CN115378791A - Data management method, device, storage medium and electronic equipment - Google Patents
Data management method, device, storage medium and electronic equipment Download PDFInfo
- Publication number
- CN115378791A CN115378791A CN202211007362.4A CN202211007362A CN115378791A CN 115378791 A CN115378791 A CN 115378791A CN 202211007362 A CN202211007362 A CN 202211007362A CN 115378791 A CN115378791 A CN 115378791A
- Authority
- CN
- China
- Prior art keywords
- field
- current alarm
- data
- alarm
- current
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Alarm Systems (AREA)
Abstract
The application discloses a data management method, a data management device, a storage medium and electronic equipment. The method comprises the steps of carrying out relevance numerical calculation on a current alarm field corresponding to current alarm data, automatically filtering the current alarm data when the current alarm data are determined to be repeated alarm data according to the relevance numerical value, and realizing automatic investigation of the alarm data.
Description
Technical Field
The present application relates to the field of network communication technologies, and in particular, to a data management method and apparatus, a storage medium, and an electronic device.
Background
In the current operation and maintenance monitoring system, as the production scale is larger and larger, the system architecture of the operation and maintenance monitoring system becomes more and more complex, and more node instances and services need to be monitored, when a certain node in a cluster fails and cannot serve to generate an alarm, normal service of other nodes in the cluster is often caused, so that other nodes also generate alarm data, and thus an alarm storm is generated.
Under the huge pressure caused by the alarm storm, operation and maintenance personnel are usually required to check all alarm data one by virtue of personal experience, a large amount of labor cost and time cost are consumed in the process, the checking efficiency of the alarm data is low, and the subsequent operation and maintenance fault processing process becomes very difficult.
Disclosure of Invention
The application provides a data management method, a data management device, a storage medium and electronic equipment, which are used for relieving the technical problem of low checking efficiency of current alarm data.
In order to solve the technical problem, the present application provides the following technical solutions:
the application provides a data management method, which comprises the following steps:
acquiring current alarm data;
determining a current alarm field according to the current alarm data;
determining a relevancy calculation mode corresponding to the current alarm field according to the field type of the current alarm field;
calculating the correlation degree value of the current alarm data and the historical alarm data based on the correlation degree calculation mode;
and if the correlation numerical value meets the repeated alarm condition, filtering the current alarm data.
Wherein, the step of obtaining the current alarm data comprises:
collecting a plurality of fault information in a preset period;
and generating a plurality of corresponding current alarm data according to each fault information.
Wherein, the step of determining the current alarm field according to the current alarm data comprises:
detecting the alarm level corresponding to each current alarm data;
and sequencing the current alarm data according to the alarm level, and sequentially performing field extraction processing on the current alarm data according to the sequencing to obtain the current alarm field corresponding to the current alarm data.
The step of determining the correlation degree calculation mode corresponding to the current alarm field according to the field type of the current alarm field includes:
if the field type of the current alarm field is a numerical value type, determining that a correlation degree calculation mode corresponding to the current alarm field is a numerical value correlation degree calculation mode;
if the field type of the current alarm field is the character type, determining that the relevancy calculation mode corresponding to the current alarm field is the character relevancy calculation mode;
and if the field type of the current alarm field is a time type, determining that the correlation degree calculation mode corresponding to the current alarm field is a time correlation degree calculation mode.
Wherein, before the step of calculating the correlation value between the current alarm data and the historical alarm data based on the correlation calculation mode, the method further comprises the following steps:
reading historical alarm data in a historical alarm database;
performing field extraction processing on the historical alarm data to obtain historical alarm fields corresponding to the historical alarm data; wherein the field types of the historical alarm field comprise the numerical value type, the character type and the time type.
Wherein the step of calculating the correlation value between the current alarm data and the historical alarm data based on the correlation calculation mode comprises:
calculating field similarity values of each current alarm field and each historical alarm field based on the correlation calculation mode;
and determining the correlation value of the current alarm data and the historical alarm data according to the field similarity value.
Wherein, the step of calculating the field similarity value of each current alarm field and each historical alarm field based on the correlation calculation mode comprises the following steps:
comparing the value corresponding to the historical alarm field with the value corresponding to the current alarm field based on the value correlation degree calculation mode to obtain a value comparison value;
and taking the numerical comparison value as the field similarity value.
Wherein, the step of calculating the field similarity value of each current alarm field and each historical alarm field based on the correlation calculation mode further comprises:
comparing the characters corresponding to the historical alarm fields with the characters corresponding to the current alarm fields based on the character relevance calculation mode to obtain character comparison values;
and taking the character comparison value as the field similarity value.
Wherein the step of calculating the field similarity value between the current alarm field and the historical alarm field based on the relevancy calculation mode further comprises:
comparing the time interval corresponding to the historical alarm field with the time interval corresponding to the current alarm field based on the time correlation degree calculation mode to obtain a time interval comparison value;
and taking the time interval comparison value as the field similarity value.
Wherein, if the correlation value satisfies the repeated alarm condition, the step of filtering the current alarm data includes:
if the correlation degree value is larger than or equal to a correlation degree threshold value, determining that the correlation degree value meets the repeated alarm condition, and determining that the data type of the current alarm data is the repeated alarm data type;
and writing the current alarm data into the historical alarm database, and removing the current alarm data from an alarm data queue to filter the current alarm data.
An embodiment of the present application further provides a data management apparatus, including:
the acquisition module is used for acquiring current alarm data;
a current alarm field determining module, configured to determine a current alarm field according to the current alarm data;
the relevancy calculation mode determining module is used for determining a relevancy calculation mode corresponding to the current alarm field according to the field type of the current alarm field;
the calculation module is used for calculating the correlation degree value of the current alarm data and the historical alarm data based on the correlation degree calculation mode;
and the filtering module is used for filtering the current alarm data if the correlation value meets the repeated alarm condition.
The embodiment of the present application further provides a computer-readable storage medium, where a plurality of instructions are stored in the computer-readable storage medium, and the instructions are adapted to be loaded by a processor to perform the steps in the data management method.
The embodiment of the application further provides an electronic device, which comprises a processor and a memory, wherein the processor is electrically connected with the memory, the memory is used for storing instructions and data, and the processor is used for executing the steps in the data management method.
The embodiment of the application provides a data management method, a data management device, a storage medium and electronic equipment. And calculating a relevance numerical value based on a current alarm field corresponding to the current alarm data, and automatically filtering the current alarm data when the current alarm data is determined to be repeated alarm data according to the relevance numerical value so as to realize automatic investigation of the alarm data.
Drawings
The technical solution and other advantages of the present application will become apparent from the detailed description of the embodiments of the present application with reference to the accompanying drawings.
Fig. 1 is a schematic flowchart of a data management method according to an embodiment of the present application.
Fig. 2 is a scene schematic diagram of a data management method according to an embodiment of the present application.
Fig. 3 is a schematic structural diagram of a data management apparatus according to an embodiment of the present application.
Fig. 4 is another schematic structural diagram of a data management apparatus according to an embodiment of the present application.
Fig. 5 is a schematic structural diagram of an electronic device provided in an embodiment of the present application.
Fig. 6 is another schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The embodiment of the application provides a data management method and device, a storage medium and electronic equipment.
As shown in fig. 1, fig. 1 is a schematic flow chart of a data management method provided in the embodiment of the present application, and a specific flow may be as follows:
s101, current alarm data are obtained.
Wherein the current alarm data is used for representing the notification information generated due to the failure of the operation and maintenance system (for example, the nodes in the cluster cannot normally serve). Specifically, in the actual operation and maintenance process, the operation and maintenance monitoring system is used for monitoring a plurality of node instances and node services, and the monitoring range includes: when a certain node/nodes in the cluster fail to normally serve due to faults, the operation and maintenance monitoring system can automatically generate alarm data according to the fault information so as to inform technicians to check the alarm data in time, and analyze the fault/abnormal reason according to the alarm content represented by the alarm data so as to repair the fault/abnormal reason.
For example, when the operation and maintenance monitoring system monitors that the CPU load is too high, the application cannot access or the bandwidth utilization rate is low, alarm data is automatically generated to notify a technician to analyze the cause of the fault according to the alarm content represented by the alarm data and then repair the fault.
In this embodiment, a plurality of pieces of fault information in a preset period are collected first, and then a plurality of corresponding current alarm data are generated according to each piece of fault information. When the operation and maintenance monitoring system monitors that a fault or an abnormality exists, fault alarm data (namely current alarm data) is automatically generated according to fault/abnormality information, and the fault alarm data carries fault alarm content related to the detailed condition of the fault.
For example, the preset period is 10min, and the operation and maintenance monitoring system detects that the fault problems of the CPU load being too high and the application being inaccessible exist within 10min, so that CPU load alarm data and application access alarm data carrying CPU load alarm content and application access alarm content are automatically generated.
And S102, determining a current alarm field according to the current alarm data.
And the current alarm field is used for representing the data attribute of the current alarm data. Specifically, the current alarm field records the fault alarm content related to the fault details, so that the fault details corresponding to the current alarm data can be acquired according to the current alarm field in the subsequent process.
Optionally, in this embodiment, priority classification is performed on each fault node in advance, for example, the priority corresponding to the CPU load fault is level a, the priority corresponding to the application access fault is level B, and the priority corresponding to the bandwidth utilization fault is level C, then the alarm level corresponding to each current alarm data is detected, and each current alarm data is sorted according to the alarm level, and finally, field extraction processing is performed on each current alarm data in sequence according to the sorting, so as to obtain the current alarm field corresponding to each current alarm data.
For example, it is detected that the alarm level corresponding to the current alarm data M is level a, and the alarm level corresponding to the current alarm data N is level B, so that field extraction processing is performed on the current alarm data M first to obtain a current alarm field M1, a current alarm field M2, and a current alarm field M3, and then field extraction processing is performed on the current alarm data N to obtain a current alarm field N1 and a current alarm field N2.
S103, determining a correlation degree calculation mode corresponding to the current alarm field according to the field type of the current alarm field.
The correlation degree calculation mode is a calculation mode of the correlation degree. Specifically, when an alarm storm is generated (that is, a large amount of alarm data is generated in a short time), each alarm data needs to be checked and located to determine repeated alarm (that is, redundant alarm) data, and the repeated alarm data is filtered to avoid generating alarm interference. Further, since one current alarm data is generally composed of a plurality of current alarm fields of different field types, and these different field types represent information of different attributes, in order to ensure accuracy of the correlation degree determination process, in this embodiment, for the current alarm fields of different field types, different correlation degree calculation modes are required to be adopted for calculating the correlation degree.
Optionally, in the actual application process, the alarm fields in each alarm data may be labeled in advance according to the division of the field types, so as to quickly determine the field types after the current alarm fields are subsequently extracted. In this embodiment, if the field type of the current alarm field is the value type, determining that the relevance calculation mode corresponding to the current alarm field is the value relevance calculation mode; if the field type of the current alarm field is the character type, determining that the correlation degree calculation mode corresponding to the current alarm field is the character correlation degree calculation mode; and if the field type of the current alarm field is the time type, determining that the correlation degree calculation mode corresponding to the current alarm field is the time correlation degree calculation mode.
For example, the field type of the current alarm field m1 is a numerical value type, so that the correlation degree calculation mode corresponding to the current alarm field m1 is determined to be a numerical correlation degree calculation mode; the field type of the current alarm field m2 is a character type, so that the relevancy calculation mode corresponding to the current alarm field m2 is determined to be a character relevancy calculation mode; the field type of the current alarm field m3 is a time type, so that the correlation degree calculation mode corresponding to the current alarm field m3 is determined to be a time correlation degree calculation mode.
And S104, calculating the correlation value of the current alarm data and the historical alarm data based on the correlation calculation mode.
The correlation degree value of the current alarm data and the historical alarm data is used for representing the correlation degree of the current alarm data and the historical alarm data.
Further, before the step S104, the method further includes:
reading historical alarm data in a historical alarm database;
performing field extraction processing on the historical alarm data to obtain historical alarm fields corresponding to the historical alarm data; wherein, the field types of the historical alarm field comprise a numerical value type, a character type and a time type.
The historical alarm database is used for storing all historical alarm data (namely all alarm data after alarm completion), the historical alarm data is used for comparing with the current alarm data so as to determine whether the current alarm data is repeated alarm data according to a comparison result, and similarly, the historical alarm field also has a plurality of different field types (such as a numerical value type, a character type and a time type).
Optionally, field similarity values of the current alarm fields and the historical alarm fields are calculated based on the correlation calculation mode, and then correlation values of the current alarm data and the historical alarm data are determined according to the field similarity values.
Specifically, in an embodiment, when the relevance calculation mode corresponding to the current alarm field is the numerical relevance calculation mode, the numerical value corresponding to the historical alarm field is compared with the numerical value corresponding to the current alarm field based on the numerical relevance calculation mode to obtain a numerical comparison value, optionally, 1 or 0 may be used as the numerical comparison value (for example, when the two numerical values are the same, the numerical comparison value is 1, and when the two numerical values are different, the numerical comparison value is 0), and the numerical comparison value is used as the field similarity value. For example, the current alarm field m1 represents a value of 1.57, the historical alarm field p1 represents a value of 1.57, and since the values are the same, the comparison value (i.e., the field similarity value) is determined to be 1.
In another embodiment, when the relevancy calculation mode corresponding to the current alarm field is the character relevancy calculation mode, the characters corresponding to the historical alarm field and the characters corresponding to the current alarm field are compared based on the character relevancy calculation mode to obtain a character comparison value, and optionally, 1 or 0 may be used as the character comparison value (for example, when the characters are the same, the character comparison value is 1; when the characters are different, the character comparison value is 0), and the character comparison value is used as the field similarity value. For example, the character represented by the current alarm field m2 is "CPU load amount", the character represented by the historical alarm field p2 is also "CPU load amount", and since the characters are the same, the character comparison value (i.e., field similarity value) is determined to be 1.
In yet another embodiment, when the correlation calculation mode corresponding to the current alarm field is the time correlation calculation mode, the time interval corresponding to the historical alarm field is compared with the time interval corresponding to the current alarm field based on the time correlation calculation mode to obtain the time interval comparison value, and optionally, 1 or 0 may be used as the time interval comparison value (for example, when both the time represented by the two are in the same time interval, the time interval comparison value is 1, and when both the time represented by the two are in different time intervals, the time interval comparison value is 0), and the time interval comparison value is used as the field similarity value. For example, the current alarm field m3 represents a time of 15, the time interval of the current alarm field m is 14-15, the time interval of the historical alarm field p3 represents a time of 15.
Further, weighted average calculation is carried out on the similarity values of all the fields, and the calculated weighted average value is used as a correlation value of the current alarm data and the historical alarm data. For example, the field similarity value of the current alarm field m1 and the historical alarm data p1 is 1, the field similarity value of the current alarm field m2 and the historical alarm data p2 is 1, the field similarity value of the current alarm field m3 and the historical alarm data p3 is 1, and the weighted average calculation is performed on the field similarity values: (1 + 1)/3=1, so that the correlation value of the current alarm data M and the historical alarm data P is determined to be 1.
Optionally, if the current alarm field cannot be extracted from the current alarm data, performing keyword analysis on the current alarm content corresponding to the current alarm data, and meanwhile, detecting whether the same keyword exists in the historical alarm content corresponding to the historical alarm data in the historical alarm database, so as to determine the correlation value between the current alarm data and the historical alarm data.
And S105, if the correlation degree value meets the repeated alarm condition, filtering the current alarm data.
The repeated alarm condition is a judgment basis for judging whether the current alarm data is redundant alarm data. Specifically, in the current operation and maintenance monitoring system, as the production scale is getting larger, the system architecture of the operation and maintenance monitoring system becomes more and more complex, and the number of node instances and services to be monitored is more and more, when a certain node in a cluster fails and cannot serve to generate an alarm, normal service of other nodes in the cluster is often caused, and alarm data is also generated by other nodes, so that an alarm storm is generated.
In order to avoid the above situation, in this embodiment, a correlation threshold may be preset according to an actual application situation, and if the correlation value is greater than or equal to the correlation threshold, it is determined that the correlation value satisfies a repeated alarm condition, that is, the data type of the current alarm data is determined to be a repeated alarm data type, and then the current alarm data is written into the historical alarm database, so that the historical alarm data stored in the historical alarm database is richer, thereby improving the accuracy of the subsequent alarm data filtering process, and at the same time, the current alarm data is removed from the alarm data queue to filter the current alarm data, thereby intercepting the report of the current alarm data.
For example, the threshold value of the degree of correlation is 0.5, and the value of the degree of correlation between the current alarm data M and the historical alarm data P is 1, so that the value of the degree of correlation is determined to satisfy the repeated alarm condition, and the data type of the current alarm data M is determined to be the repeated alarm data type, and then the current alarm data M is written into the historical alarm database, and the current alarm data M is removed from the alarm data queue, so as to filter the current alarm data M.
Optionally, after filtering the current alarm data, the interception information (i.e., the information related to the filtered current alarm data) may be stored, and the user may query the interception information according to actual needs to view the information related to the filtered current alarm data, for example, the generation time, the filtering time, and the alarm content of the filtered alarm data. For example, as shown in fig. 2, after filtering the current alarm data M and the current alarm data N, the user clicks the interception information control 2002 in the operation and maintenance management interface 2001 and automatically jumps to the interception alarm details interface 2003, so that the user can view the filtered current alarm data M and the filtered current alarm data N.
According to the data management method, the current alarm data are obtained firstly, then the current alarm field is determined according to the current alarm data, the relevancy calculation mode corresponding to the current alarm field is determined according to the field type of the current alarm field, finally the relevancy value of the current alarm data and the historical alarm data is calculated based on the relevancy calculation mode, and if the relevancy value meets the repeated alarm condition, the current alarm data are filtered. And calculating a relevance numerical value based on a current alarm field corresponding to the current alarm data, and automatically filtering the current alarm data when the current alarm data is determined to be repeated alarm data according to the relevance numerical value so as to realize automatic investigation of the alarm data.
The present embodiment will be further described from the perspective of the data management apparatus according to the method described in the above embodiment.
Referring to fig. 3, fig. 3 specifically describes a data management apparatus provided in an embodiment of the present application, where the data management apparatus may include: the system comprises an acquisition module 10, a current alarm field determination module 20, a relevance calculation mode determination module 30, a calculation module 40 and a filtering module 50, wherein:
(1) Acquisition module 10
The obtaining module 10 is configured to obtain current alarm data.
The obtaining module 10 is specifically configured to:
collecting a plurality of fault information in a preset period;
and generating a plurality of corresponding current alarm data according to each fault information.
(2) Current alert field determination module 20
And a current alarm field determining module 20, configured to determine a current alarm field according to the current alarm data.
The current alarm field determining module 20 is specifically configured to:
detecting the alarm level corresponding to each current alarm data;
and sequencing the current alarm data according to the alarm level, and sequentially performing field extraction processing on the current alarm data according to the sequencing to obtain the current alarm field corresponding to the current alarm data.
(3) Correlation calculation mode determination module 30
And a relevance calculation mode determining module 30, configured to determine a relevance calculation mode corresponding to the current alarm field according to the field type of the current alarm field.
The correlation calculation mode determining module 30 is specifically configured to:
if the field type of the current alarm field is a numerical value type, determining that the correlation degree calculation mode corresponding to the current alarm field is a numerical value correlation degree calculation mode;
if the field type of the current alarm field is a character type, determining that a correlation degree calculation mode corresponding to the current alarm field is a character correlation degree calculation mode;
and if the field type of the current alarm field is the time type, determining that the correlation degree calculation mode corresponding to the current alarm field is the time correlation degree calculation mode.
(4) Calculation module 40
And the calculating module 40 is used for calculating the correlation value of the current alarm data and the historical alarm data based on the correlation calculating mode.
Wherein, the calculating module 40 is specifically configured to:
calculating field similarity values of each current alarm field and each historical alarm field based on the correlation calculation mode;
and determining the correlation value of the current alarm data and the historical alarm data according to the field similarity value.
Specifically, the calculation module 40 is further configured to:
comparing the value corresponding to the historical alarm field with the value corresponding to the current alarm field based on the value correlation degree calculation mode to obtain a value comparison value;
the numerical comparison value is taken as a field similarity value.
Optionally, the calculation module 40 is further configured to:
comparing the characters corresponding to the historical alarm fields with the characters corresponding to the current alarm fields based on the character correlation degree calculation mode to obtain character comparison values;
the character comparison value is taken as a field similarity value.
Further, the calculation module 40 is further configured to:
comparing a time interval corresponding to the historical alarm field with a time interval corresponding to the current alarm field based on the time correlation degree calculation mode to obtain a time interval comparison value;
the time interval comparison value is taken as a field similarity value.
(5) Filter module 50
And the filtering module 50 is configured to filter the current alarm data if the correlation value satisfies the repeated alarm condition.
The filtering module 50 is specifically configured to:
if the correlation degree value is larger than or equal to the correlation degree threshold value, determining that the correlation degree value meets a repeated alarm condition, and determining that the data type of the current alarm data is a repeated alarm data type;
and writing the current alarm data into a historical alarm database, and removing the current alarm data from the alarm data queue to filter the current alarm data.
As shown in fig. 4, fig. 4 is another schematic structural diagram of the data management apparatus provided in the embodiment of the present application, and the apparatus further includes a historical alert data reading module 60.
The historical alarm data reading module 60 is configured to:
reading historical alarm data in a historical alarm database;
performing field extraction processing on the historical alarm data to obtain historical alarm fields corresponding to the historical alarm data; wherein, the field types of the historical alarm field comprise a numerical value type, a character type and a time type.
In specific implementation, the above units may be implemented as independent entities, or may be combined arbitrarily, and implemented as the same or several entities, and specific implementations of the above units may refer to the foregoing method embodiment, which is not described herein again.
As can be seen from the above description, the data management apparatus provided in the present application first obtains current alarm data through the obtaining module 10, then determines a current alarm field according to the current alarm data through the current alarm field determining module 20, determines a correlation calculation mode corresponding to the current alarm field according to a field type of the current alarm field through the correlation calculation mode determining module 30, and finally calculates a correlation value between the current alarm data and historical alarm data through the calculation module 40 based on the correlation calculation mode, and filters the current alarm data through the filtering module 50 if the correlation value satisfies a repeat alarm condition. And calculating a relevance numerical value based on a current alarm field corresponding to the current alarm data, and automatically filtering the current alarm data when the current alarm data is determined to be repeated alarm data according to the relevance numerical value so as to realize automatic investigation of the alarm data.
Correspondingly, the embodiment of the invention also provides a data management system, which comprises any data management device provided by the embodiment of the invention, and the data management device can be integrated in the electronic equipment.
Acquiring current alarm data; determining a current alarm field according to the current alarm data; determining a correlation degree calculation mode corresponding to the current alarm field according to the field type of the current alarm field; calculating the correlation value of the current alarm data and the historical alarm data based on the correlation calculation mode; and if the correlation degree value meets the repeated alarm condition, filtering the current alarm data.
The specific implementation of each device can be referred to the previous embodiment, and is not described herein again.
Since the data management system may include any data management device provided in the embodiment of the present invention, the beneficial effects that can be achieved by any data management device provided in the embodiment of the present invention can be achieved, which are detailed in the foregoing embodiments and will not be described herein again.
In addition, the embodiment of the application also provides electronic equipment, and the electronic equipment can be equipment such as a smart phone or a computer. As shown in fig. 5, the electronic device 500 includes a processor 501, a memory 502. The processor 501 is electrically connected to the memory 502.
The processor 501 is a control center of the electronic device 500, connects various parts of the whole electronic device by using various interfaces and lines, executes various functions of the electronic device and processes data by running or loading an application program stored in the memory 502 and calling the data stored in the memory 502, thereby performing overall monitoring of the electronic device.
In this embodiment, the processor 501 in the electronic device 500 loads instructions corresponding to processes of one or more application programs into the memory 502 according to the following steps, and the processor 501 runs the application programs stored in the memory 502, so as to implement various functions:
acquiring current alarm data;
determining a current alarm field according to the current alarm data;
determining a correlation degree calculation mode corresponding to the current alarm field according to the field type of the current alarm field;
calculating the correlation value of the current alarm data and the historical alarm data based on the correlation calculation mode;
and if the correlation degree value meets the repeated alarm condition, filtering the current alarm data.
Fig. 6 shows a specific structural block diagram of an electronic device provided in an embodiment of the present invention, where the electronic device may be used to implement the data management method provided in the foregoing embodiment.
The RF circuit 610 is used for receiving and transmitting electromagnetic waves, and performs interconversion between the electromagnetic waves and electrical signals, thereby communicating with a communication network or other devices. RF circuit 610 may include various existing circuit elements for performing these functions, such as an antenna, a radio frequency transceiver, a digital signal processor, an encryption/decryption chip, a Subscriber Identity Module (SIM) card, memory, and so forth. The RF circuit 610 may communicate with various networks such as the internet, an intranet, a wireless network, or with other devices over a wireless network. The wireless network may comprise a cellular telephone network, a wireless local area network, or a metropolitan area network. The Wireless network may use various Communication standards, protocols and technologies, including but not limited to Global System for Mobile Communication (GSM), enhanced Data GSM Environment (EDGE), wideband Code Division Multiple Access (WCDMA), code Division Multiple Access (CDMA), time Division Multiple Access (TDMA), wireless Fidelity (Wi-Fi) (such as IEEE802.11a, IEEE802.11 b, IEEE802.11g and/or IEEE802.11 n), internet telephony (VoIP), world Interoperability for Microwave, and other suitable protocols for instant messaging, including any other protocols not currently developed.
The memory 620 may be used to store software programs and modules, and the processor 680 may execute various functional applications and data processing, i.e., implement the function of storing 5G capability information, by operating the software programs and modules stored in the memory 620. The memory 620 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 620 can further include memory located remotely from the processor 680, which can be connected to the electronic device 600 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The input unit 630 may be used to receive input numeric or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control. In particular, the input unit 630 may include a touch sensitive surface 631 as well as other input devices 632. The touch sensitive surface 631, also referred to as a touch display screen or a touch pad, may collect touch operations by a user (e.g., operations by a user on the touch sensitive surface 631 or near the touch sensitive surface 631 using any suitable object or attachment such as a finger, a stylus, etc.) on or near the touch sensitive surface 631 and drive the corresponding connection device according to a predetermined program. Alternatively, the touch sensitive surface 631 may comprise two parts, a touch detection means and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts the touch information into touch point coordinates, sends the touch point coordinates to the processor 680, and can receive and execute commands sent by the processor 680. In addition, the touch sensitive surface 631 may be implemented using various types of resistive, capacitive, infrared, and surface acoustic waves. The input unit 630 may include other input devices 632 in addition to the touch-sensitive surface 631. In particular, other input devices 632 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.
The display unit 640 may be used to display information input by or provided to a user and various graphical user interfaces of the electronic device 600, which may be made up of graphics, text, icons, video, and any combination thereof. The Display unit 640 may include a Display panel 641, and optionally, the Display panel 641 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like. Further, the touch-sensitive surface 631 may overlay the display panel 641, and when the touch-sensitive surface 631 detects a touch operation thereon or nearby, the touch operation is transmitted to the processor 680 to determine the type of the touch event, and then the processor 680 provides a corresponding visual output on the display panel 641 according to the type of the touch event. Although in FIG. 6, the touch-sensitive surface 631 and the display panel 641 are implemented as two separate components to implement input and output functions, in some embodiments, the touch-sensitive surface 631 and the display panel 641 may be integrated to implement input and output functions.
The electronic device 600 may also include at least one sensor 650, such as light sensors, motion sensors, and other sensors. Specifically, the light sensor may include an ambient light sensor that may adjust the brightness of the display panel 641 according to the brightness of ambient light, and a proximity sensor that may turn off the display panel 641 and/or the backlight when the electronic device 600 is moved to the ear. As one of the motion sensors, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally, three axes), can detect the magnitude and direction of gravity when the mobile phone is stationary, and can be used for applications of recognizing the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer and tapping), and the like; as for other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor, which can be configured in the electronic device 600, further description is omitted here.
The electronic device 600, via the transport module 670 (e.g., a Wi-Fi module), may assist a user in emailing, browsing web pages, accessing streaming media, etc., which provides wireless broadband internet access to the user. Although fig. 6 shows the transmission module 670, it is understood that it does not belong to the essential constitution of the electronic device 600 and may be omitted entirely as needed within the scope not changing the essence of the invention.
The processor 680 is a control center of the electronic device 600, connects various parts of the entire cellular phone using various interfaces and lines, and performs various functions of the electronic device 600 and processes data by operating or executing software programs and/or modules stored in the memory 620 and calling data stored in the memory 620. Optionally, processor 680 may include one or more processing cores; in some embodiments, processor 680 may integrate an application processor, which handles primarily the operating system, user interface, applications, etc., and a modem processor, which handles primarily wireless communications. It will be appreciated that the modem processor described above may not be integrated into processor 680.
Electronic device 600 also includes a power supply 690 (e.g., a battery) that provides power to the various components, and in some embodiments may be logically coupled to processor 680 via a power management system that may perform functions such as managing charging, discharging, and power consumption. The power supply 690 may also include any component including one or more dc or ac power sources, recharging systems, power failure detection circuitry, power converters or inverters, power status indicators, and the like.
Although not shown, the electronic device 600 may further include a camera (e.g., a front camera, a rear camera), a bluetooth module, and the like, which are not described in detail herein. Specifically, in this embodiment, the display unit of the electronic device is a touch screen display, the electronic device further includes a memory, and one or more programs, where the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for:
acquiring current alarm data;
determining a current alarm field according to the current alarm data;
determining a correlation degree calculation mode corresponding to the current alarm field according to the field type of the current alarm field;
calculating the correlation value of the current alarm data and the historical alarm data based on the correlation calculation mode;
and if the correlation degree value meets the repeated alarm condition, filtering the current alarm data.
In specific implementation, the above modules may be implemented as independent entities, or may be combined arbitrarily to be implemented as the same or several entities, and specific implementation of the above modules may refer to the foregoing method embodiments, which are not described herein again.
It will be understood by those skilled in the art that all or part of the steps of the methods of the above embodiments may be performed by instructions or by associated hardware controlled by the instructions, which may be stored in a computer readable storage medium and loaded and executed by a processor. To this end, the present invention provides a storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any one of the data management methods provided by the embodiments of the present invention.
Wherein the storage medium may include: read Only Memory (ROM), random Access Memory (RAM), magnetic or optical disks, and the like.
Since the instructions stored in the storage medium can execute the steps in any data management method provided in the embodiments of the present invention, the beneficial effects that can be achieved by any data management method provided in the embodiments of the present invention can be achieved, which are detailed in the foregoing embodiments and will not be described herein again.
The above operations can be implemented in the foregoing embodiments, and are not described in detail herein.
In summary, although the present application has been described with reference to the preferred embodiments, the above-described preferred embodiments are not intended to limit the present application, and those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application, therefore, the scope of the present application is defined by the appended claims.
Claims (13)
1. A method for managing data, comprising:
acquiring current alarm data;
determining a current alarm field according to the current alarm data;
determining a relevancy calculation mode corresponding to the current alarm field according to the field type of the current alarm field;
calculating the correlation degree value of the current alarm data and the historical alarm data based on the correlation degree calculation mode;
and if the correlation numerical value meets the repeated alarm condition, filtering the current alarm data.
2. The data management method according to claim 1, wherein the step of obtaining the current alarm data comprises:
collecting a plurality of fault information in a preset period;
and generating a plurality of corresponding current alarm data according to each fault information.
3. The data management method of claim 2, wherein the step of determining a current alarm field based on the current alarm data comprises:
detecting the alarm level corresponding to each current alarm data;
and sequencing the current alarm data according to the alarm level, and sequentially performing field extraction processing on the current alarm data according to the sequencing to obtain the current alarm field corresponding to the current alarm data.
4. The data management method according to claim 3, wherein the step of determining the correlation calculation mode corresponding to the current alarm field according to the field type of the current alarm field comprises:
if the field type of the current alarm field is a numerical value type, determining that a correlation degree calculation mode corresponding to the current alarm field is a numerical value correlation degree calculation mode;
if the field type of the current alarm field is the character type, determining that the relevancy calculation mode corresponding to the current alarm field is the character relevancy calculation mode;
and if the field type of the current alarm field is the time type, determining that the correlation degree calculation mode corresponding to the current alarm field is the time correlation degree calculation mode.
5. The data management method according to claim 4, further comprising, before the step of calculating the relevance value between the current alarm data and the historical alarm data based on the relevance calculation mode:
reading historical alarm data in a historical alarm database;
performing field extraction processing on the historical alarm data to obtain historical alarm fields corresponding to the historical alarm data; wherein the field types of the historical alarm field comprise the numerical value type, the character type and the time type.
6. The data management method according to claim 5, wherein the step of calculating the correlation value between the current alarm data and the historical alarm data based on the correlation calculation mode comprises:
calculating field similarity values of each current alarm field and each historical alarm field based on the correlation degree calculation mode;
and determining the correlation value of the current alarm data and the historical alarm data according to the field similarity value.
7. The data management method according to claim 6, wherein the step of calculating field similarity values of each current alarm field and each historical alarm field based on the relevancy calculation mode comprises:
comparing the value corresponding to the historical alarm field with the value corresponding to the current alarm field based on the value correlation degree calculation mode to obtain a value comparison value;
and taking the numerical comparison value as the field similarity value.
8. The data management method according to claim 6, wherein the step of calculating field similarity values of each current alarm field and each historical alarm field based on the correlation calculation mode further comprises:
comparing the characters corresponding to the historical alarm fields with the characters corresponding to the current alarm fields based on the character relevance calculation mode to obtain character comparison values;
and taking the character comparison value as the field similarity value.
9. The data management method of claim 6, wherein the step of calculating field similarity values of the current alarm field and the historical alarm field based on the relevancy calculation mode further comprises:
comparing the time interval corresponding to the historical alarm field with the time interval corresponding to the current alarm field based on the time correlation degree calculation mode to obtain a time interval comparison value;
and taking the time interval comparison value as the field similarity value.
10. The data management method according to claim 7, 8 or 9, wherein the step of filtering the current alarm data if the relevancy value satisfies a repeated alarm condition comprises:
if the correlation degree value is larger than or equal to a correlation degree threshold value, determining that the correlation degree value meets the repeated alarm condition, and determining that the data type of the current alarm data is a repeated alarm data type;
and writing the current alarm data into the historical alarm database, and removing the current alarm data from an alarm data queue to filter the current alarm data.
11. A data management apparatus, comprising:
the acquisition module is used for acquiring current alarm data;
a current alarm field determining module, configured to determine a current alarm field according to the current alarm data;
the relevancy calculation mode determination module is used for determining a relevancy calculation mode corresponding to the current alarm field according to the field type of the current alarm field;
the calculation module is used for calculating the correlation degree value of the current alarm data and the historical alarm data based on the correlation degree calculation mode;
and the filtering module is used for filtering the current alarm data if the correlation value meets the repeated alarm condition.
12. A computer-readable storage medium having stored thereon a plurality of instructions adapted to be loaded by a processor to perform the steps of the data management method of any of claims 1 to 10.
13. An electronic device comprising a processor and a memory, the processor being electrically connected to the memory, the memory being configured to store instructions and data, the processor being configured to perform the steps of the data management method of any one of claims 1 to 10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211007362.4A CN115378791A (en) | 2022-08-22 | 2022-08-22 | Data management method, device, storage medium and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211007362.4A CN115378791A (en) | 2022-08-22 | 2022-08-22 | Data management method, device, storage medium and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115378791A true CN115378791A (en) | 2022-11-22 |
Family
ID=84066879
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211007362.4A Pending CN115378791A (en) | 2022-08-22 | 2022-08-22 | Data management method, device, storage medium and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115378791A (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107819606A (en) * | 2017-09-29 | 2018-03-20 | 北京金山安全软件有限公司 | Network attack alarm method and device |
| CN111382779A (en) * | 2019-12-31 | 2020-07-07 | 清华大学 | Alarm condition similarity recognition method, device and equipment |
| CN113938649A (en) * | 2021-09-24 | 2022-01-14 | 成都智元汇信息技术股份有限公司 | Alarm message duplicate removal method and device |
-
2022
- 2022-08-22 CN CN202211007362.4A patent/CN115378791A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107819606A (en) * | 2017-09-29 | 2018-03-20 | 北京金山安全软件有限公司 | Network attack alarm method and device |
| CN111382779A (en) * | 2019-12-31 | 2020-07-07 | 清华大学 | Alarm condition similarity recognition method, device and equipment |
| CN113938649A (en) * | 2021-09-24 | 2022-01-14 | 成都智元汇信息技术股份有限公司 | Alarm message duplicate removal method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105335653A (en) | Abnormal data detection method and apparatus | |
| CN112749074B (en) | Test case recommending method and device | |
| CN112415367A (en) | Drive chip abnormality detection method and device, electronic equipment and readable storage medium | |
| CN111464328A (en) | Cloud monitoring process control method and device capable of configuring monitoring items | |
| CN112711516B (en) | Data processing method and related device | |
| CN112256748A (en) | Abnormity detection method and device, electronic equipment and storage medium | |
| CN114661515B (en) | Alarm information convergence method and device, electronic equipment and storage medium | |
| CN115118636B (en) | Method and device for determining network jitter state, electronic equipment and storage medium | |
| CN108269223B (en) | Webpage graph drawing method and terminal | |
| CN112363895B (en) | System fault positioning method and device and electronic equipment | |
| CN113918757A (en) | Application recommendation method and device, electronic equipment and storage medium | |
| CN115378791A (en) | Data management method, device, storage medium and electronic equipment | |
| CN114817419A (en) | Kafka-based media asset data storage method and device, electronic equipment and storage medium | |
| CN112367428A (en) | Electric quantity display method and system, storage medium and mobile terminal | |
| CN106896896B (en) | Electricity saving method, device and electronic equipment | |
| CN111818548A (en) | Data processing method, device and equipment | |
| CN113364910B (en) | Signal processing method, device, equipment and storage medium | |
| CN114095585B (en) | Data transmission method, device, storage medium and electronic equipment | |
| CN109660664B (en) | Event processing method, device and storage medium | |
| CN114742033A (en) | Data analysis method and device, storage medium and electronic equipment | |
| CN117746287A (en) | Abnormal event judging method and device | |
| CN115509939A (en) | Interface testing method and device, storage medium and electronic equipment | |
| CN115840678A (en) | Application automatic inspection method and device, computer equipment and readable storage medium | |
| CN113641521A (en) | Data processing method, data processing device, storage medium and electronic equipment | |
| CN115103068A (en) | Outbound list generation method and device, storage medium and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |