CN115086146A

CN115086146A - Alarm processing method, device, equipment and storage medium

Info

Publication number: CN115086146A
Application number: CN202210658055.6A
Authority: CN
Inventors: 张航; 莫兵臣; 钱能胜; 朱斌; 周冉曌
Original assignee: Shenzhen Sensetime Technology Co Ltd
Current assignee: Shenzhen Sensetime Technology Co Ltd
Priority date: 2022-06-10
Filing date: 2022-06-10
Publication date: 2022-09-20

Abstract

The embodiment of the disclosure discloses an alarm processing method, an alarm processing device, alarm processing equipment and a storage medium, wherein the method comprises the following steps: acquiring first alarm information and a first alarm scheme matched with the first alarm information; the first alarm scheme comprises attribute information of at least two processing nodes and a dependency relationship between the at least two processing nodes; generating an alarm task based on the first alarm information and the attribute information of at least two processing nodes; the alarm task comprises a subtask which needs to be processed by each processing node; and dispatching a corresponding subtask in the alarm task for each processing node based on the dependency relationship between at least two processing nodes.

Description

Alarm processing method, device, equipment and storage medium

Technical Field

The present disclosure relates to, but not limited to, the field of computer technologies, and in particular, to an alarm processing method, apparatus, device, and storage medium.

Background

With the continuous development of computer technology, various computer services are widely used, and related personnel need to process a large amount of alarm information in the running process of the computer services. With the increasing complexity and quantity of the alarm information, the decision cost and the time cost of the related personnel are increased gradually.

Disclosure of Invention

In view of this, the embodiments of the present disclosure at least provide an alarm processing method, apparatus, device and storage medium.

The technical scheme of the embodiment of the disclosure is realized as follows:

in one aspect, an embodiment of the present disclosure provides an alarm processing method, where the method includes:

acquiring first alarm information and a first alarm scheme matched with the first alarm information; the first alarm scheme comprises attribute information of at least two processing nodes and a dependency relationship between the at least two processing nodes;

generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes; wherein, the alarm task comprises a subtask which needs to be processed by each processing node;

and dispatching a corresponding subtask in the alarm task for each processing node based on the dependency relationship between the at least two processing nodes.

In another aspect, an embodiment of the present disclosure provides an alarm processing apparatus, where the apparatus includes:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring first alarm information and a first alarm scheme matched with the first alarm information; the first alarm scheme comprises attribute information of at least two processing nodes and a dependency relationship between the at least two processing nodes;

the generating module is used for generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes; the alarm task comprises a subtask which needs to be processed by each processing node;

and the dispatching module is used for dispatching the corresponding subtask in the alarm task for each processing node based on the dependency relationship between the at least two processing nodes.

In yet another aspect, the present disclosure provides a computer device, including a memory and a processor, where the memory stores a computer program executable on the processor, and the processor implements some or all of the steps of the above method when executing the program.

In yet another aspect, the disclosed embodiments provide a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements some or all of the steps of the above-described method.

In yet another aspect, the disclosed embodiments provide a computer program comprising computer readable code, which when run in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

In yet another aspect, the disclosed embodiments provide a computer program product comprising a non-transitory computer readable storage medium storing a computer program, which when read and executed by a computer, implements some or all of the steps of the above method.

In the embodiment of the disclosure, first alarm information and a first alarm scheme matched with the first alarm information are obtained; the first alarm scheme comprises attribute information of at least two processing nodes and a dependency relationship between the at least two processing nodes; generating an alarm task based on the first alarm information and the attribute information of at least two processing nodes; the alarm task comprises a subtask which needs to be processed by each processing node; and dispatching a corresponding subtask in the alarm task for each processing node based on the dependency relationship between at least two processing nodes. Therefore, the subtasks which need to be processed by each processing node can be generated based on the first alarm information and the attribute information of the processing node in the alarm scheme matched with the first alarm information, so that the corresponding subtasks can be distributed to each processing node with dependency relationship, the first alarm information is processed together, the processing flow of the alarm information can be simplified, and the processing efficiency of the alarm information and the like can be improved.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the technical aspects of the disclosure.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure.

Fig. 1 is a schematic diagram of an implementation flow of an alarm processing method according to an embodiment of the present disclosure;

fig. 2 is a schematic diagram illustrating an implementation flow of an alarm processing method according to an embodiment of the present disclosure;

fig. 3 is a schematic diagram illustrating an implementation flow of an alarm processing method according to an embodiment of the present disclosure;

fig. 4 is a schematic diagram of an implementation flow of an alarm processing method according to an embodiment of the present disclosure;

fig. 5 is a schematic flow chart illustrating an implementation of a flow processing method of an alarm scenario according to an embodiment of the present disclosure;

fig. 6A is a schematic diagram illustrating management of an alarm scenario set according to an embodiment of the present disclosure;

FIG. 6B is a schematic view illustrating an alarm scenario provided by the embodiment of the present disclosure;

fig. 6C is an editing schematic diagram of an alarm scenario provided by the embodiment of the present disclosure;

fig. 6D is an editing schematic diagram of a processing node according to an embodiment of the disclosure;

fig. 7A is a schematic diagram illustrating an implementation of a pushing manner according to an embodiment of the present disclosure;

fig. 7B is a schematic diagram illustrating an implementation of a pushing manner according to an embodiment of the disclosure;

fig. 8 is a schematic flow chart illustrating an implementation of updating a storage space according to an embodiment of the present disclosure;

fig. 9 is a schematic structural diagram of a component of an alarm processing apparatus according to an embodiment of the present disclosure;

fig. 10 is a hardware entity diagram of a computer device according to an embodiment of the present disclosure.

Detailed Description

For the purpose of making the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure are further elaborated with reference to the drawings and the embodiments, the described embodiments should not be construed as limiting the present disclosure, and all other embodiments obtained by a person of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present disclosure.

In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. Reference to the terms "first/second/third" merely distinguishes similar objects and does not denote a particular ordering with respect to the objects, it being understood that "first/second/third" may, where permissible, be interchanged in a particular order or sequence so that embodiments of the disclosure described herein can be practiced in other than the order shown or described herein.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for the purpose of describing the disclosure only and is not intended to be limiting of the disclosure.

The disclosed embodiments provide an alarm processing method, which may be executed by a processor of a computer device. The computer device refers to a device with alarm processing capability, such as a server, a notebook computer, a tablet computer, a desktop computer, a smart television, a set-top box, a mobile device (e.g., a mobile phone, a portable video player, a personal digital assistant, a dedicated messaging device, and a portable game device). Fig. 1 is a schematic flow chart illustrating an implementation of an alarm processing method according to an embodiment of the present disclosure, as shown in fig. 1, the method includes the following steps S101 to S103:

step S101, acquiring first alarm information and a first alarm scheme matched with the first alarm information; the first alarm scheme comprises attribute information of at least two processing nodes and a dependency relationship between the at least two processing nodes.

Here, the alarm information may be understood as information generated due to occurrence of an abnormality for alerting a relevant person. The alarm information may include, but is not limited to, at least one of abnormal content, and information of time, place, etc. when the abnormality occurs. In some embodiments, an alarm event may be preset, and in the case of triggering the alarm event, it is determined that an abnormality occurs, so as to generate alarm information, and the alarm event may be understood as a preset event that may generate alarm information after being triggered. The alarm event may include: device failure events, data access exception events, and the like. For example: in the process of calling the camera of the equipment, under the condition that calling fails, warning information that the camera of the equipment fails can be generated. The first alarm information may be understood as the alarm information to be currently processed, and is not limited herein.

The alarm scheme may be understood as a preset processing scheme or processing flow for the alarm information. For example: the processing scheme is that an alarm list is generated according to the alarm information, the alarm list is sent to a processing department or a processing object according to a preset mode at preset time, the processing object is informed to process, and the like. The alarm list can be understood as a work document requiring processing remarks by processing departments at different levels and processing objects, and can be generated according to one alarm message or at least two alarm messages. Here, the first alarm scenario may be understood as an alarm scenario that matches the current first alarm information.

In some embodiments, different alarm information may match different alarm schemes, and different alarm schemes may be set according to one or more of attributes such as different alarm types, alarm levels, or alarm sources of the alarm information. The alert type may include the type of alert event that triggered the generation of alert information, such as: the type of abnormal operation of the access control equipment, the type of abnormal running of the vehicle and the like. The alarm level may be understood as a preset urgency level for processing alarm information, such as: a first level alarm may indicate a milder alarm and a second level alarm may indicate a more severe alarm. An alert source may be understood as a device that generates alert information, such as: cameras and sensing devices, etc. For example: the first alarm information of the first alarm type may be preset to match the first alarm scheme, the second alarm information of the second alarm type may be preset to match the second alarm scheme, and the like.

In some embodiments, the first warning information may be obtained from the first preset storage space at a preset time interval, and the first warning scheme may be matched in response to receiving the first warning information. For example: the preset time interval is set to be 30 seconds, and first alarm information is acquired from a first preset storage space such as a message queue or a server every 30 seconds. The first warning information sent by the operating device can also be received, and the operating device can be understood as a device provided with a warning event, such as an access control device. The operating device can generate and send first alarm information to the computer device under the condition of triggering the alarm event, so that the computer device running the alarm processing method can receive the first alarm information sent by the operating device, and can further respond to the received first alarm information and match a first alarm scheme and the like. One first alarm information may match one alarm scheme or may match a plurality of alarm schemes. When the first alarm information matches a plurality of alarm schemes, the first alarm information may be processed according to the plurality of matched alarm schemes, that is, the number of the first alarm information and the first alarm scheme is not limited.

In some embodiments, in response to receiving the first alarm information, a first alarm scheme matching the first alarm information may be determined from the set at least one alarm scheme according to a matching relationship between alarm information of different attributes stored in the second preset storage space and the alarm scheme. For example: and receiving the first alarm information, analyzing the first alarm information, and determining the alarm type of the first alarm information, so that the first alarm scheme is determined according to the alarm type and the preset matching relationship between the alarm type and the alarm scheme. The first alarm scheme can also be determined by determining the matching degree between the first alarm information and each preset alarm scheme. For example: and determining the matching degrees between the first alarm information and each preset alarm scheme to be 0.5, 0.7, 0.3 and the like by using the first prediction model, and taking the alarm scheme with the maximum matching degree with the first alarm information as the first alarm scheme. The first prediction model may be a pre-trained neural network, and outputs a matching degree with each preset alarm scheme, etc. by inputting alarm information.

In some embodiments, the first alarm scenario includes attribute information of at least two processing nodes, and dependencies between the at least two processing nodes. The processing node may be understood as one or more of objects for processing the first alarm information, such as a processing department or a processing object (related person), and the like. Different processing nodes can be used for improving the processing efficiency of the alarm information and the like aiming at the task of processing part or all of the first alarm information. For example: the first alarm scheme comprises three processing nodes, wherein the first processing node processes a first part of tasks of the first alarm information, the second processing node processes a second part of tasks of the first alarm information, and the third processing node processes a third part of tasks of the first alarm information; the first alert scheme may further include: the first processing node processes all tasks aiming at the first alarm information, if the first processing node cannot process all tasks, the second processing node can be reported, the second processing node continues to process all tasks aiming at the first alarm information, if the second processing node cannot process all tasks, the third processing node can be reported, and the third processing node continues to process all tasks aiming at the first alarm information. Here, the three processing nodes can process the first alarm information together, so that tasks such as maintenance or management are completed, and the situation that the alarm information cannot be processed in time is reduced.

In some embodiments, different processing nodes may be defined by configuring different attribute information for the processing nodes, which may include: processing object, alarm mode (such as system page pushing, acousto-optic prompting and the like), processing time, processing name, remark content and other information. For example: when the current time is 10:00, the processing time of the current processing node is 30 minutes, and within the time range from 10:00 to 10:30, if it is determined that the processing object of the current processing node cannot process the first alarm information, the first alarm information is transferred to the next processing node, and the processing object of the next processing node is reminded according to the alarm mode of the next processing node.

In some embodiments, in order to accurately and completely process the first alarm information, a dependency relationship between the processing nodes may be preset in the first alarm scenario, and the dependency relationship between the processing nodes may be understood as a processing order of the processing nodes in a processing process, and the like. For example: the processing order of the first processing node is prior (i.e., the first processing order), the processing order of the second processing node is intermediate (i.e., the second processing order), the processing order of the second processing node is subsequent (i.e., the third processing order), and so on. The dependency relationship between the processing nodes may be an upper-level relationship, a lower-level relationship, a peer-level relationship, or the like. For example: the dependency between at least two processing nodes comprises: the dependency relationship between the previous processing node and the current processing node, or the dependency relationship between the current processing node and the next processing node, etc. The processing node of the current processing order may be one, or may be multiple, for example: the processing nodes of the second processing order comprise a second processing node and a fourth processing node, each processing node processing a second part of the tasks of the first alarm information, and the like.

Step S102, generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes; and the alarm task comprises subtasks which need to be processed by each processing node.

Here, the alert task may be understood as a task generated for the first alert information, and the like. For example: analyzing the first alarm information, determining the reason for generating the first alarm information, and determining an alarm task and the like capable of dealing with the first alarm information according to the reason for generating the first alarm information. The generated alert task may be one or multiple, and is not limited herein, for example: generating an alarm task, wherein the first alarm task can comprise updating a software version, newly adding a calling interface and the like; and generating two alarm tasks, wherein the second alarm task comprises starting a firewall, and the third alarm task comprises changing a power supply and the like.

In some embodiments, the alert task may be generated based on the first alert information and attribute information of the at least two processing nodes. Different task templates can be set in advance according to the attribute information of each processing node, the alarm task is generated through the task module, and the task module can be a template used for generating the alarm task according to the alarm information. For example: and analyzing the first alarm information to obtain at least one task information field in the task template, and filling the task information field into the task template to generate the alarm task. The alarm task may also be generated using a generative model. The generated model can be a pre-trained neural network, and an alarm task and the like corresponding to the alarm information are obtained by inputting the alarm information and the attribute information of each processing node.

In some embodiments, the alarm task may include a sub-task that each processing node needs to process, that is, the sub-tasks of all the processing nodes in the first alarm scenario may be integrated into a complete alarm task corresponding to the first alarm information. For example: the first alarm scheme includes three processing nodes, and the alarm task includes a first subtask for a first processing node, a second subtask for a second processing node, and a third subtask for a third processing node. Each subtask may be identical, partially identical, completely different, etc. The subtasks of each processing node may be generated simultaneously or at different time periods, that is, the generation time of the subtasks of each processing node may be different. For example: generating an alarm task based on the first alarm information and the attribute information of at least two processing nodes, and then dividing the alarm task to obtain a plurality of subtasks; and then after the first subtask is processed, a second subtask and the like can be generated according to the first alarm information and the attribute information of the second processing node.

Step S103, based on the dependency relationship between the at least two processing nodes, a corresponding subtask in the alarm task is dispatched to each processing node.

Here, the dependency relationship between the processing nodes may be understood as a processing order and the like of the respective processing nodes in the processing procedure. For example: the processing order of the first processing node is prior (i.e., first processing order), the processing order of the second processing node is in-between (i.e., second processing order), the processing order of the second processing node is posterior (i.e., third processing order), and so on. The dependency relationship between the processing nodes may include a superior-inferior relationship, a peer relationship, and the like. For example: the dependency relationship between at least two processing nodes includes a dependency relationship between a previous processing node and a current processing node, or a dependency relationship between the current processing node and a next processing node, and the like.

In some embodiments, corresponding subtasks in the alarm task may be dispatched for each processing node in turn based on a dependency relationship between at least two processing nodes. For example: sending the first subtask to a previous processing node, after determining that the processing of the previous processing node is completed, sending the second subtask to a current processing node, and then sending the second subtask to a next processing node and the like; one subtask can be sent to one processing node, or can be sent to a plurality of processing nodes, and the sending time, the sending mode and other dispatching modes. For example: based on the dependency relationship between at least two processing nodes, a processing node (e.g., a third processing node, etc.) with the highest level is determined from the first alarm scenario, the first subtask is sent to the previous processing node and the processing node with the highest level, and after it is determined that the processing of the previous processing node is completed, the second subtask may be sent to the current processing node and the processing node with the highest level, etc.

In the embodiment of the disclosure, the subtasks to be processed by each processing node can be generated based on the first warning information and the attribute information of the processing node in the warning scheme matched with the first warning information, so that the corresponding subtasks can be dispatched for each processing node with dependency relationship to process the first warning information together, and further, the processing flow of the warning information can be simplified, and the processing efficiency of the warning information can be improved.

In some embodiments, the above alarm processing method may further include the following steps S111 to S112:

step S111, determining a target processing node of the first alarm scheme according to the dependency relationship between at least two processing nodes.

Here, the target processing node may be understood as a processing node with the highest level in the first alarm scenario, and is used to reduce the occurrence of the first alarm information being unable to be processed. For example: the first alarm scheme comprises three processing nodes, according to the dependency relationship among the processing nodes, the second processing node is a superior node of the first processing node, the third processing node is a superior node of the second processing node, and the third processing node is determined to be a target processing node. In some embodiments, a corresponding logic diagram (e.g., a tree diagram, etc.) in the first processing scheme may be determined according to the dependency relationship between the processing nodes, so that the target processing node is determined accurately and quickly according to the logic diagram. The logic diagram can be used for representing the dependency relationship among the processing nodes, and is helpful for simply and intuitively representing the relationship among the processing nodes.

In some embodiments, in the process of configuring the attribute information of the processing node, a target identifier may be added, and the target identifier may be used to characterize whether the processing node is a target processing node. For example: and setting the target identifications of the first processing node and the second processing node as 0 and the target identification of the third processing node as 1. Then the third processing node is the target processing node, etc. by determining that the target identification of the third processing node is 1.

Step S112, in a case that the subtask of the current processing node in the alert task is pushed to the current processing node, the subtask of the current processing node in the alert task is pushed to the target processing node.

Here, the target processing node may acquire and process the subtasks of any processing node, for example: under the condition that the subtask of the previous processing node is pushed to the previous processing node, the subtask of the previous processing node is pushed to the target processing node; and under the condition that the subtasks of the current processing node are pushed to the current processing node, pushing the subtasks of the current processing node to a target processing node and the like.

In some embodiments, the same pushing manner as that of pushing the subtask of the current processing node to the current processing node may be adopted to push the subtask of the current processing node to the target processing node, which is beneficial to reducing the processing complexity; the subtask of the current processing node can be pushed to the target processing node in a pushing mode different from that of pushing the subtask of the current processing node to the current processing node, and the pushing stability is improved. For example: the first interface may be invoked to push the subtask of the current processing node to the current processing node, the second interface may be invoked to push the subtask of the current processing node to the target processing node, and so on.

In the embodiment of the present disclosure, a target processing node of a first alarm scenario is determined according to a dependency relationship between at least two processing nodes, so that a subtask of a current processing node in an alarm task can be pushed to the target processing node under the condition that the subtask of the current processing node in the alarm task is pushed to the current processing node. Therefore, the target processing node can be accurately and quickly determined, the subtasks of the current processing node are pushed to the target processing node, and the processing efficiency of the alarm information and the like can be improved under the condition that the subtasks cannot be processed in time.

In some embodiments, the attribute information of each processing node includes an alarm mode and a processing object; the method may further include steps S121 to S122 of:

step S121, generating first notification information when the subtask of the current processing node in the alert task is pushed to the current processing node.

Here, the attribute information of each processing node may include an alarm manner and a processing object. The alarm mode may be a mode of reminding the processing object, and may include: the method comprises the following steps of selecting one or more of a mail reminding mode, a short message reminding mode, a voice reminding mode and the like, and can also comprise single reminding, repeated reminding and the like, and can also comprise real-time reminding, delayed reminding and the like. The processing object may be understood as an object capable of processing the alarm task, such as related personnel or related equipment. One processing node may include one processing object or may include a plurality of processing objects, and the processing objects of different processing nodes may be the same or different. The first notification information may be understood as information for reminding the processing object, for example: before 16:00, xx processing objects process information subtasks, and the like.

In some embodiments, the first notification information may be generated according to the attribute information and the subtask of the current processing node. For example: the method comprises the steps of presetting a first notification information template, adding character strings such as the current time, the names of processing objects and subtasks and the like into an area to be added in the first notification information template, and generating first notification information and the like.

Step S122, sending the first notification information to at least one processing object belonging to the current processing node in an alarm mode of the current processing node; or the first notification information is respectively sent to at least one processing object belonging to each processing node through an alarm mode of each processing node.

Here, in the case where the first notification information is generated, the first notification information may be transmitted to at least one processing object belonging to the current processing node in an alert manner of the current processing node. For example: and sending the first notification information to three processing objects belonging to the current processing node in a voice broadcast warning mode. The first notification information may also be sent to at least one processing object belonging to each processing node, respectively, in an alarm manner for each processing node. For example: sending the first notification information to any processing object belonging to the previous processing node in a voice broadcast warning mode; or the first notification information is sent to all processing objects belonging to the current processing node by an alarm mode of mail reminding, and the first notification information is sent to at least one processing object belonging to the next processing node by an alarm mode of short message reminding, and the like.

In the embodiment of the present disclosure, in a case that a subtask of a current processing node in an alarm task is pushed to the current processing node, first notification information may be generated, so that the first notification information is sent to at least one processing object belonging to the current processing node in an alarm manner of the current processing node, or the first notification information is sent to at least one processing object belonging to each processing node in an alarm manner of each processing node, respectively. Therefore, the first notification information can be simply and accurately generated, and the first notification information can be rapidly sent to at least one processing object of the current processing node, so that the situation that the notification is not timely occurs is reduced, or the first notification information is sent to at least one processing object of each processing node, the situation that the notification is missed is reduced, and the processing efficiency of the alarm information is improved.

An embodiment of the present disclosure provides an alarm processing method, as shown in fig. 2, the method includes the following steps S201 to S204:

step S201, determining attribute information of at least one dimension of the first warning information.

Here, the attribute information of the first alarm information may be understood as information carried by the alarm information, such as time, location, specific component, fault type, and the like, of triggering an alarm event. The alarm attribute may include attribute information for at least one dimension, such as one or more dimensions in alarm type, alarm level, or alarm source.

In some embodiments, in the process of generating the first warning information, a corresponding relationship between the attribute identifier of at least one field and the attribute information of each dimension may be preset to characterize the attribute information of the first warning information. For example: the method comprises the steps that a first field in first alarm information represents an alarm type, an attribute identifier is 1, a second field represents an alarm level, an attribute identifier is 3, and according to the corresponding relation between a preset attribute identifier and the attribute information, the alarm type of the first alarm information can be determined to be equipment failure, the alarm level is three-level alarm and the like.

Step S202, according to the attribute information of at least one dimension of the first alarm information, determining the first alarm scheme matched with the first alarm information from a preset alarm scheme set.

Here, a plurality of different alarm schemes may be set in advance according to different alarm attributes of the alarm information, and the alarm scheme set may include a plurality of alarm schemes and a correspondence between the alarm schemes and the alarm attributes. For example: the alarm information of the first alarm attribute corresponds to a first alarm scheme, and the alarm information of the second alarm attribute corresponds to a second alarm scheme, and the like. The first alarm scheme matched with the first alarm information can be determined from a preset alarm scheme set by determining attribute information of at least one dimension of the first alarm information. For example: and determining the alarm type of the first alarm information as the equipment fault, and determining the alarm scheme corresponding to the alarm type as the first alarm scheme according to the corresponding relation.

In some embodiments, the first alarm scheme matched with the first alarm information may be determined by a matching degree between the attribute information of at least one dimension of the first alarm information and each preset alarm scheme. For example: and obtaining the matching degrees between the attribute information of at least one dimension of the alarm information and each alarm scheme by using a second prediction model, wherein the matching degrees are respectively 0.6, 0.8, 0.9 and the like, and taking the alarm scheme with the maximum matching degree with the alarm information as the first alarm scheme. The second prediction model can be understood as a pre-trained neural network, and by inputting attribute information of at least one dimension of the alarm information, the matching degree between the second prediction model and each alarm scheme can be output.

Step S203, generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes.

Step S204, based on the dependency relationship between the at least two processing nodes, a corresponding subtask in the alarm task is dispatched for each processing node.

Here, the steps S203 to S204 correspond to the steps S102 to S103, respectively, and specific embodiments of the steps S102 to S103 may be referred to when the steps are performed.

In the embodiment of the disclosure, attribute information of at least one dimension of first alarm information is determined, a first alarm scheme matched with the first alarm information is determined from a preset alarm scheme set according to the attribute information of at least one dimension of the first alarm information, an alarm task is generated based on the first alarm information and the attribute information of at least two processing nodes, and a corresponding subtask in the alarm task is distributed to each processing node based on a dependency relationship between the at least two processing nodes. Therefore, the first alarm scheme matched with the first alarm information can be determined from the preset alarm scheme set according to the attribute information of at least one dimension of the first alarm information, so that the first alarm scheme can be accurately and quickly determined, the processing efficiency of the alarm information can be improved, and the like.

In some embodiments, the attribute information of at least one dimension of the first warning information includes at least one of: device name and alarm type; the step S202 may include the following steps S211 to S212:

step S211, determining attribute information of each alarm scheme; the attribute information of the alarm scheme includes at least one of: attention alert device and attention alert type.

Here, the attribute information of at least one dimension of the first warning information may include at least one of: device name and alarm type. The alarm device concerned may be understood as an alarm device associated with an alarm scheme, the alarm device may be understood as a device capable of generating alarm information, and the alarm type concerned may be understood as an alarm type associated with an alarm scheme. The attribute information of the alarm scheme may include at least one dimension, the attention alarm device includes at least one, the attention alarm type includes at least one, and the like.

Step S212, at least one of the following conditions: determining the first alarm scheme matched with the first alarm information from the alarm scheme set;

in the case that the device name belongs to the attention warning device;

in case the alert type belongs to the alert of interest type.

Here, in a case where the device name of the first alarm information belongs to the attention alarm device or the alarm type of the first alarm information belongs to the attention alarm type, a first alarm scenario matching the first alarm information may be determined from the alarm scenario set. For example: the alarm type of the first alarm information is equipment failure, and the equipment name is a second camera and the like. Determining that the warning scheme can be used as a first warning scheme under the condition that the concerned warning equipment of the warning scheme comprises a second camera; and under the condition that the concerned alarm equipment of the alarm scheme does not comprise the second camera, determining that the alarm scheme cannot be used as the first alarm scheme.

In the embodiment of the disclosure, the attribute information of each alarm scheme is determined, and the attribute information of the alarm scheme includes at least one of the following: and the attention alarm device and the attention alarm type can determine the first alarm scheme matched with the first alarm information from the alarm scheme set under the conditions that the device name of the first alarm information belongs to the attention alarm device, or the alarm type of the first alarm information belongs to the attention alarm type, and the like, so that the first alarm scheme can be simply and accurately determined, the processing efficiency of the alarm information is improved, and the like.

In some embodiments, the step S212 may include: step S221, determining the first alarm scenario matched with the first alarm information from the alarm scenario set stored in the first storage space.

Here, the preset alarm scenario set may be stored in a first storage space, such as a cache component Redis. In the process of determining the first alarm scheme matched with the first alarm information, the alarm scheme set may be obtained in the first storage space, and the first alarm scheme may be determined from the alarm scheme set. In some embodiments, if the first alarm scheme matching the first alarm information is not determined, a default alarm scheme may be used as the first alarm scheme, and the default alarm scheme may be any alarm scheme in the alarm scheme set. If the first alarm scheme matched with the first alarm information is not determined, prompt information (such as matching failure) can be generated, and the prompt information is output to a user and the like.

In some embodiments, the method may further include the following steps S231 to S232:

step S231, at least one of: updating the first alarm scheme to obtain an updated first alarm scheme;

in the case of adjusting attribute information of any of the processing nodes; in the case of adjusting the number of processing nodes; in the event that a dependency relationship between the at least two processing nodes is adjusted; in case of adjusting attribute information of any of the alarm scenarios.

Here, the updating of the first alarm scenario may be implemented by adjusting, in real time, attribute information of each processing node, adjusting the number of processing nodes (e.g., adding processing nodes, deleting processing nodes, or the like), adjusting a dependency relationship between at least two processing nodes (e.g., updating a dependency relationship between a first processing node and a second processing node to a dependency relationship between a first processing node and a fourth processing node, or the like), or adjusting one or more editing processes such as attribute information of any alarm scenario. After the first alarm scheme is updated, the updated first alarm scheme may be obtained, for example: the first alarm scheme before updating comprises three processing nodes, and the first alarm scheme after updating comprises four processing nodes and the like by adding the processing nodes.

Step S232, the first alarm scenario is migrated from the first storage space to a second storage space, and the updated first alarm scenario is stored in the first storage space.

Here, the second storage space may be a search Engine (ES) or the like for querying update information (e.g., update time, history version, etc.) of the first alarm scenario. And storing the updated first alarm scheme to the first storage space, so that the first alarm information can be matched in the first storage space subsequently.

In the embodiment of the disclosure, the first alarm scheme is updated to obtain an updated first alarm scheme, the first alarm scheme is migrated from the first storage space to the second storage space, and the updated first alarm scheme is stored in the first storage space, so that the alarm scheme set can be updated in time, the latest first alarm scheme is matched, the storage capacity of the first storage space is reduced, and the processing efficiency of alarm information is improved.

In some embodiments, the method may further include steps S241 to S242:

step S241 is to generate second notification information when the processing target of any of the processing nodes is adjusted.

Here, the processing object of any processing node may be adjusted in real time, for example: and adjusting two processing objects of the first processing node into three processing objects and the like. The second notification information may be adjustment information for characterizing the processing object, for example: the second notification information is that a new processing object is added to the first processing node.

Step S242, sending the second notification information to a push service, so that the push service modifies the subscription relationship of the push service according to the second notification information, and sends the first notification information to the processing object after the processing node is adjusted based on the modified subscription relationship.

Here, the push service may be a service for realizing transmission of the first notification information to the processing object, or the like, and the push service may set a subscription relationship between the processing node and the processing object in advance, and may transmit the first notification information to the corresponding processing object according to the subscription relationship when generating the first notification information, which contributes to improvement of information transmission efficiency, or the like. The push service may include a plurality of push interfaces (e.g., application program interfaces, etc.), and the first notification information may be sent to a plurality of processing objects by calling different push interfaces, etc. Taking the example of deleting the second processing object in the second processing node, before modification, the first notification information is sent to the first processing object and the second processing object of the second processing node; and after modification, sending the first notification information to a first processing object of the second processing node, and the like.

In the embodiment of the present disclosure, in a case that a processing object of any processing node is adjusted, second notification information is generated, and the second notification information is sent to the push service, so that the push service modifies a subscription relationship of the push service according to the second notification information, and based on the modified subscription relationship, the first notification information may be sent to the processing object that is adjusted by the processing node. Therefore, the first notification information can be simply and accurately sent to the corresponding processing object, and the processing efficiency of the alarm information is improved.

An embodiment of the present disclosure provides an alarm processing method, as shown in fig. 3, the method includes the following steps S301 to S304:

step S301, acquiring first alarm information and a first alarm scheme matched with the first alarm information.

Here, the step S301 corresponds to the step S101, and the specific implementation of the step S101 may be referred to.

Step S302, obtaining the processing result of the previous processing node to the subtask of the previous processing node.

Here, the processing result may be understood as a result of processing the sub-task after the processing node acquires the sub-task, such as processing completed, unprocessed, processing suspended, and reporting, and is not limited herein. The processing result may be determined by acquiring a processing instruction of a processing object of the processing node. For example: by parsing the processing instruction, the instruction content is determined, thereby determining the processing result. The processing instructions may include: and reporting the instruction, ignoring the instruction, waiting the instruction and the like, and responding to the processing instruction of the processing object by components such as a touch display screen, a keyboard or a mouse and the like. In the process of processing the first alarm information based on the first alarm scheme, a processing result of each processing node for a subtask of the processing node may be obtained, for example: and in the process of processing the subtask by the previous processing node, acquiring a processing result of the previous processing node on the subtask of the previous processing node, and the like.

Step S303, generating a subtask of the current processing node according to the processing result of the subtask of the previous processing node and the subtask of the previous processing node.

Here, for example: the processing result of the subtask of the previous processing node is unprocessed, and the subtask of the previous processing node is used as the subtask of the current processing node; and deleting the processed part in the subtasks of the current processing node, and generating the subtask of the next processing node based on the unprocessed part.

Step S304, based on the dependency relationship between the at least two processing nodes, dispatching corresponding subtasks in the alarm task to each processing node.

Here, the step S304 corresponds to the step S103, and the specific implementation of the step S103 can be referred to.

In the embodiment of the disclosure, first alarm information and a first alarm scheme matched with the first alarm information are obtained, a processing result of a previous processing node on a subtask of the previous processing node is obtained, a subtask of a current processing node is generated according to the processing result of the subtask of the previous processing node and the subtask of the previous processing node, and a corresponding subtask in an alarm task is distributed to each processing node based on a dependency relationship between at least two processing nodes. In this way, the subtask of the next processing node can be generated through the processing result of each processing node to the subtask of the processing node and the subtask of the processing node, so that an accurate subtask can be generated in time, and the processing efficiency of the alarm information and the like can be improved.

An embodiment of the present disclosure provides an alarm processing method, as shown in fig. 4, the method includes the following steps S401 to S404:

step S401, determining attribute information of at least one dimension of the first alarm information.

Step S402, generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes.

Here, the steps S401 to S402 correspond to the steps S101 to S102, respectively, and the detailed embodiments of the steps S101 to S102 can be referred to when the steps are performed.

Step S403, pushing the subtask of the previous processing node in the alarm task to the previous processing node.

Here, the previous processing node may be any processing node in the first alarm scenario, and is not limited herein. For example: the subtask of the previous processing node can be pushed to the previous processing node in a long connection pushing framework (such as Websocket) mode; the subtask of the previous processing node may also be pushed to the previous processing node in a real-time messaging framework (e.g., SignalR).

Step S404, in response to receiving the processing result of the subtask of the previous processing node, pushing the subtask of the current processing node in the alarm task to the current processing node.

Here, for example: receiving the processing result of the subtask of the last processing node at 17:00, pushing the subtask of the current processing node to the current processing node at 17:01, and the like.

In the embodiment of the disclosure, attribute information of at least one dimension of the first warning information is determined, a warning task is generated based on the first warning information and attribute information of at least two processing nodes, a subtask of a previous processing node in the warning task is pushed to the previous processing node, and the subtask of a current processing node in the warning task can be pushed to the current processing node in response to receiving a processing result of the subtask of the previous processing node. Therefore, the subtasks can be timely and accurately distributed to each processing node, and the processing efficiency of the alarm information is improved.

In some embodiments, the attribute information of each of the processing nodes comprises a treatment time; the method may further comprise:

step S411, determining attribute information of at least one dimension of the first alarm information.

Step S412, generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes.

Here, the steps S411 to S412 correspond to the steps S101 to S102, respectively, and specific embodiments of the steps S101 to S102 may be referred to when the steps are performed.

Step S413, pushing the subtask of the current processing node in the alarm task to the current processing node.

Here, the attribute information of each processing node may include a treatment time, which may be understood as a scheduled time for the processing node to process the subtask, and the treatment time of different processing nodes may be different. For example: setting the processing time of the current processing node to be 10 minutes, and pushing the subtask of the current processing node to the current processing node for 15:00, wherein the processing result of the current processing node is not received in a period from 15:00 to 15:10, and the conditions of abnormity and the like of the current processing node are determined; and in the time period of 15: 00-15: 10, receiving the processing result of the current processing node, and performing subsequent processing and the like according to the processing result.

Step S414, in a case that the processing result of the sub task of the current processing node is not received within the processing time, pushing the sub task of the next processing node in the alarm task to the next processing node.

Here, for example: and in the time period from 15:00 to 15:10, the processing result of the current processing node is not received, and in the time period from 15:10, the subtask of the next processing node in the alarm task is pushed to the next processing node, and the like.

In the embodiment of the disclosure, attribute information of at least one dimension of first warning information is determined, a warning task is generated based on the first warning information and attribute information of at least two processing nodes, a subtask of a current processing node in the warning task is pushed to the current processing node, and a subtask of a next processing node in the warning task can be pushed to the next processing node under the condition that a processing result of the subtask of the current processing node is not received within a processing time, so that the subtask can be dispatched to the processing node in time, the situation that the subtask cannot be processed in time is reduced, and the processing efficiency of the warning information is further improved.

The following describes an application of the alarm processing method provided by the embodiment of the present disclosure in an actual scene, and a scene of flow processing based on an alarm scheme is taken as an example for description.

The embodiment of the disclosure provides a flow processing method of an alarm scheme, which can determine the processing of each alarm message as a flow processing event. By introducing the alarm scheme, the processing aiming at the alarm information is completely streamlined, and the progress of the alarm task in the process of flow processing and the backtracking processing result can be tracked in time. Based on the alarm scheme, the alarm information with the attribute information being a specific dimensionality can be selected, a plurality of processing nodes with dependency relationships can be defined, and processing objects for processing alarm tasks can be defined on the processing nodes, so that the screening cost of invalid alarm information is reduced, the realization of alarm information flow processing is standardized, processing hidden dangers are timely discovered, and the stability of flow processing is maintained.

As shown in fig. 5, the method for processing the flow of the alarm scheme according to the embodiment of the present disclosure includes the following steps S501 to S511:

step S501, determining the scheme type of the first alarm scheme.

Here, after the first alarm information is obtained, the first alarm scenario matched with the first alarm information may be determined, so as to determine a scenario type of the first alarm scenario from the first alarm scenario, for example, the scenario type is a general scenario or an advanced scenario, which is helpful for screening alarm information through multiple dimensions, and improving a classification processing capability of the alarm information. The alarm task can be generated according to the attribute information such as the scheme type of the first alarm scheme and the first alarm information, and the alarm task can be pushed to the processing node for processing and the like.

Step S502, the alarm task flow is transferred to the first processing node, and the processing object of the first processing node is informed.

Here, after the alert task is generated, the alert task may be stored to a third storage space, which may be a relational database MySql. In the case that the alarm task is stored in the third storage space, the first processing node in the first alarm scenario and the processing object belonging to the first processing node may be determined, the alarm task is transferred to the first processing node, and the processing object of the first processing node is notified according to the alarm mode in the first processing node. In some embodiments, the alarm mode includes sound and light notification, short message notification, mail notification, and the like; after the alarm task flow is transferred to the first processing node, the processing object of the first processing node may not be notified.

In step S503, it is determined whether a processing result is received.

Here, the processing result may be processing completion or processing incompletion, and different processing flows may be executed subsequently according to different processing results.

In step S504, it is determined whether the processing is completed.

Here, in the case where the processing result has been received, it is possible to further determine the content of the processing result, for example, whether the processing is completed or not, and subsequently execute a different processing flow according to the different content of the processing result.

In step S505, it is determined whether the treatment time is exceeded.

Here, in the case where the processing result is not received, it may be determined whether or not the current time exceeds the treatment time, for example: when the current time is 12:20 and the handling time is 12:30, determining that the handling time is not exceeded, and continuing to wait for a processing result; when the current time is 12:35 and the handling time is 12:30, determining that the handling time is exceeded, then transferring the alarm task flow to the second processing node, and notifying a processing object of the second processing node, and the like.

Step S506, the alarm task flow is transferred to the second processing node, and the processing object of the second processing node is notified.

Here, in the case that the processing result is that the processing is not completed or the processing time is exceeded, the alert task flow may be transferred to the second processing node and the processing object of the second processing node is notified, so that the processing object can accurately acquire the task of the higher level in time.

And step S507, filing the alarm task.

Here, in the case where the processing result is that the processing is completed, the processing result may be pushed to all processing nodes and the like subsequent in the processing flow, such as the second processing node, the third processing node, and the fourth processing node. And the alarm tasks can be archived, for example, the alarm tasks are migrated to a second storage space (such as a search engine ES) for subsequent query, so that the historical alarm tasks can be determined simply and timely.

In step S508, it is determined whether the processing is completed.

Here, it may be determined whether a processing result of the second processing node for the alert task is received, and if the processing result of the second processing node for the alert task is received, it may be determined whether the processing result is processing completion, and different processing flows may be subsequently executed according to different processing results.

Step S509, the alarm task flow is transferred to the third processing node, and the processing object of the third processing node is notified.

Here, in the case where the processing result is that the processing is not completed or the processing time is exceeded, the alert task flow may be transferred to the third processing node and the processing object of the third processing node may be notified.

Step S510, the alarm task flow is transferred to the fourth processing node, and the processing object of the fourth processing node is notified.

Here, in the case where the processing result is that the processing is not completed or the processing time is exceeded, the alert task flow may be transferred to the fourth processing node and the processing object of the fourth processing node may be notified. The third processing node and the fourth processing node can understand the peer processing node, and any processing node of the peer processing node can process the alarm task.

Step S511, the alarm task flow is transferred to the target processing node, and the processing object of the target processing node is notified.

Here, in the case where the processing result of the third processing node (or the fourth processing node) is that the processing is not completed or the processing time is exceeded, the alarm task flow may be transferred to the target processing node, and the processing target of the target processing node or the like may be notified.

In some embodiments, the flow processing method of the alarm scheme may include a definition process and a storage space update process of the alarm scheme. The definition of the alarm scheme may include setting attribute information of the alarm scheme, attribute information of each processing node, dependency relationship between each processing node, and the like. The updating process of the storage space may include migrating the first alarm scenario from the first storage space to the second storage space, and storing the updated first alarm scenario to the first storage space, etc.

In some embodiments, the information related to the alarm scenario may be stored in the form of a storage structure table or the like. For example: the attribute information of the alarm scheme, such as the process name, the scheme type (e.g., a general scheme, a high-level scheme, etc.), attention alarm equipment, attention alarm type, scheme remark, etc., may be stored through the table one; the second table can store scheme identifiers corresponding to all the alarm schemes, can be associated with the first table, and can be used for representing the alarm schemes, and the scheme identifiers are unique; the third table can store concerned alarm devices and the like corresponding to each alarm scheme; the fourth table can store the dependency relationship among the processing nodes, and the like; the fifth table may store processing objects and the like corresponding to the respective processing nodes. The sixth table may store the push mode of the processing object of each processing node, and the like; the correspondence relation and the number of the storage structure table are obtained.

As shown in fig. 6A, may include: preset attention alarm types, such as a first type 601, a second type 602, a third type 603, a fourth type 604, a fifth type 605, a sixth type 606, a seventh type 607, an eighth type 608, and the like; the method can also comprise the following steps: attribute information of the alarm scenario, such as a process name 611, a plan type (i.e., scenario type) 612, an alarm type (i.e., attention alarm type) 613, an alarm device (i.e., attention alarm device) 614, a creator 615, a creation time 616, an affiliate 617, an update time 618, an operation 619, and the like. The preset function can be called by triggering controls such as a newly-built plan (namely, an alarm scheme) 621, viewing 622, editing 623, deleting 624 and the like, so that the alarm scheme is processed.

As shown in fig. 6B, may include: attribute information 631 of the alarm scenario, such as a process name, a scenario type, attention alarm devices, attention alarm types, scenario notes, and the like; processing nodes 632, e.g., a first processing node and a second processing node, and attribute information of each processing node, etc., may also be included; a scenario flow diagram 633 may also be included, such as an automation node, a must-pass node, handle flows and notifications, and so forth. The automatic nodes can be understood as default public nodes, and comprise scheme pushing nodes and scheme filing nodes. The scheme pushing node can generate an alarm task according to the first alarm scheme matched with the first alarm information, and transfer the alarm task to the first processing node; the scheme archiving node may migrate the first alarm scheme to a second storage space, and so on.

As shown in fig. 6C, editing of the alarm scenario and other processing may be implemented by editing the attribute information 641, the processing node 642, and other portions of the alarm scenario. As shown in fig. 6D, the editing, sorting, and other processing of each processing node in the alarm scenario may be implemented by editing the first processing node 651, the second processing node 652, and other parts.

In some embodiments, different scheme types may correspond to different push manners, as shown in fig. 7A, a first alarm scheme is a general scheme, and when an alarm task of a previous processing node is transferred to a current processing node, a processing object of the current processing node may be notified; in some embodiments, as shown in fig. 7B, the first alarm scenario is a high-level scenario, and in the case that the alarm task flow of the previous processing node is transferred to the current processing node, the processing object of the current processing node and the processing object of the next processing node may be notified, and the like.

An embodiment of the present disclosure provides a method for updating a storage space, as shown in fig. 8, the method for updating a storage space includes the following steps S801 to S805:

and step S801, establishing a first alarm scheme.

Here, the re-creation of the first alarm scenario may be implemented by the function of the new plan 621 control.

Step S802, storing the first alarm scheme in a first storage space.

Here, in the case where the first alert scenario is newly created, all information of the newly created first alert scenario may be stored in the first storage space in the form of a storage configuration table.

Step S803, the first alarm scenario is updated, and the first alarm scenario before updating is migrated from the first storage space to the second storage space.

Here, after editing the content such as the attribute information of the first alarm scenario and the attribute information of the processing node or the processing node, the first alarm scenario before update may be migrated from the first storage space to the second storage space. In some embodiments, the first alarm scenario before updating may be stored by table seven, and table seven may be stored to the second storage space.

Step S804, storing the updated first alarm scenario in the first storage space.

Here, the updated first alarm scenario may be stored to a first storage space, a relational database, a cache component, and the like.

Step S805, the second notification information is sent to the push service.

Here, in the case of adjusting a processing object of any processing node in the first alarm scenario, the second notification information may be generated and sent to the push service, so that the push service modifies a subscription relationship of the push service according to the second notification information, and based on the modified subscription relationship, the first notification information may be sent to the processing node adjusted processing object, and the like.

In the above embodiment, the first alarm scheme may be updated to obtain an updated first alarm scheme, the first alarm scheme is migrated from the first storage space to the second storage space, and the updated first alarm scheme is stored in the first storage space, so that the alarm scheme set may be updated in time, the latest first alarm scheme is matched, the storage capacity of the first storage space is reduced, and the processing efficiency of the alarm information is further improved.

Based on the foregoing embodiments, the embodiments of the present disclosure provide an alarm processing apparatus, where the apparatus includes each included unit and each module included in each unit, and may be implemented by a processor in a computer device; of course, the implementation can also be realized through a specific logic circuit; in the implementation process, the Processor may be a Central Processing Unit (CPU), a Microprocessor Unit (MPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), or the like.

Fig. 9 is a schematic structural diagram of a component of an alarm processing apparatus according to an embodiment of the present disclosure, and as shown in fig. 9, the alarm processing apparatus 900 includes: an obtaining module 910, a generating module 920 and a dispatching module 930, wherein: an obtaining module 910, configured to obtain first alarm information and a first alarm scenario matched with the first alarm information; the first alarm scheme comprises attribute information of at least two processing nodes and a dependency relationship between the at least two processing nodes; a generating module 920, configured to generate an alarm task based on the first alarm information and the attribute information of the at least two processing nodes; wherein, the alarm task comprises a subtask which needs to be processed by each processing node; a dispatching module 930, configured to dispatch, for each processing node, a corresponding sub-task in the alarm task based on a dependency relationship between the at least two processing nodes.

In some embodiments, the obtaining module is further configured to: determining attribute information of at least one dimension of the first alarm information; and determining the first alarm scheme matched with the first alarm information from a preset alarm scheme set according to the attribute information of at least one dimension of the first alarm information.

In some embodiments, the attribute information of at least one dimension of the first warning information includes at least one of: device name and alarm type; the acquisition module is further configured to: determining attribute information of each alarm scheme; the attribute information of the alarm scheme includes at least one of: attention alarm equipment and attention alarm types; at least one of: determining the first alarm scheme matched with the first alarm information from the alarm scheme set; in the case that the device name belongs to the attention warning device; in case the alert type belongs to the alert of interest type.

In some embodiments, the generating module is further to: acquiring a processing result of a previous processing node on a subtask of the previous processing node; generating a subtask of a current processing node according to a processing result of the subtask of the previous processing node and the subtask of the previous processing node; wherein the dependency relationship between the at least two processing nodes comprises: a dependency between the current processing node and the previous processing node and/or the next processing node.

In some embodiments, the dispatch module is further to: pushing the subtask of the last processing node in the alarm task to the last processing node; and under the condition of responding to the received processing result of the subtask of the last processing node, pushing the subtask of the current processing node in the alarm task to the current processing node.

In some embodiments, the attribute information of each of the processing nodes comprises a treatment time; the dispatch module is further configured to: pushing the subtasks of the current processing node in the alarm task to the current processing node; and under the condition that the processing result of the subtask of the current processing node is not received in the processing time, pushing the subtask of the next processing node in the alarm task to the next processing node.

In some embodiments, the apparatus further comprises: the first determining module is used for determining a target processing node of the first alarm scheme according to the dependency relationship between at least two processing nodes; a second determining module, configured to, when the subtask of the current processing node in the alert task is pushed to the current processing node, push the subtask of the current processing node in the alert task to the target processing node.

In some embodiments, the attribute information of each processing node includes an alarm mode and a processing object; the device further comprises:

a third determining module, configured to generate first notification information when a subtask of the current processing node in the alert task is pushed to the current processing node; a sending module, configured to send the first notification information to at least one processing object belonging to the current processing node in an alarm manner of the current processing node; or the first notification information is respectively sent to at least one processing object belonging to each processing node through an alarm mode of each processing node.

In some embodiments, the obtaining module is further configured to: determining the first alarm scheme matched with the first alarm information from the alarm scheme set stored in a first storage space; the device further comprises: an update module to update at least one of: updating the first alarm scheme to obtain an updated first alarm scheme; migrating the first alarm scheme from the first storage space to a second storage space, and storing the updated first alarm scheme to the first storage space; in the case of adjusting attribute information of any of the processing nodes; in the case of adjusting the number of processing nodes; in the event that a dependency relationship between the at least two processing nodes is adjusted; in case of adjusting attribute information of any of the alarm scenarios.

In some embodiments, the apparatus further comprises: a fourth determining module, configured to generate second notification information when a processing object of any of the processing nodes is adjusted; and the notification module is used for sending the second notification information to a push service so that the push service modifies the subscription relationship of the push service according to the second notification information, and sending the first notification information to the processing object after the processing node is adjusted based on the modified subscription relationship.

The above description of the apparatus embodiments, similar to the above description of the method embodiments, has similar beneficial effects as the method embodiments. In some embodiments, functions of or modules included in the apparatuses provided in the embodiments of the present disclosure may be used to perform the methods described in the above method embodiments, and for technical details not disclosed in the embodiments of the apparatuses of the present disclosure, please refer to the description of the method embodiments of the present disclosure for understanding.

It should be noted that, in the embodiment of the present disclosure, if the alarm processing method is implemented in the form of a software functional module and is sold or used as a standalone product, the alarm processing method may also be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present disclosure may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods described in the embodiments of the present disclosure. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read Only Memory (ROM), a magnetic disk, or an optical disk. Thus, embodiments of the present disclosure are not limited to any specific hardware, software, or firmware, or any combination thereof.

The embodiment of the present disclosure provides a computer device, which includes a memory and a processor, where the memory stores a computer program that can be run on the processor, and the processor implements some or all of the steps of the above method when executing the program.

The disclosed embodiments provide a computer-readable storage medium having stored thereon a computer program that, when executed by a processor, performs some or all of the steps of the above-described method. The computer readable storage medium may be transitory or non-transitory.

The disclosed embodiments provide a computer program comprising computer readable code, where the computer readable code runs in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

The disclosed embodiments provide a computer program product comprising a non-transitory computer readable storage medium storing a computer program that when read and executed by a computer performs some or all of the steps of the above method. The computer program product may be embodied in hardware, software or a combination thereof. In some embodiments, the computer program product is embodied in a computer storage medium, and in other embodiments, the computer program product is embodied in a Software product, such as a Software Development Kit (SDK), or the like.

Here, it should be noted that: the foregoing description of the various embodiments is intended to highlight differences between various embodiments that are the same or similar and that which may be referenced otherwise. The above description of the apparatus, storage medium, computer program and computer program product embodiments is similar to the description of the method embodiments above, with similar advantageous effects as the method embodiments. For technical details not disclosed in the embodiments of the disclosed apparatus, storage medium, computer program and computer program product, reference is made to the description of the embodiments of the method of the present disclosure for understanding.

It should be noted that fig. 10 is a schematic diagram of a hardware entity of a computer device in an embodiment of the present disclosure, and as shown in fig. 10, the hardware entity of the computer device 1000 includes: a processor 1001, a communication interface 1002, and a memory 1003, wherein:

the processor 1001 generally controls the overall operation of the computer device 1000.

The communication interface 1002 may enable the computer device to communicate with other terminals or servers via a network.

The Memory 1003 is configured to store instructions and applications executable by the processor 1001, and may also buffer data (e.g., image data, audio data, voice communication data, and video communication data) to be processed or already processed by the processor 1001 and modules in the computer apparatus 1000, and may be implemented by a FLASH Memory (FLASH) or a Random Access Memory (RAM). Data transmission between the processor 1001, the communication interface 1002, and the memory 1003 can be performed via the bus 1004.

It should be appreciated that reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present disclosure. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. It should be understood that, in various embodiments of the present disclosure, the sequence numbers of the above steps/processes do not mean the execution sequence, and the execution sequence of each step/process should be determined by the function and the inherent logic thereof, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure. The above-mentioned serial numbers of the embodiments of the present disclosure are merely for description, and do not represent the advantages or disadvantages of the embodiments.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

In the several embodiments provided in the present disclosure, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only a logical functional division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units; can be located in one place or distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, all the functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.

Those of ordinary skill in the art will understand that: all or part of the steps for realizing the method embodiments can be completed by hardware related to program instructions, the program can be stored in a computer readable storage medium, and the program executes the steps comprising the method embodiments when executed; and the aforementioned storage medium includes: various media that can store program codes, such as a removable Memory device, a Read Only Memory (ROM), a magnetic disk, or an optical disk.

Alternatively, the integrated unit of the present disclosure may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the present disclosure may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods described in the embodiments of the present disclosure. And the aforementioned storage medium includes: various media that can store program code, such as removable storage devices, ROMs, magnetic or optical disks, etc.

The above description is only an embodiment of the present disclosure, but the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily conceive of changes or substitutions within the technical scope of the present disclosure, and all the changes or substitutions should be covered by the scope of the present disclosure.

Claims

1. An alarm processing method, characterized in that the method comprises:

2. The method of claim 1, wherein the obtaining the first alarm information and the first alarm scenario matched with the first alarm information comprises:

determining attribute information of at least one dimension of the first alarm information;

and determining the first alarm scheme matched with the first alarm information from a preset alarm scheme set according to the attribute information of at least one dimension of the first alarm information.

3. The method of claim 2, wherein the attribute information of at least one dimension of the first warning information comprises at least one of: device name and alarm type; the determining, according to the attribute information of at least one dimension of the first alarm information, the first alarm scheme matched with the first alarm information from a preset alarm scheme set includes:

determining attribute information of each alarm scheme; the attribute information of the alarm scheme includes at least one of: attention alarm equipment and attention alarm types;

at least one of: determining the first alarm scheme matched with the first alarm information from the alarm scheme set;

in the case that the device name belongs to the attention warning device;

in case the alert type belongs to the alert of interest type.

4. The method according to any one of claims 1 to 3, wherein generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes comprises:

acquiring a processing result of a previous processing node on a subtask of the previous processing node;

generating a subtask of a current processing node according to a processing result of the subtask of the previous processing node and the subtask of the previous processing node;

wherein the dependency relationship between the at least two processing nodes comprises: a dependency between the current processing node and the previous processing node and/or the next processing node.

5. The method according to claim 4, wherein said dispatching a corresponding subtask among the alarm tasks for each of the processing nodes based on the dependency relationship between the at least two processing nodes comprises:

pushing the subtask of the last processing node in the alarm task to the last processing node;

and under the condition of responding to the received processing result of the subtask of the last processing node, pushing the subtask of the current processing node in the alarm task to the current processing node.

6. The method according to claim 4 or 5, wherein the attribute information of each of the processing nodes comprises a treatment time; the dispatching a corresponding subtask in the alarm task for each processing node based on the dependency relationship between the at least two processing nodes includes:

pushing the subtasks of the current processing node in the alarm task to the current processing node;

and under the condition that the processing result of the subtask of the current processing node is not received in the processing time, pushing the subtask of the next processing node in the alarm task to the next processing node.

7. The method of claim 5 or 6, further comprising:

determining a target processing node of the first alarm scheme according to the dependency relationship between at least two processing nodes;

and under the condition that the subtask of the current processing node in the alarm task is pushed to the current processing node, pushing the subtask of the current processing node in the alarm task to the target processing node.

8. The method according to any one of claims 1 to 7, wherein the attribute information of each of the processing nodes includes an alarm manner and a processing object; the method further comprises the following steps:

generating first notification information under the condition that the subtask of the current processing node in the alarm task is pushed to the current processing node;

sending the first notification information to at least one processing object belonging to the current processing node in an alarm mode of the current processing node; or

And respectively sending the first notification information to at least one processing object belonging to each processing node in an alarm mode of each processing node.

9. The method according to any one of claims 1 to 8, wherein the determining the first alarm scenario matching the first alarm information from the set of alarm scenarios comprises:

determining the first alarm scheme matched with the first alarm information from the alarm scheme set stored in a first storage space;

the method further comprises the following steps:

at least one of: updating the first alarm scheme to obtain an updated first alarm scheme;

migrating the first alarm scheme from the first storage space to a second storage space, and storing the updated first alarm scheme to the first storage space;

in the case of adjusting attribute information of any of the processing nodes;

in the case of adjusting the number of processing nodes;

in the event that a dependency relationship between the at least two processing nodes is adjusted;

in case of adjusting attribute information of any of the alarm scenarios.

10. The method of claim 9, further comprising:

generating second notification information when a processing object of any one of the processing nodes is adjusted;

and sending the second notification information to a push service, so that the push service modifies the subscription relationship of the push service according to the second notification information, and sending the first notification information to the processing object adjusted by the processing node based on the modified subscription relationship.

11. An alarm processing apparatus, comprising:

the acquisition module is used for acquiring first alarm information and a first alarm scheme matched with the first alarm information; the first alarm scheme comprises attribute information of at least two processing nodes and a dependency relationship between the at least two processing nodes;

the generating module is used for generating an alarm task based on the first alarm information and the attribute information of the at least two processing nodes; wherein, the alarm task comprises a subtask which needs to be processed by each processing node;

12. A computer device comprising a memory and a processor, the memory storing a computer program operable on the processor, wherein the processor implements the steps of the method of any one of claims 1 to 10 when executing the program.

13. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 10.