corresponding adjusting target information of the adjustable project according to the visual output result.

And step 207, adjusting the corresponding adjustable items in the syntax tree according to the received adjustment target information.

And 208, generating target alarm rule source code information according to the adjusted syntax tree and the position information.

Optionally, after the target alarm rule source code information is obtained, the target alarm rule source code information may be sent to a corresponding monitoring system for application.

The information processing method provided by the embodiment of the disclosure firstly carries out the de-variation quantization processing on the original alarm rule source code information containing the custom variable to obtain the original alarm rule expression not containing the custom variable, and recording the position information of each defined variable in the original alarm rule expression, then constructing a syntax tree based on the original alarm rule expression, according to the expression corresponding to each node in the grammar tree, the alarm rule elements are split and the target alarm rule elements containing adjustable items are screened out, and the change of the corresponding historical data is visually output and processed, so that a user can conveniently and intuitively adjust the adjustable items according to the change rule, and finally, target alarm rule source code information is automatically generated according to the adjusted grammar tree and the position information, so that the debugging efficiency and accuracy of the alarm rule are effectively improved.

In some embodiments, the screening out target alarm rule elements from the split alarm rule elements includes: screening alarm triggering conditions from the alarm rule elements obtained by splitting; for each screened alarm triggering condition, under the condition that the alarm triggering threshold value in the current alarm triggering condition is determined to be adjustable, the current alarm triggering condition is determined as a target alarm rule element, and the alarm triggering threshold value in the current alarm triggering condition is determined as an adjustable item. The set alarm rule has the advantages that the alarm triggering threshold value is an important adjustable item for many alarm rules, and the alarm rules can be quickly optimized by screening target alarm rule elements according to the alarm triggering threshold value.

In some embodiments, the obtaining of the historical data corresponding to the target alarm rule element and performing visual output processing on the change of the historical data includes: acquiring historical data corresponding to each time point of the time sequence data monitoring target in the target alarm rule elements in a preset historical time period; and displaying variation curves corresponding to the historical data and alarm triggering thresholds in the target alarm rule elements respectively in a statistical chart coordinate system, and displaying an adjusting target information input control corresponding to an adjustable item, wherein the statistical chart coordinate system takes time and the time sequence data monitoring target as a horizontal axis and a vertical axis respectively. The advantage of setting like this lies in, to warning trigger threshold's regulation, can carry out visual output processing more rationally, and convenience of customers debugs out the warning trigger threshold who accords with current demand fast accurately.

Fig. 3 is a schematic flow chart of another information processing method provided in the embodiment of the present disclosure, which is optimized based on the foregoing optional embodiments, and as shown in fig. 3, the method may include:

step 301, performing replacement processing on the custom variable of the original alarm rule source code information to obtain an original alarm rule expression.

In order to facilitate understanding of the technical solutions of the embodiments of the present disclosure, a relatively simple example is described below as an example. Assume that the original alarm rule source code information is as follows:

$q1＝1+1

$q2＝2+$q1

$q1＝$q2+1

$q3＝$q1+$q2

warn＝$q3>2

brackets can be added to the expressions corresponding to the variables, because when a syntax tree is built, if the expressions are not included with brackets, the original expressions are difficult to restore when the syntax tree is built, so that each expression with an operator is added with brackets in advance, and a final war statement can be obtained without adding:

$q1＝(1+1)

$q2＝(2+$q1)

$q1＝($q2+1)

$q3＝($q1+$q2)

warn＝$q3>2

after the replacement processing of the custom variable, a final expression (((2+ (1+1)) +1) + (2+ (1+1))) >2 can be obtained, that is, the original alarm rule expression is obtained. During the de-variation quantization, the position information of each variable in the final expression can be recorded, and when a syntax tree is subsequently constructed according to the final expression, the original variable name can be restored after the metrics, target, threshold, condition and trigger are divided. The specific process of recording the position information is described in the following steps. The reason for recording the position information is that, in the absence of this step, the expression of each node obtained by subsequently dividing the Bosun syntax tree cannot find the corresponding variable name or find the wrong variable name, which causes misinterpretation. In addition, because the last executed statement of Bosun is a pure expression without a variable name (i.e., the preset type expression), after the adjustable item is adjusted, that is, after the syntax tree node is changed, if the syntax tree node does not correspond to the corresponding variable name, the corresponding specific position in the original source code information of the alarm rule with the variable cannot be modified, that is, the change of the adjustable item cannot be matched by using the character string. It should be noted that, after the parentheses are added, although after the Bosun syntax tree is constructed, redundant spaces and parentheses are automatically removed from the nodes of the syntax tree, the position (Pos) of each node is still relative to the position of the original expression (i.e., the final expression), so that the position of the leftmost first non-parenthesized and non-blank character of the expression corresponding to each variable is recorded at the position of the final expression.

Step 302, recording the relative position of a first custom variable contained in the original alarm rule source code information in a preset type expression corresponding to a second custom variable.

In this step, it is equivalent to record the position of the first leftmost non-bracketed non-space character of each variable relative to the first leftmost non-bracketed non-space character of the referenced variable. If the referenced variable is in a war statement, the position relative to the starting point can be directly recorded since the war statement does not add brackets. In addition, for the case that a repeatedly used variable appears in the original alarm rule source code information, such as $ q1 in the above example, the Line number (Line) of the expression referenced by the variable in the original alarm rule source code information may be recorded, and when the relative position is calculated, only the Line number of the referenced expression in which the Line number is greater than the Line number of the variable may be calculated, that is, the Line number in which the second customized variable references the first customized variable is greater than the Line number of the expression corresponding to the first customized variable, for example, the Line number in which $ q2 ═ 2+ $ q1 is greater than $ q1 ═ 1. In addition, after the line number is recorded, the line number of the expression of each variable in the original alarm rule source code information can be conveniently and accurately restored according to the adjusted syntax tree, and more accurate target alarm rule source code information can be obtained.

For the above example, the relative position calculation process is as follows:

1.$ q1 ═ (1+1), Line ═ 0, no other variables used, can be skipped;

2.$ q2 ═ (2+ $ q1) > (2+ (1+1)), Line ═ 1, $ q2 byte expression ═ 0:'(',1: '2',2: '+',3:'(',4: '1',5: '+',6: '1',7:'), 8:'), the leftmost non-bracketed non-space character of $ q2 is 1: '2', the leftmost non-bracketed non-space character of $ q1 is 4: '1' at the position of $ q2, so the position of q1 relative to q2 is 4-1 ═ 3;

3.$ q1 ($ q2+1) ═ ((2+ (1+1)) +1), Line 2, $ q1 byte expression ═ 0:'(',1:'(',2: '2',3: '+',4:'(',5: '1',6: '+',7: '1',8: '), 9:', 10: '+',11: '1',12: ')' ], $ q $ 1 leftmost non-bracketed character is 2: '2', and the leftmost non-bracketed non-spacebar character of $ q2 is 2: '2' at the position of q1, so the position of $ q2 relative to $ q1 is 2-2 ═ 0;

4.$ q3 ═($ q1+ $ q2) ═ > ((2+ (1+1)) +1) + (2+ (1+1))), Line ═ 3, $ q3 byte expression ═ 0: '(',1:'(',2:'(',3: '2',4:'+',5:'(',6: '1',7: '+',8: '1',9:')',10:'), 11:' + ',12:'1',13:'), 14: '+',15:'(',16: '2',17: '+',18:'(',19: '1',20: '+',21 '1',22:'), 23:', 24:'),' q3 leftmost non-bracketed non-space character is 3: the leftmost non-bracketed non-space character of '2', $ q1 is 3 in position $ q 3: '2', so the position of $ q1 relative to $ q3 is 3-0; the leftmost non-bracketed non-space character of $ q2 is at position $ q 3: '2'; so the position of $ q2 relative to $ q3 is 16-3-13;

5.war ═ q3>2 ═ ((2+ (1+1)) +1) + (2+ (1+1))) >2, Line ═ 4, war byte expression: [0:' (',1:' (',2:' (',3: '2',4: ' + ',5:' (',6: '1',7: ' + ',8: '1',9:'), 10:'), 11: ' + ',12: '1',13:', 14: ' + ',15:' (',16: '2',17: ' + ',18:', 19: '1',20: ' + ',21: '1',22: () ',23: () ',24: () ',25: ',26 '; '2 ';, since war is used in only the beginning point 3 and no more non-left space relative to the final sentence is needed, so the position of $ q3 in the war statement is 3: '2'.

The recording may be performed in a form in which Name represents a variable Name of the second custom variable, Pos represents a relative position, and Line represents the number of lines.

$ q1 as the first custom variable: name is $ q2, Pos is 3, Line is 1; name is $ q3, Pos is 0, Line is 3;

$ q2 as the first custom variable: name is $ q1, Pos is 0, Line is 2; name is $ q3, Pos is 13, Line is 3;

$ q3 as the first custom variable: name is war, Pos is 3, and Line is 4.

Step 303, traversing all the custom variables contained in the original alarm rule source code information, determining the position information of each custom variable in the original alarm rule expression according to the relative position, and recording the position information.

The position information may be represented by an offset amount, which may be calculated as follows, as an example:

offsets of $ q1 are 9, 19, and 3. Wherein [ $ q1 in $ 2 ═ 3] + [ $ q2 in $ 1 ═ 0] + [ $ q1 in $ 3 ═ 3] + [ $ q3 in war ═ 3] ═ 3+0+3+3 ═ 9, $ q1 in $ 2 ═ 3 means that the relative position of $ 1 in q2 is 3; q1 in q2 ═ 3] + [ $ q2 in q3 ═ 13] + [ $ q3 in wen ═ 3] +13+3 ═ 19; q1 in q3 ═ 0] + [ $ q3 in wan ═ 3 ═ 0+3 ═ 3.

Offsets of $ q2 are 3 and 16. Wherein [ $ q2 in $ q1 ═ 0] + [ $ q1 in $ q3 ═ 0] + [ $ q3 in wen ═ 3] ═ 0+0+3 ═ 3; q2 in q3 ═ 13] + [ $ q3 in wan ═ 3 ═ 13+3 ═ 16.

The offset of $ q2 is 3,. Wherein [ $ q3 in wan ═ 3] ═ 3.

It can be seen that there may be multiple offsets for the same custom variable in the original alarm rule expression.

And step 304, determining the user-defined variable corresponding to each position in the original alarm rule expression according to the position information to obtain first information.

For example, this step may be understood as calculating the variable names that may correspond to the positions in the original alarm rule expression relative to the starting position, so that the subsequent syntax tree can find the variable names that may correspond to the positions on the nodes.

As in the previous example, the first information may be represented as: the variable name for location "16" may be $ q2, the variable name for location "9" may be $ q1, the variable name for location "19" may be $ q1, and the variable name for location "3" may be $ q3, $ q2, and $ q 1.

And 305, summarizing the preset type expression corresponding to each user-defined variable to obtain second information.

For example, Value may be used to represent a preset type expression corresponding to the custom variable, and then the second information may be obtained as described above by way of example:

$ q 1: value is 1+1, Line is 0; value is 2+1+1+1, and Line is 2.

$ q 2: value is 2+1+1, and Line is 1.

$ q 2: value is 2+1+1+1+2+1+1, and Line is 3.

And step 306, constructing a syntax tree based on the original alarm rule expression.

Fig. 4 is a schematic diagram of a syntax tree structure provided in the embodiment of the present disclosure, and as shown in fig. 4, a syntax tree is constructed according to an original alarm rule expression that does not include a custom variable.

And 307, determining a user-defined variable corresponding to each node in the syntax tree according to the first information and the second information.

Fig. 5 is a schematic diagram of another syntax tree structure provided by the embodiment of the present disclosure, as shown in fig. 5, on the basis of fig. 4, corresponding custom variables are determined for each node.

Illustratively, taking node 2+1+1 as an example, the leftmost leaf node is 2, the corresponding position is 3, which can be obtained by querying the first information, and the possible corresponding variables are $ q3, $ q2 and $ q1, and then querying the second information to find that Value of $ q2 is 2+1+1, so that the node corresponds to the custom variable $ q 2.

And 308, splitting alarm rule elements according to the expression corresponding to each node in the syntax tree, and screening alarm triggering conditions from the split alarm rule elements.

Illustratively, alarm rule elements can be split according to metrics, target, threshold, condition and trigger and according to expressions corresponding to nodes in a syntax tree, and alarm rules can be standardized through splitting, so that a machine can understand alarm rules, and key expressions, namely target alarm rule elements, can be conveniently extracted according to requirements. In addition, in order to effectively distinguish the alarm rule elements, an Identification (ID) corresponding to each alarm rule element may be generated after the division.

Fig. 6 is a schematic diagram illustrating a parsing of an alarm rule element based on a syntax tree according to an embodiment of the present disclosure, as shown in fig. 6, for the above example, since only a simple example is used, a data source is not associated, and metrics can be considered to be absent; determining an expression "q3>2" containing ">" as condition, wherein the name of a corresponding variable can be war and the ID is 1; determining ">" expression on the left side "(((2+ (1+1)) +1) + (2+ (1+1)))" as target, the corresponding variable name may be q3, and the ID is 2; determining an expression "2" on the left side of ">" as threshold, no pair strain quantity name, and ID as 3; trigger is identical to condition since there is only one condition.

For example, when the threshold needs to be adjusted, the alarm trigger condition, that is, the condition, may be screened out from the alarm rule elements that are split out.

And 309, determining the current alarm triggering condition as a target alarm rule element and determining the alarm triggering threshold value in the current alarm triggering condition as an adjustable item under the condition that the alarm triggering threshold value in the current alarm triggering condition is determined to be adjustable for each screened alarm triggering condition.

For example, the basis for determining whether the alarm trigger threshold is adjustable may be whether an expression corresponding to the alarm trigger threshold is a pure mathematical expression (e.g., 2 or 1+1, etc., or a mathematical expression with a variable, e.g., a +1, etc.), and if so, the alarm trigger threshold is considered to be adjustable. If the expression corresponding to the alarm trigger threshold is not a pure mathematical expression, for example, contains a time series, then it is considered to be unadjustable.

As exemplified above, there is only one condition, q3>2 can be a target alarm rule element since the threshold is 2, a pure mathematical expression, which can be adjusted.

And 310, acquiring historical data corresponding to each time point of the time sequence data monitoring target in the target alarm rule element in a preset historical time period.

For example, for an alarm triggering condition which becomes an element of a target alarm rule, historical data corresponding to each time point of a time sequence data monitoring target in a preset historical time period may be acquired, and a specific acquisition manner is not limited.

And 311, displaying variation curves corresponding to the alarm triggering thresholds in the historical data and the target alarm rule elements respectively in a statistical chart coordinate system, and displaying an adjusting target information input control corresponding to an adjustable item.

The statistical chart coordinate system takes time as a horizontal axis and takes a time sequence data monitoring target as a vertical axis. Fig. 7 is a schematic diagram of a display interface provided in an embodiment of the present disclosure, as shown in fig. 7, since values of q3 in the above simple example are 9 at any time, a change curve corresponding to q3 is a straight line parallel to a horizontal axis and having a vertical coordinate of 9, and an alarm trigger threshold is 2, so that a change curve corresponding to an alarm trigger threshold is a straight line parallel to a horizontal axis and having a vertical coordinate of 2, an adjustment target information input control corresponding to the alarm trigger threshold may be displayed above a statistical coordinate graph, as shown in a square frame in the figure, a user may input adjustment target information in a square frame, and since a current alarm trigger threshold is 2 and 9>2, an alarm may be triggered, and if an actual service requirement does not want to trigger an alarm, 2 may be adjusted. Fig. 8 is a schematic view of another display interface provided in the embodiment of the present disclosure, as shown in fig. 8, when 10 is input in a block, the alarm triggering threshold value is changed to 10, and at this time, a change curve corresponding to the alarm triggering threshold value is a straight line parallel to a horizontal axis and having a vertical coordinate of 10, and an alarm is not triggered.

And step 312, adjusting corresponding adjustable items in the grammar tree according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted grammar tree and the user-defined variables corresponding to the nodes in the grammar tree.

Illustratively, after the alarm triggering threshold is adjusted, a value 2 corresponding to the alarm triggering threshold in the syntax tree is modified to 10, and then target alarm rule source code information is generated according to the adjusted syntax tree and the custom variables corresponding to the nodes in the syntax tree.

Optionally, an area for displaying the alarm rule source code information may be provided on the display interface, the original alarm rule source code information may be displayed before the adjustment, and the target alarm rule source code information may be displayed after the adjustment. For example, the area may be displayed above the adjustment target information input control. Fig. 9 is a schematic view of another display interface provided in the embodiment of the present disclosure, and as shown in fig. 9, after a value 2 corresponding to an alarm trigger threshold is modified to 10, target alarm rule source code information is automatically displayed in an alarm rule source code information display area.

The information processing method provided by the embodiment of the disclosure includes firstly carrying out de-variation quantization processing on original alarm rule source code information containing self-defined variables to obtain original alarm rule expressions not containing the self-defined variables, recording position information of respective defined variables in the original alarm rule expressions, then constructing a grammar tree based on the original alarm rule expressions, carrying out alarm rule element splitting according to the expressions corresponding to the nodes in the grammar tree and screening out target alarm trigger conditions containing adjustable alarm trigger thresholds, and carrying out visual output processing on change curves of historical data corresponding to time sequence data monitoring targets in the target alarm trigger conditions and change curves corresponding to the alarm trigger thresholds by adopting a statistical chart, so that a user can conveniently and visually adjust the alarm trigger thresholds according to the change rules of the historical data and adjust the grammar tree according to expected alarm trigger thresholds input by the user, and finally, the target alarm rule source code information is automatically generated according to the adjusted syntax tree, so that the debugging efficiency and accuracy of the alarm rule are effectively improved.

It should be noted that the above example is simple, and in practical applications, the alarm rule may be complex. A somewhat more complex example is listed below for further explanation:

assume that the original alarm rule source code information is as follows:

$metrics＝"sum:rate:go.{psm}.numGos"

$numGos1＝avg(q($metrics,"3m","2m"))

$numGos2＝avg(q($metrics,"4m","3m"))

$condition1＝$numGos1>120

$condition2＝$numGos2>200

$trigger＝$condition1&&$condition2

warn＝$trigger

the original alarm rule source code information is subjected to de-quantization processing, and the original alarm rule source code information is converted into a specific expression, so that the following can be obtained:

avg(q("sum:rate:go.{psm}.numGos","3m","2m"))>120&&avg(q("sum:rate:go.{psm}.numGos","4m","3m"))>200

fig. 10 is a schematic diagram of another alarm rule element splitting based on a syntax tree provided in the embodiment of the present disclosure, as shown in fig. 10, the metrics is $ metrics, the trigger is $ trigger, the condition is $ condition1 and $ condition2, the target is $ numGos1 and $ numGos2, and the threshold is 120 and 200.

The user can only pay attention to the two expressions of $ numGos1>120 and $ numGos2>200, historical data of $ numGos1 and $ numGos2 such as the historical data in the last 6 hours can be obtained, corresponding statistical graphs are drawn, the user can observe the change of the historical data conveniently, only the two thresholds of 120 and 200 need to be adjusted, and the computer device can automatically and synchronously modify the corresponding values in the original alarm rule source code information to generate the target alarm rule source code information.

Therefore, by adopting the technical scheme provided by the embodiment of the disclosure, the key expression determining triggering alarm in the alarm rule and the part which is frequently adjusted by the user are extracted, the user can better pay attention to the monitoring target without paying attention to the complete and complicated alarm rule, the historical curves of target and threshold in the condition are simulated on one graph through the graph, the user can visually observe the expression form of the historical curves, so that the threshold is quickly adjusted, the values in the expression are modified by positioning the variable or the expression in the positions of the grammar tree and the original alarm rule, the alarm rule can be automatically associated and modified, and the difficulty in editing the alarm rule is reduced.

Fig. 11 is a block diagram of an information processing apparatus, which may be implemented by software and/or hardware, and may be generally integrated in a computer device, and may perform information processing by executing an information processing method according to an embodiment of the present disclosure. As shown in fig. 11, the apparatus includes:

a regular expression obtaining module 1101, configured to obtain an original alarm rule expression corresponding to the original alarm rule source code information;

a target alarm rule element determining module 1102, configured to split an alarm rule element of the original alarm rule expression, and screen a target alarm rule element from the split alarm rule elements, where the target alarm rule element includes an adjustable item;

a visualization processing module 1103, configured to obtain historical data corresponding to the target alarm rule element, and perform visualization output processing on changes in the historical data, so that a user inputs adjustment target information of a corresponding adjustable item according to a visualization output result;

and the target alarm rule source code generation module 1104 is configured to adjust the corresponding adjustable item according to the received adjustment target information, and generate target alarm rule source code information according to the adjusted alarm rule elements.

The information processing device provided in the embodiment of the disclosure can automatically screen out the adjustable items in the alarm rule source code, and visually process the change of the historical data corresponding to the alarm rule element to which the adjustable item belongs, so that a user can more intuitively check the change trend of the historical data, further quickly set the reasonable target value of the adjustable item, and automatically generate the adjusted target alarm rule source code information after readjustment is completed, thereby improving the debugging efficiency of the alarm rule source code.

Optionally, the obtaining of the original alarm rule expression corresponding to the original alarm rule source code information includes: carrying out replacement processing of a custom variable on original alarm rule source code information to obtain an original alarm rule expression, wherein in the replacement processing process, position information of the custom variable contained in the original alarm rule source code information in the original alarm rule expression is recorded; correspondingly, the generating of the target alarm rule source code information according to the adjusted alarm rule elements includes: and generating target alarm rule source code information according to the adjusted alarm rule elements and the position information.

Optionally, the splitting the alarm rule element of the original alarm rule expression includes: constructing a syntax tree based on the original alarm rule expression; splitting alarm rule elements according to expressions corresponding to the nodes in the grammar tree; correspondingly, the adjusting the corresponding adjustable item according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements includes: adjusting corresponding adjustable items in the grammar tree according to the received adjustment target information; and generating target alarm rule source code information according to the adjusted syntax tree and the position information.

Optionally, the alarm rule elements include a time sequence data monitoring target, an alarm triggering threshold, an alarm triggering condition, and an alarm triggering condition combination mode.

Optionally, the splitting the alarm rule element according to the expression corresponding to each node in the syntax tree includes: determining a first expression corresponding to a first node in the syntax tree as an alarm triggering condition, wherein the first expression comprises a mathematical relation symbol; determining one side of the mathematical relationship symbols in the first expression as a time sequence data monitoring target, and determining the other side of the mathematical relationship symbols in the first expression as an alarm triggering threshold; and determining a second expression corresponding to a second node in the syntax tree as an alarm triggering condition combination mode, wherein the second expression comprises alarm triggering conditions, and when the second expression comprises at least two alarm triggering conditions, the at least two alarm triggering conditions are connected by a logic operation symbol.

Optionally, the recording the position information of the user-defined variable included in the original alarm rule source code information in the original alarm rule expression includes: recording the relative position of a first user-defined variable contained in the original alarm rule source code information in a preset type expression corresponding to a second user-defined variable; traversing all the custom variables contained in the original alarm rule source code information, determining the position information of each custom variable in the original alarm rule expression according to the relative position, and recording the position information.

Optionally, the apparatus further comprises: a first information determining module, configured to determine, according to the position information, a custom variable corresponding to each position in the original alarm rule expression before constructing a syntax tree based on the original alarm rule expression, so as to obtain first information; the first information determining module is used for summarizing the preset type expression corresponding to each user-defined variable to obtain second information; a node variable determining module, configured to determine, according to the first information and the second information, a custom variable corresponding to each node in the syntax tree before performing element splitting of an alarm rule according to an expression corresponding to each node in the syntax tree; correspondingly, the generating of the target alarm rule source code information according to the adjusted syntax tree and the position information includes: and generating target alarm rule source code information according to the adjusted syntax tree and the user-defined variables corresponding to the nodes in the syntax tree.

Optionally, marking any node in the syntax tree as a third node, and determining a custom variable corresponding to each node in the syntax tree according to the first information and the second information includes: inquiring the first information according to the first position of the leftmost leaf node of the third node to obtain a candidate custom variable corresponding to the first position; and querying a preset type expression corresponding to the candidate custom variable in the second information, and recording the custom variable corresponding to the first preset type expression as the custom variable corresponding to the third node when the queried first preset type expression is consistent with the preset type expression of the third node.

Optionally, the step of screening out target alarm rule elements from the alarm rule elements obtained by splitting includes: screening alarm triggering conditions from the alarm rule elements obtained by splitting; for each screened alarm triggering condition, under the condition that the alarm triggering threshold value in the current alarm triggering condition is determined to be adjustable, the current alarm triggering condition is determined as a target alarm rule element, and the alarm triggering threshold value in the current alarm triggering condition is determined as an adjustable item.

Optionally, the obtaining of the historical data corresponding to the target alarm rule element and performing visual output processing on the change of the historical data includes: acquiring historical data corresponding to each time point of the time sequence data monitoring target in the target alarm rule elements in a preset historical time period; and displaying variation curves corresponding to the historical data and alarm triggering thresholds in the target alarm rule elements respectively in a statistical chart coordinate system, and displaying an adjusting target information input control corresponding to an adjustable item, wherein the statistical chart coordinate system takes time and the time sequence data monitoring target as a horizontal axis and a vertical axis respectively.

Referring now to FIG. 12, shown is a schematic block diagram of a computer device 1200 suitable for use in implementing embodiments of the present disclosure. The computer device in the embodiments of the present disclosure may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle terminal (e.g., a car navigation terminal), and the like, and a fixed terminal such as a digital TV, a desktop computer, and the like. The computer device shown in fig. 12 is only an example and should not bring any limitation to the function and scope of use of the embodiments of the present disclosure.

As shown in fig. 12, the computer device 1200 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 1201 that may perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM)1202 or a program loaded from a storage means 1208 into a Random Access Memory (RAM) 1203. In the RAM 1203, various programs and data necessary for the operation of the computer apparatus 1200 are also stored. The processing apparatus 1201, the ROM 1202, and the RAM 1203 are connected to each other by a bus 1204. An input/output (I/O) interface 1205 is also connected to bus 1204.

Generally, the following devices may be connected to the I/O interface 1205: input devices 1206 including, for example, a touch screen, touch pad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, or the like; output devices 1207 including, for example, a Liquid Crystal Display (LCD), speakers, vibrators, or the like; storage devices 1208 including, for example, magnetic tape, hard disk, etc.; and a communication device 1209. The communication means 1209 may allow the computer apparatus 1200 to perform wireless or wired communication with other apparatuses to exchange data. While fig. 12 illustrates a computer apparatus 1200 having various means, it is to be understood that not all illustrated means are required to be implemented or provided. More or fewer devices may alternatively be implemented or provided.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer readable medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication device 1209, or installed from the storage device 1208, or installed from the ROM 1202. The computer program, when executed by the processing apparatus 1201, performs the above-described functions defined in the methods of the embodiments of the present disclosure.

It should be noted that the computer readable medium in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer readable signal medium may comprise a propagated data signal with computer readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.

The computer readable medium may be embodied in the computer device; or may exist separately and not be incorporated into the computer device.

The computer readable medium carries one or more programs which, when executed by the computing device, cause the computing device to: splitting alarm rule elements of the original alarm rule expression, and screening target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements comprise adjustable items; acquiring historical data corresponding to the target alarm rule elements, and performing visual output processing on the change of the historical data so that a user can input corresponding adjusting target information of the adjustable project according to a visual output result; and adjusting the corresponding adjustable item according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements.

Computer program code for carrying out operations for the present disclosure may be written in any combination of one or more programming languages, including but not limited to an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The modules described in the embodiments of the present disclosure may be implemented by software or hardware. The name of the module does not form a limitation on the module itself under a certain condition, for example, the regular expression obtaining module may also be described as a module for obtaining an original alarm rule expression corresponding to the original alarm rule source code information.

The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), systems on a chip (SOCs), Complex Programmable Logic Devices (CPLDs), and the like.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

According to one or more embodiments of the present disclosure, there is provided an information processing method including:

Further, the original alarm rule expression is a preset type expression, the preset type expression does not include a user-defined variable, and the obtaining of the original alarm rule expression corresponding to the original alarm rule source code information includes:

carrying out replacement processing of a custom variable on original alarm rule source code information to obtain an original alarm rule expression, wherein in the replacement processing process, position information of the custom variable contained in the original alarm rule source code information in the original alarm rule expression is recorded;

correspondingly, the generating of the target alarm rule source code information according to the adjusted alarm rule elements includes:

and generating target alarm rule source code information according to the adjusted alarm rule elements and the position information.

Further, the splitting the alarm rule element of the original alarm rule expression includes:

constructing a syntax tree based on the original alarm rule expression;

splitting alarm rule elements according to expressions corresponding to the nodes in the grammar tree;

correspondingly, the adjusting the corresponding adjustable item according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements includes:

adjusting corresponding adjustable items in the grammar tree according to the received adjustment target information;

and generating target alarm rule source code information according to the adjusted syntax tree and the position information.

Further, the alarm rule elements comprise a time sequence data monitoring target, an alarm triggering threshold, an alarm triggering condition and an alarm triggering condition combination mode.

Further, the splitting the alarm rule elements according to the expression corresponding to each node in the syntax tree includes:

determining a first expression corresponding to a first node in the syntax tree as an alarm triggering condition, wherein the first expression comprises a mathematical relation symbol;

determining one side of the mathematical relationship symbols in the first expression as a time sequence data monitoring target, and determining the other side of the mathematical relationship symbols in the first expression as an alarm triggering threshold;

and determining a second expression corresponding to a second node in the syntax tree as an alarm triggering condition combination mode, wherein the second expression comprises alarm triggering conditions, and when the second expression comprises at least two alarm triggering conditions, the at least two alarm triggering conditions are connected by a logic operation symbol.

Further, the recording the position information of the user-defined variable contained in the original alarm rule source code information in the original alarm rule expression includes:

recording the relative position of a first user-defined variable contained in the original alarm rule source code information in a preset type expression corresponding to a second user-defined variable;

traversing all the custom variables contained in the original alarm rule source code information, determining the position information of each custom variable in the original alarm rule expression according to the relative position, and recording the position information.

Further, before the constructing a syntax tree based on the original alarm rule expression, the method further includes:

determining a user-defined variable corresponding to each position in the original alarm rule expression according to the position information to obtain first information;

summarizing a preset type expression corresponding to each user-defined variable to obtain second information;

correspondingly, before the alarm rule element splitting is performed according to the expression corresponding to each node in the syntax tree, the method further includes:

determining a user-defined variable corresponding to each node in the syntax tree according to the first information and the second information;

correspondingly, the generating of the target alarm rule source code information according to the adjusted syntax tree and the position information includes:

and generating target alarm rule source code information according to the adjusted syntax tree and the user-defined variables corresponding to the nodes in the syntax tree.

Further, marking any node in the syntax tree as a third node, and determining a custom variable corresponding to each node in the syntax tree according to the first information and the second information includes:

inquiring the first information according to the first position of the leftmost leaf node of the third node to obtain a candidate custom variable corresponding to the first position;

and querying a preset type expression corresponding to the candidate custom variable in the second information, and recording the custom variable corresponding to the first preset type expression as the custom variable corresponding to the third node when the queried first preset type expression is consistent with the preset type expression of the third node.

Further, the screening of target alarm rule elements from the alarm rule elements obtained by splitting includes:

screening alarm triggering conditions from the alarm rule elements obtained by splitting;

for each screened alarm triggering condition, under the condition that the alarm triggering threshold value in the current alarm triggering condition is determined to be adjustable, the current alarm triggering condition is determined as a target alarm rule element, and the alarm triggering threshold value in the current alarm triggering condition is determined as an adjustable item.

Further, the acquiring historical data corresponding to the target alarm rule element and performing visual output processing on the change of the historical data includes:

acquiring historical data corresponding to each time point of the time sequence data monitoring target in the target alarm rule elements in a preset historical time period;

and displaying variation curves corresponding to the historical data and alarm triggering thresholds in the target alarm rule elements respectively in a statistical chart coordinate system, and displaying an adjusting target information input control corresponding to an adjustable item, wherein the statistical chart coordinate system takes time and the time sequence data monitoring target as a horizontal axis and a vertical axis respectively.

According to one or more embodiments of the present disclosure, there is provided an information processing apparatus including:

The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the disclosure herein is not limited to the particular combination of features described above, but also encompasses other embodiments in which any combination of the features described above or their equivalents does not depart from the spirit of the disclosure. For example, the above features and (but not limited to) the features disclosed in this disclosure having similar functions are replaced with each other to form the technical solution.

Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are included in the above discussion, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. An information processing method characterized by comprising:

2. The method of claim 1, wherein the original alarm rule expression is a preset type expression, the preset type expression does not include a custom variable, and the obtaining of the original alarm rule expression corresponding to the original alarm rule source code information includes:

3. The method of claim 2, wherein said splitting the original alarm rule expression into alarm rule elements comprises:

constructing a syntax tree based on the original alarm rule expression;

4. The method of claim 3, wherein the alarm rule elements comprise time series data monitoring targets, alarm trigger thresholds, alarm trigger conditions, and alarm trigger condition combinations.

5. The method of claim 4, wherein said performing alarm rule element splitting according to the expression corresponding to each node in the syntax tree comprises:

6. The method of claim 3, wherein the recording the location information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression comprises:

7. The method of claim 6,

before the constructing a syntax tree based on the original alarm rule expression, the method further comprises:

8. The method according to claim 7, wherein marking any node in the syntax tree as a third node, and determining the custom variable corresponding to each node in the syntax tree according to the first information and the second information comprises:

9. The method of claim 5, wherein the screening out target alarm rule elements from the split alarm rule elements comprises:

10. The method according to claim 9, wherein the acquiring historical data corresponding to the target alarm rule element and performing visual output processing on the change of the historical data comprises:

11. An information processing apparatus characterized by comprising:

12. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-10.

13. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the method according to any of claims 1-10 when executing the computer program.