CN115550138A

CN115550138A - Alarm processing method and device, electronic equipment and storage medium

Info

Publication number: CN115550138A
Application number: CN202211119494.6A
Authority: CN
Inventors: 张恕征
Original assignee: Beijing Che Huan Huan Information Technology Co ltd
Current assignee: Beijing Che Huan Huan Information Technology Co ltd
Priority date: 2022-09-14
Filing date: 2022-09-14
Publication date: 2022-12-30

Abstract

The embodiment of the invention provides an alarm processing method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring alarm information, and sending the alarm information to a corresponding first receiving terminal; determining the alarm state of the alarm information; when the alarm state of the alarm information is the alarm generation state, storing a corresponding alarm upgrading record for the alarm information in a database according to the alarm information; judging whether the alarm information corresponding to the alarm upgrading record in the database meets the upgrading condition at regular time; when the upgrading condition is met, upgrading the alarm level in the alarm upgrading record; and sending the alarm information corresponding to the alarm upgrading record to a second receiving terminal corresponding to the upgraded alarm level according to the notification mode corresponding to the upgraded alarm level in the alarm upgrading record. By the alarm processing method of the embodiment, the alarm can be effectively tracked, the alarm information can be effectively processed in time, and the alarm processing efficiency is improved.

Description

Alarm processing method and device, electronic equipment and storage medium

Technical Field

The present invention relates to the field of data processing technologies, and in particular, to an alarm processing method and apparatus, an electronic device, and a storage medium.

Background

With the continuous development of internet technology, the service scale of each system is continuously increased, and a monitoring system needs to monitor the operating state of each system, and send the alarm information detected in real time to a user terminal after being processed by the alarm system so as to notify relevant operation and maintenance personnel. The current alarm system can not track the alarm state change, so that the alarm information can not be processed effectively in time, and the alarm processing efficiency is greatly influenced.

Disclosure of Invention

The embodiment of the invention provides an alarm processing method, an alarm processing device, electronic equipment and a storage medium, which are used for continuously tracking the alarm state, effectively processing alarm information in time and improving the alarm processing efficiency.

A first aspect of an embodiment of the present invention provides an alarm processing method, where the method includes:

acquiring alarm information, and sending the alarm information to a corresponding first receiving terminal;

determining the alarm state of the alarm information;

when the alarm state of the alarm information is the alarm generation state, storing a corresponding alarm upgrading record for the alarm information in a database according to the alarm information;

regularly judging whether the alarm information corresponding to the alarm upgrading record in the database meets the upgrading condition;

when the alarm information corresponding to the alarm upgrading record meets the upgrading condition, upgrading the alarm level in the alarm upgrading record;

and sending the alarm information corresponding to the alarm upgrading record to a second receiving terminal corresponding to the upgraded alarm level according to the notification mode corresponding to the upgraded alarm level in the alarm upgrading record.

A second aspect of the embodiments of the present invention provides an alarm processing apparatus, where the apparatus includes:

the acquisition module is used for acquiring alarm information and sending the alarm information to a corresponding first receiving terminal;

the first determining module is used for determining the alarm state of the alarm information;

the storage module is used for storing a corresponding alarm upgrading record for the alarm information in a database according to the alarm information when the alarm state of the alarm information is the alarm generation state;

the first judgment module is used for regularly judging whether the alarm information corresponding to the alarm upgrading record in the database meets the upgrading condition;

the upgrading module is used for upgrading the alarm grade in the alarm upgrading record when the alarm information corresponding to the alarm upgrading record meets the upgrading condition;

and the first sending module is used for sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal corresponding to the upgraded alarm grade according to the notification mode corresponding to the upgraded alarm grade in the alarm upgrading record.

A third aspect of embodiments of the present invention provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and executable on the processor, where when executed by the processor, the computer program implements the steps of the alarm processing method according to the first aspect of the present invention.

A fourth aspect of the embodiments of the present invention provides a computer-readable storage medium, where a computer program is stored, and when the computer program is executed by a processor, the computer program implements the steps in the alarm processing method according to the first aspect of the present invention.

The embodiment of the invention determines the alarm state of the alarm information after sending the acquired alarm information to the first receiving terminal, and stores the corresponding alarm upgrading record for the alarm information in the database according to the alarm information when the alarm state is the alarm state; and tracking whether the alarm information corresponding to the alarm upgrading record stored in the database meets the upgrading condition or not at regular time, upgrading the alarm level in the alarm upgrading record corresponding to the alarm information meeting the upgrading condition when the upgrading condition is met, and sending the alarm information corresponding to the alarm upgrading record to a second receiving terminal corresponding to the upgraded alarm level according to the notification mode corresponding to the upgraded alarm level. By the alarm processing method of the embodiment, the alarm upgrading record corresponding to the alarm information is stored for the alarm information to be processed (the sent alarm information), whether the alarm information corresponding to the alarm upgrading record stored in the database meets the upgrading condition is judged at regular time, so that the tracking of the alarm information to be processed is directly converted into the inquiry of whether the alarm upgrading record exists in the database to screen the alarm information to be processed, and a reliable means is provided for the subsequent judgment of whether the screened alarm information to be processed needs to be subjected to alarm upgrading; and the alarm information to be processed is subjected to alarm upgrading, and the alarm information is sent by the second receiving terminal according to the notification mode corresponding to the upgraded alarm information, so that the alarm processing can be more timely, the influence surface and timeliness of the alarm can be improved, and the alarm processing efficiency can be improved.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required to be used in the description of the embodiments of the present invention will be briefly introduced below, and it is obvious that the drawings in the description below are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings without inventive labor.

FIG. 1 is a flow chart illustrating a method for alarm handling according to an embodiment of the present invention;

FIG. 2 is a diagram illustrating an alert message format conversion according to an embodiment of the present invention;

FIG. 3 is a diagram illustrating an alarm message in a standard format according to an embodiment of the present invention;

FIG. 4 is a flowchart illustrating a process of sending alarm information for an alarm recovery status according to an embodiment of the present invention;

FIG. 5 is a flow chart illustrating a process of sending an alarm message that generates an alarm state according to an embodiment of the present invention;

FIG. 6 is a flow diagram illustrating an alert callback according to an embodiment of the present invention;

FIG. 7 is a flow diagram illustrating an alarm handling acknowledgement according to an embodiment of the present invention;

FIG. 8 is a flow chart illustrating an alarm escalation according to an embodiment of the present invention;

fig. 9 is a block diagram of an alarm processing apparatus according to an embodiment of the present invention;

fig. 10 is a schematic diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

As described above, although alarm systems in the related art, such as alert manager, can perform simple operations such as alarm grouping, recipient grouping, alarm muting, and notification frequency specifying alarm rules, these alarm systems cannot track the state of an alarm and do not know whether someone handles the alarm, so that alarm information cannot be processed effectively in time, and the processing efficiency of the alarm is greatly affected.

In order to at least partially solve one or more of the above problems and other potential problems, an embodiment of the present invention provides an alarm processing method, which stores an alarm update record in a database for alarm information after the alarm information is sent, periodically determines whether the alarm information corresponding to the alarm update record stored in the database meets an update condition, and can directly convert tracking of the alarm information to be processed into querying whether the alarm update record exists in the database, so as to screen the alarm information to be processed, thereby providing a reliable means for subsequently determining whether the screened alarm information to be processed (the alarm update record existing in the database) needs to be updated, and updating the alarm of the alarm information to be processed, so that alarm processing can be more timely, and the influence surface and timeliness of the alarm can be improved, thereby improving the alarm processing efficiency.

Referring to fig. 1, fig. 1 is a flowchart illustrating an alarm processing method according to an embodiment of the present invention. The alarm processing method provided by the embodiment can be applied to an alarm system. The alarm system of the embodiment supports the functions of alarm tracking, alarm upgrading, alarm information format conversion and the like. As shown in fig. 1, the alarm processing method of this embodiment may include the following steps:

step S11: and acquiring alarm information, and sending the alarm information to a corresponding first receiving terminal.

In this embodiment, the alarm system obtains the alarm information from the monitoring system, and may determine the first receiving terminal corresponding to the alarm information according to the alarm information, where the first receiving terminal is a responsible terminal that is directly responsible for processing the alarm and corresponds to the alarm information, so as to notify the responsible terminal to a direct responsible person/processing person/attendant of the alarm, for example, the alarm information may be sent to the first receiving terminal by means of nail notification, so as to complete forwarding of the alarm information.

Step S12: and determining the alarm state of the alarm information.

In this embodiment, the alarm system may determine the alarm state of the alarm information according to the alarm information, where the alarm state in this embodiment at least includes: an alarm state and an alarm recovery state are generated. Specifically, in this embodiment, the alarm state of the alarm information may be determined before the alarm information is sent to the corresponding first receiving terminal, but no matter whether the alarm state is an alarm state or an alarm recovery state, the alarm information is sent to the corresponding first receiving terminal; the embodiment may also be configured to determine the alarm state of the alarm information after sending the alarm information to the corresponding first receiving terminal, and the embodiment does not limit this.

Step S13: and when the alarm state of the alarm information is the alarm generation state, storing a corresponding alarm upgrading record for the alarm information in a database according to the alarm information.

In the embodiment, when the alarm system determines that the alarm state of the alarm information is the alarm generation state, the alarm generation state represents that the alarm is occurring, after the alarm information is sent, the alarm information is the alarm information to be processed, at the moment, according to the alarm information (the alarm information to be processed), the alarm upgrading record corresponding to the alarm information is stored in the database, so that the alarm information corresponding to the alarm upgrading record in the database is the alarm information to be processed, the possibility of timely and effectively processing the alarm through alarm upgrading can exist only when the alarm information to be processed does not need to be tracked, and the corresponding alarm upgrading record can be deleted in the database when the alarm information does not need to be tracked, thereby ensuring the effective tracking and upgrading of the alarm information.

Step S14: and regularly judging whether the alarm information corresponding to the alarm upgrading record in the database meets the upgrading condition.

The alarm upgrading record of this embodiment records the upgrading history of the corresponding alarm information, which is a record to be upgraded, and needs the alarm system to periodically determine whether the alarm information corresponding to the alarm upgrading record needs to be upgraded along with a timing task, so as to track the alarm. The alarm system can regularly judge whether the alarm information corresponding to the alarm upgrading record stored in the database meets the upgrading condition. The time interval for the alarm system to regularly determine whether the alarm information corresponding to the alarm upgrade record stored in the database satisfies the upgrade condition may be freely selected, which is not limited in this embodiment. Preferably, the time interval in this embodiment may be one minute, and the alarm system may scan the alarm upgrade record stored in the database every minute, and determine whether the alarm information corresponding to the stored alarm upgrade record meets the upgrade condition.

Step S15: and when the alarm information corresponding to the alarm upgrading record meets the upgrading condition, upgrading the alarm grade in the alarm upgrading record.

In this embodiment, when the alarm system determines that the alarm information corresponding to the alarm upgrading record stored in the database satisfies the upgrading condition, the alarm system may upgrade the alarm level in the alarm upgrading record corresponding to the alarm information that needs to be upgraded.

The alarm upgrading record comprises an alarm grade, when the alarm upgrading record is established, the alarm grade in the alarm upgrading record is defaulted to be an initial grade, and a receiving terminal corresponding to the initial grade is a first receiving terminal. In this embodiment, the alarm levels in the alarm upgrade record correspond to the alarm information corresponding to the alarm upgrade record, notification manners corresponding to different alarm levels of the same alarm information are different, and the notification manners corresponding to the alarm levels of the same level may be different due to different corresponding alarm information of the alarm levels of the same level. If the alarm levels are all initial levels, the alarm level of one initial level corresponds to the alarm information A, the corresponding notification mode is A1, the alarm level of the other initial level corresponds to the alarm information B, the corresponding notification mode is B1, and the A1 and the B1 are different. The alarm levels can be divided into a plurality of levels, for example, the alarm levels can be divided into 0 level, 1 level, 2 level, 3 level, or 1 level, 2 level, 3 level, 4 level, or primary level, middle level, high level, etc.; wherein, the 0 grade, the 1 grade and the primary grade are initial grades, the 1 grade, the 2 grade, the 3 grade and the 4 grade, and the medium grade, the medium grade and the high grade are alarm grades after the initial grade is upgraded. The above is only a partial example of the present embodiment, and the present embodiment does not set any limit to the specific form, the number of levels, and the like of the alarm level.

It can be understood that a plurality of alarm upgrading records may exist in the database, and when the system regularly judges whether the alarm information corresponding to the alarm upgrading record in the database meets the upgrading condition, the system judges whether the alarm information corresponding to each alarm upgrading record in the database meets the upgrading condition, so as to determine the alarm information which currently meets the upgrading condition and needs to be subjected to alarm upgrading, and thus, the alarm level in the alarm upgrading record corresponding to the alarm information which meets the upgrading condition is upgraded.

Step S16: and sending the alarm information corresponding to the alarm upgrading record to a second receiving terminal corresponding to the upgraded alarm level according to the notification mode corresponding to the upgraded alarm level in the alarm upgrading record.

In this embodiment, a corresponding notification mode and a second receiving terminal are preset for each alarm level of each alarm upgrade record, where the second receiving terminal is a receiving terminal corresponding to the alarm level after the alarm upgrade. After the alarm system upgrades the alarm level in the alarm upgrade record, the upgraded alarm level in the alarm upgrade record is determined, so that the alarm information corresponding to the alarm upgrade record can be sent to the second receiving terminal corresponding to the upgraded alarm level in the alarm upgrade record according to the notification mode corresponding to the upgraded alarm level in the alarm upgrade record.

In this embodiment, after the alarm information is sent, a corresponding alarm upgrade record is stored in the database for the alarm information, and whether the alarm information corresponding to the alarm upgrade record stored in the database meets the upgrade condition is determined at regular time, so that the tracking of the alarm information to be processed can be directly converted into the query of whether the alarm upgrade record exists in the database, so as to screen the alarm information to be processed, thereby providing a reliable and effective means for subsequently determining whether the screened alarm information to be processed (the alarm upgrade record existing in the database) needs to be subjected to alarm upgrade. And the alarm upgrading is carried out on the alarm information to be processed meeting the upgrading conditions, and the alarm information is sent again through the corresponding notification mode after the alarm upgrading and the receiving terminal, so that the alarm processing can be more timely, the influence surface and the timeliness of the alarm are improved, and the technical effect of improving the alarm processing efficiency is realized.

With reference to the foregoing embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. Specifically, in the method, before the step S13 of "saving the corresponding alarm upgrade record for the alarm information in the database according to the alarm information", the method further includes a step S21, and the step S13 of "saving the corresponding alarm upgrade record for the alarm information in the database according to the alarm information" may specifically include the step S22:

step S21: and judging whether an alarm upgrading record corresponding to the alarm fingerprint of the alarm information exists in the database.

In this embodiment, after the alarm system sends the alarm information to the first receiving terminal, the alarm fingerprint of the alarm information may be determined according to the alarm information. The alarm fingerprint of this embodiment is an identity characteristic of the alarm information, one alarm fingerprint may correspond to multiple pieces of alarm information, and if the alarm fingerprints of the multiple pieces of alarm information are the same, it represents that the multiple pieces of alarm information substantially belong to the same alarm; if the alarm fingerprints of the plurality of pieces of alarm information are different, the plurality of pieces of alarm information are represented to be different alarms substantially. For example, when the alarm system acquires two pieces of alarm information in sequence, the alarm system may determine alarm fingerprints corresponding to alarm information 1 and alarm information 2, respectively, and when it is determined that the alarm fingerprint of alarm information 1 is the same as the alarm fingerprint of alarm information 2, the alarm system may determine that alarm information 1 and alarm information 2 belong to the same alarm, for example, alarm information 1 is "the disk usage rate of server a reaches 91%", alarm information 2 is "the disk usage rate of server a reaches 92%", both the two pieces of alarm information are alarms for the disk usage rate of server a, and are substantially the same alarm, but the latest value of the alarm is different, and is changed from 91% to 92%.

For the alarm fingerprint in this embodiment, in an implementation manner, each alarm attribute of the alarm information may be regarded as a key, a value corresponding to each alarm attribute is regarded as a value, and a hash value is calculated according to all the alarm attributes and the values corresponding to all the alarm attributes, that is, a hash value is taken according to all the keys and all the values, and the obtained hash value is regarded as the alarm fingerprint of the alarm information.

In this embodiment, the alarm system creates an alarm update record for an alarm fingerprint, that is, the same alarm corresponds to only one alarm update record, and the alarm update record stored in the database corresponds to the alarm fingerprint. After sending the alarm information to the first receiving terminal, the alarm system determines an alarm fingerprint corresponding to the alarm information and judges whether an alarm upgrading record corresponding to the alarm fingerprint of the alarm information exists in the database.

Step S22: if the alarm upgrading record corresponding to the alarm fingerprint of the alarm information does not exist in the database, establishing a corresponding alarm upgrading record for the alarm fingerprint of the alarm information according to the alarm information and storing the alarm upgrading record in the database; and the alarm information corresponding to the alarm upgrading record is the latest alarm information corresponding to the alarm fingerprint corresponding to the alarm upgrading record.

In this embodiment, when the alarm system determines that the alarm upgrade record corresponding to the alarm fingerprint of the alarm information does not exist in the database, the alarm system may create a corresponding alarm upgrade record for the alarm fingerprint of the alarm information according to the alarm information, and store the created alarm upgrade record in the database, that is, the alarm system may create an alarm upgrade record according to the alarm information, where the alarm upgrade record corresponds to the alarm fingerprint of the alarm information, and store the alarm upgrade record in the database in association with the alarm fingerprint.

When the alarm system determines that the alarm upgrading record corresponding to the alarm fingerprint of the alarm information exists in the database, the same alarm corresponding to the alarm information is represented, the alarm upgrading record already exists in the database, and the same alarm is tracked through the alarm upgrading record, so that the alarm system does not need to create the alarm upgrading record again according to the alarm information, but directly takes the alarm upgrading record corresponding to the existing alarm fingerprint as the alarm upgrading record of the current alarm information.

In this embodiment, since the alarm upgrade record corresponds to an alarm fingerprint, and the alarm fingerprint may correspond to one or more pieces of alarm information, when the alarm system determines that the alarm information corresponding to the alarm upgrade record satisfies the upgrade condition, and upgrades the alarm level in the alarm upgrade record, the alarm system sends the latest alarm information corresponding to the alarm fingerprint corresponding to the alarm upgrade record to the second receiving terminal corresponding to the upgraded alarm level according to the notification manner corresponding to the upgraded alarm level in the alarm upgrade record.

When the alarm fingerprint only corresponds to one piece of alarm information, the latest alarm information corresponding to the alarm fingerprint corresponding to the alarm upgrading record is the alarm information corresponding to the alarm fingerprint; when the alarm fingerprint corresponds to a plurality of alarm information, the latest alarm information corresponding to the alarm fingerprint corresponding to the alarm upgrading record is one piece of alarm information which is latest received and sent by the alarm system aiming at the alarm fingerprint.

In this embodiment, an alarm upgrade record is created for an alarm fingerprint, after the alarm information is sent, it is determined whether an alarm upgrade record corresponding to the alarm fingerprint of the alarm information already exists in a database, and if not, the corresponding alarm upgrade record is created for the alarm fingerprint of the alarm information and stored in the database according to the alarm information, so that only one alarm upgrade record is generated for multiple pieces of alarm information of the same alarm for alarm tracking, thereby not only saving memory resources of data amount, but also optimizing a tracking algorithm, saving subsequent upgrade calculation resources, avoiding occupying storage space of the database due to generation of multiple alarm upgrade records for the same alarm, avoiding excessive consumption of calculation resources for alarm upgrade, and frequent repeated tracking and sending of multiple pieces of alarm information for the same alarm.

With reference to the foregoing embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, in addition to the above steps, the method may further include step S31:

step S31: and when the alarm state of the alarm information is an alarm recovery state, deleting an alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database.

In this embodiment, when the alarm system determines that the alarm state of the alarm information is the alarm recovery state, the alarm recovery state indicates that the alarm has been recovered. For example, after the alarm system acquires the alarm information which is sent by the monitoring system and generates the alarm state and sends the alarm information to the receiving terminal, the alarm corresponding to the alarm information is processed, and when the monitoring system detects that the alarm condition is no longer met by the system state, that is, the system state is lower than the preset alarm threshold value, which represents that the alarm is recovered, the monitoring system sends the alarm information of which the alarm state is the alarm recovery state to the alarm system, so as to notify the corresponding receiving terminal through the alarm system.

In this embodiment, the alarm system acquires the alarm information whose alarm state is the alarm recovery state, and at this time, it represents that the alarm corresponding to the alarm information has been processed, and the alarm does not need to be tracked.

Specifically, the alarm system may first determine whether an alarm upgrade record corresponding to the alarm fingerprint of the alarm information exists in the database, and if so, delete the alarm upgrade record corresponding to the alarm fingerprint of the alarm information in the database; if not, the step is ended directly.

In this embodiment, when the alarm system acquires the alarm information of the alarm recovery state, the alarm upgrade record corresponding to the alarm fingerprint of the alarm information is deleted from the database, so as to screen out the processed alarm, thereby enhancing the accuracy of subsequent alarm tracking.

With reference to the foregoing embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, in addition to the above steps, the method further includes steps S41 and S42:

step S41: receiving processing information of the alarm information, wherein the processing information at least comprises: acknowledge the notification or ignore the notification.

In this embodiment, after the receiving terminal (the first receiving terminal or the second receiving terminal) receives the alarm information sent by the alarm system, the user (such as a relevant responsible person/processing person/attendant) may confirm or ignore the alarm information through the receiving terminal, and the confirmation indicates that the alarm is being processed or is about to be processed; ignoring means that processing may not be performed for the alarm.

The receiving terminal responds to the confirmation or the neglect operation of the user aiming at the alarm information, the receiving terminal returns the processing information of the alarm information to the alarm system, the alarm system receives the processing information of the alarm information, and the processing information at least comprises: acknowledge notification or ignore notification.

Step S42: and deleting the alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database.

In this embodiment, after the alarm system receives the processing information for the alarm information returned by the first receiving terminal or the second receiving terminal, the alarm system may determine that the alarm corresponding to the alarm information has been followed up, and the purpose of performing the alarm for the alarm event has been achieved, so that the alarm does not need to be tracked and subsequently updated. Therefore, after receiving the processing information of the alarm information returned by the first receiving terminal or the second receiving terminal, the alarm system can delete the alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database, so that the alarm system does not need to perform alarm upgrading according to the alarm upgrading record corresponding to the alarm fingerprint of the alarm information.

In this embodiment, when the alarm information receives the processing information for the alarm information, it is determined that the alarm corresponding to the alarm information has been followed, and the alarm upgrade record corresponding to the alarm fingerprint of the alarm information is deleted from the database, so as to screen out the alarm that has been followed and does not need to be tracked any more, and enhance the accuracy of subsequent alarm tracking.

With reference to any one of the above embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, steps S51 and S52 are also included after the step S11 of "acquiring the warning information":

step S51: and determining whether the alarm information corresponds to a callback address according to the alarm resource type and the alarm resource ID of the alarm information.

In this embodiment, the alarm system supports execution of the callback WebHook, and may configure a callback address in advance according to the alarm resource type and the alarm resource ID, where the callback address is used to call a corresponding self-healing service to automatically process an alarm event. The alarm resource type and the alarm resource ID of this embodiment are two features of the alarm resource of the alarm information. For example, the alarm information is alarm information for a server, the alarm resource of the alarm information may be defined as a node resource, the alarm resource type of the alarm information is a node, and the alarm resource ID is a specific IP address of the server.

After the alarm system of this embodiment acquires the alarm information, whether the alarm information is in the alarm generation state or the alarm recovery state, it may determine whether the alarm information corresponds to the callback address according to the alarm resource type and the alarm resource ID of the alarm information. Specifically, one alarm may be bound to the alarm resource type + the alarm resource id, and the configured callback address is also bound to the two (the alarm resource type + the alarm resource id), and if the alarm information is received, the alarm resource type + the alarm resource id of the alarm information is only configured with the callback address, and it may be determined that the alarm information corresponds to the callback address.

Step S52: and if the alarm information corresponds to a callback address, triggering a script to execute the alarm processing operation of the alarm information through the callback address.

In this embodiment, if the alarm system determines that the alarm information corresponds to the callback address, the alarm system may trigger the script corresponding to the callback address through the callback address to perform an alarm processing operation on the alarm information, thereby implementing automatic processing of an alarm event; if the fact that the alarm information does not have the corresponding callback address is determined, callback cannot be supported. The script is a self-healing service on the downstream of the callback address, different callback addresses correspond to different alarm resource types and alarm resource IDs, different self-healing services correspond to different callback addresses, and the self-healing services can include but are not limited to: and services such as automatic disk content deletion, automatic capacity expansion and the like.

The alarm system of the embodiment supports execution of call-back WebHook during alarm and recovery to transmit alarm parameters to downstream self-healing services, where the alarm parameters are parameters that are included in alarm information and must be used when a corresponding script is executed, and the alarm parameters corresponding to each self-healing service are different. When the system receives the alarm information generating the alarm state, the callback can be executed later by judging whether the callback is supported or not. When the system receives the alarm information of the alarm recovery state, although the alarm is recovered, that is, the alarm is recovered to a state that the alarm is not alarmed, the system may also need to call back the alarm, so as to implement automatic alarm processing.

For example, when the alarm is "a disk capacity alarm of the server", and the alarm threshold of the alarm is that the disk usage rate of the server exceeds 90%, and the alarm system acquires the alarm information of the alarm recovery state that the disk usage rate of the server reaches 88%, the alarm is in the alarm recovery state at this time, but the disk capacity of the server may continue to perform capacity expansion processing, for example, the disk capacity of the server is expanded to 60%, and at this time, the alarm system may execute a callback after judging whether the alarm supports callback, so as to implement automatic processing of the alarm.

In this embodiment, the alarm system supports execution of a callback WebHook when generating an alarm and recovering the alarm, so that corresponding alarm parameters in the alarm information are transmitted to a downstream self-healing service through the callback address, thereby implementing automatic processing of the alarm.

With reference to any one of the above embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, the step S11 of "acquiring the warning information" may specifically include the steps S61 to S63:

step S61: and receiving original alarm information sent by different systems through different HTTP interfaces.

In this embodiment, the alarm system supports alarm information from different systems, such as Prometheus, arrhizus monitoring, custom alarms, and the like. The alarm system can receive the original alarm information sent by different systems through different HTTP interfaces.

Step S62: determining the home department of the original alarm information, and acquiring the alarm attribute of the original alarm information; wherein the alert attributes include at least: alarm resource type, alarm resource ID, alarm level, alarm state, and home department; and the attribution department is used for determining an alarm channel for sending the alarm information.

In this embodiment, the alarm system may determine the home department of the original alarm information according to the alarm resource of the original alarm information. Specifically, the alarm resource type and the alarm resource ID of the original alarm information may be determined, so that the home department of the original alarm information is determined according to the alarm resource type and the alarm resource ID of the original alarm information, and the alarm system can accurately push the alarm information to the designated terminal according to the alarm channel of the home department, so that the alarm information is pushed to the designated terminal by analyzing the resource information in the maintenance alarm information, and an attendant and a responsible person to which the alarm belongs are notified, thereby improving the accuracy of the alarm information.

The attribution department is an execution department for processing the alarm information, each attribution department specifies a corresponding alarm channel, and each level of responsible person and a receiving notification mode of the department are specified by the alarm channel. In this embodiment, the corresponding home department may be configured for each alarm resource in advance, and if not configured in advance, the operation and maintenance team may default to receive the alarm information at the bottom.

After the alarm system determines the home department door of the original alarm information, the alarm attribute of the original alarm information can be obtained. The alarm attributes of this embodiment at least include: alarm resource type, alarm resource ID, alarm level, alarm status, affiliation department, etc. Wherein the alert level includes: fault, warning, notification. Error, the Error information with the highest priority, needs to be processed in the fastest time, and has actual influence; warn that Warn, the information that needs to be processed, may have or will soon have an actual impact. Notify, low priority, is generally used for informative or suggestive information.

In this step, the alarm attribute of the original alarm information obtained by the alarm system may be understood as the complete alarm attribute of the original alarm information, where the alarm resource type, the alarm resource ID, the alarm level, the alarm state, and the like in the complete alarm attribute may be determined directly according to the obtained original alarm information, and the attribution department in the complete alarm attribute is determined according to the alarm resource type and the alarm resource ID in the alarm attribute, so that the alarm attribute of the original alarm information may be obtained after the attribution department of the original alarm information is determined.

Step S63: and according to the alarm attribute of the original alarm information, performing standard format conversion on the original alarm information to obtain the alarm information.

In this embodiment, the formats of the original alarm information sent by different systems received by the alarm system are different, and the alarm system needs to perform uniform format conversion on the original alarm information. Therefore, after the alarm system receives the original alarm information and determines the home department door of the original alarm information, the standard format conversion can be carried out on the original alarm information according to each alarm attribute of the original alarm information, so that the alarm information with a unified format can be obtained, and the acquisition of the alarm information in the alarm system can be realized.

In this embodiment, the alarm system supports the alarm information from different systems to convert the original alarm information of different systems into the standard alarm information format of the system, thereby avoiding the limitation that the alarm system can only receive the alarm information of a single system.

With reference to any one of the foregoing embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, before "sending the alarm information to the corresponding first receiving terminal" in the step S11, the method further includes steps S71 to S74, and the "sending the alarm information to the corresponding first receiving terminal" in the step S11 may specifically include step S75:

step S71: and judging whether an alarm record corresponding to the alarm fingerprint of the alarm information exists in the database.

In this embodiment, the alarm system may create an alarm record for each received alarm to record all information about the alarm, where the alarm record includes all alarm information corresponding to the alarm fingerprint, and specifically may include the sequence of each alarm information, the sending time of the alarm information, the alarm content of the alarm information, the alarm state of the alarm information, the alarm level of the alarm information, the alarm resource and the affiliation department of the alarm information, and so on. That is, the alarm system creates alarm records according to the alarm fingerprints, that is, the same alarm only corresponds to one alarm record, and the alarm records stored in the database correspond to the alarm fingerprints. After the alarm system acquires the alarm information, firstly, whether an alarm record corresponding to the alarm fingerprint of the alarm information exists in a database is judged, so that whether the corresponding alarm record exists in the alarm information is determined.

Step S72: and if the alarm record corresponding to the alarm fingerprint of the alarm information does not exist in the database, establishing a corresponding alarm record for the alarm fingerprint of the alarm information according to the alarm information and storing the alarm record in the database.

In this embodiment, if the alarm system determines that the alarm record corresponding to the alarm fingerprint of the alarm information does not exist in the database, the alarm system may create a corresponding alarm record according to the alarm information by using the alarm fingerprint of the alarm information, and store the created alarm record in the database. That is, the alarm system may create an alarm record according to the alarm information, where the alarm record corresponds to the alarm fingerprint of the alarm information, and store the alarm record in the database in association with the alarm fingerprint.

When the alarm system determines that the alarm record corresponding to the alarm fingerprint of the alarm information exists in the database, the same alarm corresponding to the alarm information is represented, the alarm record exists in the database, and the alarm system does not create the alarm record any more but updates the alarm record corresponding to the alarm fingerprint of the alarm information in the database according to the alarm information.

Step S73: and judging whether the alarm content of the alarm information is repeated.

In this embodiment, after creating or updating an alarm record according to the acquired alarm information, the alarm system may determine whether the alarm content of the alarm information is completely the same as the alarm content of the alarm information that has been acquired before. In the embodiment, aiming at the condition that the alarm system may receive a large amount of repeated alarm information at the same time or in a short time, the alarm system judges the alarm content of the alarm information so as to deduplicate the alarm information with the same alarm content.

Step S74: and if the alarm content is not repeated, judging whether the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is ignored or not.

In this embodiment, when the alarm system determines that the alarm content of the alarm information is not repeated, the alarm system may determine whether the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is ignored. The alarm record comprises an alarm follow-up state, the alarm follow-up state is a related follow-up state aiming at all alarm information corresponding to the alarm fingerprint, and the alarm follow-up state comprises alarm confirmation or alarm neglect. When the alarm system receives the processing information aiming at the alarm information, the processing information is recorded in the alarm record in the form of an alarm follow-up state; when the alarm system receives the alarm information of which the alarm state is the alarm recovery state, the alarm state is updated in the alarm record corresponding to the alarm fingerprint of the alarm information. In addition, when the alarm system determines that the alarm content of the alarm information is repeated, the alarm information can be directly not subjected to subsequent processing.

Step S75: and if the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is not ignored, sending the alarm information to the corresponding first receiving terminal.

In this embodiment, when the alarm system determines that the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is not ignored, the user does not perform an operation of ignoring all the alarm information corresponding to the alarm fingerprint, and at this time, the alarm system may send the alarm information to the corresponding first receiving terminal.

When the alarm system determines that the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is ignored, the representative user performs an ignoring operation on each alarm information corresponding to the alarm fingerprint, and at this time, even if the latest value of the alarm information is changed compared with other alarm information corresponding to the alarm fingerprint, for example, the utilization rate of a disk is changed from 91% to 92%, the alarm system does not send the alarm information of the alarm fingerprint again, and the alarm information is invalid alarm information, that is, when the alarm system receives the processing information of the alarm information, which is the ignore notice, the alarm system does not repeatedly send other alarm information belonging to the same alarm as the alarm information.

In this embodiment, after receiving the alarm information, the alarm system automatically performs effective alarm screening by determining deduplication of the alarm information and alarm ignoring, thereby further ensuring tracking of the effective alarm information.

With reference to any one of the above embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, the upgrading condition is that the alarm level of the alarm information corresponding to the alarm upgrading record is a fault or an alarm, and the alarm upgrading record still exists in the database within a preset time interval.

In this embodiment, since the notification is generally used for notifying or suggestive information, when the alarm level of the alarm information corresponding to the alarm upgrade record is the notification, the alarm system does not upgrade the alarm level of the alarm upgrade record. And when the alarm level of the alarm information corresponding to the alarm upgrading record is a fault or an alarm, the alarm system judges whether to upgrade the alarm level according to whether the alarm upgrading record exists in the database in a preset time interval. After the alarm system determines that the alarm information corresponding to the alarm upgrade record meets the upgrade condition each time, the alarm system upgrades the alarm level corresponding to the alarm upgrade record by one level, for example: after the alarm information corresponding to the alarm upgrading record is determined to meet the upgrading condition for the first time, the alarm level corresponding to the alarm upgrading record is upgraded by one level (such as being upgraded from the initial level to a middle level); and after the alarm information corresponding to the alarm upgrading record is determined to meet the upgrading condition for the second time, upgrading the alarm level corresponding to the alarm upgrading record by one level (such as upgrading from the middle level to the middle level).

The preset time interval in this embodiment may be flexibly determined according to requirements, and may be, for example, 10 minutes or 15 minutes, which is not limited in this embodiment. For example, when the alarm system determines that the alarm level of the alarm information corresponding to the alarm upgrade record in the database is a fault or an alarm and the alarm upgrade record still exists in the database within 10 minutes, it may be determined that the alarm information corresponding to the alarm upgrade record satisfies the upgrade condition.

With reference to any one of the above embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, different alarm levels correspond to different second receiving terminals; and the higher the alarm level is, the higher the level of the second receiving terminal corresponding to the alarm level is.

In this embodiment, the default alarm level when the alarm upgrade record is created is an initial level, and the initial level corresponds to the first receiving terminal. And aiming at the alarm level after the alarm level is upgraded, different alarm levels correspond to different second receiving terminals, and the higher the alarm level is, the higher the level of the second receiving terminal corresponding to the alarm level is, and the higher the level of the second receiving terminal is than that of the first receiving terminal.

For example, the receiving terminal corresponding to the alarm level 0 (initial level) may be the person on duty in the department, the receiving terminal corresponding to the alarm level 1 may be the person responsible for the department, the receiving terminal corresponding to the alarm level 2 may be the person responsible for the department at the previous level, the receiving terminal corresponding to the alarm level 3 may be the person responsible for the department at the previous level, and so on. Therefore, the level of the responsible person who updates the notification is higher, and the attention degree of the alarm is improved (the responsible person is updated according to the level of the organization structure of the alarm attribution department, and the influence is larger).

In this embodiment, the alarm level in the alarm upgrade record may be set to a highest level (top level), and when the alarm information corresponding to the alarm upgrade record meets the upgrade condition and is upgraded for the first time, the alarm system sends the corresponding alarm information to the first and second receiving terminals, and if the alarm is not processed or followed (i.e., the alarm system does not receive the processing information of the alarm information or the alarm information of the alarm recovery state corresponding to the alarm fingerprint of the alarm information), the alarm upgrade record will always exist in the database; when the alarm information corresponding to the alarm upgrading record meets the upgrading condition and is upgraded for the second time, the alarm system sends the corresponding alarm information to a second receiving terminal \8230 \8230andso on, when the alarm information corresponding to the alarm upgrading record meets the upgrading condition and is upgraded to the top level of the alarm level after being upgraded for the Nth time, the alarm system sends the corresponding alarm information to the last second receiving terminal (namely, the receiving terminal with the highest level), which indicates that all responsible persons are informed by the alarm at the moment, the upgrading process is finished, and no matter whether the alarm is subjected to alarm processing or follow-up, the alarm system deletes the alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database, so that the upgrading judgment is not required to be carried out subsequently aiming at the alarm.

With reference to any one of the above embodiments, in an implementation manner, an embodiment of the present invention further provides an alarm processing method. In the method, different alarm levels correspond to the same or different notification modes: for example, the notification mode corresponding to the low alarm level may be a nail notification, and the notification mode corresponding to the high alarm level may be the nail notification plus an attentive person; the notification mode corresponding to the low alarm level can be a nail notification or a short message notification, and the notification mode corresponding to the high alarm level can be a telephone notification; the notification mode corresponding to the low alarm level may also be a nail notification, a short message notification, or a telephone notification, and the notification mode corresponding to the high alarm level may also be a nail notification, a short message notification, or a telephone notification.

In this embodiment, when the notification mode corresponding to the upgraded alarm level in the alarm upgrade record is a telephone notification, the step S16 may specifically include steps S81 to S83:

step S81: it is determined whether the current time is within a preset time period.

In this embodiment, when determining that the alarm information corresponding to the alarm upgrade record satisfies the upgrade condition, the alarm system may determine whether the current time is within a preset time period. The preset time period is a preset time period allowing telephone notification. For example, since the fault is higher than the warning level of the warning, it may be set that the warning information of the fault may be notified by a telephone, and the warning information of the warning may be notified by a nail or a short message, which is understood to be only an example and not to have any limitation on the scope of the present application.

Step S82: and if the current time is within the preset time period, sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal according to a telephone notification.

In this embodiment, the alarm upgrade may occur at any time in a day, but in the early morning, the user is not very convenient to answer a call, and therefore, the time period in which the call notification is allowed may be set, and when the alarm system determines that the current time is within the preset time period (i.e., the time period in which the call notification is allowed), the alarm information corresponding to the alarm upgrade record is sent to the second receiving terminal corresponding to the upgraded alarm level according to the call notification.

Step S83: and if the current time is not within the preset time period, sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal according to a short message notification or a nail notification.

When the alarm system determines that the current time is not within a preset time period (i.e. a time period for allowing telephone notification), the telephone notification cannot be performed, but the alarm information corresponding to the alarm upgrade record can be sent to the second receiving terminal corresponding to the upgraded alarm level according to the short message notification or the nail notification.

In the embodiment, the alarm delivery capacity is improved by more effectively upgrading the channel of the notification; when the notification mode corresponding to the upgraded alarm level is determined to be a telephone, the specific notification mode is determined by determining whether the current time is within a preset time period for telephone notification in operation, so that the alarm system is more humanized on the basis of improving the alarm influence, and the user experience is improved.

In an implementation manner, referring to fig. 2, fig. 2 is a schematic diagram of an alarm information format conversion according to an embodiment of the present invention. As shown in fig. 2, the alarm system may receive original alarm information from different systems (e.g., promemeus, arryli cloud monitoring, custom alarm, etc.) through different HTTP interfaces, determine an alarm resource of the original alarm information through the original alarm information, determine an alarm resource attribution department (i.e., the alarm resource attribution in fig. 2) corresponding to the alarm resource according to a table lookup of the alarm resource in a database (i.e., the DB in fig. 2), where the table is a correspondence table of the alarm resource and the attribution department configured in advance. The alarm system performs standard format conversion on the original alarm information according to the related alarm attributes (such as alarm resource type, alarm resource ID, alarm level, alarm state, home department, and the like) of the original alarm information, so as to obtain the converted alarm information in the standard format including the ID of the home department (i.e., the receiver mode in fig. 2), and performs subsequent alarm processing on the alarm information according to the receiving notification mode configured by the home department. If the receiver (home department) does not configure a corresponding receiving notification mode, the operation and maintenance personnel can receive the alarm information by default.

Referring to fig. 3, fig. 3 is a schematic diagram of an alarm message in a standard format according to an embodiment of the present invention. The alarm information in fig. 3 includes an alarm level (alarm), an alarm state (alarm generation state), an alarm resource type (kafka), an alarm resource ID (inf), alarm content (i.e., the alarm information in fig. 3), and a home department (i.e., the resource home in fig. 3, which also includes a specific recipient).

In an embodiment, referring to fig. 4, fig. 4 is a schematic flowchart illustrating a process of sending alarm information of an alarm recovery state according to an embodiment of the present invention. As shown in fig. 4, when the alarm system obtains the alarm information in the alarm recovery state, the alarm state of the alarm record corresponding to the alarm fingerprint of the alarm information may be updated in the database, and then the alarm information is sent to the receiving terminal in a nail manner, and the alarm update record corresponding to the alarm fingerprint of the alarm information is deleted in the database.

In an implementation manner, referring to fig. 5, fig. 5 is a flowchart illustrating a process of sending alarm information for generating an alarm state according to an embodiment of the present invention. As shown in fig. 5, when the alarm system acquires the alarm information in the standard format that generates the alarm state (i.e., "alarm" in the first arrow in fig. 5), first, it determines whether an alarm record corresponding to the alarm fingerprint of the alarm information already exists in the database (i.e., "whether it has been sent" in fig. 5), and when it is determined that the alarm record corresponding to the alarm fingerprint of the alarm information exists in the database, it directly determines whether the alarm content of the alarm information is the repeated alarm content; when the alarm record corresponding to the alarm fingerprint of the alarm information does not exist in the database, the alarm record corresponding to the alarm fingerprint of the alarm information is established and stored in the database, and then whether the alarm content of the alarm information is the repeated alarm content or not is judged.

When the alarm system determines that the alarm content of the alarm information is the repeated alarm content, the alarm process is directly ended; when the alarm system determines that the alarm content of the alarm information is not the repeated alarm content, judging whether the alarm follow-up information is ignored or not according to the alarm record corresponding to the alarm fingerprint of the alarm information, and if so, directly ending the alarm process; and if the alarm follow-up information is determined not to be ignored according to the alarm record corresponding to the alarm fingerprint of the alarm information, sending the alarm information to the corresponding first receiving terminal in a nailing mode, creating an alarm upgrading record for the alarm fingerprint of the alarm information and storing the alarm upgrading record in the database. Before creating the alarm upgrading record, whether the alarm upgrading record corresponding to the alarm fingerprint of the alarm information exists in the database can be judged, if yes, the alarm upgrading record is not required to be created, and if not, the alarm upgrading record can be created.

In an implementation manner, referring to fig. 6, fig. 6 is a schematic flowchart of an alert callback according to an embodiment of the present invention. As shown in fig. 6, when the alarm system acquires alarm information, no matter the alarm information is in an alarm generation state or an alarm recovery state, the alarm system supports execution of a callback WebHook operation during alarm and recovery: firstly, judging whether callback is carried out or not, namely determining whether a callback address is configured or not according to the alarm resource type and the alarm resource ID of the alarm information, and if the callback address exists, determining that callback can be carried out, so that a relevant script is called through the callback address to execute the alarm processing operation of the alarm; if no callback address exists, determining that callback cannot be carried out, and directly ending the alarm callback flow.

In an implementation manner, referring to fig. 7, fig. 7 is a schematic flow chart of an alarm handling acknowledgement according to an embodiment of the present invention. As shown in fig. 7, after the alarm system sends the alarm information to the relevant receiving terminal and the attemperer or the responsible person is associated with the attemperer or the responsible person by the stapling robot, the attemperer or the responsible person corresponding to the relevant receiving terminal may ignore or confirm the alarm information, so that the alarm system may receive the processing information about the alarm information, confirm that the alarm has been followed, update the alarm follow-up status of the alarm in the alarm record, and delete the alarm upgrade record corresponding to the alarm fingerprint of the alarm information in the database. Meanwhile, the relevant person on duty or the person in charge can also check the workbench through the corresponding receiving terminal to know the relevant information of the alarm.

In an embodiment, referring to fig. 8, fig. 8 is a schematic flowchart illustrating an alarm upgrading process according to an embodiment of the present invention. As shown in fig. 8, the alarm system regularly queries whether an alarm upgrade record exists in the database, and if the alarm upgrade record does not exist in the database, the alarm upgrade process is ended. If the alarm upgrading record exists in the database, judging whether the alarm information corresponding to the alarm upgrading record accords with the upgrading condition or not for the existing alarm upgrading record, and if not, not carrying out alarm upgrading. If the alarm system determines that the alarm information corresponding to the alarm upgrading record in the database meets the upgrading condition, the alarm upgrading is carried out, the alarm information corresponding to the alarm upgrading record is sent to the receiving terminal corresponding to the upgraded alarm by a notification mode such as a telephone, whether the current upgraded alarm level reaches the top level is judged, if not, the subsequent upgrading judgment process is continued, until the alarm level is upgraded to the top level after the alarm upgrading, the alarm information corresponding to the alarm upgrading record is sent to the receiving terminal corresponding to the top level by the notification mode corresponding to the top level, at this moment, all responsible persons are notified, the upgrading cannot be carried out, namely, the upgrading process is finished, and the alarm upgrading record of the top level is deleted in the database.

It should be noted that, for simplicity of description, the method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present invention is not limited by the illustrated order of acts, as some steps may occur in other orders or concurrently in accordance with the embodiments of the present invention. Further, those skilled in the art will appreciate that the embodiments described in the specification are presently preferred and that no particular act is required to implement the invention.

Based on the same inventive concept, an embodiment of the present invention provides an alarm processing apparatus 900, and the alarm processing apparatus 900 may be applied to the alarm system of the embodiment. The alarm system of the embodiment supports the functions of alarm tracking, alarm upgrading, alarm information format conversion and the like. Referring to fig. 9, fig. 9 is a block diagram of an alarm processing apparatus according to an embodiment of the present invention. As shown in fig. 9, the alarm processing apparatus 900 includes:

an obtaining module 901, configured to obtain alarm information and send the alarm information to a corresponding first receiving terminal;

a first determining module 902, configured to determine an alarm state of the alarm information;

a storage module 903, configured to store, when an alarm state of the alarm information is an alarm generation state, a corresponding alarm update record for the alarm information in a database according to the alarm information;

a first judging module 904, configured to regularly judge whether the alarm information corresponding to the alarm upgrade record in the database meets an upgrade condition;

the upgrading module 905 is used for upgrading the alarm level in the alarm upgrading record when the alarm information corresponding to the alarm upgrading record meets the upgrading condition;

a first sending module 906, configured to send, according to a notification mode corresponding to the upgraded alarm level in the alarm upgrade record, the alarm information corresponding to the alarm upgrade record to a second receiving terminal corresponding to the upgraded alarm level.

Optionally, the apparatus 900 further includes:

a second judging module, configured to judge whether an alarm upgrade record corresponding to an alarm fingerprint of the alarm information exists in a database before storing, according to the alarm information, a corresponding alarm upgrade record for the alarm information in the database;

the storage module 903 includes:

the first establishing module is used for establishing a corresponding alarm upgrading record for the alarm fingerprint of the alarm information according to the alarm information and storing the alarm upgrading record in the database if the alarm upgrading record corresponding to the alarm fingerprint of the alarm information does not exist in the database;

and the alarm information corresponding to the alarm upgrading record is the latest alarm information corresponding to the alarm fingerprint corresponding to the alarm upgrading record.

Optionally, the apparatus 900 further includes:

and the first deleting module is used for deleting the alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database when the alarm state of the alarm information is the alarm recovery state.

Optionally, the apparatus 900 further includes:

a first receiving module, configured to receive processing information of the alarm information, where the processing information at least includes: confirm notification or ignore notification;

and the second deleting module is used for deleting the alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database.

Optionally, the apparatus 900 further includes:

the third judging module is used for determining whether the alarm information corresponds to a callback address according to the alarm resource type and the alarm resource ID of the alarm information after the alarm information is acquired;

and the callback module is used for triggering a script to execute the alarm processing operation of the alarm information through the callback address if the alarm information corresponds to the callback address.

Optionally, the obtaining module 901 includes:

the second receiving module is used for receiving original alarm information sent by different systems through different HTTP interfaces;

the second determining module is used for determining the attribution department of the original alarm information and acquiring the alarm attribute of the original alarm information; wherein the alert attributes include at least: alarm resource type, alarm resource ID, alarm level, alarm state, and home department; the attribution department is used for determining an alarm channel for sending the alarm information;

and the format conversion module is used for performing standard format conversion on the original alarm information according to the alarm attribute of the original alarm information to obtain the alarm information.

Optionally, the apparatus 900 further includes:

a fourth judging module, configured to judge whether an alarm record corresponding to an alarm fingerprint of the alarm information exists in the database before the alarm information is sent to the corresponding first receiving terminal;

the second establishing module is used for establishing a corresponding alarm record for the alarm fingerprint of the alarm information according to the alarm information and storing the alarm record in the database if the alarm record corresponding to the alarm fingerprint of the alarm information does not exist in the database;

the fifth judging module is used for judging whether the alarm content of the alarm information is repeated;

a sixth judging module, configured to judge whether an alarm follow-up state in an alarm record corresponding to an alarm fingerprint of the alarm information is ignored or not if the alarm content is not repeated;

the obtaining module 901 includes:

and the second sending module is used for sending the alarm information to the corresponding first receiving terminal if the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is not ignored.

Optionally, the upgrade condition is that the alarm level of the alarm information corresponding to the alarm upgrade record is a fault or an alarm, and the alarm upgrade record still exists in the database within a preset time interval.

Optionally, different alarm levels correspond to different second receiving terminals; and the higher the alarm level is, the higher the level of the second receiving terminal corresponding to the alarm level is.

Optionally, different alarm levels correspond to the same or different notification modes; the first sending module 906, comprising:

a seventh judging module, configured to determine whether the current time is within a preset time period when the notification mode corresponding to the upgraded alarm level in the alarm upgrade record is a telephone notification;

the third sending module is used for sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal according to a telephone notification if the current time is within the preset time period;

and the fourth sending module is used for sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal according to a short message notification or a nail notification if the current time is not within the preset time period.

Based on the same inventive concept, another embodiment of the present invention provides an electronic device 1000, as shown in fig. 10. Fig. 10 is a schematic diagram of an electronic device according to an embodiment of the present invention. The electronic device comprises a processor 1001, a memory 1002 and a computer program stored in the memory 1002 and executable on the processor 1001, wherein the computer program, when executed by the processor, implements the steps of the alarm processing method according to any of the above embodiments of the present invention.

Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the steps in the alarm processing method according to any of the above-mentioned embodiments of the present invention.

The embodiments in the present specification are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a component of' 8230; \8230;" does not exclude the presence of another like element in a process, method, article, or apparatus that comprises the element.

Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solutions of the present invention may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal (such as a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the method according to the embodiments of the present invention.

While the present invention has been described with reference to the particular illustrative embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but is intended to cover various modifications, equivalent arrangements, and equivalents thereof, which may be made by those skilled in the art without departing from the spirit and scope of the invention as defined by the appended claims.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the technical solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

It can be clearly understood by those skilled in the art that, for convenience and simplicity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of the changes or substitutions within the technical scope of the present invention, and shall cover the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An alarm processing method, characterized in that the method comprises:

determining the alarm state of the alarm information;

2. The alarm processing method according to claim 1, wherein before said storing, according to the alarm information, a corresponding alarm escalation record for the alarm information in a database, the method further comprises:

judging whether an alarm upgrading record corresponding to the alarm fingerprint of the alarm information exists in the database;

the step of storing a corresponding alarm upgrading record for the alarm information in a database according to the alarm information comprises the following steps:

if the alarm upgrading record corresponding to the alarm fingerprint of the alarm information does not exist in the database, establishing a corresponding alarm upgrading record for the alarm fingerprint of the alarm information according to the alarm information and storing the alarm upgrading record in the database;

3. The alert processing method according to claim 2, wherein the method further comprises:

and when the alarm state of the alarm information is an alarm recovery state, deleting an alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database.

4. The alert processing method according to claim 2, wherein the method further comprises:

receiving processing information of the alarm information, wherein the processing information at least comprises: confirm notification or ignore notification;

and deleting the alarm upgrading record corresponding to the alarm fingerprint of the alarm information in the database.

5. The alarm processing method according to claim 1, wherein after said obtaining the alarm information, the method further comprises:

determining whether the alarm information corresponds to a callback address according to the alarm resource type and the alarm resource ID of the alarm information;

and if the alarm information corresponds to a callback address, triggering a script to execute the alarm processing operation of the alarm information through the callback address.

6. The alarm processing method according to claim 1, wherein the obtaining the alarm information comprises:

receiving original alarm information sent by different systems through different HTTP interfaces;

determining a home department of the original alarm information, and acquiring an alarm attribute of the original alarm information; wherein the alert attributes include at least: alarm resource type, alarm resource ID, alarm level, alarm state, and home department; the attribution department is used for determining an alarm channel for sending the alarm information;

and according to the alarm attribute of the original alarm information, performing standard format conversion on the original alarm information to obtain the alarm information.

7. The alarm processing method according to claim 2, wherein before said sending the alarm information to the corresponding first receiving terminal, the method further comprises:

judging whether an alarm record corresponding to the alarm fingerprint of the alarm information exists in the database;

if the alarm record corresponding to the alarm fingerprint of the alarm information does not exist in the database, establishing a corresponding alarm record for the alarm fingerprint of the alarm information according to the alarm information and storing the alarm record in the database;

judging whether the alarm content of the alarm information is repeated;

if the alarm content is not repeated, judging whether the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is ignored or not;

the sending the alarm information to a corresponding first receiving terminal includes:

and if the alarm follow-up state in the alarm record corresponding to the alarm fingerprint of the alarm information is not ignored, sending the alarm information to the corresponding first receiving terminal.

8. The alarm processing method according to any one of claims 1 to 7, wherein the upgrade condition is that the alarm level of the alarm information corresponding to the alarm upgrade record is a fault or an alarm, and the alarm upgrade record still exists in the database within a preset time interval.

9. The alarm processing method according to any of claims 1 to 7, wherein different alarm levels correspond to different second receiving terminals; and the higher the alarm level is, the higher the level of the second receiving terminal corresponding to the alarm level is.

10. The alarm processing method according to any one of claims 1 to 7, wherein different alarm levels correspond to the same or different notification modes; when the notification mode corresponding to the upgraded alarm level in the alarm upgrade record is a telephone notification, sending the alarm information corresponding to the alarm upgrade record to the second receiving terminal corresponding to the upgraded alarm level according to the notification mode corresponding to the upgraded alarm level in the alarm upgrade record, including:

determining whether the current time is within a preset time period;

if the current time is within the preset time period, sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal according to a telephone notification;

and if the current time is not within the preset time period, sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal according to a short message notification or a nail notification.

11. An alert processing apparatus, characterized in that the apparatus comprises:

and the first sending module is used for sending the alarm information corresponding to the alarm upgrading record to the second receiving terminal corresponding to the upgraded alarm level according to the notification mode corresponding to the upgraded alarm level in the alarm upgrading record.

12. The alert processing apparatus according to claim 11, wherein said apparatus further comprises:

the second judgment module is used for judging whether an alarm upgrading record corresponding to the alarm fingerprint of the alarm information exists in the database before the corresponding alarm upgrading record is stored for the alarm information in the database according to the alarm information;

the memory module includes:

13. The alert processing apparatus according to claim 12, wherein the apparatus further comprises:

14. The alert processing apparatus according to claim 12, wherein said apparatus further comprises:

15. The alert processing apparatus according to claim 11, wherein said apparatus further comprises:

a third judging module, configured to determine whether the alarm information corresponds to a callback address according to an alarm resource type and an alarm resource ID of the alarm information after the alarm information is obtained;

16. The alarm processing apparatus according to claim 11, wherein the obtaining module comprises:

the second determining module is used for determining the affiliation department of the original alarm information and acquiring the alarm attribute of the original alarm information; wherein the alert attributes include at least: alarm resource type, alarm resource ID, alarm level, alarm state, and home department; the attribution department is used for determining an alarm channel for sending the alarm information;

17. The alert processing apparatus according to claim 12, wherein the apparatus further comprises:

a fourth judging module, configured to judge whether an alarm record corresponding to an alarm fingerprint of the alarm information exists in the database before sending the alarm information to a corresponding first receiving terminal;

the second creating module is used for creating a corresponding alarm record for the alarm fingerprint of the alarm information according to the alarm information and storing the alarm record in the database if the alarm record corresponding to the alarm fingerprint of the alarm information does not exist in the database;

a fifth judging module, configured to judge whether the alarm content of the alarm information is repeated;

the acquisition module comprises:

18. The alarm processing apparatus according to any one of claims 11 to 17, wherein the upgrade condition is that an alarm level of the alarm information corresponding to the alarm upgrade record is a fault or an alarm, and the alarm upgrade record still exists in the database within a preset time interval.

19. The alarm processing device according to any of claims 11 to 17, wherein different alarm classes correspond to different second receiving terminals; and the higher the alarm level is, the higher the level of the second receiving terminal corresponding to the alarm level is.

20. The alarm processing device according to any of claims 11 to 17, wherein different alarm levels correspond to the same or different notification modes; the first sending module includes:

a third sending module, configured to send, according to a telephone notification, alarm information corresponding to the alarm upgrade record to the second receiving terminal if the current time is within the preset time period;

21. An electronic device, comprising: processor, memory and a computer program stored on the memory and executable on the processor, which computer program, when executed by the processor, carries out the steps of the alert processing method according to any of claims 1 to 10.

22. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, which computer program, when being executed by a processor, carries out the steps of the alert processing method according to any one of claims 1 to 10.