CN115544202A - Alarm processing method, device and storage medium - Google Patents

Abstract

The embodiment of the application discloses an alarm processing method, an alarm processing device and a storage medium, and belongs to the technical field of AI. In the embodiment of the application, the NLP model obtained by the alarm description text training is used for processing the information of each alarm in the alarm event, so that one or more candidate fault reasons of the alarm event are obtained, one or more candidate fault reasons of the alarm event can be obtained without manually presetting a diagnosis rule, and the fault information corresponding to the alarm event is determined according to the one or more candidate fault reasons, so that the method is intelligent and efficient. When new alarms are increased subsequently, the alarms can be analyzed and processed only by correspondingly adding corresponding alarm description texts to train the NLP model, rule codes do not need to be developed again, workload is small, and maintenance cost is low.

Description

Alarm processing method, device and storage medium

technical field

The embodiments of the present application relate to the technical field of artificial intelligence (AI), and in particular, to an alarm processing method, device, and storage medium.

Background technique

Various faults may occur during the operation of network devices in the network to trigger alarms. After receiving the alarm information reported by the network equipment, the control device can process the alarm information, so as to determine the location of the fault, and repair the fault or provide a fault repair method.

In the related art, after the control device receives the alarm information, it can judge the triggering cause of the alarming information through manually preset diagnostic rules, and then determine the location of the fault according to the determined triggering cause.

It can be seen that, in related technologies, it is necessary to manually pre-set diagnostic rules to process alarm information. In this way, whenever a new rule needs to be added, the rule code needs to be redeveloped, which involves a large workload, high development difficulty, and high maintenance cost. .

Contents of the invention

Embodiments of the present application provide an alarm processing method, device, and storage medium, capable of intelligently and efficiently processing alarms in alarm events. Described technical scheme is as follows:

In a first aspect, an alarm processing method is provided, the method comprising: obtaining an alarm event, the alarm event including information of multiple alarms; processing each of the multiple alarms through a first natural language processing NLP model The information of the alarm is processed to obtain one or more candidate fault items corresponding to the alarm event, and the first NLP model is obtained by training the alarm description text; according to the one or more candidate fault items corresponding to the alarm event, determine Fault information corresponding to the alarm event.

In the embodiment of the present application, the information of each alarm in the alarm event is processed through the NLP model trained by the alarm description text, so as to obtain one or more candidate fault causes of the alarm event, without manually setting diagnostic rules in advance. One or more candidate fault causes of the alarm event can be obtained, and then the fault information corresponding to the alarm event is determined according to the one or more candidate fault causes, which is intelligent and efficient. When new alarms are added later, you only need to add the corresponding alarm description text to train the NLP model to realize the analysis and processing of alarms, without re-developing rule codes, with a small workload and low maintenance costs.

Optionally, the implementation process of processing the information of each of the multiple alarms through the first natural language processing NLP model to obtain one or more candidate fault items corresponding to the alarm event may be: Using the information of each alarm in the plurality of alarms as the input of the first NLP model, processing the information of each alarm in the plurality of alarms through the first NLP model to obtain the alarm A diagnostic chain of events, the diagnostic chain of the alarm event includes the multiple alarms and one or more fault items, and the diagnostic chain is used to characterize the relationship between the multiple alarms and the one or more fault items logical relationship; using one or more fault items included in the diagnosis chain as one or more candidate fault items corresponding to the alarm event.

After processing the information of multiple alarms included in the alarm event through the NLP model, the diagnostic chain of the alarm event can be obtained. The diagnostic chain includes multiple alarms and one or more fault items, and the diagnostic chain can represent each The logical relationship between alarms and between alarms and fault items, so that the reasoning logic between alarms and fault items has strong interpretability.

It should be noted that, in the embodiment of the present application, the control device may also use the diagnosis chain of the alarm event as a part of the subsequent fault information.

Optionally, before using the first NLP model to process the alarm information in the alarm event, the method further includes: acquiring the alarm description text; The alarm explanation information and the alarm reason train the first initial NLP network to obtain the first NLP model.

That is, in the embodiment of the present application, the first NLP model can learn the logical relationship between each sample alarm in the alarm description text and the logical relationship between the sample alarm and the fault item.

Optionally, the implementation process of determining the fault information corresponding to the alarm event according to one or more candidate fault items of the alarm event includes: calling each candidate fault item in the one or more candidate fault items The diagnostic interface of the corresponding diagnostic item; obtain the status information of the corresponding diagnostic item through the diagnostic interface of the diagnostic item corresponding to each candidate fault item; determine the corresponding alarm event according to the status information of the diagnostic item corresponding to each candidate fault item accident details.

In the embodiment of the present application, after one or more candidate fault items corresponding to the alarm event are determined, the corresponding candidate fault items can be diagnosed through the automatically generated diagnosis interface, so as to obtain the real fault item corresponding to the alarm event , that is, the real cause of the alarm event, the whole process is intelligent and efficient.

Optionally, the method further includes: using the second NLP model to identify the processing steps corresponding to each sample alarm in the multiple sample alarms included in the alarm description text, so as to obtain the diagnostic items corresponding to the corresponding processing steps; A diagnostic interface that generates diagnostic items corresponding to each processing step.

In the embodiment of the present application, the processing steps contained in the alarm description text can be identified through the NLP model to obtain the corresponding diagnostic items, and then the diagnostic interface corresponding to the diagnostic items can be automatically generated. Subsequently, when diagnosing the candidate fault items corresponding to the alarm event, the automatically generated diagnosis interface can be directly invoked for diagnosis, making the entire diagnosis process intelligent and efficient.

Optionally, according to the state information of each candidate fault item, the implementation process of determining the fault information corresponding to the alarm event may be: determining the state information of the corresponding diagnostic item from the one or more candidate fault items and the corresponding diagnosing a target fault item whose preset state information is inconsistent; generating fault information corresponding to the alarm event according to the target fault item and the repair method corresponding to the target fault item.

The diagnostic item with an abnormal state is determined through the obtained status information of the diagnostic item, and then the real fault item among the candidate fault items is determined accordingly, which is true and reliable.

Optionally, the alarm description text includes at least one of product information text, alarm manual, and fault maintenance experience text.

In this embodiment of the application, the alarm description text may be at least one of product information text, alarm manual, or fault maintenance experience text. That is to say, the first NLP model can be obtained only by providing product information text, alarm manual or fault maintenance experience text, and then intelligently identify various alarms. In this way, when new equipment or services appear, only need to add corresponding The amount of alarm description text to train the first NLP model can not only handle the alarm of new equipment or business, but compared with the method of manually setting rules for alarm identification, there is no need to re-develop the rule code, the workload is small, and the maintenance cost is low. Low.

In a second aspect, an alarm processing device is provided, and the alarm processing device has a function of realizing the behavior of the alarm processing method in the above first aspect. The alarm processing apparatus includes at least one module, and the at least one module is configured to implement the alarm processing method provided in the first aspect above.

A third aspect provides an alarm processing device, the structure of the alarm processing device includes a processor and a memory, and the memory is used to store a program that supports the alarm processing device to execute the alarm processing method provided in the first aspect above, And storing the data involved in realizing the alarm processing method provided by the first aspect above. The processor is configured to execute programs stored in the memory. The operating device of the storage device may further include a communication bus for establishing a connection between the processor and the memory.

In a fourth aspect, a computer-readable storage medium is provided, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, it causes the computer to execute the alarm processing method described in the above-mentioned first aspect.

A fifth aspect provides a computer program product containing instructions, which when run on a computer causes the computer to execute the alarm processing method described in the first aspect above.

The technical effects obtained by the above-mentioned second aspect, third aspect, fourth aspect and fifth aspect are similar to those obtained by the corresponding technical means in the first aspect, and will not be repeated here.

The beneficial effects brought by the technical solutions provided by the embodiments of the present application at least include:

In the embodiment of the present application, the information of each alarm in the alarm event is processed through the NLP model trained by the alarm description text, so as to obtain one or more candidate fault causes of the alarm event, without manually setting diagnostic rules in advance. One or more candidate fault causes of the alarm event can be obtained, and then the fault information corresponding to the alarm event is determined according to the one or more candidate fault causes, which is intelligent and efficient. When new alarms are added later, you only need to add the corresponding alarm description text to train the NLP model to realize the analysis and processing of alarms, without re-developing rule codes, with a small workload and low maintenance costs.

Description of drawings

FIG. 1 is a network system architecture diagram involved in an alarm processing method provided by an embodiment of the present application;

Fig. 2 is a schematic structural diagram of a computer device provided by an embodiment of the present application;

FIG. 3 is a flow chart of an alarm processing method provided in an embodiment of the present application;

FIG. 4 is a schematic diagram of a diagnosis chain of an alarm event provided by an embodiment of the present application;

Fig. 5 is a schematic structural diagram of an alarm processing device provided by an embodiment of the present application.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the following will further describe the embodiments of the present application in detail in conjunction with the accompanying drawings.

Before explaining the embodiment of the present application in detail, the application scenarios involved in the embodiment of the present application are firstly introduced.

With the development of network technology, the network architecture becomes increasingly complex, and correspondingly, there are more and more network devices in the network. Among them, when a network device in the network fails, the network device will send an alarm to the control device. In this case, it is necessary to quickly locate the fault according to the alarm to repair the fault, so as to minimize the impact of the fault on the business. The alarm processing method provided in the embodiment of the present application can be applied to the above scenario, so as to analyze and process the alarm, so as to obtain the fault information corresponding to the alarm.

Optionally, the alarm processing method provided in the embodiment of the present application may also be used to process alarms in other scenarios. For example, in a banking system, when a risky user appears, an alarm can be reported to the control device. Correspondingly, the control device may also identify risky users through the alarm processing method provided in the embodiment of the present application. For another example, in the power system, when an alarm is received, the alarm processing method provided by the embodiment of the present application can be used to process the alarm, so as to determine the fault point in the power system that triggers the alarm, such as an abnormal power consumption point Or abnormal equipment, etc. For another example, in the field of industrial production, the control equipment in the automated factory can receive the alarm reported by the detection equipment on the production line. Correspondingly, the control equipment can also monitor the abnormal points in the production process through the method provided by this embodiment detection etc.

It should be noted that the above are only some exemplary application scenarios given by the embodiment of the application. For other scenarios where the alarm needs to be processed to determine the information of the failure point, risk point or abnormal point, the embodiment of the application also Applicable, the embodiment of the present application will not be repeated here.

Next, the system architecture involved in the alarm processing method provided by the embodiment of the present application will be introduced.

FIG. 1 is a schematic diagram of a network system architecture involved in an alarm processing method provided in an embodiment of the present application. As shown in FIG. 1 , the network system includes an alarm processing device 101 and multiple network devices 102 , where communication connections are established between the alarm processing device 101 and the multiple network devices 102 .

In this embodiment of the present application, the alarm processing device 101 may be a control device corresponding to multiple network devices 102 . In this case, each network device 102 can trigger an alarm when it fails or the service is abnormal, and send the alarm information to the alarm processing device 101, or a certain network device 102 can receive other network When the device 102 generates an alarm, an alarm is triggered, and the alarm information is sent to the alarm processing device 101 .

After receiving the alarm information of each network device 102, the alarm processing device 101 may cluster the alarms according to the alarm information reported by each network device 102, so as to obtain an alarm event including multiple alarm information. Afterwards, the alarm processing device 101 may process each alarm in the alarm event through the alarm processing method provided in the embodiment of the present application, so as to obtain the fault information corresponding to the alarm event. Wherein, each alarm in the alarm event refers to an alarm with a certain relationship.

Optionally, in some possible situations, the alarm processing device 101 is not a control device corresponding to multiple network devices 102, but a server or terminal device with data processing functions. In this case, the network system Control devices corresponding to the multiple network devices 102 may also be included. On this basis, each network device 102 may report alarm information to the control device, and the control device clusters the alarm information reported by each network device 102 to obtain an alarm event. Afterwards, the control device may send the clustered alarm event to the alarm processing device 101, and then the alarm processing device 101 processes each alarm in the alarm event according to the alarm processing method provided by the embodiment of the present application.

Wherein, when the alarm processing device 101 is a control device corresponding to multiple network devices, the alarm processing device 101 may be a network cloud engine (network cloud engine, NCE), for example, the alarm processing device 101 is a software-defined network ( software designed network, SDN) controller, or a cloud management platform. In this case, the multiple network devices 102 are devices such as terminal devices and gateway devices managed and controlled by the alarm processing device 101, which is not limited in this embodiment of the present application.

When the alarm processing device 101 is not a control device corresponding to multiple network devices, the alarm processing device 101 may be a server or a terminal device. For example, the alarm processing device 101 is a server or a server cluster in a data center, or the alarm processing device 101 is a client device, which is not limited in this embodiment of the present application.

Optionally, in some possible cases, when the alarm processing method provided by the embodiment of the present application is applied to other scenarios, such as in power systems or industrial production fields, the alarm processing device 101 can be a centralized management control Functional devices of other devices, correspondingly, the plurality of network devices 102 are devices managed and controlled by the control device 101 . Or, similarly, the alarm processing device 101 may not be a control device corresponding to multiple network devices, but a server or a terminal device, which is not limited in this embodiment of the present application.

In the following embodiments, the alarm processing method provided in the embodiment of the present application is introduced by taking the alarm processing device 101 as a control device corresponding to multiple network devices 102 as an example. For the case where the alarm processing device 101 is other devices, reference may be made to the following implementation manners, which will not be repeated in this embodiment of the present application.

Fig. 2 is a schematic structural diagram of a computer device provided by an embodiment of the present application. The alarm processing device in the system architecture shown in FIG. 1 can be realized by the computer device shown in FIG. 2 . Referring to FIG. 2 , the computer device includes one or more processors 201 , a communication bus 202 , a memory 203 and one or more communication interfaces 204 .

The processor 201 may be a general-purpose central processing unit (central processing unit, CPU), a network processor (network processor, NP), a microprocessor, or may be one or more integrated circuits for implementing the solution of the present application, such as , application-specific integrated circuit (application-specific integrated circuit, ASIC), programmable logic device (programmable logic device, PLD) or a combination thereof. The aforementioned PLD may be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a generic array logic (generic array logic, GAL) or any combination thereof.

The communication bus 202 is used to transfer information between the aforementioned components. The communication bus 202 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

The memory 203 may be a read-only memory (read-only memory, ROM), or a random access memory (random access memory, RAM), or an electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), optical discs (including compact disc-only memory (CD-ROM), compact discs, laser discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used for Any other medium that carries or stores desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 203 may exist independently, and is connected to the processor 201 through the communication bus 202 . The memory 203 can also be integrated with the processor 201 .

Communication interface 204 utilizes any transceiver-like device for communicating with other devices or a communication network. The communication interface 204 includes a wired communication interface, and may also include a wireless communication interface. Wherein, the wired communication interface may be an Ethernet interface, for example. The Ethernet interface can be an optical interface, an electrical interface or a combination thereof. The wireless communication interface may be a wireless local area network (wireless local area networks, WLAN) interface, a cellular network communication interface, or a combination thereof.

In some embodiments, the computer device may include multiple processors, such as processor 201 and processor 205 as shown in FIG. 2 . Each of these processors can be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data such as computer program instructions.

In a specific implementation, as an embodiment, the computer device may further include an output device 206 and an input device 207 . Output device 206 is in communication with processor 201 and can display information in a variety of ways. For example, the output device 206 may be a liquid crystal display (liquid crystal display, LCD), a light emitting diode (light emitting diode, LED) display device, a cathode ray tube (cathode ray tube, CRT) display device, or a projector (projector), etc. . The input device 207 communicates with the processor 201 and can receive user input in various ways. For example, the input device 207 may be a mouse, a keyboard, a touch screen device, or a sensing device, among others.

In some embodiments, the memory 203 is used to store the program code 208 for implementing the solution of the present application, and the processor 201 can execute the program code 208 stored in the memory 203 . The program code may include one or more software modules, and the computer device may implement the alarm processing method provided in the embodiment of FIG. 3 below through the processor 201 and the program code 208 in the memory 203 .

Next, the alarm processing method provided by the embodiment of the present application is introduced.

Fig. 3 is a flow chart of an alarm processing method provided by an embodiment of the present application. This method can be applied to the alarm processing device in the aforementioned system architecture. In the following, the alarm processing device is used as the control device corresponding to multiple network devices As an example for illustration, referring to Figure 3, the method includes the following steps:

Step 301: Obtain an alarm event, where the alarm event includes information about multiple alarms.

In this embodiment of the present application, when a network device detects its own failure or service anomaly, or receives an alarm from other devices, it can trigger its own alarm, and report the alarm information to the control device.

Wherein, the alarm information may include alarm content, and the alarm content can be used to indicate what type of alarm the alarm is. For example, the alarm content may be an Ethernet signal loss alarm. In addition, the alarm information may also include an alarm location, where the alarm location may be location information of the network device reporting the alarm. Exemplarily, the alarm location is an Internet protocol (internet protocol, IP) address of the network device reporting the alarm information, or a media access control (media access control, MAC) address of the network equipment reporting the alarm information, Or it is the device identifier of the network device, where the device identifier is used to uniquely identify the network device.

After receiving the alarm information reported by each network device, the control device may cluster the received alarm information to obtain one or more alarm events. Wherein, each alarm event includes information of multiple alarms, and the multiple alarms in each alarm event are related to a certain extent. For example, the plurality of alarms may be alarms reported by certain network devices having a connection relationship within a certain period of time, and this embodiment of the present application does not specifically limit the relationship among alarms in an alarm event.

It should be noted that, in the embodiment of the present application, the alarm processing method provided in the embodiment of the present application is introduced by taking the acquisition of an alarm event by the control device as an example.

Step 302: Process the information of each of the multiple alarms through the first NLP model to obtain one or more candidate fault items of the alarm event, and the first NLP model is obtained through training the alarm description text.

After the control device acquires the alarm event, the information of each alarm in the multiple alarms included in the alarm event is used as the input of the first NLP model, and the information of each alarm in the multiple alarms is processed by the first NLP model. processing to obtain a diagnostic chain of alarm events, the diagnostic chain of alarm events includes multiple alarms and one or more fault items, and the diagnostic chain is used to characterize the logical relationship between multiple alarms and one or more fault items; the diagnostic One or more fault items contained in the chain are used as one or more candidate fault items of the alarm event.

In the embodiment of the present application, the first NLP model obtained by training the alarm description text is deployed on the control device. It should be noted that the NLP algorithm is a hot topic in the field of AI. The NLP algorithm is designed to allow machines to understand human natural language so as to give feedback to users. In this embodiment of the present application, before the control device processes the information of the alarm in the alarm event through the first NLP model, it may first acquire the alarm description text to train the first initial NLP network to obtain the first NLP model.

Exemplarily, the control device can obtain the alarm description text, extract the alarm explanation information and alarm reasons corresponding to multiple sample alarms from the alarm description text, and analyze the first initial The NLP network is trained to obtain the first NLP model.

Wherein, the alarm description text includes at least one of product information text, alarm manual, and fault maintenance experience text. The product information text may include the product manual of each network device controlled by the control device, and the product manual may include instructions for use of the corresponding network device, alarm explanation information of possible alarms, alarm causes and corresponding processing steps. The alarm manual may include a document explaining the alarms that may occur in the network, where the alarm manual may include alarm explanation information, alarm causes, and corresponding processing steps for alarms that may be generated by network devices in the network. The fault maintenance experience text may include information about network device alarms in the network and related processing methods uploaded by customers or other relevant personnel. However, this embodiment of the present application does not specifically limit it.

The control device can obtain one or more of product information texts, alarm manuals, and fault maintenance experience texts as alarm description texts, and the number of each type of alarm description text can be one or more. Do limited.

After acquiring the alarm description text, the control device may train the first initial NLP network by using the acquired alarm description text.

Wherein, the control device can use the alarm description text as the input of the first initial NLP network, detect keywords such as sample alarm identification, alarm explanation, and alarm reason in the alarm description text through the first initial NLP network, and extract the keywords containing the above keywords. paragraphs or sentences, so as to obtain the alarm explanation information and alarm reasons corresponding to multiple sample alarms, and then extract the keywords in the alarm reasons of each sample alarm through the first initial NLP network. After that, the alarm explanation information of each sample alarm is used as the prediction source, and the keywords in the alarm reasons of the corresponding sample alarms are used as the labels of the alarm explanation information, and the first initial NLP network is trained. Among them, the first initial NLP network can perform semantic analysis and text similarity calculation on the alarm explanation information of each sample alarm, so as to output the alarm cause corresponding to the alarm explanation information of each sample alarm, and compare the output alarm cause with the set corresponding alarm explanation The labels of the information are compared to obtain the deviation between the two, and the parameters in the first initial NLP network are continuously adjusted through the deviation, so that the first initial NLP network gradually learns the logical relationship between each sample alarm , to get the first NLP model.

For example, for the alarm of Ethernet signal loss, the alarm identifier is ETH_LOS, then the control device can detect keywords such as ETH_LOS, alarm explanation, and alarm reason in the alarm description text through the first initial NLP network, and then include the above-mentioned The paragraph or sentence of the keyword is extracted to obtain the alarm explanation information and alarm reason corresponding to the ETH_LOS alarm.

Exemplarily, the alarm explanation information of ETH_LOS is as follows:

Exemplarily, the alarm reasons of ETH_LOS are as follows:

It should be noted that the above is only a possible implementation of extracting the alarm explanation information and the alarm reason provided by the embodiment of the present application. In some other possible implementation manners, the alarm explanation information and the alarm cause may also be extracted by other algorithms Or, the third NLP model can also be used to detect other keywords that can indicate the alarm explanation information and the alarm cause to realize the extraction of the alarm explanation information and the alarm cause of the sample alarm, which is not limited in this embodiment of the present application.

Optionally, in some possible implementations, the process of training the first initial NLP network to obtain the first NLP model can also be performed on other devices, that is, other devices can be trained to obtain the first NLP model, and then, can The first NLP model is deployed on the control device. Wherein, the implementation manner in which other devices train the first initial NLP network to obtain the first NLP model is the same as or similar to the above implementation manner, which is not limited in this embodiment of the present application.

Since the first NLP model has learned the logical relationship between each sample alarm in the alarm description text and the alarm cause of each sample alarm, after the control device obtains the alarm event, it can Input the information into the first NLP model, and the first NLP model can search for other alarms associated with each alarm included in the alarm event and The cause of the alarm, and then generate the diagnostic chain of the alarm event. At this point, the diagnostic chain of the alarm event will include the fault items corresponding to each alarm in the alarm event and other alarms that trigger the corresponding alarm, that is, the diagnostic chain of the alarm event will be able to characterize the correlation between the alarms And the logical relationship between each alarm and one or more fault items.

Exemplarily, it is assumed that the alarm event includes three alarms, which are link connectivity loss alarm TUNNEL_LOCV, Ethernet signal loss alarm ETH_LOS, and physical board offline alarm BD_STATUS. In the logical relationship among the various alarms learned by the first NLP model and the corresponding alarm causes, the triggering cause of TUNNEL_LOCV is ETH_LOS, that is, TUNNEL_LOCV is triggered by the alarm ETH_LOS. The triggering causes of ETH_LOS include two alarms and two fault items, among which, the two alarms are single-board hardware error alarms HARD_BAD and BD_STATUS, and the two fault items are the peer board fault and the local board fault, that is, The ETH_LOS alarm may be triggered by at least one of the two alarms HARD_BAD and BD_STATUS, or may be triggered by at least one of the two faults of the peer board failure and the local board failure. The triggering causes of BD_STATUS include the failure of the local board and the abnormal power supply alarm POWER_ABNORMAL, and the triggering causes of HARD_BAD include the failure of the lost power module. In this way, the first NLP model can obtain the diagnosis chain of the alarm event as shown in FIG. 4 according to the learned logical relationship among the alarms and the corresponding alarm cause. It can be seen that the diagnosis chain includes multiple fault items and multiple alarms, and represents the logical relationship between each alarm and the logical relationship between alarms and fault items.

After obtaining the diagnosis chain of the alarm event, the control device may use one or more non-repeated fault items included in the diagnosis chain as one or more candidate fault items of the alarm event.

For example, in the diagnosis chain of the alarm event in Figure 4, the ETH_LOS fault item includes the remote board fault and the local board fault, the BD_STATUS fault item includes the local board fault, and the HARD_BAD fault item that triggers ETH_LOS includes power loss module. By deduplicating the above fault items, it is obtained that multiple fault items in the diagnosis chain are peer board faults, local board faults, and lost power modules. The multiple fault items are used as multiple candidate fault items of the alarm event.

Step 303: According to one or more candidate fault items of the alarm event, determine the fault information corresponding to the alarm event.

After obtaining one or more candidate fault items of the alarm event, the control device can determine the real fault item corresponding to the alarm event from the one or more candidate fault items, and then generate the corresponding fault item of the alarm event according to the real fault item accident details.

Exemplarily, the control device may call a diagnostic interface of a diagnostic item corresponding to each candidate fault item among one or more candidate fault items; obtain the status information of the corresponding diagnostic item through the diagnostic interface of the diagnostic item corresponding to each candidate fault item; According to the state information of the diagnostic item corresponding to each candidate fault item, the fault information corresponding to the alarm event is determined.

It should be noted that the control device may store a mapping relationship between faulty items and corresponding diagnostic items. Based on this, after obtaining one or more candidate fault items, for the first candidate fault item among them, the control device may obtain one or more diagnostic items corresponding to the first candidate fault item from the mapping relationship. Afterwards, for the first diagnostic item among the one or more diagnostic items corresponding to the first candidate fault item, the control device may call the diagnostic interface of the first diagnostic item.

It should be noted that the diagnosis interface corresponding to each diagnosis item may be obtained after the control device pre-processes the processing steps of each sample alarm in the alarm description text through the second NLP model.

Exemplarily, the control device may identify the processing steps corresponding to each sample alarm among the multiple sample alarms included in the alarm description text in advance through the second NLP model, so as to obtain the diagnostic items corresponding to the corresponding processing steps; after that, generate each The diagnosis interface of the diagnosis item corresponding to each processing step.

Wherein, the control device may first extract the processing steps corresponding to each sample alarm from the alarm description text. Wherein, since there may be multiple alarm causes corresponding to each sample alarm, different processing steps may exist for different alarm reasons, therefore, there may be multiple processing steps corresponding to each sample alarm. After acquiring the processing steps corresponding to each sample alarm, the control device uses the processing steps corresponding to each alarm cause of the corresponding sample alarm as an input of the second NLP model. The second NLP model can perform semantic analysis and keyword extraction on the received processing step, so as to obtain the diagnosis item corresponding to the processing step. Afterwards, the control device can obtain the code input by relevant personnel for diagnosing the corresponding diagnostic item according to the obtained diagnostic item, and generate a diagnostic interface corresponding to the diagnostic item according to the obtained code.

Exemplarily, it is assumed that the processing steps corresponding to each alarm cause of ETH_LOS are as follows:

Through the second NLP model to identify the above processing steps, three diagnostic items can be obtained, which are querying whether the port is enabled, querying the working mode of the ports at both ends of the connection, and querying the loopback status of the opposite port.

After obtaining the above three diagnostic items, for the diagnostic item of querying the working mode of the ports at both ends of the docking, the control device can obtain the code input by the relevant personnel to realize the query of the working mode of the ports at both ends of the docking, and then according to the acquired The received code automatically generates the diagnostic interface corresponding to the diagnostic item.

For each diagnostic item analyzed by the second NLP model, the control device may refer to the above method to automatically generate a diagnostic interface corresponding to the corresponding diagnostic item.

It should be noted that, in the embodiment of the present application, after a diagnostic interface corresponding to a diagnostic item is generated, the control device may use the diagnostic item to name the diagnostic interface. Alternatively, in some possible implementation manners, the control device may also assign a corresponding interface identifier to the generated diagnostic interface, and store the interface identifier corresponding to the diagnostic item.

In addition, it can be seen from the foregoing introduction that the sample alarm may correspond to multiple alarm reasons, and different processing steps may be corresponding to different alarm reasons. In this case, after analyzing the processing steps corresponding to each sample alarm through the second NLP model to obtain the diagnostic items of the corresponding processing steps, the control device can also use the alarm cause corresponding to each processing step as the corresponding processing step corresponding fault items, and then correspondingly store the fault items and diagnostic items corresponding to each processing step, so as to obtain the mapping relationship between fault items and diagnostic items.

It can be known from the foregoing description that after the control device generates the diagnostic interface corresponding to the diagnostic item, it can name the corresponding diagnostic interface through the diagnostic item, that is, use the diagnostic item as the interface identifier of the corresponding diagnostic interface. In this case, taking the first diagnostic item among the one or more candidate diagnostic items as an example, when the control device calls the diagnostic interface corresponding to the first diagnostic item, it may call the diagnostic interface whose interface identifier is the first diagnostic item. Alternatively, it can be known from the foregoing introduction that the control device may also assign an interface identifier to the diagnostic interface corresponding to the diagnostic item, and store the diagnostic item corresponding to the interface identifier. In this case, the control device may obtain the interface identifier corresponding to the first diagnostic item from the stored mapping relationship between the diagnostic item and the interface identifier, and then call the diagnostic interface corresponding to the first diagnostic item according to the obtained interface identifier.

After invoking the diagnostic interface of the first diagnostic item, the control device may acquire the state information of the first diagnostic item through the diagnostic interface corresponding to the first diagnostic item.

Exemplarily, the control device may acquire the alarm position included in the information of the alarm triggered by the first candidate fault item in the alarm event, and determine the alarm position according to the acquired alarm position and the diagnostic content indicated by the first diagnostic item Location information of the first diagnostic item. Afterwards, according to the location information of the first diagnostic item, the status information of the first diagnostic item is acquired through the diagnostic interface corresponding to the first diagnostic item.

For example, assuming that the first candidate fault item is that the working mode of the peer port does not match or the inner ring is enabled on the peer port, the first candidate fault item will correspond to two diagnostic items, which are querying the working mode of the ports at both ends of the connection, Query the loopback status of the peer port. Assuming that the first diagnostic item is to query the working mode of the ports at both ends of the connection, and the alarm location contained in the information of the alarm triggered by the first candidate fault item is port 1 of network device A, the control device can use the alarm location and the first The diagnosis content indicated by a diagnosis item determines that the location information of the first diagnosis item is port 1 and the peer port connected to port 1 .

After obtaining the location information of the first diagnostic item, the control device may use the location information of the first diagnostic item as a query parameter of the diagnostic interface of the first diagnostic item, so as to acquire the status information of the first diagnostic item.

It should be noted that the control device may directly send a diagnosis instruction to the corresponding device through the diagnosis interface of the first diagnosis item to acquire status information.

Optionally, the control device may also display the status information acquisition indication of the first diagnostic item through the diagnostic interface of the first diagnostic item, so that the user can acquire the corresponding status information according to the status information acquisition indication of the first diagnostic item, and the acquired Status information is input to the control device. Correspondingly, the control device may receive the status information of the first diagnostic item input by the user.

For example, the location information of the first diagnostic item includes the address and port number of the network device, then the control device can send a diagnostic command to the network device indicated by the address of the network device through the diagnostic interface of the first diagnostic item, and the diagnostic command can be Carrying the port number in the location information, after receiving the diagnostic instruction, the network device queries the state information of the corresponding port according to the port number, and then feeds back the state information to the control device. After receiving the status information fed back by the network device, the control device uses the status information as the status information of the first diagnostic item.

For each diagnostic item corresponding to the first candidate fault item, the control device may refer to the method for obtaining the status information of the first diagnostic item described above to obtain the status information corresponding to each diagnostic item.

Further, for each candidate fault item among the one or more candidate fault items corresponding to the alarm event, the control device can refer to the above-mentioned processing method for the first candidate fault item to process each candidate fault item, so as to obtain each The status information of the diagnostic items corresponding to candidate fault items.

After obtaining the state information of the diagnostic item corresponding to each candidate fault item, the control device can determine the target fault item whose state information of the corresponding diagnostic item is inconsistent with the preset state information of the corresponding diagnostic item from one or more candidate fault items ; Generate fault information corresponding to the alarm event according to the target fault item and the repair method corresponding to the target fault item.

Wherein, for each diagnostic item, preset status information of the corresponding diagnostic item may be stored in the control device, and the preset status information is status information of the diagnostic item when the device is in normal operation. Based on this, the control device can compare the obtained status information of each diagnostic item with the preset status information of the corresponding diagnostic item. If the two are different, it means that the status of the corresponding diagnostic item is abnormal. At this time, the corresponding The candidate fault item corresponding to the diagnosis item is used as the target fault item, and the target fault item is the real fault item corresponding to the alarm event.

After determining the real fault item corresponding to the alarm event, the control device generates the fault information of the alarm event according to the real fault item. Wherein, the fault information includes a real fault item corresponding to the alarm event. In addition, the control device can also obtain the processing steps or repair methods corresponding to the real fault items from the alarm description text according to the real fault items corresponding to the alarm event, and then use the processing steps or repair methods as the alarm event part of the fault message.

Optionally, in some possible implementation manners, after the control device generates the fault information, it can send the fault information to the upper-layer operation and maintenance device, and the upper-layer operation and maintenance device will display it, so that the operation and maintenance personnel can make corresponding actions based on the fault information. repair processing.

Or, in some possible implementations, after the control device obtains the fault information of the alarm event, it can also automatically perform repair processing according to the repair method or processing steps included in the fault information, which is not limited in this embodiment of the present application. .

In the embodiment of the present application, the information of each alarm in the alarm event is processed through the NLP model trained by the alarm description text, so as to obtain one or more candidate fault causes of the alarm event, without manually setting diagnostic rules in advance. One or more candidate fault causes of the alarm event can be obtained, and then the fault information corresponding to the alarm event is determined according to the one or more candidate fault causes, which is intelligent and efficient. When new alarms are added later, you only need to add the corresponding alarm description text to train the NLP model to realize the analysis and processing of alarms, without re-developing rule codes, with a small workload and low maintenance costs.

Secondly, in the embodiment of the present application, the NLP model is used to identify the fault item corresponding to the alarm event. Since the NLP model is trained through the alarm description text, even if there is a human language deviation in the alarm information in the alarm event, it can still The correct result is identified through the NLP model, but in the related art once the warning information has a language deviation, the corresponding fault item cannot be obtained through the manually set rules. It can be seen that the method provided by the embodiment of the present application has wider applicability and is more stable.

Third, in the embodiment of the present application, after processing the information of multiple alarms included in the alarm event through the NLP model, the diagnostic chain of the alarm event can be obtained, and the diagnostic chain includes multiple alarms and one or more fault items , and the diagnostic chain can characterize the logical relationship between alarms and between alarms and fault items, so that the reasoning logic between alarms and fault items has strong interpretability.

Finally, in the embodiment of the present application, the processing steps in the alarm description text can be analyzed and processed by the second NLP model in advance to obtain the corresponding diagnosis item, and then the diagnosis interface corresponding to the diagnosis item can be automatically generated. In this way, when diagnosing the candidate fault item corresponding to the alarm event, the automatically generated diagnosis interface can be directly called for diagnosis, making the whole diagnosis process intelligent and efficient.

Next, the alarm processing apparatus provided by the embodiment of the present application will be introduced.

Referring to FIG. 5 , an embodiment of the present application provides an alarm processing device 500, which includes: an acquisition module 501, a processing module 502, and a determination module 503;

An acquisition module 501, configured to execute step 301 in the foregoing embodiment;

A processing module 502, configured to execute step 302 in the foregoing embodiment;

The determining module 503 is configured to execute step 302 in the foregoing embodiment.

Wherein, the obtaining module 501 , the processing module 502 and the determining module 503 may be implemented by a processor in the computer device shown in FIG. 2 .

Optionally, the processing module 502 is mainly used for:

The information of each alarm in the multiple alarms is used as the input of the first NLP model, and the information of each alarm in the multiple alarms is processed through the first NLP model to obtain a diagnostic chain of alarm events, and a diagnostic chain of alarm events Including multiple alarms and one or more fault items, and the diagnostic chain is used to characterize the logical relationship between multiple alarms and one or more fault items;

One or more fault items included in the diagnosis chain are used as one or more candidate fault items corresponding to the alarm event.

Optionally, the device 500 is also used for:

Get the alarm description text;

The first initial NLP network is trained according to the alarm explanation information and the alarm reasons respectively corresponding to the multiple sample alarms in the alarm description text to obtain the first NLP model.

Optionally, the determining module 503 includes:

Invoking a submodule for invoking a diagnostic interface of a diagnostic item corresponding to each candidate fault item in one or more candidate fault items;

The obtaining sub-module is used to obtain the state information of the corresponding diagnostic item through the diagnostic interface of the diagnostic item corresponding to each candidate fault item;

The determining submodule is configured to determine the fault information corresponding to the alarm event according to the state information of the diagnostic item corresponding to each candidate fault item.

Optionally, the device 500 is also used for:

Using the second NLP model to identify the processing steps corresponding to each sample alarm in the multiple sample alarms contained in the alarm description text, so as to obtain the diagnostic items corresponding to the corresponding processing steps;

A diagnostic interface that generates diagnostic items corresponding to each processing step.

Optionally, identify submodules primarily for:

Determining a target fault item whose status information of the corresponding diagnostic item is inconsistent with the preset status information of the corresponding diagnostic item from one or more candidate fault items;

The fault information corresponding to the alarm event is generated according to the target fault item and the repair device corresponding to the target fault item.

Optionally, the alarm description text includes at least one of product information text, alarm manual, and fault maintenance experience text.

To sum up, in the embodiment of this application, the information of each alarm in the alarm event is processed through the NLP model trained by the alarm description text, so as to obtain one or more candidate fault causes of the alarm event, without manual Presetting the diagnostic rules means that one or more candidate fault causes of the alarm event can be obtained, and then the fault information corresponding to the alarm event can be determined according to the one or more candidate fault causes, which is intelligent and efficient. When new alarms are added later, you only need to add the corresponding alarm description text to train the NLP model to realize the analysis and processing of alarms, without re-developing rule codes, with a small workload and low maintenance costs.

It should be noted that: when the alarm processing device provided in the above-mentioned embodiments handles alarms, it only uses the division of the above-mentioned functional modules as an example. In practical applications, the above-mentioned function allocation can be completed by different functional modules according to needs. The internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the alarm processing device and the alarm processing method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process thereof is detailed in the method embodiments, and will not be repeated here.

In the above embodiments, all or part may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center via wired (eg coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (eg infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media. The available medium may be a magnetic medium (for example: floppy disk, hard disk, magnetic tape), an optical medium (for example: Digital Versatile Disc (Digital Versatile Disc, DVD)), or a semiconductor medium (for example: Solid State Disk (Solid State Disk, SSD) )Wait.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above embodiments can be completed by hardware, and can also be completed by instructing related hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

The above description is not intended to limit the embodiments of the present application, and any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the embodiments of the present application shall be included within the scope of protection of the embodiments of the present application.

Claims (15)

1. An alarm processing method, characterized in that the method comprises:

acquiring an alarm event, wherein the alarm event comprises information of a plurality of alarms;

processing the information of each alarm in the plurality of alarms through a first natural language processing NLP model to obtain one or more candidate fault items corresponding to the alarm event, wherein the first NLP model is obtained through alarm description text training;

and determining fault information corresponding to the alarm event according to one or more candidate fault items corresponding to the alarm event.

2. The method according to claim 1, wherein the processing information of each of the plurality of alarms through the first NLP model to obtain one or more candidate fault items corresponding to the alarm event comprises:

taking information of each alarm in the plurality of alarms as input of the first NLP model, and processing the information of each alarm in the plurality of alarms through the first NLP model to obtain a diagnosis chain of the alarm event, where the diagnosis chain of the alarm event includes the plurality of alarms and one or more fault items, and the diagnosis chain is used to characterize a logical relationship between the plurality of alarms and the one or more fault items;

and taking one or more fault items contained in the diagnosis chain as one or more candidate fault items corresponding to the alarm event.

3. The method according to claim 1 or 2, characterized in that the method further comprises:

acquiring the alarm description text;

and training a first initial NLP network according to alarm explanation information and alarm reasons respectively corresponding to a plurality of sample alarms in the alarm description text to obtain the first NLP model.

4. The method according to claim 1, wherein the determining fault information corresponding to the alarm event according to one or more candidate fault items of the alarm event comprises:

calling a diagnosis interface of a diagnosis item corresponding to each candidate fault item in the one or more candidate fault items;

acquiring the state information of the corresponding diagnosis item through the diagnosis interface of the diagnosis item corresponding to each candidate fault item;

and determining the fault information corresponding to the alarm event according to the state information of the diagnosis item corresponding to each candidate fault item.

5. The method of claim 4, further comprising:

identifying the processing step corresponding to each sample alarm in the plurality of sample alarms contained in the alarm description text through a second NLP model to obtain a diagnosis item corresponding to the corresponding processing step;

and generating a diagnosis interface of the diagnosis item corresponding to each processing step.

6. The method according to claim 4 or 5, wherein the determining fault information corresponding to the alarm event according to the state information of each candidate fault item comprises:

determining a target fault item, of which the state information of the corresponding diagnosis item is inconsistent with the preset state information of the corresponding diagnosis item, from the one or more candidate fault items;

and generating fault information corresponding to the alarm event according to the target fault item and the repair method corresponding to the target fault item.

7. The method of claim 1, 3 or 5, wherein the alarm description text comprises at least one of a product information text, an alarm manual, and a fault maintenance experience text.

8. An alert processing apparatus, characterized in that the apparatus comprises:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring an alarm event, and the alarm event comprises information of a plurality of alarms;

the processing module is used for processing the information of each alarm in the plurality of alarms through a first Natural Language Processing (NLP) model to obtain one or more candidate fault items corresponding to the alarm event, and the first NLP model is obtained through alarm description text training;

and the determining module is used for determining the fault information corresponding to the alarm event according to the one or more candidate fault items corresponding to the alarm event.

9. The apparatus of claim 8, wherein the processing module is configured to:

taking information of each alarm in the plurality of alarms as input of the first NLP model, and processing the information of each alarm in the plurality of alarms through the first NLP model to obtain a diagnosis chain of the alarm event, where the diagnosis chain of the alarm event includes the plurality of alarms and one or more fault items, and the diagnosis chain is used to characterize a logical relationship between the plurality of alarms and the one or more fault items;

and taking one or more fault items contained in the diagnosis chain as one or more candidate fault items corresponding to the alarm event.

10. The apparatus of claim 8 or 9, wherein the apparatus is further configured to:

acquiring the alarm description text;

and training the first initial NLP network according to the alarm explanation information and the alarm reason which respectively correspond to the plurality of sample alarms and are included in the alarm description text to obtain the first NLP model.

11. The apparatus of claim 8, wherein the determining module comprises:

the calling submodule is used for calling a diagnosis interface of a diagnosis item corresponding to each candidate fault item in the one or more candidate fault items;

the acquisition submodule is used for acquiring the state information of the corresponding diagnosis item through the diagnosis interface of the diagnosis item corresponding to each candidate fault item;

and the determining submodule is used for determining the fault information corresponding to the alarm event according to the state information of the diagnosis item corresponding to each candidate fault item.

12. The apparatus of claim 11, wherein the apparatus is further configured to:

identifying the processing step corresponding to each sample alarm in the plurality of sample alarms contained in the alarm description text through a second NLP model to obtain a diagnosis item corresponding to the corresponding processing step;

and generating a diagnosis interface of the diagnosis item corresponding to each processing step.

13. The apparatus of claim 11 or 12, wherein the determination submodule is configured to:

determining a target fault item, of which the state information of the corresponding diagnosis item is inconsistent with the preset state information of the corresponding diagnosis item, from the one or more candidate fault items;

and generating fault information corresponding to the alarm event according to the target fault item and the repair device corresponding to the target fault item.

14. The apparatus of claim 8, 10 or 12, wherein the alarm description text comprises at least one of a product information text, an alarm manual, and a fault maintenance experience text.

15. A computer-readable storage medium having stored thereon instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 1-7.

Images