CN112565009A - Processing method and device based on custom performance threshold alarm rule - Google Patents
Processing method and device based on custom performance threshold alarm rule Download PDFInfo
- Publication number
- CN112565009A CN112565009A CN202011359663.4A CN202011359663A CN112565009A CN 112565009 A CN112565009 A CN 112565009A CN 202011359663 A CN202011359663 A CN 202011359663A CN 112565009 A CN112565009 A CN 112565009A
- Authority
- CN
- China
- Prior art keywords
- alarm
- performance
- rule
- clearing
- threshold
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a processing method and a device based on a custom performance threshold alarm rule, wherein the method comprises the following steps: the system receives real-time performance data from kafka; the system loads a performance threshold alarm rule from a database at regular time; judging whether the performance data meets a performance threshold condition, if so, triggering a performance alarm, standardizing the performance alarm and outputting the performance alarm, and finishing the judgment in the current round; otherwise, further judging whether the current active alarm which is not cleared exists, if not, finishing the judgment in the current round; otherwise, further judging whether a corresponding performance alarm clearing rule exists, if not, finishing the judgment in the current round; otherwise, further judging whether the corresponding performance alarm clearing rule is met, if not, finishing the judgment in the current round; otherwise, triggering performance clearing alarm, standardizing the performance alarm and outputting, and finishing the judgment in the current round. The method and the device carry out real-time analysis and processing aiming at various collected performance indexes and generate performance alarms with different degrees.
Description
Technical Field
The invention relates to the field of network performance monitoring, in particular to a processing method and a device based on a custom performance threshold alarm rule.
Background
When various performance indexes in a network are monitored, whether the performance indexes exceed a normal range or not, and the amplitude, the severity, the frequency and the like exceeding the normal range are required to be captured actively and timely, so that timely and effective treatment measures are taken, the performance indexes cannot be collected periodically for statistical analysis, whether the performance indexes are abnormal or not is monitored in real time, early warnings of different levels are sent out in real time, monitoring personnel and operation and maintenance personnel can conveniently and efficiently treat the abnormality and the fault, the stable operation of the network and the system is guaranteed, and the network or service quality is improved under the condition that a user feels no sense.
Disclosure of Invention
In view of the above situation, the present invention provides a processing method and device based on a custom performance threshold alarm rule, which performs real-time analysis and processing on various collected performance indexes to generate performance alarms of different degrees, thereby guiding operation and maintenance personnel to process network performance problems in time and efficiently.
In order to achieve the purpose, the invention adopts the following technical scheme:
in an embodiment of the present invention, a method for processing an alarm rule based on a custom performance threshold is provided, where the method includes:
the system receives real-time performance data from kafka;
the system loads a refresh performance threshold alarm rule from a database at regular time;
judging whether the performance data meets a performance alarm generation rule of a performance threshold condition, if so, triggering a performance alarm, standardizing the performance alarm and outputting an alarm message, and finishing the judgment in the current round;
if not, further judging whether an uncleaned active alarm exists at present, and if not, finishing the judgment in the current round;
if the performance warning clearing rule exists, further judging whether the corresponding performance warning clearing rule exists, and if the performance warning clearing rule does not exist, finishing the judgment in the current round;
if the performance alarm clearing rule does not meet the performance alarm clearing rule, the current round of judgment is finished;
if yes, triggering performance clearing alarm, standardizing the performance alarm and outputting alarm information, and finishing the judgment in the current round.
Further, the setting of the performance threshold condition is defined by four dimensions, namely, an index dimension, a threshold source, a network element dimension and an index granularity.
Further, the performance alarm generation rules are defined in the following dimensions:
whether performance alarm generation rules are enabled;
generating an alarm title and an alarm level of the alarm;
the effective time range of the performance alarm generation rule comprises start-stop time;
frequency, i.e., the number of durations that satisfy a performance threshold condition;
an observation period, i.e. an observation time window after meeting the performance threshold condition;
trigger pattern in time dimension: the judgment of a static threshold and a dynamic threshold is supported;
priority levels can be set among all performance threshold value alarm rules of the same index, and only one alarm is reported by the same index finally;
the alarms compressed according to the performance threshold alarm rules need to be presented as sub-alarms of the main alarm triggered by the performance threshold alarm rules; and aiming at the performance alarm generated frequently by the alarm, all alarm information can be downloaded into the performance alarm.
Further, the performance alarm clearing rules are of the following two types:
performance index recovery type: when the performance data does not meet the performance threshold condition, the system generates a performance clearing alarm and clears the performance alarm generated before;
alarm clearing observation period type: that is, when the performance data does not satisfy the performance threshold condition and no deterioration occurs within a certain time range, the system generates a performance clearing alarm and clears the previously generated performance alarm.
Further, the output content of the performance alarm after being standardized includes:
alarm title, alarm network element manufacturer, alarm network element type, alarm occurrence time, alarm type, alarm level, alarm source and alarm details.
In an embodiment of the present invention, a processing apparatus based on a custom performance threshold warning rule is further provided, where the apparatus includes:
the performance data real-time receiving module is used for receiving the real-time performance data from the kafka;
the performance threshold value alarming rule loading module is used for regularly loading and refreshing the performance threshold value alarming rule from the database;
the performance alarm triggering module is used for judging whether the performance data meets the performance alarm generation rule of the performance threshold condition, if so, triggering the performance alarm, standardizing the performance alarm and outputting an alarm message, and finishing the judgment in the current round;
the performance clearing alarm triggering module is used for further judging whether an unremoved active alarm exists at present or not under the condition that the performance data does not meet the performance alarm triggering rule of the performance threshold condition, and if not, the current judgment is finished; if the performance warning clearing rule exists, further judging whether the corresponding performance warning clearing rule exists, and if the performance warning clearing rule does not exist, finishing the judgment in the current round; if the performance alarm clearing rule does not meet the performance alarm clearing rule, the current round of judgment is finished; if yes, triggering performance clearing alarm, standardizing the performance alarm and outputting alarm information, and finishing the judgment in the current round.
Further, the setting of the performance threshold condition is defined by four dimensions, namely, an index dimension, a threshold source, a network element dimension and an index granularity.
Further, the performance alarm generation rules are defined in the following dimensions:
whether performance alarm generation rules are enabled;
generating an alarm title and an alarm level of the alarm;
the effective time range of the performance alarm generation rule comprises start-stop time;
frequency, i.e., the number of durations that satisfy a performance threshold condition;
an observation period, i.e. an observation time window after meeting the performance threshold condition;
trigger pattern in time dimension: the judgment of a static threshold and a dynamic threshold is supported;
priority levels can be set among all performance threshold value alarm rules of the same index, and only one alarm is reported by the same index finally;
the alarms compressed according to the performance threshold alarm rules need to be presented as sub-alarms of the main alarm triggered by the performance threshold alarm rules; and aiming at the performance alarm generated frequently by the alarm, all alarm information can be downloaded into the performance alarm.
Further, the performance alarm clearing rules are of the following two types:
performance index recovery type: when the performance data does not meet the performance threshold condition, the system generates a performance clearing alarm and clears the performance alarm generated before;
alarm clearing observation period type: that is, when the performance data does not satisfy the performance threshold condition and no deterioration occurs within a certain time range, the system generates a performance clearing alarm and clears the previously generated performance alarm.
Further, the output content of the performance alarm after being standardized includes:
alarm title, alarm network element manufacturer, alarm network element type, alarm occurrence time, alarm type, alarm level, alarm source and alarm details.
In an embodiment of the present invention, a computer device is further provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the processing method and apparatus based on the customized performance threshold warning rule are implemented.
In an embodiment of the present invention, a computer-readable storage medium is further provided, where a computer program for executing the processing method and apparatus based on the custom performance threshold warning rule is stored in the computer-readable storage medium.
Has the advantages that:
the invention carries out comprehensive deep monitoring aiming at the monitoring granularity, the relevance and the dimensionality of abnormal performance data, thereby judging and processing whether various performance indexes meet the performance threshold value rule and generating standardized performance alarm and performance clearing alarm in real time, meeting the personalized monitoring requirements of monitoring personnel in various network specialties, different levels and different areas, and greatly improving the monitoring efficiency and the visualization degree in daily operation and maintenance work orders.
Drawings
FIG. 1 is a flow chart of a processing method for an alarm rule based on a custom performance threshold according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of alarm clearing in accordance with an embodiment of the present invention;
FIG. 3 is a schematic diagram of an alarm clearing observation period according to an embodiment of the invention;
FIG. 4 is a schematic structural diagram of a processing apparatus based on a custom performance threshold alarm rule according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of a computer device according to an embodiment of the present invention.
Detailed Description
The principles and spirit of the present invention will be described below with reference to several exemplary embodiments, which should be understood to be presented only to enable those skilled in the art to better understand and implement the present invention, and not to limit the scope of the present invention in any way. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
As will be appreciated by one skilled in the art, embodiments of the present invention may be embodied as a system, apparatus, device, method, or computer program product. Accordingly, the present disclosure may be embodied in the form of: entirely hardware, entirely software (including firmware, resident software, micro-code, etc.), or a combination of hardware and software.
According to the embodiment of the invention, the invention provides a processing method and a device based on a self-defined performance threshold alarm rule, which have flexible and rich performance threshold alarm rule setting functions and comprise the following aspects: setting performance threshold conditions of multiple dimensions and multiple visual angles; performance alarm triggering rules of multiple scenes and multiple combined threshold conditions; intelligent performance alarm clearing rules. Generating alarms for performance data that satisfies performance threshold alarm rules, including the following: triggering a performance alarm when a performance threshold alarm generation rule is met; triggering a clearing alarm when a performance threshold alarm clearing rule is met; and standardizing and outputting the generated performance alarm or performance clearing alarm.
The principles and spirit of the present invention are explained in detail below with reference to several representative embodiments of the invention.
Fig. 1 is a schematic flow chart of a processing method based on a custom performance threshold alarm rule according to an embodiment of the present invention. As shown in fig. 1, the method includes:
the system receives real-time performance data from kafka;
the system loads a refresh performance threshold alarm rule from a database at regular time;
judging whether the performance data meets a performance alarm generation rule of a performance threshold condition, if so, triggering a performance alarm, standardizing the performance alarm and outputting an alarm message, and finishing the judgment in the current round;
if not, further judging whether an uncleaned active alarm exists at present, and if not, finishing the judgment in the current round;
if the performance warning clearing rule exists, further judging whether the corresponding performance warning clearing rule exists, and if the performance warning clearing rule does not exist, finishing the judgment in the current round;
if the performance alarm clearing rule does not meet the performance alarm clearing rule, the current round of judgment is finished;
if yes, triggering performance clearing alarm, standardizing the performance alarm and outputting alarm information, and finishing the judgment in the current round.
The following describes the contents of the key steps in detail:
1. performance threshold condition setting
The setting of the performance threshold condition supports flexible definition from several dimensions:
(1) index dimension: including single index conditions and composite index conditions. The single index is set for a single index, for example, the packet loss rate is greater than 20% or the packet loss rate is between 50% and 80%. The composite index condition is a condition in which a plurality of indexes are comprehensively judged, a threshold value condition of the plurality of indexes can be defined, and the relationship between the conditions can be an and or relationship.
(2) The threshold value source is as follows: the threshold value may be a manually set static value, such as a CPU utilization rate greater than 60%, or a baseline value automatically calculated from historical data, and the baseline value may be a time point (e.g., 20 points of the last week) or an average value of a period (e.g., an average value of the last week).
(3) Network element dimension: the selection and setting conditions may be made for the equipment manufacturer, the equipment type, the equipment name, and the geographical area.
(4) Index particle size: the method is divided into 15 minutes, hours, days and months and a radio box. May be automatically determined by default according to the attributes of the index. Only when the index granularity is hours, the selection of 24 time points needs to be displayed. Selecting an hour range: divided into full election, busy hour (default settings of 10, 11 o ' clock early and 7, 8 o ' clock late) and day (default settings of 6-22 o ' clock).
2. Performance alert generation rules
In addition to the threshold condition of the performance data, the performance alarm generation rule may also be flexibly defined according to the following dimensions:
(1) whether a rule is enabled may be defined;
(2) the alarm title and the alarm level of the generated alarm can be defined, so that the emergency degree of the alarm is reflected;
(3) a rule validation time range may be defined, including a start-stop time;
(4) a frequency, i.e., the number of durations that satisfy a performance threshold condition, may be defined;
(5) an observation period, i.e., an observation time window after meeting a performance threshold condition, may be defined;
(6) a trigger pattern in the time dimension can be defined: the method supports the judgment of a static threshold and a dynamic threshold, wherein the static threshold refers to the periodic judgment which does not change along with the time point, and the dynamic threshold refers to the different judgment according to the time point, namely the method supports the setting of discrete time, such as: the too high traffic volume of busy hour in the morning and evening of a day continuously generates a performance alarm 2 times. Two alarm triggering modes, namely discrete and periodic, need to be distinguished, and the triggering alarm of continuous N times in discrete time needs to be judged at the same discrete time point of each day, and the same is true for the triggering mechanism of the recovery alarm.
(7) Priority levels can be set among all performance threshold rules of the same index, and the same index can only report one alarm finally. For example: threshold ranges corresponding to the alarm levels of the provincial default rule and the Nanjing custom rule may be different or overlapped; the priority between high frequency alarms and pure threshold alarms is allowed to be defined.
(8) The alarms compressed according to the performance threshold rules need to be presented as sub-alarms of the main alarm triggered by the performance threshold rules. And aiming at the performance alarm generated frequently by the alarm, all alarm information can be downloaded into the performance alarm. For example: and if the power failure alarm of the moving ring exceeds 30 times to generate a performance alarm, hanging the 30 power failure alarms into the generated performance alarm.
3. Performance alarm clearing rules
Since the performance alarm is an alarm generated by making a threshold condition decision based on the performance index data, it is necessary to automatically and intelligently generate the performance data clearing alarm when the performance data is restored to the normal value range.
There are two types of performance alarm clearing rules:
(1) performance index recovery type: that is, when the performance data does not meet the performance threshold condition, the system generates a performance clearing alarm to clear the previously generated performance alarm. For example: the system call completing rate is less than 97%, and a three-level alarm is generated; in the next acquisition cycle, the system call-on rate is restored to 97% or more, and the system automatically clears the three-level alarm sent before, as shown in fig. 2.
(2) Alarm clearing observation period type: that is, when the performance data does not satisfy the performance threshold condition and no deterioration occurs within a certain time range, the system generates a performance clearing alarm and clears the previously generated performance alarm. The introduction of the alarm clearing observation period is mainly a means for effectively preventing a large amount of repeated performance alarms caused by flickering and frequent performance fluctuation. For example: CPU utilization > 50%, generating a three-level alarm. Since CPU utilization fluctuates significantly during busy hours, a clear alarm is generated when the load recovers and does not fluctuate more than 50% for a period of time, as shown in fig. 3.
4. Performance alarm standardized output
When the performance alarm is triggered and cleared, the generated performance alarm needs to be standardized, so that subsequent functions such as data storage, data visual presentation and the like can be analyzed and processed by adopting a uniform specification.
The performance alarm standardized content comprises the following contents:
(1) alarm title: defined in the performance threshold rule may be the index name that generates the performance alarm, for example: the 3G radio access rate is low, and may also be a failure description, for example: the XX cell secondary paging strategy is not appropriate.
(2) Alarm network element and network element manufacturer name: the equipment and equipment manufacturer that generates the alarm.
(3) The alarm network element type: and generating the types of alarm equipment, such as a router, a switch and the like.
(4) Alarm occurrence time: performance data collection generation time.
(5) Alarm type: the alarms generated by the general performance monitoring are marked as 'performance alarms' by distinguishing the types of alarms.
(6) Alarm level: defined in the performance threshold rules, consistent with a fault alarm, are generally classified as urgent, severe, secondary, and warning.
(7) And (4) alarming source: and marking an alarm source for distinguishing the alarm information source, wherein the performance alarm generated by the performance threshold rule is marked as a performance monitoring subsystem.
(8) And (4) warning details: the alarm index data and the threshold setting condition or alarm condition expression of the alarm generated index.
It should be noted that although the operations of the method of the present invention have been described in the above embodiments and the accompanying drawings in a particular order, this does not require or imply that these operations must be performed in this particular order, or that all of the operations shown must be performed, to achieve the desired results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions.
The scheme is implemented on the upper line of Jiangsu Unicom, so that a good effect is achieved, the individual requirements on performance monitoring are met, and the efficiency of monitoring network performance abnormity is improved.
Based on the same invention concept, the invention also provides a processing device based on the self-defined performance threshold value alarm rule. The implementation of the device can be referred to the implementation of the method, and repeated details are not repeated. The term "module," as used below, may be a combination of software and/or hardware that implements a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.
Fig. 4 is a schematic structural diagram of a processing apparatus based on a custom performance threshold alarm rule according to an embodiment of the present invention. As shown in fig. 4, the apparatus includes:
a performance data real-time receiving module 101, configured to receive real-time performance data from kafka;
a performance threshold alarm rule loading module 102, configured to load and refresh a performance threshold alarm rule from a database at regular time;
the performance alarm triggering module 103 is used for judging whether the performance data meets the performance alarm generation rule of the performance threshold condition, if so, triggering the performance alarm, standardizing the performance alarm and outputting an alarm message, and finishing the judgment in the current round;
the setting of the performance threshold condition is defined by four dimensions, namely index dimension, threshold source, network element dimension and index granularity;
the performance alarm generation rules are defined in the following dimensions:
whether performance alarm generation rules are enabled;
generating an alarm title and an alarm level of the alarm;
the effective time range of the performance alarm generation rule comprises start-stop time;
frequency, i.e., the number of durations that satisfy a performance threshold condition;
an observation period, i.e. an observation time window after meeting the performance threshold condition;
trigger pattern in time dimension: the judgment of a static threshold and a dynamic threshold is supported;
priority levels can be set among all performance threshold value alarm rules of the same index, and only one alarm is reported by the same index finally;
the alarms compressed according to the performance threshold alarm rules need to be presented as sub-alarms of the main alarm triggered by the performance threshold alarm rules; all alarm information can be hung down in the performance alarm aiming at the performance alarm generated by the frequent alarm;
the performance clearing alarm triggering module 104 is configured to further determine whether an unremoved active alarm exists at present under the condition that the performance data does not meet the performance alarm triggering rule of the performance threshold condition, and if the performance data does not meet the performance alarm triggering rule of the performance threshold condition, end the current determination; if the performance warning clearing rule exists, further judging whether the corresponding performance warning clearing rule exists, and if the performance warning clearing rule does not exist, finishing the judgment in the current round; if the performance alarm clearing rule does not meet the performance alarm clearing rule, the current round of judgment is finished; if yes, triggering a performance clearing alarm, standardizing the performance alarm and outputting an alarm message, and finishing the judgment in the current round;
the performance alarm clearing rules are of the following two types:
performance index recovery type: when the performance data does not meet the performance threshold condition, the system generates a performance clearing alarm and clears the performance alarm generated before;
alarm clearing observation period type: when the performance data does not meet the performance threshold condition and does not deteriorate within a certain time range, the system generates a performance clearing alarm and clears the performance alarm generated before;
the output content after the performance alarm is standardized comprises the following contents:
alarm title, alarm network element manufacturer, alarm network element type, alarm occurrence time, alarm type, alarm level, alarm source and alarm details.
It should be noted that although several modules of the processing device based on the custom performance threshold alert rule are mentioned in the above detailed description, such partitioning is merely exemplary and not mandatory. Indeed, the features and functionality of two or more of the modules described above may be embodied in one module according to embodiments of the invention. Conversely, the features and functions of one module described above may be further divided into embodiments by a plurality of modules.
Based on the aforementioned inventive concept, as shown in fig. 5, the present invention further provides a computer device 200, which includes a memory 210, a processor 220, and a computer program 230 stored on the memory 210 and operable on the processor 220, wherein when the processor 220 executes the computer program 230, the processing method and apparatus based on the customized performance threshold warning rule are implemented.
Based on the above inventive concept, the present invention further provides a computer readable storage medium, in which a computer program for executing the processing method and apparatus based on the customized performance threshold warning rule is stored.
The processing method and the device based on the custom performance threshold value alarm rule carry out comprehensive deep monitoring aiming at the monitoring granularity, the association degree and the dimensionality of abnormal performance data, thereby judging and processing whether various performance indexes meet the threshold value rule and generating standardized performance alarm and performance clearing alarm in real time, meeting the personalized monitoring requirements of monitoring personnel in various network professions, different levels and different areas, and greatly improving the monitoring efficiency and the visualization degree in daily operation and maintenance work orders.
While the spirit and principles of the invention have been described with reference to several particular embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, nor is the division of aspects, which is for convenience only as the features in such aspects may not be combined to benefit. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.
The limitation of the protection scope of the present invention is understood by those skilled in the art, and various modifications or changes which can be made by those skilled in the art without inventive efforts based on the technical solution of the present invention are still within the protection scope of the present invention.
Claims (12)
1. A processing method based on a custom performance threshold alarm rule is characterized by comprising the following steps:
the system receives real-time performance data from kafka;
the system loads a refresh performance threshold alarm rule from a database at regular time;
judging whether the performance data meets a performance alarm generation rule of a performance threshold condition, if so, triggering a performance alarm, standardizing the performance alarm and outputting an alarm message, and finishing the judgment in the current round;
if not, further judging whether an uncleaned active alarm exists at present, and if not, finishing the judgment in the current round;
if the performance warning clearing rule exists, further judging whether the corresponding performance warning clearing rule exists, and if the performance warning clearing rule does not exist, finishing the judgment in the current round;
if the performance alarm clearing rule does not meet the performance alarm clearing rule, the current round of judgment is finished;
if yes, triggering performance clearing alarm, standardizing the performance alarm and outputting alarm information, and finishing the judgment in the current round.
2. The processing method of claim 1, wherein the setting of the performance threshold condition is defined from four dimensions, namely an index dimension, a threshold source, a network element dimension, and an index granularity.
3. The method of claim 1, wherein the performance alarm generation rules are defined in the following dimensions:
whether performance alarm generation rules are enabled;
generating an alarm title and an alarm level of the alarm;
the effective time range of the performance alarm generation rule comprises start-stop time;
frequency, i.e., the number of durations that satisfy a performance threshold condition;
an observation period, i.e. an observation time window after meeting the performance threshold condition;
trigger pattern in time dimension: the judgment of a static threshold and a dynamic threshold is supported;
priority levels can be set among all performance threshold value alarm rules of the same index, and only one alarm is reported by the same index finally;
the alarms compressed according to the performance threshold alarm rules need to be presented as sub-alarms of the main alarm triggered by the performance threshold alarm rules; and aiming at the performance alarm generated frequently by the alarm, all alarm information can be downloaded into the performance alarm.
4. The method of claim 1, wherein the performance alarm clearing rules are of the following two types:
performance index recovery type: when the performance data does not meet the performance threshold condition, the system generates a performance clearing alarm and clears the performance alarm generated before;
alarm clearing observation period type: that is, when the performance data does not satisfy the performance threshold condition and no deterioration occurs within a certain time range, the system generates a performance clearing alarm and clears the previously generated performance alarm.
5. The processing method according to claim 1, wherein the content outputted after the performance alarm is normalized comprises:
alarm title, alarm network element manufacturer, alarm network element type, alarm occurrence time, alarm type, alarm level, alarm source and alarm details.
6. A processing apparatus based on a custom performance threshold alarm rule, the apparatus comprising:
the performance data real-time receiving module is used for receiving the real-time performance data from the kafka;
the performance threshold value alarming rule loading module is used for regularly loading and refreshing the performance threshold value alarming rule from the database;
the performance alarm triggering module is used for judging whether the performance data meets the performance alarm generation rule of the performance threshold condition, if so, triggering the performance alarm, standardizing the performance alarm and outputting an alarm message, and finishing the judgment in the current round;
the performance clearing alarm triggering module is used for further judging whether an unremoved active alarm exists at present or not under the condition that the performance data does not meet the performance alarm triggering rule of the performance threshold condition, and if not, the current judgment is finished; if the performance warning clearing rule exists, further judging whether the corresponding performance warning clearing rule exists, and if the performance warning clearing rule does not exist, finishing the judgment in the current round; if the performance alarm clearing rule does not meet the performance alarm clearing rule, the current round of judgment is finished; if yes, triggering performance clearing alarm, standardizing the performance alarm and outputting alarm information, and finishing the judgment in the current round.
7. The apparatus according to claim 6, wherein the setting of the performance threshold condition is defined from four dimensions, namely an index dimension, a threshold source, a network element dimension, and an index granularity.
8. The apparatus according to claim 6, wherein the performance alarm generation rule is defined by the following dimensions:
whether performance alarm generation rules are enabled;
generating an alarm title and an alarm level of the alarm;
the effective time range of the performance alarm generation rule comprises start-stop time;
frequency, i.e., the number of durations that satisfy a performance threshold condition;
an observation period, i.e. an observation time window after meeting the performance threshold condition;
trigger pattern in time dimension: the judgment of a static threshold and a dynamic threshold is supported;
priority levels can be set among all performance threshold value alarm rules of the same index, and only one alarm is reported by the same index finally;
the alarms compressed according to the performance threshold alarm rules need to be presented as sub-alarms of the main alarm triggered by the performance threshold alarm rules; and aiming at the performance alarm generated frequently by the alarm, all alarm information can be downloaded into the performance alarm.
9. The apparatus according to claim 6, wherein the performance alarm clearing rules are of the following two types:
performance index recovery type: when the performance data does not meet the performance threshold condition, the system generates a performance clearing alarm and clears the performance alarm generated before;
alarm clearing observation period type: that is, when the performance data does not satisfy the performance threshold condition and no deterioration occurs within a certain time range, the system generates a performance clearing alarm and clears the previously generated performance alarm.
10. The apparatus according to claim 6, wherein the normalized output content of the performance alarm comprises:
alarm title, alarm network element manufacturer, alarm network element type, alarm occurrence time, alarm type, alarm level, alarm source and alarm details.
11. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the method of any of claims 1-5 when executing the computer program.
12. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program for executing the method of any one of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011359663.4A CN112565009A (en) | 2020-11-27 | 2020-11-27 | Processing method and device based on custom performance threshold alarm rule |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011359663.4A CN112565009A (en) | 2020-11-27 | 2020-11-27 | Processing method and device based on custom performance threshold alarm rule |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112565009A true CN112565009A (en) | 2021-03-26 |
Family
ID=75046367
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011359663.4A Pending CN112565009A (en) | 2020-11-27 | 2020-11-27 | Processing method and device based on custom performance threshold alarm rule |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112565009A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113205666A (en) * | 2021-05-06 | 2021-08-03 | 广东鹰视能效科技有限公司 | Early warning method |
| CN114205215A (en) * | 2021-12-06 | 2022-03-18 | 湖北天融信网络安全技术有限公司 | Data pre-analysis method and device |
| CN114708717A (en) * | 2022-04-18 | 2022-07-05 | 中国银行股份有限公司 | Association alarm method and device for system monitoring |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102118276A (en) * | 2009-12-31 | 2011-07-06 | 北京亿阳信通软件研究院有限公司 | Method and device for providing performance alarm services |
| CN103684862A (en) * | 2013-12-06 | 2014-03-26 | 大唐移动通信设备有限公司 | Alarm information processing method, device and system and equipment |
| US20150004964A1 (en) * | 2009-07-15 | 2015-01-01 | Rockstar Consortium Us Lp | Method and apparatus for telecommunications network performance anomaly events detection and notification |
| CN105323100A (en) * | 2014-07-31 | 2016-02-10 | 中兴通讯股份有限公司 | Method and device for generating alarm |
| CN108880917A (en) * | 2018-08-23 | 2018-11-23 | 华为技术有限公司 | Switching method, device and turn control separation system of control plane equipment |
| CN109218097A (en) * | 2018-09-19 | 2019-01-15 | 山东浪潮云投信息科技有限公司 | A kind of warning system and alarm method of cloud platform configurable alert rule |
| CN109257200A (en) * | 2017-07-14 | 2019-01-22 | 北京京东尚科信息技术有限公司 | The method and apparatus of big data platform monitoring |
| CN110674013A (en) * | 2019-10-08 | 2020-01-10 | 浪潮云信息技术有限公司 | GPU monitoring alarm system with cloud platform capable of achieving custom monitoring |
-
2020
- 2020-11-27 CN CN202011359663.4A patent/CN112565009A/en active Pending
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150004964A1 (en) * | 2009-07-15 | 2015-01-01 | Rockstar Consortium Us Lp | Method and apparatus for telecommunications network performance anomaly events detection and notification |
| CN102118276A (en) * | 2009-12-31 | 2011-07-06 | 北京亿阳信通软件研究院有限公司 | Method and device for providing performance alarm services |
| CN103684862A (en) * | 2013-12-06 | 2014-03-26 | 大唐移动通信设备有限公司 | Alarm information processing method, device and system and equipment |
| CN105323100A (en) * | 2014-07-31 | 2016-02-10 | 中兴通讯股份有限公司 | Method and device for generating alarm |
| CN109257200A (en) * | 2017-07-14 | 2019-01-22 | 北京京东尚科信息技术有限公司 | The method and apparatus of big data platform monitoring |
| CN108880917A (en) * | 2018-08-23 | 2018-11-23 | 华为技术有限公司 | Switching method, device and turn control separation system of control plane equipment |
| CN109218097A (en) * | 2018-09-19 | 2019-01-15 | 山东浪潮云投信息科技有限公司 | A kind of warning system and alarm method of cloud platform configurable alert rule |
| CN110674013A (en) * | 2019-10-08 | 2020-01-10 | 浪潮云信息技术有限公司 | GPU monitoring alarm system with cloud platform capable of achieving custom monitoring |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113205666A (en) * | 2021-05-06 | 2021-08-03 | 广东鹰视能效科技有限公司 | Early warning method |
| CN113205666B (en) * | 2021-05-06 | 2022-06-17 | 广东鹰视能效科技有限公司 | Early warning method |
| CN114205215A (en) * | 2021-12-06 | 2022-03-18 | 湖北天融信网络安全技术有限公司 | Data pre-analysis method and device |
| CN114708717A (en) * | 2022-04-18 | 2022-07-05 | 中国银行股份有限公司 | Association alarm method and device for system monitoring |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112565009A (en) | Processing method and device based on custom performance threshold alarm rule | |
| US10013866B2 (en) | Production equipment monitoring method and system | |
| CN102447570B (en) | Monitoring device and method based on health degree analysis | |
| CN107239388A (en) | A kind of monitoring alarm method and system | |
| CN111679958A (en) | Server monitoring system | |
| CN103440726A (en) | Electrical fire warning information processing method and system | |
| CN104156297A (en) | Warning method and device | |
| CN102568147B (en) | Alarm method for software failure of semiconductor device | |
| CN112564949A (en) | Analysis method and device based on cross-professional alarm association rule | |
| CN113109659A (en) | Distribution automation monitoring system | |
| CN113377559A (en) | Big data based exception handling method, device, equipment and storage medium | |
| CN112116123A (en) | Intelligent alarm method and system based on dynamic baseline | |
| CN116820014B (en) | Intelligent monitoring and early warning method and system for traffic electromechanical equipment | |
| CN105871611A (en) | Network management system supervision platform and supervision method | |
| CN105278521A (en) | Method and device for diagnosing fault cause of unit and air conditioning unit | |
| CN110198224A (en) | A kind of alarm processing method, apparatus and system | |
| CN112324627A (en) | Wind generating set generator bearing temperature alarm system | |
| CN106199251A (en) | A kind of distribution network failure early warning system analyzed based on adaptive modeling and method | |
| CN113779327B (en) | Equipment monitoring management system based on full life cycle data of ship equipment | |
| CN111062503A (en) | Power grid monitoring alarm processing method, system, terminal and storage medium | |
| CN110988584A (en) | Intelligent monitoring and automatic control system for electric power system | |
| CN115940399A (en) | Ring main unit fault online early warning method, device and system and early warning monitoring equipment | |
| CN114398222A (en) | Method for declaratively visually configuring Prometheus monitoring alarm | |
| US20220187814A1 (en) | Collection and use of data distributed throughout industrial systems | |
| CN112581715B (en) | Battery high-temperature alarm method, device and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20210326 |