WO2023040259A1

WO2023040259A1 - Resource alarm analysis method and apparatus, electronic device, and storage medium

Info

Publication number: WO2023040259A1
Application number: PCT/CN2022/087437
Authority: WO
Inventors: 唐英; 李小进; 文秀林; 杨洋
Original assignee: 中兴通讯股份有限公司
Priority date: 2021-09-18
Filing date: 2022-04-18
Publication date: 2023-03-23
Also published as: CN115827363A

Abstract

The present application relates to the technical field of wireless communications, and discloses a resource alarm analysis method and apparatus, an electronic device, and a storage medium. The method comprises: acquiring an association resource instance relationship tree of an alarm resource; acquiring a plurality of alarm slices of the alarm resource according to the association resource instance relationship tree, wherein the alarm slices comprise alarm information of at least one resource node in the association resource instance relationship tree in a unit time; and acquiring associated alarm information having an association relationship according to the alarm information in the plurality of alarm slices.

Description

Resource alarm analysis method, device, electronic device and storage medium

Cross References to Related Applications

This application is based on the Chinese patent application with the application number "202111101821.0" and the filing date is September 18, 2021, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated by reference Apply.

technical field

The embodiments of the present application relate to the technical field of mobile communications, and in particular to a resource alarm analysis method, device, electronic equipment, and storage medium.

Background technique

Relying on the core idea of Cloud Native, the 5G network realizes customization, openness and service of the network through a service-based network architecture combined with virtualization and cloud technologies. The virtualized network is divided into hardware layer, virtual layer, and network element layer from bottom to top. The lower layer resources are the basis for the operation of the upper layer resources. The failure of the physical layer resources often causes the failure of the virtual layer resources, and the failure of the virtual layer resources, It will also cause network elements to fail, and eventually affect the normal processing of services. Therefore, when an alarm occurs on a resource in a virtualized network, it is often necessary to comprehensively analyze the alarm status of other resources related to this resource in order to find the root cause of the problem and understand the impact of the fault on the entire network resource.

However, most network operation and maintenance systems use different pages to provide the query of network resources and resource alarms respectively. When querying resource alarms, the query results only include the alarm information of the selected resource. Therefore, it is necessary to switch between pages repeatedly during the query process. Only multiple queries can obtain all the alarm information of associated resources within a period of time. Finally, the root cause of resource failures can be identified through manual inductive statistics. Large, it is very time-consuming to rely solely on manual distribution queries.

In order to solve the time-consuming problem of manual distributed query, a query method based on association rules is adopted, and the correlation analysis between alarms is carried out when active alarms are reported to identify primary-auxiliary alarms. However, limited by the generation conditions, The generation efficiency and practical application of association rules are still in a relatively difficult state, and the correlation analysis of resource alarms in virtualized networks and the efficient detection of root causes are still problems that need to be solved urgently.

Contents of the invention

The embodiment of the present application provides a resource alarm analysis method, the method includes: obtaining the associated resource instance relationship tree of the alarm resource; according to the associated resource instance relationship tree, obtaining multiple alarm slices of the alarm resource; wherein, the alarm slice includes Associate the alarm information of at least one resource node in the resource instance relationship tree; obtain associated alarm information with an associated relationship according to the alarm information in multiple alarm slices.

The embodiment of the present application also proposes a resource alarm analysis device, including: an acquisition module, used to acquire the associated resource instance relationship tree of the alarm resource; a slicing module, used to acquire multiple alarm resources of the alarm resource according to the associated resource instance relationship tree A slice; wherein, the alarm slice includes alarm information of at least one resource node in the relationship tree of associated resource instances per unit time; the analysis module is used to obtain associated alarm information with an associated relationship according to the alarm information in multiple alarm slices.

The embodiment of the present application also provides an electronic device, the device includes: at least one processor; and a memory connected to the at least one processor in communication; wherein, the memory stores information that can be processed by the at least one processor; Instructions executed by a processor, the instructions are executed by the at least one processor, so that the at least one processor can execute the resource alarm analysis method as described above.

The embodiment of the present application also provides a computer-readable storage medium storing a computer program, and implementing the resource alarm analysis method as described above when the computer program is executed by a processor.

Description of drawings

One or more embodiments are exemplified by pictures in the accompanying drawings, and these exemplifications are not intended to limit the embodiments.

Fig. 1 is a schematic diagram of a 5G virtual network resource model in an embodiment of the present application;

FIG. 2 is a flow chart of a resource alarm analysis method in an embodiment of the present application;

FIG. 3 is a schematic diagram of a resource relationship structure in a virtualized network in an embodiment of the present application;

FIG. 4 is a schematic structural diagram of the total tree of associated resource instance relationships in an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a resource alarm analysis device in another embodiment of the present application;

Fig. 6 is a schematic structural diagram of an electronic device in another embodiment of the present application.

Detailed ways

It can be seen from the background technology that in order to solve the time-consuming problem of manual distributed query, a query method based on association rules is adopted, and the correlation analysis between alarms is carried out when active alarms are reported to identify primary-auxiliary alarms. Due to the limitation of generation conditions, the generation efficiency and practical application of association rules are still in a relatively difficult state. The correlation analysis of resource alarms in virtualized networks and the efficient detection of root causes are still problems that need to be solved urgently.

The main purpose of the embodiment of the present application is to propose a resource alarm analysis method, device, electronic equipment, and storage medium, aiming at efficiently identifying the alarm association relationship between different alarms on the alarm resource when receiving a resource alarm, thereby improving Speed of root cause analysis of resource alerts.

In order to solve the above problems, an embodiment of the present application provides a resource alarm analysis method, the method includes: obtaining the associated resource instance relationship tree of the alarm resource; according to the associated resource instance relationship tree, obtaining multiple alarm slices of the alarm resource; wherein, The alarm slice contains the alarm information of at least one resource node in the associated resource instance relationship tree per unit time; according to the alarm information in multiple alarm slices, the associated alarm information with the associated relationship is obtained.

The resource alarm analysis method provided by the embodiment of the present application obtains the associated resource instance relationship tree of the alarm resource, and obtains multiple alarm slices of the alarm resource according to the associated resource instance relationship tree, and obtains the The associated alarm information of the resource association relationship, by obtaining the associated resource instance relationship tree of the alarm resource, and only detecting the alarm information of each resource contained in the associated resource instance relationship tree, reduces the amount of data that needs to be analyzed and detected, and improves the analysis. detection efficiency, and through the slice-based processing and detection of alarm information, according to the alarm information in each slice, accurately identify the correlation between alarms, which is convenient for analyzing the root cause of resource alarms based on the alarm correlation, and realize resource management. Efficient identification of the correlation between alarms and the root cause of alarms.

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. However, those of ordinary skill in the art can understand that in each embodiment of the application, many technical details are provided for readers to better understand the application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in this application can also be realized. The division of the following embodiments is for the convenience of description, and should not constitute any limitation to the specific implementation of the present application, and the embodiments can be combined and referred to each other on the premise of no contradiction.

The implementation details of the resource alarm analysis method described in this application will be described in detail below in conjunction with specific embodiments. The following content is only implementation details provided for easy understanding, and is not necessary for implementing this solution.

The first aspect of the embodiment of the present application provides a resource alarm analysis method. The schematic diagram of the 5G virtualized network resource model targeted by the resource alarm analysis method is shown in Figure 1. The uppermost network element layer includes service network elements and virtualization network elements. Network functions, the virtual layer in the middle layer includes virtualized network resources such as hosts, virtual interactive machines, virtual databases, virtual networks, virtual hosts, virtual network cards, and virtual disks, and the lowest hardware layer includes servers and system servers , interactive server, interactive system server, switch port, router port, hardware facilities or ports such as switches and routers, each resource communicates and connects according to business interaction or association relationship. In some embodiments, the resource alarm analysis method is applied to analysis and control terminals with communication and analysis capabilities, such as electronic devices such as computers, tablets, and mobile phones. In this embodiment, the application in computers is used as an example for illustration. Refer to Figure 2 for the process, which specifically includes the following steps:

Step 201, obtain the associated resource instance relationship tree of the alarm resource.

Specifically, when a computer detects a resource alarm on a resource in the 5G virtualized network or receives an analysis of a resource alarm, it obtains the associated resource of the alarm resource based on the specific type and number of the resource where the alarm occurred. instance relationship tree.

In an example, before the computer obtains the associated resource instance relationship tree of the alarm resource, it also includes: generating the associated resource instance relationship tree including each resource, and storing the generated associated resource instance relationship tree in the graph database; obtaining The associated resource instance relationship tree of the alarm resource includes: reading the associated resource instance relationship tree of the alarm resource in the overall tree of the associated resource instance relationship according to the preset association type. For example, the alarm resource analysis system in the computer collects various resource data from each network element through resource probes, and stores them in the system resource library; After virtualized processing, it is stored in the current alarm library and historical alarm library. When the computer detects the alarm of the virtualized network, it extracts the resource data that will report the alarm from the resources of the entire network, and combines the structure of the currently managed network with the According to the characteristics of the network, model the resources that need to be analyzed, determine the resources that have direct or indirect relationship between each resource, and then generate a total tree of related resource instances including each resource, and summarize the generated related resource instance relationships The tree is stored in a graph database other than the resource database of the entire network. When it is necessary to obtain the associated resource instance relationship tree of the alarm resource, according to the preset association type, the associated resource of the alarm resource is read in the overall tree of the associated resource instance relationship Relationship instance relationship tree. For example, when the default association type is resource-level association, the resource relationship structure diagram of the seven-layer resources in the virtualized network is shown in Figure 3. The router is at the bottom layer, and the bottom switch (End of Row, EOR) is at the top. , Top of Rack (Top of Rack, TOR), server, host, virtual host and service network element, the structural diagram of the general tree of the associated resource instance relationship established is shown in Figure 4. The overall structure is that different routers pass through different switches and At least one server is connected, and the corresponding host is connected through the server, and then each host is connected through its own connected virtual host and virtual network function. After reading the overall tree of the associated resource instance relationship, read the associated resource instance relationship tree of the alarm resource according to the associated type. For a resource in the total relationship tree of an associated resource instance, there are multiple resources directly or indirectly associated with itself in the entire relationship tree, and a specific associated resource instance relationship tree contains resources calculated according to the preset association type All associated resources including itself.

When reading the associated resource instance relationship tree of alarm resources, the selected preset association type can be adjusted according to the actual situation, so as to analyze the association relationship of alarm information from different angles. The total tree of associated resource instance relationship can be stored in the graph database It can also be stored in other databases. This embodiment does not limit the specific storage method of the selected preset association type and the total tree of association resource instance relationships. By pre-establishing the total tree of associated resource instance relationships containing each resource and storing it in the graph database, it is convenient to directly obtain the total tree of associated resource instance relationships in the graph database when performing alarm correlation analysis and obtain the associated resources of alarm resources according to the preset association type Instance relationship tree; it is convenient for subsequent query and analysis of alarm information based on the obtained associated resource instance relationship tree, so that the computer can perform directional query and analysis under massive resources and alarms, and improve the analysis speed of the relationship between alarms , and then more efficiently analyze the root cause of the alarm.

Step 202, according to the associated resource instance relationship tree, multiple alarm slices of the alarm resource are obtained.

Specifically, after the computer obtains the associated resource instance relationship tree of the alarm resource, it obtains multiple alarm slices of the alarm resource according to the associated resource instance relationship tree, wherein the alarm slice contains at least Alarm information of a resource node.

In one example, the computer obtains multiple alarm slices of the alarm resource according to the relationship tree of the associated resource instance, including: obtaining the query snapshot of the alarm data of each resource in the relationship tree of the associated resource instance within a preset time period; according to the unit time, according to The alarm sequence divides the query snapshot into multiple query slices; multiple alarm slices containing alarm information are filtered out from multiple query slices. After obtaining the associated resource instance relationship tree of the alarm resource, the computer determines the resource instance to be queried, the time range of the alarm query, and the range of alarm data (historical alarms, active alarms or all alarms) according to the associated resource instance relationship tree. Among them, the resource instance only selects the resources included in the resource association type for instantiation. For example, in the associated resource instance relationship tree generated according to the resource hierarchical relationship, only network elements, virtual hosts, hosts, servers, switches, and routers are selected for instantiation and associated query, and all the alarm information and resources that are queried All are displayed on the same query result page, and one category of resources is displayed in a list in one tab. Before querying, the computer can traverse the associated resource instance relationship tree according to the query conditions in advance to query out the associated resources of the alarm resource, and query out the alarm information of these resources within the preset time period. Store the resource collection contained in the relationship tree of the associated resource instance and the alarm data information collection within the preset time period into a temporary table, and build an index based on the resource type and alarm occurrence time, and generate a query snapshot as a sample to be analyzed. For example, if the query command entered by the user is to query the alarms of a certain network element, the query result display interface will display the network element itself, all virtual machines associated with this network element, the host where each virtual machine is located, and each host The corresponding server, the TOR connected to each server, the EOR connected to TOR, and the router connected to EOR are identified respectively, and all alarm information of each resource within a preset time period is displayed in a list display on multiple tab pages. Then store the alarm information in each tab page as a query snapshot and put it into the database. When the computer performs a query, directly read the query snapshot as the sample to be analyzed, and divide the query snapshot corresponding to the alarm information of each resource node in the relationship tree of the associated resource instance into Continuous time slices form multiple query slices for querying alarm information, and then the computer screens out multiple alarm slices containing alarm information from multiple query slices, and each alarm slice stores associated resource instances per unit time Alarm information of each resource node in the relationship tree. In practical applications, the query snapshot corresponding to the relationship tree of the associated resource instance of the alarm resource can be generated in real time based on the data in the database, or can be directly obtained by reading the data in the database in advance, for each association The query snapshot generated by the resource instance relationship tree is not limited in this embodiment. By dividing the query snapshot generated according to the alarm information of each resource point within the preset time length into multiple query slices, and filtering out the alarm slices containing the alarm information, the alarms can be distinguished in chronological order, which is convenient for subsequent alarms. analysis of the relationship between them.

Step 203, according to the alarm information in the multiple alarm slices, the associated alarm information with the associated relationship is obtained.

Specifically, after the computer acquires multiple alarm slices of the alarm resource, according to the alarm information in the multiple alarm slices, the computer acquires associated alarm information with an associated relationship, and uses the associated alarm as an associated alarm.

In an example, according to the alarm information in multiple alarm slices, obtaining associated alarm information with an association relationship includes: determining at least one target alarm slice in multiple alarm slices; wherein, the target alarm slice contains multiple resource nodes Alarm information; if multiple alarm information is included in multiple target alarm slices, the multiple alarm information is used as associated alarm information. The computer obtains the query snapshot of the alarm information of each resource node in the relationship tree of the associated resource instance within 3 minutes, and divides the query snapshot into 18 alarm slices according to the unit duration of 10 seconds. The computer detects the alarm information in each alarm slice, and uses alarm slices 1 to 6 that simultaneously contain alarm information of multiple resource nodes as target alarm slices. Then detect the alarm information in the target alarm slice, and judge the alarms whose alarm states have changed in each target alarm slice. Alarm 1 to Alarm 4 are associated alarm sets. If the alarm resources are at different levels, set the alarm at the lowest level as the root alarm; if the alarm resources are at the same level, set the alarm that occurs first as the root alarm; or if a user confirms an alarm as the root alarm according to other criteria, the After the root alarm is confirmed, other alarms in this alarm set are automatically sub-alarms. In practical applications, the number of target alarm slices in which multiple alarms recorded as associated alarm information need to appear can be adjusted according to actual conditions, which is not limited in this embodiment. By determining multiple target alarm slices and using multiple target alarm slices to detect alarms that may have correlations multiple times, it is ensured that the associated alarm information with correlations can be accurately identified, and the identification efficiency of alarm correlations is improved. Improve the detection efficiency of the root cause of the alarm.

In another example, according to the alarm information in multiple alarm slices, the associated alarm information with associated relationship is obtained, including: generating an associated topology map according to the associated resource instance relationship tree; playing each alarm slice in the associated topology map, according to The alarm information in the alarm slice updates the alarm levels and alarm times of each resource node in the associated topology; according to the instruction and the associated topology map, the associated alarm information with the associated relationship is obtained. For example, establish an associated resource instance relationship tree based on the service network element association, and when performing resource alarm association analysis on one of the Unified Data Management (UDM) instances, query out the relationship between the UDM instance and the UDM instance based on the associated resource instance relationship tree. Multiple types of NEs such as Session Management function (SMF), Access and Mobility Management Function (AMF) and Authentication Server Function (AUSF) are associated, and the computer After obtaining the alarm information of each resource at the preset duration, the selected UDM network element instance, all SMF network element instances, AMF network element instances and AUSF network element instances associated with this UDM network element instance are displayed on the top of the page through 4 tab pages. The network element instance, and then according to the relationship tree of the associated resource instance, generate an associated topology diagram for the alarm resource that includes the resource nodes corresponding to the four types of network element instances, and display it according to the associated type. At the same time, the computer displays the slice analysis switch on the top of the alarm list. After receiving the user's instruction to click slice analysis, the computer will render the current playback on each resource node of the associated topology map according to the alarm information in each alarm slice obtained. In the alarm slice, the color of the highest-level alarm active on each resource and the total number of alarms of each level are displayed on the associated topology map. After receiving the slice switching instruction from the user, the slice time window automatically changes from the current position Swipe backwards to automatically render the alarm status of each resource instance in each alarm slice to the associated topology map at a certain speed, which is equivalent to computer tomography (Computed Tomography, CT) and imaging, for users to observe the alarm status of each resource. When the time is generated and restored, for example, during the playback of multiple alarm slices generated by a query snapshot, it is found that the resource nodes corresponding to the UDM instance and the resource nodes corresponding to the SMF instance are in different alarm slices, and the alarm colors on the nodes are rendered simultaneously. Change or the alarm count on the node changes at the same time, the user can observe the alarm changes, check the UDM instance and the SMF instance in the alarm list, and then click the association button to confirm that the UDM instance and the SMF instance in the alarm list are in the same slice The alarms that are reported at the same time and recovered in another time slice are set for alarm association. The computer will set the alarms that are reported in the same time slice and recovered in another time slice as A set of associated alarms, the alarm reported first is set as the root alarm, or a root alarm is determined by the user according to other principles, and the rest of the alarms are automatically sub-alarms. According to the alarm information in the alarm slice on the association topology diagram generated according to the association resource instance relationship tree, the alarm rendering is performed on each resource node on the association topology diagram, and the alarm changes are intuitively displayed for the user by means of slice scanning, for the user Determine the alarms with correlations, and store the alarms with correlations as associated alarm information according to user input instructions, so as to realize the accurate and efficient identification of the correlations of alarm information, and improve the detection efficiency of the root cause of alarms.

In another example, after obtaining associated alarm information with an associated relationship according to the alarm information in multiple alarms, it further includes: obtaining alarm key features of the associated alarm information; wherein, the alarm key features include: resource type and/or Alarm code; according to the key features of the alarm, an alarm association mark associated with the alarm information is generated. For example, after the computer obtains associated alarm information based on slice analysis results and user instructions, it extracts the key features of the associated alarm set generated based on the root alarm and sub-alarms, and uses the preset analysis algorithm to obtain associated alarm information. The resource type, network element type, alarm code and other characteristics corresponding to the information, and according to the obtained key characteristics of the alarm, generate the alarm association mark corresponding to the associated alarm information, and distinguish and identify the obtained associated alarms.

In another example, after generating the alarm associated flag associated with the alarm information, it also includes: detecting whether the cumulative number of alarm associated flags is zero, and if the accumulated number of alarm associated flags is zero, creating a new cumulative time for the alarm associated flag times, and update the newly-created cumulative times to 1; if the cumulative times of the alarm-related flags is not zero, update the cumulative times of the alarm-related flags. For example, after the computer extracts the alarm key features of the associated alarm information according to the analysis algorithm, and generates the corresponding alarm associated tags according to the alarm key features, it queries whether the cumulative number of alarm associated tags generated in the associated tag database is zero. If there is no newly generated alarm correlation tag in the database, create a new cumulative count for the generated alarm correlation tag in the correlation tag database, and update the cumulative count to 1; when the cumulative number of newly generated alarm correlation tags is zero case, directly update the accumulated count to 1. If the accumulative count of the newly generated alarm-related flag is not zero, update the accumulative count of the alarm-related flag, and add one to the accumulative count. By generating alarm correlation tags according to the key features of the associated alarm information, and counting and updating the cumulative number of alarm correlation tags, it is convenient for subsequent analysis of the cause of the alarm, and the accumulation of expert experience in the associated alarm relationship is realized, so that the follow-up can Generate association rules for detecting the root cause of the alarm based on the expert experience of the associated alarm relationship, the historical alarm analysis structure, and other information to further improve the detection efficiency of the root cause of the alarm.

In addition, it should be understood that the division of steps in the above methods is only for clarity of description, and may be combined into one step or split into multiple steps during implementation. As long as the same logical relationship is included, all Within the scope of protection of this patent; adding insignificant modifications or introducing insignificant designs to the algorithm or process, but not changing the core design of the algorithm and process are all within the scope of protection of the patent.

Another embodiment of the present application relates to a resource alarm analysis device, referring to FIG. 5 , including:

The acquiring module 501 is configured to acquire the associated resource instance relationship tree of the alarm resource.

The slicing module 502 is configured to obtain multiple alarm slices of alarm resources according to the associated resource instance relationship tree; wherein, the alarm slice includes alarm information of at least one resource node in the associated resource instance relationship tree within a unit time.

The analysis module 503 is configured to acquire associated alarm information with an association relationship according to the alarm information in multiple alarm slices.

It is not difficult to find that this embodiment is an apparatus embodiment corresponding to the method embodiment, and this embodiment can be implemented in cooperation with the method embodiment. The relevant technical details mentioned in the method embodiments are still valid in this embodiment, and will not be repeated here in order to reduce repetition. Correspondingly, the related technical details mentioned in this embodiment can also be applied in the method embodiment.

It is worth mentioning that all the modules involved in this embodiment are logical modules. In practical applications, a logical unit can be a physical unit, or a part of a physical unit, or multiple physical units. Combination of units. In addition, in order to highlight the innovative part of the present invention, units that are not closely related to solving the technical problem proposed by the present invention are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.

Another embodiment of the present application also provides an electronic device, referring to FIG. 6 , including: including at least one processor 601; and a memory 602 communicatively connected to at least one processor 601; An instruction executed by one processor 601, the instruction is executed by at least one processor 601, so that at least one processor 601 can execute the resource alarm analysis method described in any method embodiment above.

Wherein, the memory 602 and the processor 601 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors 601 and various circuits of the memory 602 together. The bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein. The bus interface provides an interface between the bus and the transceivers. A transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium. The data processed by the processor 601 is transmitted on the wireless medium through the antenna, and further, the antenna also receives the data and transmits the data to the processor 601 .

Processor 601 is responsible for managing the bus and general processing, and may also provide various functions including timing, peripheral interface, voltage regulation, power management, and other control functions. And the memory 602 may be used to store data used by the processor 601 when performing operations.

Another embodiment of the present application also provides a computer-readable storage medium storing a computer program. The above method embodiments are implemented when the computer program is executed by the processor.

That is, those skilled in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, the program is stored in a storage medium, and includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Those of ordinary skill in the art can understand that the above-mentioned embodiments are specific embodiments for realizing the present application, and in practical applications, various changes can be made to it in form and details without departing from the spirit and spirit of the present application. scope.

Claims

A resource alarm analysis method, comprising:

Get the associated resource instance relationship tree of the alarm resource;

Obtain multiple alarm slices of the alarm resource according to the associated resource instance relationship tree; wherein, the alarm slice includes alarm information of at least one resource node in the associated resource instance relationship tree within a unit time;

According to the alarm information in the plurality of alarm slices, associated alarm information having an association relationship is acquired.
The resource alarm analysis method according to claim 1, wherein said obtaining associated alarm information having an association relationship according to the alarm information in the plurality of alarm slices comprises:

Determine at least one target alarm slice among the plurality of alarm slices; wherein, the target alarm slice contains the alarm information of multiple resource nodes;

If multiple alarm information is included in multiple target alarm slices, the multiple alarm information is used as the associated alarm information.
The resource alarm analysis method according to claim 1 or 2, wherein said obtaining associated alarm information with an associated relationship according to the alarm information in the plurality of alarm slices comprises:

Generate an association topology diagram according to the association resource instance relationship tree;

Play each of the alarm slices in the associated topology graph, and update the alarm level and alarm times of each resource node in the associated topology graph according to the alarm information in the alarm slice;

According to the instruction and the associated topology map, the associated alarm information having an associated relationship is obtained.
The resource alarm analysis method according to any one of claims 1 to 3, wherein said obtaining multiple alarm slices of the alarm resource according to the associated resource instance relationship tree includes:

Obtain a query snapshot of the alarm data of each resource in the relationship tree of the associated resource instance within a preset period of time;

According to the unit time, divide the query snapshot into multiple query slices according to the order of alarms;

Filtering out multiple alarm slices containing alarm information from the multiple query slices.
The resource alarm analysis method according to any one of claims 1 to 4, wherein, before acquiring the associated resource instance relationship tree of the alarm resource, further comprising:

Generate a total tree of associated resource instance relationships including each resource, and store the generated total tree of associated resource instance relationships in a graph database;

The associated resource instance relationship tree for obtaining the alarm resource includes:

According to a preset association type, the associated resource instance relationship tree of the alarm resource is read in the associated resource instance relationship tree.
The resource alarm analysis method according to any one of claims 1 to 5, wherein, after obtaining associated alarm information with an associated relationship according to the alarm information in the plurality of alarm slices, further comprising:

Acquiring key alarm features of the associated alarm information; wherein, the key features of the alarm include: resource type and/or alarm code;

An alarm association mark associated with the alarm information is generated according to the key feature of the alarm.
The resource alarm analysis method according to claim 6, wherein, after generating the alarm association mark of the associated alarm information, further comprising:

Detecting whether the accumulative count of the alarm associated flag is zero;

If the cumulative count of the alarm-related flag is zero, create a new cumulative count for the alarm-related flag, and update the newly-created cumulative count to 1;

In the case that the accumulated number of times of the alarm related flag is not zero, the accumulated number of times of the alarm related flag is updated.
A resource alarm analysis device, comprising:

The obtaining module is used to obtain the associated resource instance relationship tree of the alarm resource;

A slicing module, configured to acquire multiple alarm slices of the alarm resource according to the associated resource instance relationship tree; wherein, the alarm slice includes alarm information of at least one resource node in the associated resource instance relationship tree within a unit time ;

An analysis module, configured to acquire associated alarm information with an association relationship according to the alarm information in the plurality of alarm slices.
An electronic device comprising:

at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions are executed by the at least one processor, so that the at least one processor can perform the operation described in any one of claims 1 to 7 The resource alarm analysis method described above.
A computer-readable storage medium storing a computer program, and implementing the resource alarm analysis method according to any one of claims 1 to 7 when the computer program is executed by a processor.