CN106484595A - A kind of event-handling method and device - Google Patents
A kind of event-handling method and device Download PDFInfo
- Publication number
- CN106484595A CN106484595A CN201610881737.8A CN201610881737A CN106484595A CN 106484595 A CN106484595 A CN 106484595A CN 201610881737 A CN201610881737 A CN 201610881737A CN 106484595 A CN106484595 A CN 106484595A
- Authority
- CN
- China
- Prior art keywords
- event
- alarm
- incoming
- predetermined
- pending
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
Abstract
The embodiment of the present invention provides a kind of event-handling method and device, is related to monitoring alarm field.Methods described includes：Receives input event；When the condition for receiving the incoming event meets preset rules, using the incoming event for receiving as pending event set, the pending event set is mated with predetermined alarm regulation, when the pending event set meets the predetermined alarm regulation, is generated alarm event.Methods described achieves the inquiry of real-time and alarm, while the complicated alarm corresponding with multiple events can be obtained.And as the incoming event for meeting preset rules only to being currently received carries out real-time processing, the disposable incoming event limited amount for processing, therefore the alarm amount of synchronization is also limited, and system is convenient to be processed.Further, since the complicated alarm for generating is corresponding with multiple incoming events, comprising information content larger, the alarm of generation has and becomes apparent from clear and definite meaning, and system is more easy to make rapidly corresponding response.
Description
Technical field
The present invention relates to monitoring alarm field, in particular to a kind of event-handling method and device.
Background technology
Traditional monitoring warning system, when the monitoring information to collecting is processed, typically by the number for monitoring
According to storage in database, from database, then read data and execute and inquire about to complete.
This inquiry that is only supported by database is in the way of processing monitoring information, being commonly used to own static state
The inquiry of historical data, is difficult to realize inquiry and the alarm of real-time, and due to disposably inquiring about all of historical data, can make
Obtain the amount of alarm excessive, system is difficult to process.Meanwhile, it is often corresponding with individual event simple that this mode is analyzed
Alarm, the information that these alarms include are less, and system is difficult to make suitable and quick response.Further, this mode is very
Difficulty analyzes the complexity alarm with ad hoc rules corresponding with multiple events, if for the higher alarm of this complexity,
Writing code on the basis of simple alarm result is analyzed carries out after-treatment, can produce huge workload.
Content of the invention
In view of this, the purpose of the embodiment of the present invention is to provide a kind of event-handling method and device, above-mentioned to solve
Problem.
To achieve these goals, the technical scheme that the embodiment of the present invention is adopted is as follows：
In a first aspect, embodiments providing a kind of event-handling method, methods described includes：Receives input thing
Part；When the condition for receiving the incoming event meets preset rules, using the incoming event for receiving as pending
Event set, the pending event set is mated with predetermined alarm regulation, when the pending event set meet described pre-
When determining alarm regulation, alarm event is generated.
Second aspect, embodiments provides a kind of event processing apparatus, and described device includes：Event receives mould
Block, for receives input event；Event processing module, for meeting preset rules whenever the condition for receiving the incoming event
When, using the incoming event for receiving as pending event set, the pending event set and predetermined alarm regulation are entered
Row coupling, when the pending event set meets the predetermined alarm regulation, generates alarm event.
Compared with prior art, a kind of event-handling method provided in an embodiment of the present invention and device, by defeated in reception
During incoming event, once meet preset rules, at once using the incoming event for receiving as pending event set with predetermined
The mode mated by alarm regulation, it is achieved that the inquiry of real-time and alarm, while can also obtain relative with multiple events
Complicated alarm under the ad hoc rules that answers.And as the incoming event for meeting preset rules only to being currently received carries out reality
When process, the disposable incoming event limited amount for processing, therefore the alarm amount of synchronization is also limited, and system is convenient to be processed.
Further, due to generate complicated alarm event corresponding with multiple incoming events, comprising information content larger, the announcement of generation
Implement of police becomes apparent from clear and definite meaning, and system is more easy to make rapidly corresponding response.
Other features and advantages of the present invention will be illustrated in subsequent specification, also, are partly become from specification
It is clear that or being understood by implementing the embodiment of the present invention.The purpose of the present invention and other advantages can pass through in saying for being write
In bright book, claims and accompanying drawing, specifically noted structure is realizing and obtain.
Description of the drawings
In order to be illustrated more clearly that the technical scheme of the embodiment of the present invention, below by to be used attached needed for embodiment
Figure is briefly described, it will be appreciated that the following drawings illustrate only certain embodiments of the present invention, and it is right to be therefore not construed as
The restriction of scope, for those of ordinary skill in the art, on the premise of not paying creative work, can also be according to this
A little accompanying drawings obtain other related accompanying drawings.
Fig. 1 is the structural representation of server provided in an embodiment of the present invention.
Fig. 2 is a kind of flow chart of event-handling method that first embodiment of the invention is provided.
Fig. 3 is a kind of partial process view of event-handling method that first embodiment of the invention is provided.
Fig. 4 is a kind of structured flowchart of event processing apparatus that second embodiment of the invention is provided.
Specific embodiment
Below in conjunction with accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clear, complete
Ground description, it is clear that described embodiment is only a part of embodiment of the present invention, rather than whole embodiments.Generally exist
The component of the embodiment of the present invention described and illustrated in accompanying drawing can be arranged and be designed with a variety of configurations herein.Cause
This, the detailed description of the embodiments of the invention to providing in the accompanying drawings is not intended to limit claimed invention below
Scope, but it is merely representative of the selected embodiment of the present invention.Based on embodiments of the invention, those skilled in the art are not doing
The every other embodiment obtained on the premise of going out creative work, belongs to the scope of protection of the invention.
It should be noted that：Similar label and letter represent similar terms in following accompanying drawing, therefore, once a certain Xiang Yi
It is defined in individual accompanying drawing, then which need not be defined further and explain in subsequent accompanying drawing.Meanwhile, the present invention's
In description, term " first ", " second " etc. are only used for distinguishing description, and it is not intended that indicating or hint relative importance.
Fig. 1 shows the structural representation of server 100, refers to Fig. 1, the server 100 include memory 110,
Processor 120 and mixed-media network modules mixed-media 130.
Memory 110 can be used to storing software program and module, such as the event-handling method in the embodiment of the present invention and
Corresponding programmed instruction/the module of device, processor 120 are stored in software program and module in memory 110 by operation,
So as to various function application and data processing is executed, that is, realize the event-handling method in the embodiment of the present invention.Memory 110
May include high speed random access memory, may also include nonvolatile memory, such as one or more magnetic storage device, flash memory,
Or other non-volatile solid state memories.Further, in above-mentioned memory 110 software program and module can also be wrapped
Include：Operating system 111 and service module 112.Wherein operating system 111, for example, can be LINUX, UNIX, WINDOWS, and which can
Including the various component softwares for management system task (such as memory management, storage device control, power management etc.) and/or
Drive, and can mutually communicate with various hardware or component software, so as to provide the running environment of other software component.Service module
On the basis of 112 operate in operating system 111, and monitored come the request of automatic network, root by the network service of operating system 111
Corresponding data processing is completed according to request, and result is returned to client.That is, service module 112 is used for visitor
Family end provides network service.
Mixed-media network modules mixed-media 130 is used for receiving and sending network signal.Above-mentioned network signal may include wireless signal or have
Line signal.
It is appreciated that structure shown in Fig. 1 is only illustrate, server 100 may also include more more than shown in Fig. 1 or more
Few component, or with the configuration different from shown in Fig. 1.Each component shown in Fig. 1 can adopt hardware, software or its group
Close and realize.In addition, the server in the embodiment of the present invention can also include the server of multiple concrete difference in functionalitys.
The flow chart that Fig. 2 shows a kind of event-handling method that first embodiment of the invention is provided, refers to Fig. 2, this
Embodiment describes the handling process of server, and methods described includes：
Step S210, receives input event.
Wherein, the incoming event is formed by the data abstraction that pays close attention to.The data of the concern can be by different data
Source provides.For example, it may be sensor collection data, video camera photograph view data, computer-generated data also
Or the data that big data platform is provided.It is understood that in different application scenarios, the data of the concern can root
There is provided by different data sources according to demand, therefore above-mentioned example does not constitute the restriction to the specific embodiment of the invention.
Event refers to the once generation of the one-shot change of state of interest or a certain activity.The point of a such as mouse
Hit, the change of a record is also or a deletion action of user.
Wherein, the incoming event can be simple event, or complicated event.
Simple event refers to the event detected in actual environment.The temperature value that such as temperature sensor is collected,
The smokescope value that Smoke Sensor is detected, the information of a stock exchange, or once modification or deletion action.
Simple event has atomicity, is inseparable from event.
Complicated event be by the high-level event of two or more event extractions.Such as event of fire, can
With by be 62 degree to the temperature value that temperature sensor is collected, the smokescope value that detects of Smoke Sensor as 5% and
The radiation intensity that radiation sensor is detected is 25kw/m2, three simple events carry out abstract and extraction and obtain.
Preferably, after step S210, methods described can also include：The incoming event is converted into first
The incoming event of preset format.
Wherein, first preset format is data model set in advance, i.e., the form of event set in advance.Chang Cai
Data model includes first group model, record cast and object model.Wherein, first group model by event having with an attribute
Ordered sets is being described；Record cast by event with a keyword-value to set describing；Event is belonged to by object model
Property is packaged with class.
Incoming event with different-format is converted into unified form, is conducive to server together to locate which
Reason.
Step S220, when the condition for receiving the incoming event meets preset rules, by the input for receiving
The pending event set is mated with predetermined alarm regulation by event as pending event set, when the pending thing
When part collection meets the predetermined alarm regulation, alarm event is generated.
Wherein, the preset rules can be the time interval for receiving the incoming event set in advance, i.e., every
When the time for receiving the incoming event prefixed time interval is reached, using the incoming event in the prefixed time interval as
Pending event set.
For example, it is assumed that the preset rules are for receiving the time interval of the incoming event for 10 minutes, then often connecing
The incoming event of 10 minutes is received, the incoming event that will be received in currently this 10 minutes is used as pending event set.
The preset rules can also be the quantity of the incoming event for receiving, i.e., whenever the input for receiving
When the quantity of event reaches predetermined number, using the incoming event of the predetermined number as pending event set.
For example, it is assumed that the quantity that the preset rules are the incoming event for receiving is 1000, then whenever receiving
The quantity of incoming event when reaching 1000, will this 1000 incoming events as pending event set.
It is understood that the preset rules can be defined according to different demands or change, therefore not structure
The restriction of the specific embodiment of the invention in pairs.
Wherein, the predetermined alarm regulation can be defined and stored in server using event description language, as
A kind of embodiment, can be stored in the Esper module of server.
Event description language can be：Combination operation expression formula, Data Stream Query Language, production rule or other species
Event description language.Individual event is combined by combined expression by using different composite operators, and in this base
The nesting of the enterprising row expression of plinth is describing complicated event.Data Stream Query Language is the expansion to SQL SQL,
The relation being converted into the event in inlet flow in database first, then fastens in these passes and executes inquiry, finally will inquiry
As a result data flow output is converted into.Production rule then specifies the corresponding action that execute when particular state is reached.
Preferably, the predetermined alarm regulation is defined using Data Stream Query Language.
As event description language is the executable language of machine, and its syntax and semantics is high-rise and intuitively, therefore
The predetermined alarm regulation is defined using event description language, is more beneficial for programming personnel or user is defined.
As a kind of specific embodiment, described the pending event set is mated with predetermined alarm regulation,
When the pending event set meets the predetermined alarm regulation, alarm event is generated, including：
Each described incoming event in the pending event set is mated with predetermined limit condition successively, when
Work(is made into, then the incoming event meets the predetermined limit condition, when the input thing for meeting the predetermined limit condition
When the number of part exceedes predetermined threshold, then the pending event set meets the predetermined alarm regulation, generates alarm event, institute
State alarm event and be associated with the incoming event for meeting the predetermined limit condition.
The predetermined limit condition is the condition for screening the incoming event set in advance.For example, described predetermined
Restrictive condition can for the temperature difference reach 20 degree, responsiveness more than 97% or less than 5%, stock trading volume reach 100000.Permissible
It is understood by, in different application scenarios, the predetermined limit condition can be defined according to the actual requirements, therefore above-mentioned
Example does not constitute the restriction to the specific embodiment of the invention, and further, these restrictive conditions can be used alone, and also may be used
With while being applied in combination.
It is understood that after the pending event set is mated with predetermined alarm regulation and finished, the pending thing
Part collection is changed into processed event set, and each the described incoming event in the processed event set can be deposited according to real needs
Store up, delete or as the incoming event in pending event set another described.
Step S220 is illustrated with a specific embodiment below.
If preset rules are for receiving the time interval of the incoming event for 10 minutes.Predetermined limit condition is continuous
1 minute average response time is more than 100ms or responsiveness is less than 97% or number of responses is less than 100000, and predetermined threshold is 10.
Reach 10 minutes whenever the time for receiving the incoming event, the incoming event that will be received in this 10 minutes
As pending event set；Each incoming event in the pending event set is carried out with predetermined limit condition successively
Join, continuous 1 minute average response time is filtered out more than 100ms or responsiveness is less than 97% or number of responses is less than 100000
Incoming event, when the number of the incoming event for filtering out exceedes predetermined threshold 10, then generates corresponding alarm event.
As a kind of specific embodiment, when the predetermined alarm regulation is multiple, described by the pending thing
Part collection is mated with predetermined alarm regulation, when the pending event set meets the predetermined alarm regulation, generates alarm
Event, including：
The pending event set is mated with predetermined alarm regulation each described respectively, when the pending event
When collection meets any one of predetermined alarm regulation, alarm thing corresponding with the described predetermined alarm regulation for being met is generated
Part.
Wherein, the alarm event can carry event type identification number, to distinguish corresponding to different predetermined alarm regulations
Alarm event, convenient service device is respectively processed for the alarm event of different event type.
Preferably, after step S220, methods described can also include：The alarm event is converted into second
The alarm event of preset format.
Wherein, second preset format is data model set in advance, i.e., the form of event set in advance.Will tool
The alarm event for having consolidation form is converted to predetermined other event format, is conducive to adapting to alarm event receiving terminal
Different demands.
Preferably, Fig. 3 is referred to, and methods described can also include：
Step S230, receives the fresh information for updating the predetermined alarm regulation.
Step S240, according to the fresh information, corresponding predetermined alarm regulation is updated.
Wherein, the fresh information could be for replacing the brand-new alarm regulation of former predetermined alarm regulation, it is also possible to
Be for carrying out the information of part modification to former predetermined alarm regulation.The fresh information can carry regular identification number.
If the fresh information is for replacing the brand-new alarm regulation of former predetermined alarm regulation, during renewal, will be with institute
State the corresponding former predetermined alarm regulation of regular identification number and replace with the brand-new alarm regulation.
If the fresh information is for carrying out the information of part modification to former predetermined alarm regulation, during renewal, will be with institute
The corresponding contents that states in the corresponding former predetermined alarm regulation of regular identification number replace with the fresh information.
Event-handling method provided in an embodiment of the present invention, by during receives input event, once meet pre-
If regular, the mode at once incoming event for receiving mated as pending event set with predetermined alarm regulation, real
Inquiry and the alarm of real-time are showed, while the complicated alarm under the ad hoc rules corresponding with multiple events can also be obtained.
And as the incoming event for meeting preset rules only to being currently received carries out real-time processing, the disposable input thing for processing
Part limited amount, therefore the alarm amount of synchronization is also limited, and system is convenient to be processed.Further, the complicated announcement due to generating
Alert event is corresponding with multiple incoming events, comprising information content larger, the alarm of generation has and becomes apparent from clear and definite meaning,
System is more easy to make rapidly corresponding response.Additionally, being changed by the form of the alarm event to incoming event and generation so as to
Go for the monitoring warning system of different application scene.Further, due to predetermined alarm regulation can with self-defining and
Update, more flexible changeable monitoring alarm demand can be met.
Fig. 4 is a kind of structured flowchart of event processing apparatus 300 that second embodiment of the invention is provided, and refers to Fig. 4, institute
Stating event processing apparatus 300 includes event receiver module 310 and event processing module 320.
The event receiver module 310, for receives input event.
The event processing module 320, during for meeting preset rules whenever the condition for receiving the incoming event, will connect
The pending event set is mated with predetermined alarm regulation by the incoming event for receiving as pending event set,
When the pending event set meets the predetermined alarm regulation, alarm event is generated.
Wherein, the preset rules can be the time interval for receiving the incoming event set in advance.Now,
The event processing module 320, during specifically for reaching prefixed time interval whenever the time for receiving the incoming event, by institute
The incoming event in prefixed time interval is stated as pending event set, the pending event set and predetermined alarm regulation are entered
Row coupling, when the pending event set meets the predetermined alarm regulation, generates alarm event.
The preset rules can also be the quantity of the incoming event for receiving.Now, the event handling
Module 320, specifically for when the quantity of the incoming event for receiving reaches predetermined number, by the predetermined number
The pending event set is mated with predetermined alarm regulation by incoming event as pending event set, waits to locate when described
When reason event set meets the predetermined alarm regulation, alarm event is generated.
It is understood that the preset rules can be defined according to different demands or change, therefore not structure
The restriction of the specific embodiment of the invention in pairs.
Used as a kind of specific embodiment, the event processing module 320, specifically for whenever the reception input thing
When the condition of part meets preset rules, using the incoming event for receiving as pending event set, by the pending thing
Each described incoming event that part is concentrated is mated with predetermined limit condition successively, when the match is successful, then the incoming event
Meet the predetermined limit condition, when the number of the incoming event for meeting the predetermined limit condition exceedes predetermined threshold
When, then the pending event set meets the predetermined alarm regulation, generates alarm event, and the alarm event is described with satisfaction
The incoming event of predetermined limit condition is associated.
It is understood that after the pending event set is mated with predetermined alarm regulation and finished, the pending thing
Part collection is changed into processed event set, and each the described incoming event in the processed event set can be deposited according to real needs
Store up, delete or as the incoming event in pending event set another described.
When the predetermined alarm regulation is multiple, as a kind of specific embodiment, the event processing module
320, during specifically for meeting preset rules whenever the condition for receiving the incoming event, the incoming event for receiving is made
For pending event set, the pending event set is mated with predetermined alarm regulation each described respectively, is treated when described
When process event set meets any one of predetermined alarm regulation, generate corresponding with the described predetermined alarm regulation for being met
Alarm event.
Wherein, the alarm event can carry event type identification number, to distinguish corresponding to different predetermined alarm regulations
Alarm event, convenient service device is respectively processed for the alarm event of different event type.
Preferably, described device can also include input adaptation module 330, and the input adaptation module 330, for connecing
After receiving incoming event, the incoming event is converted into the incoming event with the first preset format.Will be with different-format
Incoming event be converted into unified form, be conducive to server together to process which.
Preferably, described device can also include output adaptation module 340, and the output adaptation module 340, for giving birth to
After becoming alarm event, the alarm event is converted into the alarm event with the second preset format.Will be with consolidation form
The alarm event be converted to predetermined other event format, be conducive to adapt to alarm event receiving terminal different demands.
Preferably, described device can also include information receiving module 350 and Policy Updates module 360.
Described information receiver module 350, for receiving the fresh information for updating the predetermined alarm regulation.
The Policy Updates module 360, for according to the fresh information, corresponding predetermined alarm regulation being carried out more
Newly.
Each module can be that now, above-mentioned each module can be stored in depositing for server 100 by software code realization above
In reservoir 110.Each module equally can be realized by hardware such as IC chip above.
The event processing apparatus 300 provided by the embodiment of the present invention, its realize the technique effect of principle and generation and aforementioned
Embodiment of the method is identical, is brief description, and device embodiment part does not refer to part, refers to corresponding in preceding method embodiment
Content.
In several embodiments provided herein, it should be understood that disclosed apparatus and method, it is also possible to pass through
Other modes are realized.Device embodiment described above is only schematically, for example flow chart in accompanying drawing and block diagram
Show the device of multiple embodiments according to the present invention, the architectural framework in the cards of method and computer program product,
Function and operation.At this point, each square frame in flow chart or block diagram can represent the one of module, program segment or a code
Part, a part for the module, program segment or code is comprising one or more for realizing holding for the logic function of regulation
Row instruction.It should also be noted that at some as in the implementation that replaces, the function of being marked in square frame can also be to be different from
The order marked in accompanying drawing occurs.For example, two continuous square frames can essentially be executed substantially in parallel, and they are sometimes
Can execute in the opposite order, this is depending on involved function.It is also noted that every in block diagram and/or flow chart
Individual square frame and the combination of block diagram and/or the square frame in flow chart, can be with the special base for executing the function or action for specifying
Realize in the system of hardware, or can combining realizing with specialized hardware and computer instruction.
In addition, each functional module in each embodiment of the present invention can integrate to form an independent portion
Divide, or modules individualism, it is also possible to which two or more modules are integrated to form an independent part.
If the function realized using in the form of software function module and as independent production marketing or use when, permissible
It is stored in a computer read/write memory medium.Based on such understanding, technical scheme is substantially in other words
The part contributed by prior art or the part of the technical scheme can be embodied in the form of software product, the meter
Calculation machine software product is stored in a storage medium, is used including some instructions so that a computer equipment (can be individual
People's computer, server, or network equipment etc.) execute each embodiment methods described of the present invention all or part of step.
And aforesaid storage medium includes：USB flash disk, portable hard drive, read-only storage (ROM, Read-Only Memory), arbitrary access are deposited
Reservoir (RAM, Random Access Memory), magnetic disc or CD etc. are various can be with the medium of store program codes.Need
Illustrate, herein, such as first and second or the like relational terms be used merely to by an entity or operation with
Another entity or operation make a distinction, and not necessarily require or imply between these entities or operation there is any this reality
The relation on border or order.And, term " including ", "comprising" or its any other variant are intended to the bag of nonexcludability
Contain, so that a series of process including key elements, method, article or equipment not only include those key elements, but also including
Other key elements being not expressly set out, or also include the key element intrinsic for this process, method, article or equipment.
In the absence of more restrictions, the key element for being limited by sentence "including a ...", it is not excluded that including the key element
Process, method, also there is other identical element in article or equipment.
The preferred embodiments of the present invention are the foregoing is only, the present invention is not limited to, for the skill of this area
For art personnel, the present invention can have various modifications and variations.All within the spirit and principles in the present invention, made any repair
Change, equivalent, improvement etc., should be included within the scope of the present invention.Therefore, protection scope of the present invention should be described
It is defined by scope of the claims.It should be noted that：Similar label and letter represent similar terms in following accompanying drawing, because
This, once being defined in a certain Xiang Yi accompanying drawing, then need not be defined reconciliation to which in subsequent accompanying drawing further
Release.
Claims (10)
1. a kind of event-handling method, it is characterised in that methods described includes：
Receives input event；
When the condition for receiving the incoming event meets preset rules, using the incoming event for receiving as pending
Event set, the pending event set is mated with predetermined alarm regulation, when the pending event set meet described pre-
When determining alarm regulation, alarm event is generated.
2. method according to claim 1, it is characterised in that described by the pending event set and predetermined alarm regulation
Mated, when the pending event set meets the predetermined alarm regulation, alarm event is generated, is specifically included：
Each described incoming event in the pending event set is mated with predetermined limit condition successively, when mating into
Work(, then the incoming event meet the predetermined limit condition, when the incoming event for meeting the predetermined limit condition
When number exceedes predetermined threshold, then the pending event set meets the predetermined alarm regulation, generates alarm event, the announcement
Alert event is corresponding with the incoming event for meeting the predetermined limit condition.
3. method according to claim 1, it is characterised in that methods described also includes：
Receive the fresh information for updating the predetermined alarm regulation；
According to the fresh information, corresponding predetermined alarm regulation is updated.
4. method according to claim 1, it is characterised in that the predetermined alarm regulation is multiple, described treats described
Process event set to be mated with predetermined alarm regulation, when the pending event set meets the predetermined alarm regulation, raw
Become alarm event, specifically include：
The pending event set is mated with predetermined alarm regulation each described respectively, when the pending event set is full
During any one of predetermined alarm regulation of foot, alarm event corresponding with the described predetermined alarm regulation for being met is generated.
5. method according to claim 1, it is characterised in that after the receives input event, methods described is also wrapped
Include：
The incoming event is converted into the incoming event with the first preset format.
6. method according to claim 1, it is characterised in that after the generation alarm event, methods described is also wrapped
Include：
The alarm event is converted into the alarm event with the second preset format.
7. according to the method described in claim 1, it is characterised in that preset whenever the condition for receiving the incoming event meets
When regular, using the incoming event for receiving as pending event set, specifically include：
Whenever the time for receiving the incoming event prefixed time interval is reached, will be described defeated in the prefixed time interval
Incoming event is used as pending event set.
8. according to the method described in claim 1, it is characterised in that preset whenever the condition for receiving the incoming event meets
When regular, using the incoming event for receiving as pending event set, specifically include：
When the quantity of the incoming event for receiving reaches predetermined number, by the incoming event of the predetermined number
As pending event set.
9. a kind of event processing apparatus, it is characterised in that described device includes：
Event receiver module, for receives input event；
Event processing module, during for meeting preset rules whenever the condition for receiving the incoming event, described in receiving
The pending event set is mated with predetermined alarm regulation by incoming event as pending event set, waits to locate when described
When reason event set meets the predetermined alarm regulation, alarm event is generated.
10. device according to claim 9, it is characterised in that the event processing module, specifically for whenever receiving institute
When stating the condition of incoming event and meeting preset rules, using the incoming event for receiving as pending event set, will be described
Each described incoming event in pending event set is mated with predetermined limit condition successively, when the match is successful, then described
Incoming event meets the predetermined limit condition, when the number of the incoming event for meeting the predetermined limit condition exceedes in advance
When determining threshold value, then the pending event set meets the predetermined alarm regulation, generates alarm event, the alarm event with full
The incoming event of the foot predetermined limit condition is corresponding.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610881737.8A CN106484595A (en) | 2016-10-09 | 2016-10-09 | A kind of event-handling method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610881737.8A CN106484595A (en) | 2016-10-09 | 2016-10-09 | A kind of event-handling method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106484595A true CN106484595A (en) | 2017-03-08 |
Family
ID=58269196
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610881737.8A Pending CN106484595A (en) | 2016-10-09 | 2016-10-09 | A kind of event-handling method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106484595A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107168847A (en) * | 2017-04-21 | 2017-09-15 | 国家电网公司 | The full link application monitoring method and device of a kind of support distribution formula framework |
| CN107391284A (en) * | 2017-08-18 | 2017-11-24 | 郑州云海信息技术有限公司 | A kind of event-handling method and device |
| CN108171265A (en) * | 2017-12-26 | 2018-06-15 | 北京奇艺世纪科技有限公司 | A kind of label preparation method, device and electronic equipment |
| CN110865921A (en) * | 2019-11-08 | 2020-03-06 | 拉扎斯网络科技（上海）有限公司 | Data monitoring method and device, readable storage medium and electronic equipment |
| CN110909061A (en) * | 2019-11-27 | 2020-03-24 | 恩亿科(北京)数据科技有限公司 | Data source processing method and device, electronic equipment and storage medium |
| CN111339293A (en) * | 2020-02-11 | 2020-06-26 | 支付宝(杭州)信息技术有限公司 | Data processing method and device of alarm event and classification method of alarm event |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1332867A (en) * | 1998-12-31 | 2002-01-23 | 联合想象计算机公司 | System and method for dynamic correlation of events |
| CN1529455A (en) * | 2003-09-29 | 2004-09-15 | 港湾网络有限公司 | Network failure real-time relativity analysing method and system |
| CN101540698A (en) * | 2009-05-04 | 2009-09-23 | 杭州华三通信技术有限公司 | Event processing system and method |
| CN103189866A (en) * | 2010-09-17 | 2013-07-03 | 甲骨文国际公司 | Support for a parameterized query/view in complex event processing |
| CN103282880A (en) * | 2011-12-26 | 2013-09-04 | 华为技术有限公司 | Stream processing method and apparatus |
| CN104199889A (en) * | 2014-08-25 | 2014-12-10 | 山东瀚天信息技术有限公司 | RTLogic big data processing system and method based on CEP technology |
| CN105049270A (en) * | 2015-08-31 | 2015-11-11 | 北京奇艺世纪科技有限公司 | Information processing method, device and system |
| US20160104361A1 (en) * | 2013-03-15 | 2016-04-14 | Telmate, Llc | Time-based multivariable secure facility alarm system |
| CN105843803A (en) * | 2015-01-12 | 2016-08-10 | 上海悦程信息技术有限公司 | Big data security visualization interaction analysis system and method |
-
2016
- 2016-10-09 CN CN201610881737.8A patent/CN106484595A/en active Pending
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1332867A (en) * | 1998-12-31 | 2002-01-23 | 联合想象计算机公司 | System and method for dynamic correlation of events |
| CN1529455A (en) * | 2003-09-29 | 2004-09-15 | 港湾网络有限公司 | Network failure real-time relativity analysing method and system |
| CN101540698A (en) * | 2009-05-04 | 2009-09-23 | 杭州华三通信技术有限公司 | Event processing system and method |
| CN103189866A (en) * | 2010-09-17 | 2013-07-03 | 甲骨文国际公司 | Support for a parameterized query/view in complex event processing |
| CN103282880A (en) * | 2011-12-26 | 2013-09-04 | 华为技术有限公司 | Stream processing method and apparatus |
| US20160104361A1 (en) * | 2013-03-15 | 2016-04-14 | Telmate, Llc | Time-based multivariable secure facility alarm system |
| CN104199889A (en) * | 2014-08-25 | 2014-12-10 | 山东瀚天信息技术有限公司 | RTLogic big data processing system and method based on CEP technology |
| CN105843803A (en) * | 2015-01-12 | 2016-08-10 | 上海悦程信息技术有限公司 | Big data security visualization interaction analysis system and method |
| CN105049270A (en) * | 2015-08-31 | 2015-11-11 | 北京奇艺世纪科技有限公司 | Information processing method, device and system |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107168847A (en) * | 2017-04-21 | 2017-09-15 | 国家电网公司 | The full link application monitoring method and device of a kind of support distribution formula framework |
| CN107391284A (en) * | 2017-08-18 | 2017-11-24 | 郑州云海信息技术有限公司 | A kind of event-handling method and device |
| CN108171265A (en) * | 2017-12-26 | 2018-06-15 | 北京奇艺世纪科技有限公司 | A kind of label preparation method, device and electronic equipment |
| CN110865921A (en) * | 2019-11-08 | 2020-03-06 | 拉扎斯网络科技（上海）有限公司 | Data monitoring method and device, readable storage medium and electronic equipment |
| CN110909061A (en) * | 2019-11-27 | 2020-03-24 | 恩亿科(北京)数据科技有限公司 | Data source processing method and device, electronic equipment and storage medium |
| CN111339293A (en) * | 2020-02-11 | 2020-06-26 | 支付宝(杭州)信息技术有限公司 | Data processing method and device of alarm event and classification method of alarm event |
| CN111339293B (en) * | 2020-02-11 | 2023-08-22 | 支付宝(杭州)信息技术有限公司 | Data processing method and device for alarm event and classifying method for alarm event |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106484595A (en) | A kind of event-handling method and device | |
| CN105447184B (en) | Information extraction method and device | |
| CN103942210A (en) | Processing method, device and system of mass log information | |
| CN112749194A (en) | Visualized data processing method and device, electronic equipment and readable storage medium | |
| CN108681667A (en) | A kind of unit type recognition methods, device and processing equipment | |
| CN104021195B (en) | Warning association analysis method based on knowledge base | |
| CN103997532A (en) | Agriculture internet-of-things edge middleware system | |
| CN106682213A (en) | Internet-of-things task customizing method and system based on Hadoop platform | |
| CN110909986A (en) | Suspected actual controller risk identification method and system based on knowledge graph | |
| CN112580914A (en) | Method and device for realizing enterprise-level data middling platform system for collecting multi-source data | |
| CN108764350A (en) | Target identification method, device and electronic equipment | |
| CN106169959A (en) | A kind of log processing device | |
| CN110347888A (en) | Processing method, device and the storage medium of order data | |
| US20120095986A1 (en) | Runtime optimization of spatiotemporal events processing background | |
| CN109586950A (en) | Network scenarios recognition methods, network management device, system and storage medium | |
| CN107895487B (en) | A method of similar license plate string is carried out simultaneously based on big data | |
| CN106779438A (en) | A kind of intelligent building management platform data method for organizing for being adapted to many producers | |
| CN102902614A (en) | Dynamic monitoring and intelligent guide method | |
| CN108614761A (en) | Wisdom application system server performance demand computational methods based on business model | |
| CN115391151B (en) | Method for intelligently discovering alarm tag based on object relationship | |
| CN106250406A (en) | A kind of log processing method | |
| WO2016206395A1 (en) | Weekly report information processing method and device | |
| CN109558403A (en) | Data aggregation method and device, computer installation and computer readable storage medium | |
| CN106227797A (en) | A kind of processing method of massive logs information | |
| CN110427387A (en) | A kind of data consistency detection and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170308 |
|
| RJ01 | Rejection of invention patent application after publication |