CN111400435A - Mail alarm convergence method, device, computer equipment and storage medium - Google Patents

Mail alarm convergence method, device, computer equipment and storage medium Download PDF

Info

Publication number
CN111400435A
CN111400435A CN202010101151.1A CN202010101151A CN111400435A CN 111400435 A CN111400435 A CN 111400435A CN 202010101151 A CN202010101151 A CN 202010101151A CN 111400435 A CN111400435 A CN 111400435A
Authority
CN
China
Prior art keywords
alarm
mail
target
historical
preset
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202010101151.1A
Other languages
Chinese (zh)
Other versions
CN111400435B (en
Inventor
胡博
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Life Insurance Company of China Ltd
Original Assignee
Ping An Life Insurance Company of China Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Life Insurance Company of China Ltd filed Critical Ping An Life Insurance Company of China Ltd
Priority to CN202010101151.1A priority Critical patent/CN111400435B/en
Publication of CN111400435A publication Critical patent/CN111400435A/en
Application granted granted Critical
Publication of CN111400435B publication Critical patent/CN111400435B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/33Querying
    • G06F16/3331Query processing
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/903Querying
    • G06F16/90335Query processing
    • G06F16/90344Query processing by using string matching techniques
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00Administration; Management
    • G06Q10/10Office automation; Time management
    • G06Q10/107Computer-aided management of electronic mailing [e-mailing]

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Human Resources & Organizations (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computational Linguistics (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Strategic Management (AREA)
  • Computer Hardware Design (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Tourism & Hospitality (AREA)
  • General Business, Economics & Management (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

The invention relates to the technical field of computers, and provides a mail alarm convergence method, a device, computer equipment and a storage medium, wherein the mail alarm convergence method comprises the following steps: acquiring all mails; judging the mail type of the mail according to the user id and the address id, and extracting a monitoring mail; carrying out alarm field identification on the mail text, and determining the monitoring mail with the identified alarm field as an alarm mail; acquiring i types of historical alarm items between alarm sending time and preset time from a preset log library; calculating the correlation between the target alarm item and each historical alarm item according to the target alarm item and the i types of historical alarm items to obtain i correlation; comparing the i correlation degrees with a preset threshold value; if the correlation degree is smaller than the preset threshold value, analyzing the target alarm item, and performing alarm shielding processing on the alarm mail according to the analysis processing result. The technical scheme of the invention realizes the automatic convergence of the alarm mails and improves the working efficiency of the system.

Description

Mail alarm convergence method, device, computer equipment and storage medium
Technical Field
The present invention relates to the field of computer technologies, and in particular, to a method and an apparatus for email alert convergence, a computer device, and a storage medium.
Background
With the development of data, an enterprise system generally has a plurality of monitoring systems during operation, and in order to prevent the situation that no one can process the alarm in time, the monitoring systems are generally set to continuously alarm, that is, when a certain problem is not solved all the time, the monitoring systems will continuously send out mails every N minutes, so that operation and maintenance personnel can timely process the alarms, and the alarms are not only given once. Over time, the alarm mails are overflowed, some alarms cannot be processed temporarily, but are always prompted, so that system resources are occupied, and the working efficiency of the system is further influenced.
Disclosure of Invention
The embodiment of the invention provides a mail alarm convergence method, a mail alarm convergence device, computer equipment and a storage medium, and aims to solve the problems that a mail alarm cannot be processed in time, system resources are occupied, and the working efficiency of a system is influenced.
A mail alarm convergence method comprises the following steps:
acquiring all mails from a mail database at preset time intervals, wherein the mails comprise user ids and address ids;
judging the mail type of the mail according to the user id and the address id, and extracting a monitoring mail, wherein the monitoring mail comprises a mail body;
performing alarm field identification on the mail body, and determining the monitoring mail with the identified alarm field as the alarm mail, wherein the alarm mail comprises a target alarm item and alarm sending time;
acquiring i types of historical alarm items between the alarm sending time and the preset time from a preset log library, wherein i is a positive integer greater than 0;
according to the target alarm item and the i types of historical alarm items, calculating the correlation degree between the target alarm item and each type of historical alarm item to obtain i types of correlation degrees;
comparing the i correlation degrees with a preset threshold value;
and if the correlation degree is smaller than a preset threshold value, analyzing the target alarm item, and performing alarm shielding processing on the alarm mail according to an analysis processing result.
A mail alert convergence apparatus comprising:
the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring all mails from a mail database at preset time intervals, and the mails comprise user ids and address ids;
the judging module is used for judging the mail type of the mail according to the user id and the address id and extracting a monitoring mail, wherein the monitoring mail comprises a mail body;
the identification module is used for identifying an alarm field of the mail body and determining the monitoring mail with the identified alarm field as the alarm mail, wherein the alarm mail comprises a target alarm item and alarm sending time;
the second acquisition module is used for acquiring i types of historical alarm items between the alarm sending time and the preset time from a preset log library, wherein i is a positive integer greater than 0;
the calculation module is used for calculating the correlation between the target alarm item and each historical alarm item according to the target alarm item and the i types of historical alarm items to obtain i types of correlation;
the comparison module is used for comparing the i correlation degrees with a preset threshold value;
and the shielding module is used for analyzing the target alarm item if the correlation degree is smaller than a preset threshold value, and performing alarm shielding processing on the alarm mail according to an analysis processing result.
A computer device comprising a memory, a processor and a computer program stored in said memory and executable on said processor, said processor implementing the steps of the above mail alert convergence method when executing said computer program.
A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the steps of the above-mentioned mail alert convergence method.
According to the mail alarm convergence method, the device, the computer equipment and the storage medium, the monitoring mail is extracted from the acquired mail according to the user id and the address id, the alarm mail is determined from the monitoring mail in a mail text alarm identification mode, the correlation degree between the target alarm item and each historical alarm item is calculated according to the acquired target alarm item and the historical alarm items, if the correlation degree is smaller than a preset threshold value, the target mail is analyzed, and the alarm shielding processing is carried out on the alarm mail according to the analysis processing result. Whether the target alarm item needs to be analyzed or not can be rapidly and accurately calculated by calculating the correlation degree, and shielding processing is carried out by combining analysis processing, so that the condition of occupying system resources can be effectively reduced, automatic convergence of mail alarm is realized, timely processing of mail alarm is ensured, the system load is reduced, and the working efficiency of the system is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments of the present invention will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to these drawings without inventive labor.
FIG. 1 is a flow chart of a mail alert convergence method provided by an embodiment of the present invention;
fig. 2 is a flowchart of step S3 in the mail alert convergence method according to the embodiment of the present invention;
fig. 3 is a flowchart of step S5 in the mail alert convergence method according to the embodiment of the present invention;
FIG. 4 is a flowchart of step S53 in the mail alert convergence method according to the embodiment of the present invention;
FIG. 5 is a flowchart of step S7 in the mail alert convergence method according to the embodiment of the present invention;
FIG. 6 is a flowchart of step S72 in the mail alert convergence method according to the embodiment of the present invention;
FIG. 7 is a flowchart illustrating step S73 in the mail alert convergence method according to an embodiment of the present invention;
FIG. 8 is a diagram illustrating an apparatus for mail alert convergence according to an embodiment of the present invention;
fig. 9 is a block diagram of a basic mechanism of a computer device according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The mail alarm convergence method is applied to the server side, and the server side can be realized by an independent server or a server cluster formed by a plurality of servers. In an embodiment, as shown in fig. 1, a mail alert convergence method is provided, which includes the following steps:
s1: and acquiring all mails from a mail database at preset time intervals, wherein the mails comprise user ids and address ids.
In the embodiment of the invention, the mails in the mail database are detected at preset time intervals, when the mails in the mail database are detected, the mails are acquired, and the acquired mails are deleted from the mail database.
The preset time interval may specifically refer to 1 minute, or may be set according to an actual requirement of a user, which is not limited herein.
The mail database refers to a database which is specially used for storing mails.
S2: and judging the mail type of the mail according to the user id and the address id, and extracting the monitoring mail, wherein the monitoring mail comprises a mail body.
In the embodiment of the invention, aiming at each mail, matching the user id with the monitoring target user id, matching the address id with the monitoring target address id, if the user id is the same as the monitoring target user id and the address id is the same as the monitoring target address id, indicating that the mail type of the mail containing the user id and the address id is the monitoring type, determining the mail as the monitoring mail, and extracting the monitoring mail.
The monitoring target user id and the monitoring target address id refer to the target user identity and the target address information corresponding to the sent monitoring mail.
S3: and performing alarm field identification on the mail body, and determining the monitoring mail with the identified alarm field as an alarm mail, wherein the alarm mail comprises a target alarm item and alarm sending time.
In the embodiment of the invention, the mail body is detected, if the mail body is detected to have the alarm field, the mail body is indicated to belong to the alarm type, and the monitoring mail corresponding to the alarm field is determined as the alarm mail.
S4: acquiring i types of historical alarm items between alarm sending time and preset time from a preset log library, wherein i is a positive integer greater than 0.
In the embodiment of the invention, the preset time is taken as the starting time point, the alarm sending time is taken as the ending time point, and i types of historical alarm items with time between the starting time point and the ending time point are inquired from the preset log library. The preset log library is a database which is specially used for storing historical alarm items and time corresponding to the historical alarm items.
The preset time refers to a time set according to an actual requirement of a user, and may be a specific time, such as 12 points.
S5: and calculating the correlation between the target alarm item and each type of historical alarm item according to the target alarm item and the i types of historical alarm items to obtain i correlation.
In the embodiment of the invention, according to the target alarm item and the i types of historical alarm items, the correlation between the target alarm item and each type of historical alarm item is calculated by a variance calculation method, and i correlation degrees are obtained. The relevance is used for representing the similarity between the target alarm item and the historical alarm item, and the smaller the relevance is, the higher the similarity between the target alarm item and the historical alarm item is proved to be.
S6: comparing the i correlation degrees with a preset threshold value.
Specifically, the i correlation degrees calculated in step S5 are compared with a preset threshold value. The preset threshold is a value set by a user for determining the similarity between the target alarm item and the historical alarm item, and may specifically be 1, or may be set according to the actual requirement of the user, which is not limited herein.
S7: if the correlation degree is smaller than the preset threshold value, analyzing the target alarm item, and performing alarm shielding processing on the alarm mail according to the analysis processing result.
Specifically, according to step S6, the correlation degree is compared with a preset threshold, and if the correlation degree is smaller than the preset threshold as a result of the comparison, the target alarm item is imported into a preset analysis library for analysis, and the alarm shielding process is performed on the alarm mail according to the result of the analysis process.
The preset analysis library is a database specially used for analyzing the target alarm item.
In the embodiment, a monitoring mail is extracted from an acquired mail according to a user id and an address id, an alarm mail is determined from the monitoring mail in a mail text alarm identification mode, the correlation between a target alarm item and each type of history alarm item is calculated according to the acquired target alarm item and history alarm items, if the correlation is smaller than a preset threshold, the target mail is analyzed, and alarm shielding processing is performed on the alarm mail according to the analysis processing result. Whether the target alarm item needs to be analyzed or not can be rapidly and accurately calculated by calculating the correlation degree, and shielding processing is carried out by combining analysis processing, so that the condition of occupying system resources can be effectively reduced, automatic convergence of mail alarm is realized, timely processing of mail alarm is ensured, the system load is reduced, and the working efficiency of the system is improved.
In one embodiment, as shown in fig. 2, the step S3 of performing alarm field identification on the mail body, and determining the monitoring mail with the identified alarm field as the alarm mail includes the following steps:
s31: and matching the mail text by using a preset regular expression.
In the embodiment of the invention, the regular expression is used for processing the character string, and the rules of the character in the character string can be described by using some specific characters, so that the character string which accords with a certain rule is matched, extracted or replaced, and the regular expression can also be used for searching, deleting and replacing the character string, and the searching speed is high and accurate.
Specifically, matching the mail body by using a preset regular expression for matching the alarm field. The preset regular expression refers to a regular expression which is set according to the actual requirement of a user and used for matching the alarm field.
S32: and if the matching is successful, determining the monitoring mail corresponding to the mail text as the alarm mail.
Specifically, according to the way that the regular expression is preset in step S31 to match the mail body, if an alarm field matching the preset regular expression exists in the mail body, it indicates that the matching is successful, and determines the monitoring mail corresponding to the mail body as an alarm mail.
S33: and if the matching fails, matching the mail text by using the preset configuration rule, and determining the monitoring mail corresponding to the mail text conforming to the preset configuration rule as the alarm mail.
Specifically, according to the way that the regular expression is preset in step S31 to match the mail body, if there is no alarm field matching the regular expression, it indicates that the matching is failed, and matches the mail body by using the preset configuration rule, and when the mail body satisfies the preset configuration rule, determines the monitoring mail corresponding to the mail body as an alarm mail.
The preset configuration rule refers to setting an information table for identifying the warning mail according to the actual requirement of a user, and the preset configuration rule can specifically be a warning title, a recovery mail title, a warning text format and the like.
In this embodiment, the monitoring mail corresponding to the mail body is determined as the warning mail by using the regular expression for matching in the case of successful matching, and the warning mail is determined by using the preset configuration rule for matching with the mail body in the case of failed matching. By means of the regular matching, the warning mails can be quickly and accurately identified, the warning mails are determined by the aid of the preset configuration rules under the condition that the warning mails cannot be identified by the regular matching, failure in identification of the warning mails due to inaccurate regular matching can be avoided, and accuracy of identification of the warning mails is further improved.
In one embodiment, as shown in fig. 3, the step S5 of calculating the correlation between the target alarm item and each type of history alarm item according to the target alarm item and the i types of history alarm items to obtain i correlations includes the following steps:
s51: acquiring n target alarm time of a target alarm item from a preset alarm library, wherein n is a positive integer greater than 0.
In the embodiment of the invention, n target alarm time of the target alarm item is directly obtained from the preset alarm library. The preset alarm library is a database which is specially used for storing the target alarm items and the target alarm time corresponding to the target alarm items.
S52: and for each historical alarm item, acquiring m historical alarm times corresponding to each historical alarm item from a preset historical library, wherein m is a positive integer greater than 0.
Specifically, for each historical alarm item, m historical alarm times corresponding to each historical alarm item are directly obtained from a preset historical library. The preset history library is a database specially used for storing different historical alarm items and historical alarm time corresponding to each historical alarm item.
S53: and screening according to the n target alarm time and the m historical alarm time, and extracting x target alarm time and x historical alarm time, wherein the x target alarm time comprises the latest target alarm time, the x historical alarm time comprises the latest historical alarm time, x is a positive integer greater than 0, and x is less than or equal to n or m.
Specifically, according to a preset screening rule, screening processing is performed on n target alarm times and m historical alarm times corresponding to each historical alarm item, and after the screening processing, x target alarm times and x historical alarm times are extracted. The preset screening rule refers to a screening rule for filtering out x target alarm times and x historical alarm times according to actual needs of users.
S54: according to x target alarm time and x historical alarm time, calculating the correlation between the target alarm item and the historical alarm item according to a formula (1):
Figure BDA0002386912550000091
wherein S is the degree of correlation, AkFor the warning time corresponding to the k-th target warning item, BkThe alarm time corresponding to the kth historical alarm item, X is the same number of times, AiThe latest alarm time of the target alarm item, BiThe latest alarm time of the historical alarm item.
Specifically, according to the x target alarm times and the x historical alarm times obtained in step S53, the correlation between the target alarm item and the historical alarm item is calculated by using formula (1) for the target alarm item and each of the historical alarm items.
In this embodiment, the obtained n target alarm times and m historical alarm times are subjected to screening processing, x target alarm times and x historical alarm times are extracted, and the correlation between the target alarm item and the historical alarm item is calculated according to the formula (1). The accuracy of the calculated data can be ensured by a screening processing mode, so that the relevancy can be quickly and accurately calculated by using the formula (1), and the accuracy of mail alarm convergence by using the relevancy subsequently is improved.
In an embodiment, as shown in fig. 4, in step S53, the step of performing the filtering process according to the n target alarm times and the m historical alarm times, and the step of extracting the x target alarm times and the x historical alarm times includes the following steps:
s531: n is compared to m.
S532: if n is equal to m, determining n and m as x, and extracting x target alarm times and x historical alarm times according to the time sequence.
In the embodiment of the invention, n is compared with m, if n is equal to m, both n and m are taken as x, and x target alarm times and x historical alarm times are extracted according to the time sequence.
S533: if n is smaller than m, determining n as x, selecting x historical alarm times adjacent to the x target alarm times from the m historical alarm times, and extracting the x target alarm times and the x historical alarm times according to the time sequence.
In the embodiment of the invention, n is compared with m, if n is smaller than m, n is determined as x, m historical alarm time is compared with x target alarm time, x historical alarm time close to x target alarm time is selected from m historical alarm time according to the principle of selecting the historical alarm time close to the target alarm time, and x target alarm time and x historical alarm time are extracted according to the time sequence.
For example, if there are 2 target alarm times, respectively: 12:00 and 14:00, wherein 4 historical alarm time are respectively 12:10, 13:00, 13:50 and 15:00, 2 target alarm time are compared with 4 historical alarm time to obtain that the target alarm time 12:00 is close to the historical alarm time 12:10, and the target alarm time 14:00 is close to the historical alarm time 13:50, so 12:10 and 13:50 are selected from the historical alarm time.
S534: if n is larger than m, determining m as x, selecting x target alarm times adjacent to the x historical alarm times from the n target alarm times, and extracting the x target alarm times and the x historical alarm times according to the time sequence.
Specifically, n is compared with m, if n is larger than m, m is determined as x, n target alarm times are compared with x historical alarm times, x target alarm times close to the x historical alarm times are selected from the n target alarm times according to the principle of selecting the target alarm time close to the historical alarm time, and the x target alarm times and the x historical alarm times are extracted according to the time sequence.
In this embodiment, n is compared with m, and when n is equal to m, both n and m are determined as x; when n is smaller than m, determining n as x, and selecting x historical alarm times from m historical alarm times; when n is larger than m, determining m as x, and selecting x target alarm time from n target alarm time; and finally, extracting the x target alarm times and the x historical alarm times according to the time sequence. By comparing n with m, x under different comparison conditions is determined, effective target alarm time and historical alarm time can be extracted, and the accuracy of calculating the correlation degree by using the target alarm time and the historical alarm time in the follow-up process is ensured.
In an embodiment, as shown in fig. 5, in step S7, if the correlation degree is smaller than the preset threshold, the analyzing the target alarm item, and performing the alarm shielding process on the alarm mail according to the analysis processing result includes the following steps:
s71: and if the correlation degree is smaller than the preset threshold value, sending the correlation degree, the target alarm item corresponding to the correlation degree and the historical alarm item to a target user for confirmation.
In the embodiment of the invention, if the relevance is smaller than the preset threshold, the relevance, the target alarm item corresponding to the relevance and the historical alarm item are sent to the target user for confirmation according to a preset notification mode. The preset notification mode may be specifically in the form of an email, or may be set according to the actual needs of the user.
It should be noted that, by sending the relevance, the target alarm item corresponding to the relevance, and the history alarm item to the target user for confirmation, the target user can be helped to analyze the actual situation, and confirm whether the current alarms can be merged or deleted, so as to achieve the purpose of convergence alarm.
S72: and acquiring the target mail fed back by the target user.
Specifically, a target mail fed back by a target user is obtained from a preset feedback library. The preset feedback library is a database specially used for storing the target mail.
S73: and analyzing the target mail, and performing alarm shielding processing on the alarm mail according to the analysis result.
Specifically, the target mail is imported into a preset analysis port for analysis processing, when the preset analysis port detects the target mail, the target mail is analyzed, a corresponding execution instruction is extracted from the target mail through the analysis processing, and the alarm shielding processing is performed on the alarm mail according to the execution instruction.
The preset analysis port is a processing port for analyzing the target mail.
It should be noted that the execution instruction includes instructions such as pause and stop.
In this embodiment, when the relevance is smaller than the preset threshold, the relevance, the target alarm item and the history alarm item are sent to the target user for confirmation, the target mail fed back by the target user is analyzed, and alarm shielding processing is performed according to the analysis result. By analyzing the target mail, the alarm shielding instruction carried by the target mail can be identified, so that the accuracy of alarm shielding processing is ensured.
In one embodiment, as shown in fig. 6, the step S72 of obtaining the target email fed back by the target user includes the following steps:
s721: and acquiring a user mail fed back by the target user, wherein the user mail comprises a mail title and a target user id.
Specifically, the user mails fed back by the target users are directly obtained from a preset target user library. The preset target user library is a database which is specially used for storing user mails fed back by the target users, and the user mails comprise mail titles and target user ids.
S722: and if the mail title is the same as the preset monitoring title and the target user id is the same as the preset monitoring id, determining the user mail as the target mail and acquiring the target mail.
Specifically, for the user mail, the mail title of the user mail acquired in step S722 is matched with the preset monitoring title, the target user id is matched with the preset monitoring id, and if the mail title is the same as the preset monitoring title and the target user id is the same as the preset monitoring id, it indicates that the user mail including the mail title and the target user id is the target mail, and the target mail is acquired.
The preset monitoring title refers to a title name set by a user to be used for matching one of target mail conditions.
The preset monitoring id refers to address information set by the user for matching one of the target mail conditions.
In this embodiment, the user mail is determined as the target mail under the condition that the mail title is the same as the preset monitoring title and the target user id is the same as the preset monitoring id. The target mail can be accurately identified, and the accuracy of acquiring the target mail is improved.
In an embodiment, the target email includes a target email body, as shown in fig. 7, in step S73, parsing the target email, and performing alarm shielding processing on the alarm email according to the parsing result includes the following steps:
s731: and judging the user instruction of the target mail text.
In the embodiment of the invention, the user instruction comprises the instruction identification, and whether the target mail text comprises the user instruction is judged by directly detecting the instruction identification of the target mail text.
S732: and if the target mail text contains the user instruction, matching the user instruction with a preset shielding instruction.
In the embodiment of the present invention, according to the manner of detecting the instruction identifier of the target mail text in step S731, if it is detected that the instruction identifier exists in the target mail text, it indicates that the target mail text contains the user instruction, and obtains the user instruction corresponding to the instruction identifier, and matches the user instruction with the preset shielding instruction.
The preset shielding instruction refers to a computer instruction for performing alarm shielding processing on the alarm mail according to the actual requirement of a user.
S733: and if the matching is successful, performing alarm shielding processing on the alarm mail by using the user instruction.
In the embodiment of the present invention, the user instruction is matched with the preset shielding instruction in step S732, and if the user instruction is the same as the preset shielding instruction, the matching is successful, and the user instruction is used to perform the alarm shielding processing on the alarm mail.
It should be noted that the alarm masking processing may specifically be deleting the alarm mail, or making the alarm mail not pushed within the instruction time, and specifically executed according to the user instruction.
For example, if the preset shielding instruction is AAA, the user instruction is AAA, the corresponding instruction behavior is shielding for 2 hours, the user instruction is matched with the preset shielding instruction, and the user instruction AAA is executed on the alert mail because the user instruction is the same as the preset shielding instruction, that is, the alert mail is shielded for 2 hours.
S734: and if the text of the target mail does not contain the user instruction, identifying whether the alarm mail contains preset description information or not.
In the embodiment of the present invention, according to the manner of detecting the instruction identifier of the target mail text in step S731, if it is not detected that the instruction identifier exists in the target mail text, it indicates that the target mail text does not include the user instruction, and matches the mail text in the alert mail with the preset description information.
The preset description information refers to alarm content information set by a user, and the preset description information includes an execution command corresponding to the preset description information.
S735: and if the alarm mail contains the preset description information, carrying out alarm shielding treatment on the alarm mail.
Specifically, the mail text in the alert mail is matched with the preset description information according to step S734, and if the alert mail contains the preset description information, the alert mail is subjected to the alert shielding processing by using the execution command corresponding to the preset description information.
In the embodiment, a user instruction is judged for a target mail text, if the target mail text contains the user instruction, the user instruction is matched with a preset shielding instruction, if the matching is successful, the user instruction is used for carrying out alarm shielding processing, if the target mail text does not contain the user instruction, whether the alarm mail contains preset description information or not is identified, and if the target mail text contains the user instruction, the alarm shielding processing is carried out on the alarm mail. By means of the method for recognizing the user instruction, the user instruction can be accurately utilized to conduct alarm shielding, and under the condition that the user instruction cannot be recognized, the preset description information is utilized to conduct matching, so that the condition that alarm shielding cannot be conducted due to the fact that the user instruction is recognized inaccurately can be avoided, and the accuracy of alarm shielding is further guaranteed.
It should be understood that, the sequence numbers of the steps in the foregoing embodiments do not imply an execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.
In one embodiment, a mail alarm convergence apparatus is provided, which corresponds to the mail alarm convergence method in the above embodiments one to one. As shown in FIG. 8, the mail alert convergence apparatus includes a first obtaining module 81, a judging module 82, an identifying module 83, a second obtaining module 84, a calculating module 85, a comparing module 86 and a shielding module 87. The functional modules are explained in detail as follows:
a first obtaining module 81, configured to obtain all mails from a mail database at preset time intervals, where the mails include a user id and an address id;
the judging module 82 is used for judging the mail type of the mail according to the user id and the address id and extracting a monitoring mail, wherein the monitoring mail comprises a mail text;
the identification module 83 is configured to perform alarm field identification on a mail text, and determine a monitoring mail with an identified alarm field as an alarm mail, where the alarm mail includes a target alarm item and alarm sending time;
a second obtaining module 84, configured to obtain i types of historical alarm items between the alarm sending time and the preset time from a preset log library, where i is a positive integer greater than 0;
the calculation module 85 is configured to calculate, according to the target alarm item and the i types of history alarm items, a correlation between the target alarm item and each type of history alarm item to obtain i correlations;
a comparison module 86, configured to compare the i correlation degrees with a preset threshold;
and the shielding module 87 is configured to, if the correlation degree is smaller than the preset threshold, perform analysis processing on the target alarm item, and perform alarm shielding processing on the alarm mail according to an analysis processing result.
Further, the identification module 83 includes:
the matching sub-module is used for matching the mail text by using a preset regular expression;
the matching success sub-module is used for determining the monitoring mail corresponding to the mail text as an alarm mail if the matching is successful;
and the matching failure sub-module is used for matching the mail text by using the preset configuration rule if the matching fails, and determining the monitoring mail corresponding to the mail text conforming to the preset configuration rule as the alarm mail.
Further, the calculation module 85 includes:
a third obtaining submodule, configured to obtain n target alarm times of a target alarm item from a preset alarm library, where n is a positive integer greater than 0;
the fourth obtaining submodule is used for obtaining m historical alarm time corresponding to each historical alarm item from a preset historical library aiming at each historical alarm item, wherein m is a positive integer larger than 0;
the screening submodule is used for carrying out screening processing according to the n target alarm time and the m historical alarm time and extracting x target alarm time and x historical alarm time, wherein the x target alarm time comprises the latest target alarm time, the x historical alarm time comprises the latest historical alarm time, x is a positive integer larger than 0, and x is smaller than or equal to n or m;
and the relevance degree operator module is used for calculating the relevance degree between the target alarm item and the historical alarm item according to the formula (1) according to the x target alarm times and the x historical alarm times:
Figure BDA0002386912550000161
wherein S is the degree of correlation, AkFor the warning time corresponding to the k-th target warning item, BkThe alarm time corresponding to the kth historical alarm item, X is the same number of times, AiThe latest alarm time of the target alarm item, BiThe latest alarm time of the historical alarm item.
Further, the screening submodule includes:
a numerical value comparison unit for comparing n with m;
the first comparison unit is used for determining n and m as x if the n and the m are equal, and extracting x target alarm times and x historical alarm times according to the time sequence;
the second comparison unit is used for determining n as x if the n is smaller than m, selecting x historical alarm times adjacent to the x target alarm times from the m historical alarm times, and extracting the x target alarm times and the x historical alarm times according to the time sequence;
and the third comparison unit is used for determining m as x if n is larger than m, selecting x target alarm times adjacent to the x historical alarm times from the n target alarm times, and extracting the x target alarm times and the x historical alarm times according to the time sequence.
Further, the shielding module 87 includes:
the sending submodule is used for sending the correlation degree, the target alarm item corresponding to the correlation degree and the historical alarm item to a target user for confirmation if the correlation degree is smaller than a preset threshold value;
a fifth obtaining sub-module, configured to obtain a target email fed back by a target user;
the analysis submodule is used for analyzing the target mail and carrying out alarm shielding processing on the alarm mail according to the analysis result;
further, the fifth obtaining sub-module includes:
a sixth obtaining unit, configured to obtain a user email fed back by a target user, where the user email includes an email title and a target user id;
and the target mail acquiring unit is used for determining the user mail as the target mail and acquiring the target mail if the mail title is the same as the preset monitoring title and the target user id is the same as the preset monitoring id.
Further, the parsing submodule includes:
the user instruction judging unit is used for judging the user instruction of the target mail text;
the user instruction effective unit is used for matching the user instruction with a preset shielding instruction if the target mail text contains the user instruction;
the user instruction matching success unit is used for carrying out alarm shielding processing on the alarm mail by using the user instruction if the matching is successful;
the user instruction invalidation unit is used for identifying whether the warning mail contains preset description information or not if the text of the target mail does not contain the user instruction;
and the processing unit is used for carrying out alarm shielding processing on the alarm mail if the alarm mail contains the preset description information.
Some embodiments of the present application disclose a computer device. Referring specifically to fig. 9, a basic structure block diagram of a computer device 90 according to an embodiment of the present application is shown.
As illustrated in fig. 9, the computer device 90 includes a memory 91, a processor 92, and a network interface 93 communicatively connected to each other through a system bus. It is noted that only a computer device 90 having components 91-93 is shown in FIG. 9, but it is understood that not all of the illustrated components are required to be implemented, and that more or fewer components may alternatively be implemented. As will be understood by those skilled in the art, the computer device is a device capable of automatically performing numerical calculation and/or information processing according to a preset or stored instruction, and the hardware includes, but is not limited to, a microprocessor, an Application Specific Integrated Circuit (ASIC), a Programmable gate array (FPGA), a Digital Signal Processor (DSP), an embedded device, and the like.
The computer device can be a desktop computer, a notebook, a palm computer, a cloud server and other computing devices. The computer equipment can carry out man-machine interaction with a user through a keyboard, a mouse, a remote controller, a touch panel or voice control equipment and the like.
The memory 91 includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Read Only Memory (ROM), an Electrically Erasable Programmable Read Only Memory (EEPROM), a Programmable Read Only Memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the storage 91 may be an internal storage unit of the computer device 90, such as a hard disk or a memory of the computer device 90. In other embodiments, the memory 91 may also be an external storage device of the computer device 90, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), or the like, provided on the computer device 90. Of course, the memory 91 may also include both internal and external memory units of the computer device 90. In this embodiment, the memory 91 is generally used for storing an operating system installed in the computer device 90 and various types of application software, such as program codes of the mail alert convergence method. Further, the memory 91 may also be used to temporarily store various types of data that have been output or are to be output.
The processor 92 may be a Central Processing Unit (CPU), controller, microcontroller, microprocessor, or other data Processing chip in some embodiments. The processor 92 is typically used to control the overall operation of the computer device 90. In this embodiment, the processor 92 is configured to run the program code stored in the memory 91 or process data, for example, the program code of the mail alert convergence method.
The network interface 93 may include a wireless network interface or a wired network interface, and the network interface 93 is generally used to establish a communication connection between the computer device 90 and other electronic devices.
The present application provides another embodiment, which is to provide a computer-readable storage medium storing a mail information entry program, where the mail information entry program is executable by at least one processor to cause the at least one processor to execute the steps of any one of the mail alert convergence methods described above.
Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solutions of the present application may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a computer device (such as a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the method according to the embodiments of the present application.
Finally, it should be noted that the above-mentioned embodiments illustrate only some of the embodiments of the present application, and are therefore not to be considered limiting of its scope, for the invention may admit to other equally effective embodiments. This application is capable of embodiments in many different forms and is provided for the purpose of enabling a thorough understanding of the disclosure of the application. Although the present application has been described in detail with reference to the foregoing embodiments, it will be apparent to one skilled in the art that the present application may be practiced without modification or with equivalents of some of the features described in the foregoing embodiments. All equivalent structures made by using the contents of the specification and the drawings of the present application are directly or indirectly applied to other related technical fields and are within the protection scope of the present application.

Claims (10)

1. A mail alarm convergence method is characterized by comprising the following steps:
acquiring all mails from a mail database at preset time intervals, wherein the mails comprise user ids and address ids;
judging the mail type of the mail according to the user id and the address id, and extracting a monitoring mail, wherein the monitoring mail comprises a mail body;
performing alarm field identification on the mail body, and determining the monitoring mail with the identified alarm field as the alarm mail, wherein the alarm mail comprises a target alarm item and alarm sending time;
acquiring i types of historical alarm items between the alarm sending time and the preset time from a preset log library, wherein i is a positive integer greater than 0;
according to the target alarm item and the i types of historical alarm items, calculating the correlation degree between the target alarm item and each type of historical alarm item to obtain i types of correlation degrees;
comparing the i correlation degrees with a preset threshold value;
and if the correlation degree is smaller than a preset threshold value, analyzing the target alarm item, and performing alarm shielding processing on the alarm mail according to an analysis processing result.
2. The mail alert convergence method of claim 1, wherein the steps of performing alert field identification on the body of the mail and determining the monitoring mail for which an alert field is identified as the alert mail comprise:
matching the mail text by using a preset regular expression;
if the matching is successful, determining the monitoring mail corresponding to the mail text as the warning mail;
and if the matching fails, matching the mail body by using a preset configuration rule, and determining the monitoring mail corresponding to the mail body according with the preset configuration rule as the alarm mail.
3. The mail alert convergence method according to claim 1, wherein the step of calculating the degree of correlation between the target alert item and each of the historical alert items based on the target alert item and the i types of the historical alert items comprises:
acquiring n target alarm times of the target alarm items from a preset alarm library, wherein n is a positive integer greater than 0;
for each historical alarm item, acquiring m historical alarm times corresponding to each historical alarm item from a preset historical library, wherein m is a positive integer greater than 0;
screening according to the n target alarm times and the m historical alarm times, and extracting x target alarm times and x historical alarm times, wherein the x target alarm times comprise the latest target alarm time, the x historical alarm times comprise the latest historical alarm time, x is a positive integer greater than 0, and x is less than or equal to n or m;
according to the x target alarm time and the x historical alarm time, calculating the correlation between the target alarm item and the historical alarm item according to the following formula:
Figure FDA0002386912540000021
wherein S is the degree of correlation, AkFor the kth target alarm time, BkFor the kth historical alarm time, k is a constant, AiFor the latest target alarm time, BiAnd the latest historical alarm time.
4. The mail alert convergence method according to claim 3, wherein the step of performing a filtering process based on the n target alert times and the m historical alert times to extract x target alert times and x historical alert times comprises:
comparing n to m;
if n is equal to m, determining both n and m as x, and extracting x target alarm times and x historical alarm times according to the time sequence;
if n is smaller than m, determining n as x, selecting x historical alarm times adjacent to the x target alarm times from the m historical alarm times, and extracting the x target alarm times and the x historical alarm times according to the time sequence;
if n is larger than m, determining m as x, selecting x target alarm times adjacent to the x historical alarm times from the n target alarm times, and extracting the x target alarm times and the x historical alarm times according to the time sequence.
5. The mail alarm convergence method according to claim 1, wherein the step of analyzing the target alarm item and performing alarm masking processing on the alarm mail according to the analysis processing result if the correlation degree is smaller than a preset threshold value comprises:
if the relevancy is smaller than a preset threshold value, the relevancy, the target alarm item corresponding to the relevancy and the historical alarm item are sent to a target user for confirmation;
acquiring a target mail fed back by the target user;
and analyzing the target mail, and performing alarm shielding processing on the alarm mail according to an analysis result.
6. The mail alert convergence method of claim 5, wherein the step of obtaining the target mail fed back by the target user comprises:
acquiring a user mail fed back by a target user, wherein the user mail comprises a mail title and a target user id;
and if the mail title is the same as a preset monitoring title and the target user id is the same as a preset monitoring id, determining the user mail as the target mail and acquiring the target mail.
7. The mail alarm convergence method of claim 5, wherein the target mail contains a target mail body, and the step of analyzing the target mail and performing alarm shielding processing on the alarm mail according to the analysis result comprises:
judging the user instruction of the target mail text;
if the target mail text contains a user instruction, matching the user instruction with a preset shielding instruction;
if the matching is successful, the user instruction is utilized to carry out alarm shielding processing on the alarm mail;
if the target mail text does not contain the user instruction, identifying whether the alarm mail contains preset description information or not;
and if the alarm mail contains preset description information, carrying out alarm shielding treatment on the alarm mail.
8. A mail alert convergence apparatus, characterized by comprising:
the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring all mails from a mail database at preset time intervals, and the mails comprise user ids and address ids;
the judging module is used for judging the mail type of the mail according to the user id and the address id and extracting a monitoring mail, wherein the monitoring mail comprises a mail body;
the identification module is used for identifying an alarm field of the mail body and determining the monitoring mail with the identified alarm field as the alarm mail, wherein the alarm mail comprises a target alarm item and alarm sending time;
the second acquisition module is used for acquiring i types of historical alarm items between the alarm sending time and the preset time from a preset log library, wherein i is a positive integer greater than 0;
the calculation module is used for calculating the correlation between the target alarm item and each historical alarm item according to the target alarm item and the i types of historical alarm items to obtain i types of correlation;
the comparison module is used for comparing the i correlation degrees with a preset threshold value;
and the shielding module is used for analyzing the target alarm item if the correlation degree is smaller than a preset threshold value, and performing alarm shielding processing on the alarm mail according to an analysis processing result.
9. A computer arrangement comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the steps of the mail alert convergence method according to any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the steps of the mail alert convergence method according to any one of claims 1 to 7.
CN202010101151.1A 2020-02-19 2020-02-19 Mail alarm convergence method, device, computer equipment and storage medium Active CN111400435B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010101151.1A CN111400435B (en) 2020-02-19 2020-02-19 Mail alarm convergence method, device, computer equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010101151.1A CN111400435B (en) 2020-02-19 2020-02-19 Mail alarm convergence method, device, computer equipment and storage medium

Publications (2)

Publication Number Publication Date
CN111400435A true CN111400435A (en) 2020-07-10
CN111400435B CN111400435B (en) 2024-04-12

Family

ID=71428544

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010101151.1A Active CN111400435B (en) 2020-02-19 2020-02-19 Mail alarm convergence method, device, computer equipment and storage medium

Country Status (1)

Country Link
CN (1) CN111400435B (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112073303A (en) * 2020-09-03 2020-12-11 中国平安财产保险股份有限公司 Mail task convergence management method, device, equipment and readable storage medium
CN113645073A (en) * 2021-08-11 2021-11-12 未鲲(上海)科技服务有限公司 Alarm mail processing method and device, electronic equipment and storage medium
CN115396280A (en) * 2022-08-29 2022-11-25 中国农业银行股份有限公司 Alarm data processing method, device, equipment and storage medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108809757A (en) * 2018-05-22 2018-11-13 平安科技(深圳)有限公司 A kind of system alarm method, storage medium and server
CN109039740A (en) * 2018-08-01 2018-12-18 平安科技(深圳)有限公司 A kind of method and apparatus handling O&M monitoring alarm
CN109787887A (en) * 2019-01-25 2019-05-21 中国平安人寿保险股份有限公司 Warning information management method, device, computer installation and readable storage medium storing program for executing
CN109871305A (en) * 2019-01-18 2019-06-11 深圳壹账通智能科技有限公司 Processing method, device, computer equipment and the storage medium of warning information
CN110278143A (en) * 2019-05-06 2019-09-24 平安科技(深圳)有限公司 E-mail data processing method, device, computer equipment and storage medium

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108809757A (en) * 2018-05-22 2018-11-13 平安科技(深圳)有限公司 A kind of system alarm method, storage medium and server
CN109039740A (en) * 2018-08-01 2018-12-18 平安科技(深圳)有限公司 A kind of method and apparatus handling O&M monitoring alarm
CN109871305A (en) * 2019-01-18 2019-06-11 深圳壹账通智能科技有限公司 Processing method, device, computer equipment and the storage medium of warning information
CN109787887A (en) * 2019-01-25 2019-05-21 中国平安人寿保险股份有限公司 Warning information management method, device, computer installation and readable storage medium storing program for executing
CN110278143A (en) * 2019-05-06 2019-09-24 平安科技(深圳)有限公司 E-mail data processing method, device, computer equipment and storage medium

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112073303A (en) * 2020-09-03 2020-12-11 中国平安财产保险股份有限公司 Mail task convergence management method, device, equipment and readable storage medium
CN112073303B (en) * 2020-09-03 2022-10-18 中国平安财产保险股份有限公司 Mail task convergence management method, device and equipment and readable storage medium
CN113645073A (en) * 2021-08-11 2021-11-12 未鲲(上海)科技服务有限公司 Alarm mail processing method and device, electronic equipment and storage medium
CN113645073B (en) * 2021-08-11 2024-09-27 未鲲(上海)科技服务有限公司 Alarm mail processing method and device, electronic equipment and storage medium
CN115396280A (en) * 2022-08-29 2022-11-25 中国农业银行股份有限公司 Alarm data processing method, device, equipment and storage medium
CN115396280B (en) * 2022-08-29 2024-03-19 中国农业银行股份有限公司 Alarm data processing method, device, equipment and storage medium

Also Published As

Publication number Publication date
CN111400435B (en) 2024-04-12

Similar Documents

Publication Publication Date Title
CN109325865B (en) Exception handling method, exception handling device, computer equipment and storage medium
CN111400435B (en) Mail alarm convergence method, device, computer equipment and storage medium
CN109933973B (en) Password verification method, password verification device, computer equipment and storage medium
CN111813845B (en) Incremental data extraction method, device, equipment and medium based on ETL task
CN109189888B (en) Electronic device, infringement analysis method, and storage medium
CN112445775B (en) Fault analysis method, device, equipment and storage medium of photoetching machine
CN111835737B (en) WEB attack protection method based on automatic learning and related equipment thereof
CN110866258A (en) Method for quickly positioning bug, electronic device and storage medium
CN111258799A (en) Error reporting information processing method, electronic device and computer readable storage medium
CN111475267A (en) System task automatic scheduling method and device, computer equipment and storage medium
CN114493255A (en) Enterprise abnormity monitoring method based on knowledge graph and related equipment thereof
CN112181835A (en) Automatic testing method and device, computer equipment and storage medium
CN116841779A (en) Abnormality log detection method, abnormality log detection device, electronic device and readable storage medium
CN114638501A (en) Business data processing method and device, computer equipment and storage medium
CN111651340A (en) Alarm data rule mining method and device and electronic equipment
CN113312258B (en) Interface testing method, device, equipment and storage medium
CN113283620B (en) Operation and maintenance method, device, equipment and storage medium based on artificial intelligence
CN113886590A (en) Data summarizing method and device, computer equipment and storage medium
CN111752958A (en) Intelligent associated label method, device, computer equipment and storage medium
CN110442466B (en) Method, device, computer equipment and storage medium for preventing repeated access request
JP6515048B2 (en) Incident management system
CN114756850A (en) Data acquisition method, device, equipment and storage medium
CN115098548A (en) Data decision method, system and cloud platform
KR20220117189A (en) Security compliance automation method
CN113535458A (en) Abnormal false alarm processing method and device, storage medium and terminal

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant