CN115801589A - Event topological relation determining method, device, equipment and storage medium - Google Patents
Event topological relation determining method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN115801589A CN115801589A CN202211429614.2A CN202211429614A CN115801589A CN 115801589 A CN115801589 A CN 115801589A CN 202211429614 A CN202211429614 A CN 202211429614A CN 115801589 A CN115801589 A CN 115801589A
- Authority
- CN
- China
- Prior art keywords
- identification information
- event
- topological relation
- alarm
- sub
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a method, a device, equipment and a storage medium for determining an event topological relation. The method comprises the following steps: acquiring an alarm event list of a monitoring system, matching the alarm event list with a preset topological relation table to generate a first identification information group and a first sub-event topological relation, and taking all network identification information as a second identification information group; reversely deducing the second identification information group to generate a second sub-event topological relation; and updating the second sub-event topological relation according to the first sub-event topological relation so as to generate an event topological relation corresponding to the alarm event list. The network identification information in the alarm event list is reversely deduced to generate a second sub-event topological relation, the preset topological relation table is matched with the alarm event list to update the second sub-event topological relation, the event topological relation can be sorted without data support, the manual workload is reduced, and the deduction accuracy is improved.
Description
Technical Field
The present invention relates to the field of data processing, and in particular, to a method, an apparatus, a device, and a storage medium for determining an event topology relationship.
Background
In the process of promoting enterprise informatization, a large number of IT infrastructures and monitoring systems matched with the IT infrastructures are built day by day in various industries, the large number of monitoring systems are built according to technical characteristics, in actual operation and maintenance work, a real fault appears in a batch of alarm events in a plurality of monitoring systems, and how to accurately and quickly sort the logical relationship among the events is particularly used for logic relationship derivation for positioning fault root causes, so that the method is a general problem in the whole operation and maintenance monitoring industry.
At present, the relation between network identification information is usually imported into a unified event management platform by an external relation importing method through configuring a management database, importing the cascade relation between nodes in advance, then matching newly generated events, associating and assigning a dependency relationship value to the nodes; or the attribute values of the gateway, the network segment and the like are manually set, and when a new event is acquired, a dependency relationship value is automatically assigned.
In the prior art, a method of introducing an external relationship or manually setting a gateway is adopted, a large amount of data is required for supporting, the data cannot be updated in time, and meanwhile, manual operation is relied on, so that the manual workload is large, and the accuracy is low.
Disclosure of Invention
The invention provides a method, a device, equipment and a storage medium for determining an event topological relation, which are used for analyzing alarm information to generate the event topological relation.
According to an aspect of the present invention, there is provided an event topology relation determining method, including:
acquiring an alarm event list of a monitoring system, wherein the alarm event list comprises network identification information;
matching the alarm event list with a preset topological relation table to generate a first identification information group, and taking all network identification information in the alarm event list as a second identification information group;
generating a first sub-event topological relation according to the first identification information group and the topological relation table;
reversely deducing the second identification information group to generate a second sub-event topological relation;
and updating the second sub-event topological relation according to the first sub-event topological relation so as to generate an event topological relation corresponding to the alarm event list.
Optionally, obtaining an alarm event list of the monitoring system includes: collecting alarm information in a specified time range, wherein the alarm information comprises network identification information; carrying out format conversion on the designated field in the alarm information to obtain the converted alarm information; and screening the converted alarm information according to an appointed rule to obtain screened alarm information, and generating an alarm event list according to the screened alarm information.
Optionally, generating a first identifier information group according to each network identifier information and a preset topology relationship table, includes: determining target network identification information in a topological relation table in an alarm event list; the target network identification information is divided into first identification information groups.
Optionally, generating a first sub-event topological relation according to the first identification information group and the topological relation table includes: matching each network identification information in the first identification information group with the topological relation table to determine the position and the connection relation of each network identification information; and generating a first sub-event topological relation according to the network identification information, the position and the connection relation.
Optionally, the reversely deriving the second identification information group to generate the second sub-event topological relation includes: the same network identification information in the second identification information group is used as a node, and the number of the same network identification information in the node is determined; arranging the nodes in a sequence of at least more nodes according to the number to generate a node list; sequentially selecting two nodes in the node list to carry out reverse derivation so as to determine the position relationship; and taking the first node in the node list as a main reference node, and determining a second sub-event topological relation according to the main reference node, the network identification information and the position relation.
Optionally, before sequentially selecting two nodes in the node list to perform reverse derivation to determine the position relationship, the method further includes: and carrying out format conversion on the network identification information corresponding to each node to generate conversion identification information, wherein the conversion identification information comprises a network number.
Optionally, sequentially selecting two nodes in the node list to perform reverse derivation to determine the position relationship, includes: determining conversion identification information corresponding to the node; determining the number of the two conversion identification information with the same network number; and determining the position relation of the two nodes according to the quantity.
According to another aspect of the present invention, there is provided an event topology relation determination apparatus, including:
the alarm event list acquisition module is used for acquiring an alarm event list of the monitoring system, wherein the alarm event list comprises network identification information;
the identification information group generating module is used for matching the alarm event list with a preset topological relation table to generate a first identification information group and taking all network identification information in the alarm event list as a second identification information group;
the first sub-event topological relation generating module is used for generating a first sub-event topological relation according to the first identification information group and the topological relation table;
the second sub-event topological relation generating module is used for reversely deducing the second identification information group to generate a second sub-event topological relation;
and the event topological relation generating module is used for updating the second sub-event topological relation according to the first sub-event topological relation so as to generate an event topological relation corresponding to the alarm event list.
According to another aspect of the present invention, there is provided an electronic apparatus including:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores a computer program executable by the at least one processor, the computer program being executable by the at least one processor to enable the at least one processor to perform a method of determining an event topological relation according to any one of the embodiments of the present invention.
According to another aspect of the present invention, there is provided a computer-readable storage medium storing computer instructions for causing a processor to implement a method for determining an event topology relationship according to any one of the embodiments of the present invention when the computer instructions are executed.
According to the technical scheme of the embodiment of the invention, the network identification information in the alarm event list is reversely deduced to generate the second sub-event topological relation, and the preset topological relation table is matched with the alarm event list to update the second sub-event topological relation, so that the event topological relation can be sorted without data support, the manual workload is reduced, and the deduction accuracy is improved.
It should be understood that the statements in this section do not necessarily identify key or critical features of the embodiments of the present invention, nor do they necessarily limit the scope of the invention. Other features of the present invention will become apparent from the following description.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 is a flowchart of an event topology relationship determination method according to an embodiment of the present invention;
fig. 2 is a flowchart of another method for determining event topology according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of an event topology according to an embodiment of the present invention;
fig. 4 is a flowchart of another method for determining a topological relation of events according to a second embodiment of the present invention;
fig. 5 is a schematic structural diagram of an event topological relation determining apparatus according to a third embodiment of the present invention;
fig. 6 is a schematic structural diagram of an electronic device implementing the event topology relation determining method according to the embodiment of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Example one
Fig. 1 is a flowchart of an event topological relation determining method according to an embodiment of the present invention, where this embodiment is applicable to a case where an event topological relation of an alarm event list is determined, and the method may be executed by an event topological relation determining apparatus, where the event topological relation determining apparatus may be implemented in a form of hardware and/or software, and the event topological relation determining apparatus may be configured in a computer. As shown in fig. 1, the method includes:
and S110, acquiring an alarm event list of the monitoring system.
The monitoring system is a system for detecting faults, and the monitoring system includes a network monitoring system, a host monitoring system, a database monitoring system, a log monitoring system, and the like. The alarm event list is a list which is generated after the monitoring system detects a fault and contains fault key information, and the alarm event list contains network identification information. The network identification information refers to an internet protocol address (IP), and the network identification information is a protocol designed for communication between computer networks. That is, when the monitoring system detects a fault, the controller may obtain an alarm event list of the monitoring system, and complete analysis of the alarm event through the alarm event list.
And S120, matching the alarm event list with a preset topological relation table to generate a first identification information group, and taking all network identification information in the alarm event list as a second identification information group.
The topological relation refers to the mutual relation among all spatial data satisfying the topological geometry principle, and in this embodiment, the network identification information is used as a node, and the topological relation is the connection relation among the network identification information. The topology relation table is a connection relation preset in the controller by a user and storing known network identification information in the topology relation table. The identification information group is composed of network identification information, the controller matches the alarm event list with a preset topological relation table to generate a second identification information group, and meanwhile, all network identification information in the alarm event list is used as the second identification information group.
Optionally, generating a first identifier information group according to each network identifier information and a preset topology relationship table, includes: determining target network identification information in a topological relation table in an alarm event list; the target network identification information is divided into first identification information groups.
Specifically, because the alarm event list includes the network identification information, when the controller matches the alarm event list with the preset topological relation table, the controller may determine the target network identification information located in the topological relation table in the alarm event list, and divide the target network identification information into the first identification information group, that is, the first identification information group is the network identification information of the known connection relationship in the topological relation table.
S130, generating a first sub-event topological relation according to the first identification information group and the topological relation table.
Optionally, generating a first sub-event topological relation according to the first identification information group and the topological relation table includes: matching each network identification information in the first identification information group with the topological relation table to determine the position and the connection relation of each network identification information; and generating a first sub-event topological relation according to the network identification information, the position and the connection relation.
Specifically, the controller matches each network identification information with the topology relation table, determines the position and connection relation of the network identification information in the topology relation table, and uses the network identification information and the position and connection relation as the first sub-event topology relation.
And S140, reversely deducing the second identification information group to generate a second sub-event topological relation.
The backward derivation refers to a process of representing the network identification information in the second identification information group in a 32-bit binary form, and then sequentially recursively finding the maximum collection of the network numbers of different network identification information from the head to the right, thereby indirectly determining which network identification information belongs to one network.
Fig. 2 is a flowchart of a method for determining an event topological relation according to an embodiment of the present invention, where step S140 mainly includes steps S141 to S144 as follows:
s141, using the same network identification information in the second identification information group as a node, and determining the number of the same network identification information in the node.
And S142, arranging the nodes according to the sequence of at least more nodes in number to generate a node list.
Specifically, taking the same network identification information in the second identification information group as a node means a process of combining the same IPs into a node for processing, and the larger the number of the same network identification information in a node is, the more the number of times the node occurs is. The controller may rank the nodes in order of at least a few number to generate a node list, where a first node in the node list indicates that the number of the same network identification information in the node is the largest.
And S143, sequentially selecting two nodes in the node list to perform reverse derivation to determine the position relationship.
Optionally, before sequentially selecting two nodes in the node list to perform reverse derivation to determine the position relationship, the method further includes: and carrying out format conversion on the network identification information corresponding to each node to generate conversion identification information, wherein the conversion identification information comprises a network number.
Specifically, the controller sequentially selects two nodes in the node list to perform reverse derivation to determine the position relationship, the controller performs format conversion on the network identification information to generate conversion identification information, the format conversion refers to converting an IP in a decimal format into a 32-bit binary system to be represented to generate the conversion identification information, and the conversion identification information includes a network number. For example, if the network identification information IP1 is 128.14.31.7, the corresponding conversion identification information is 10000000.00001100.00011111.00000111; if the IP2 is 128.14.35.7, the corresponding conversion identification information is 10000000.00001100.00100011.000001111; if the IP3 is 12.14.42.7, the corresponding conversion id information is 10000000.00001100.00101010.00000111. The relation between the network identification information is calculated through reverse derivation, the direct use of IP data can be completed without external parameter input, the problem that the dependency relation needs to be cleared up manually in the prior art is solved, and the problems that the data cannot be updated in time and the data lag are solved for IP data in event data acquired in real time, namely real node IP data reported in real time by each monitoring device.
Optionally, sequentially selecting two nodes in the node list to perform reverse derivation to determine the position relationship, includes: determining conversion identification information corresponding to the node; determining the number of the two conversion identification information with the same network number; and determining the position relation of the two nodes according to the quantity.
Specifically, the controller may recursively find the largest set of network numbers of different network identification information from the top to the right in sequence, that is, determine the same number of network numbers in two pieces of conversion identification information to determine the positional relationship between two nodes, for example, if the number of network numbers in conversion identification information 10000000.00001100.00011111.00000111 corresponding to IP1 is 18 as the same as that in conversion identification information 10000000.00001100.00100011.000001111 corresponding to IP2, and the number of network numbers in conversion identification information corresponding to IP2 and that in conversion identification information 10000000.00001100.00101010.00000111 corresponding to IP3 is 20 which is greater than 18, it means that IP3 is shorter than IP1 in path from IP 2.
S144, taking the first node in the node list as a main reference node, and determining a second sub-event topological relation according to the main reference node, the network identification information and the position relation.
Specifically, the controller may use a first node in the node list as a master reference node, and determine the second sub-event topological relation according to the master reference node, the network identification information, and the location relation. It should be noted that, since the second sub-event topological relation is a topological relation generated by reverse derivation, the connection relation in the second sub-event topological relation is represented by a dashed line.
S150, updating the second sub-event topological relation according to the first sub-event topological relation so as to generate an event topological relation corresponding to the alarm event list.
Specifically, the first sub-event topological relation is a known connection relation located in the topological relation table, so the first sub-event topological relation is represented by a solid line, the controller updates the second sub-event topological relation according to the first word time topological relation, and replaces the connection relation corresponding to the same network identification information in the second sub-event topological relation, so as to generate an event topological relation corresponding to the alarm event list.
The specific application scenario is as follows: fig. 3 provides a schematic diagram of an event topological relation according to the present embodiment, in fig. 3, numerals 1 to 9 represent each piece of network identification information, the network identification information are connected by a solid line or a dashed line, the solid line represents a connection relation existing in a topological relation table, and the dashed line represents a connection relation generated by reverse derivation. As shown in fig. 3, the connection relationships of the network identification information 1 and 2, the connection relationships of 2 and 5, the connection relationships of 1 and 4, and the connection relationships of 8 and 9 are the connection relationships existing in the topology relationship table, and the remaining dashed connection relationships are the connection relationships generated by the reverse derivation.
According to the technical scheme of the embodiment of the invention, the second sub-event topological relation is generated by reversely deducing the network identification information in the alarm event list, and the second sub-event topological relation is updated by matching the preset topological relation table with the alarm event list to generate the event topological relation, so that the event topological relation can be combed without data support, the manual workload is reduced, and the deduction accuracy is improved.
Example two
Fig. 4 is a flowchart of a method for determining an event topology relationship according to a second embodiment of the present invention, where the present embodiment adds a process of acquiring an alarm event list of a monitoring system on the basis of the first embodiment. The specific contents of steps S240 to S270 are substantially the same as those of steps S120 to S150 in the first embodiment, and therefore, the detailed description is omitted in this embodiment. As shown in fig. 4, the method includes:
s210, collecting alarm information in a specified time range.
Specifically, the controller collects alarm information of each monitoring system, wherein the alarm information comprises a timestamp, network identification information, a time summary, an alarm type and the like. The specified time range refers to a time window set by a user through a time window parameter in the controller, the user refers to a worker or a technician who determines the event topological relation, and the controller collects the next batch of alarm information in a rolling mode according to the specified time range set by the user so as to continuously update the event topological relation. For example, when the specified time range set by the user is 10 minutes, and the current time is 18 minutes, the controller will collect a batch of alarm information every 10 minutes, namely 18.
S220, carrying out format conversion on the designated field in the alarm information, and acquiring the converted alarm information.
Specifically, after completing the collection of a batch of alarm information, the controller performs field mapping on the alarm information, that is, format conversion on the designated fields in the alarm information, where the purpose of format conversion is to make the formats of the alarm information regular and uniform, and convert all the irregular expressions in the alarm information into the same designated expression, for example, "from" is unified into "source", and then acquire the converted alarm information.
And S230, screening the converted alarm information according to an appointed rule to obtain screened alarm information, and generating an alarm event list according to the screened alarm information.
Specifically, the purpose of format conversion is to complete event aggregation, that is, the converted alarm information is screened according to an appointed rule to obtain screened alarm information, the appointed rule is set by a user, and the user can screen out content to be subjected to event topology relationship analysis by setting the appointed rule. For example, the user may set "location" to "jiangsu", at this time, the controller may perform screening analysis on the related alarm information in the jiangsu area, the designated rule may be multiple, and the user may also perform screening by setting a text similarity and a timestamp difference, for example, when the text similarity is set to 80% by the user and the timestamp difference is within 5 minutes, the controller may compare the text similarity and the timestamp of each alarm information, and use the screened alarm information as an alarm event list.
S240, matching the alarm event list with a preset topological relation table to generate a first identification information group, and taking all network identification information in the alarm event list as a second identification information group.
Optionally, generating a first identifier information group according to each network identifier information and a preset topology relationship table, includes: determining target network identification information in a topological relation table in an alarm event list; the target network identification information is divided into first identification information groups.
And S250, generating a first sub-event topological relation according to the first identification information group and the topological relation table.
Optionally, generating a first sub-event topological relation according to the first identification information group and the topological relation table includes: matching each network identification information in the first identification information group with the topological relation table to determine the position and the connection relation of each network identification information; and generating a first sub-event topological relation according to the network identification information, the position and the connection relation.
And S260, reversely deducing the second identification information group to generate a second sub-event topological relation.
Optionally, the reversely deriving the second identification information group to generate the second sub-event topological relation includes: the same network identification information in the second identification information group is used as a node, and the number of the same network identification information in the node is determined; arranging the nodes in a sequence of at least more nodes according to the number to generate a node list; sequentially selecting two nodes in the node list to carry out reverse derivation so as to determine the position relationship; and taking the first node in the node list as a main reference node, and determining a second sub-event topological relation according to the main reference node, the network identification information and the position relation.
Optionally, before sequentially selecting two nodes in the node list to perform reverse derivation to determine the position relationship, the method further includes: and carrying out format conversion on the network identification information corresponding to each node to generate conversion identification information, wherein the conversion identification information comprises a network number.
Optionally, sequentially selecting two nodes in the node list to perform reverse derivation to determine the position relationship, includes: determining conversion identification information corresponding to the node; determining the number of the two conversion identification information with the same network number; and determining the position relation of the two nodes according to the quantity.
And S270, updating the second sub-event topological relation according to the first sub-event topological relation so as to generate an event topological relation corresponding to the alarm event list.
According to the technical scheme of the embodiment of the invention, the alarm information is generated by field mapping and aggregation of the acquired alarm information, analysis of the alarm information can be completed in a targeted manner, the network identification information in the alarm event list is reversely deduced to generate the second sub-event topological relation, the preset topological relation table is matched with the alarm event list to update the second sub-event topological relation, the event topological relation is generated, the event topological relation can be combed without data support, the manual workload is reduced, and the deduction accuracy is improved.
EXAMPLE III
Fig. 5 is a schematic structural diagram of an event topology relation determining apparatus according to a third embodiment of the present invention. As shown in fig. 5, the apparatus includes: an alarm event list obtaining module 310, configured to obtain an alarm event list of the monitoring system, where the alarm event list includes network identification information; an identification information group generating module 320, configured to match the alarm event list with a preset topological relation table to generate a first identification information group, and use all network identification information in the alarm event list as a second identification information group; a first sub-event topological relation generating module 330, configured to generate a first sub-event topological relation according to the first identification information group and the topological relation table; a second sub-event topological relation generating module 340, configured to perform reverse derivation on the second identification information group to generate a second sub-event topological relation; and an event topology relationship generating module 350, configured to update the second sub-event topology relationship according to the first sub-event topology relationship, so as to generate an event topology relationship corresponding to the alarm event list.
Optionally, the alarm event list obtaining module 310 is specifically configured to: collecting alarm information in a specified time range, wherein the alarm information comprises network identification information; carrying out format conversion on the designated field in the alarm information to obtain the converted alarm information; and screening the converted alarm information according to an appointed rule to obtain screened alarm information, and generating an alarm event list according to the screened alarm information.
Optionally, the identification information group generating module 320 specifically includes: the first identification information group generating unit is used for determining the target network identification information in the topological relation table in the alarm event list; the target network identification information is divided into first identification information groups.
Optionally, the first sub-event topological relation generating module 330 is specifically configured to: matching each network identification information in the first identification information group with the topological relation table to determine the position and the connection relation of each network identification information; and generating a first sub-event topological relation according to the network identification information, the position and the connection relation.
Optionally, the second sub-event topological relation generating module 340 specifically includes a same network identification information merging unit, configured to use the same network identification information in the second identification information group as a node, and determine the number of the same network identification information in the node; the node list generating unit is used for arranging the nodes in the order of at least more nodes according to the number to generate a node list; the position relation determining unit is used for sequentially selecting two nodes in the node list to carry out reverse derivation so as to determine the position relation; and the second sub-event topological relation determining unit is used for determining the second sub-event topological relation by taking the first node in the node list as the main reference node according to the main reference node, the network identification information and the position relation.
Optionally, the second sub-event topology relationship generating module 340 further includes a conversion identifier information generating unit, configured to perform format conversion on the network identifier information corresponding to each node to generate conversion identifier information, where the conversion identifier information includes a network number.
Optionally, the position relation determining unit is specifically configured to: determining conversion identification information corresponding to the node; determining the number of the two conversion identification information with the same network number; and determining the position relation of the two nodes according to the quantity.
According to the technical scheme of the embodiment of the invention, the network identification information in the alarm event list is reversely deduced to generate the second sub-event topological relation, and the preset topological relation table is matched with the alarm event list to update the second sub-event topological relation, so that the event topological relation can be sorted without data support, the manual workload is reduced, and the deduction accuracy is improved.
The event topological relation determining device provided by the embodiment of the invention can execute the event topological relation determining method provided by any embodiment of the invention, and has corresponding functional modules and beneficial effects of the executing method.
Example four
FIG. 6 illustrates a schematic structural diagram of an electronic device 10 that may be used to implement an embodiment of the present invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.
As shown in fig. 6, the electronic device 10 includes at least one processor 11, and a memory communicatively connected to the at least one processor 11, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, and the like, wherein the memory stores a computer program executable by the at least one processor, and the processor 11 can perform various suitable actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from a storage unit 18 into the Random Access Memory (RAM) 13. In the RAM13, various programs and data necessary for the operation of the electronic apparatus 10 can also be stored. The processor 11, the ROM12, and the RAM13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.
A number of components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, or the like; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.
The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, or the like. The processor 11 performs the various methods and processes described above, such as an event topology relationship determination method.
In some embodiments, an event topology relationship determination method may be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM12 and/or the communication unit 19. When the computer program is loaded into the RAM13 and executed by the processor 11, one or more steps of an event topology relationship determination method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform an event topology determination method by any other suitable means (e.g., by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.
A computer program for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be performed. A computer program can execute entirely on a machine, partly on a machine, as a stand-alone software package partly on a machine and partly on a remote machine or entirely on a remote machine or server.
In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic, speech, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the Internet.
The computing system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical host and VPS service are overcome.
It should be understood that various forms of the flows shown above may be used, with steps reordered, added, or deleted. For example, the steps described in the present invention may be executed in parallel, sequentially, or in different orders, and are not limited herein as long as the desired results of the technical solution of the present invention can be achieved.
The above-described embodiments should not be construed as limiting the scope of the invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may be made in accordance with design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (10)
1. An event topology relation determining method is characterized by comprising the following steps:
acquiring an alarm event list of a monitoring system, wherein the alarm event list comprises network identification information;
matching the alarm event list with a preset topological relation table to generate a first identification information group, and taking all the network identification information in the alarm event list as a second identification information group;
generating a first sub-event topological relation according to the first identification information group and the topological relation table;
reversely deducing the second identification information group to generate a second sub-event topological relation;
and updating the second sub-event topological relation according to the first sub-event topological relation so as to generate an event topological relation corresponding to the alarm event list.
2. The method of claim 1, wherein obtaining a list of alarm events for a monitoring system comprises:
collecting alarm information in a specified time range, wherein the alarm information comprises the network identification information;
carrying out format conversion on the designated field in the alarm information to obtain the converted alarm information;
and screening the converted alarm information according to an appointed rule to obtain screened alarm information, and generating the alarm event list according to the screened alarm information.
3. The method of claim 1, wherein the generating a first identification information group according to each of the network identification information and a preset topology relation table comprises:
determining target network identification information in the alarm event list, wherein the target network identification information is located in the topological relation table;
and dividing the target network identification information into the first identification information group.
4. The method according to claim 3, wherein the generating a first sub-event topological relation according to the first identification information group and the topological relation table comprises:
matching each network identification information in the first identification information group with the topological relation table to determine the position and the connection relation of each network identification information;
and generating the first sub-event topological relation according to the network identification information, the position and the connection relation.
5. The method of claim 3, wherein the reversely deriving the second identification information group to generate a second sub-event topological relation comprises:
using the same network identification information in the second identification information group as a node, and determining the number of the same network identification information in the node;
arranging the nodes according to the order of the number at least more to generate a node list;
sequentially selecting two nodes in the node list to carry out reverse derivation so as to determine the position relation;
and taking the first node in the node list as a main reference node, and determining the second sub-event topological relation according to the main reference node, the network identification information and the position relation.
6. The method of claim 5, further comprising, prior to said sequentially selecting two of said nodes in said list of nodes for reverse derivation to determine a positional relationship:
and carrying out format conversion on the network identification information corresponding to each node to generate conversion identification information, wherein the conversion identification information comprises a network number.
7. The method of claim 6, wherein said sequentially selecting two of said nodes in said list of nodes for reverse derivation to determine a location relationship comprises:
determining the conversion identification information corresponding to the node;
determining the number of the two same network numbers in the conversion identification information;
and determining the position relation of the two nodes according to the number.
8. An event topology relation determination apparatus, comprising:
the alarm event list acquisition module is used for acquiring an alarm event list of the monitoring system, wherein the alarm event list comprises network identification information;
the identification information group generating module is used for matching the alarm event list with a preset topological relation table to generate a first identification information group, and taking all the network identification information in the alarm event list as a second identification information group;
the first sub-event topological relation generating module is used for generating a first sub-event topological relation according to the first identification information group and the topological relation table;
the second sub-event topological relation generating module is used for reversely deducing the second identification information group to generate a second sub-event topological relation;
and the event topological relation generating module is used for updating the second sub-event topological relation according to the first sub-event topological relation so as to generate an event topological relation corresponding to the alarm event list.
9. An electronic device, characterized in that the electronic device comprises:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein, the first and the second end of the pipe are connected with each other,
the memory stores a computer program executable by the at least one processor, the computer program being executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.
10. A computer storage medium having stored thereon computer instructions for causing a processor, when executed, to implement the method of any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211429614.2A CN115801589B (en) | 2022-11-15 | 2022-11-15 | Event topological relation determination method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211429614.2A CN115801589B (en) | 2022-11-15 | 2022-11-15 | Event topological relation determination method, device, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115801589A true CN115801589A (en) | 2023-03-14 |
| CN115801589B CN115801589B (en) | 2023-07-18 |
Family
ID=85437879
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211429614.2A Active CN115801589B (en) | 2022-11-15 | 2022-11-15 | Event topological relation determination method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115801589B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101668025A (en) * | 2008-09-04 | 2010-03-10 | 北京启明星辰信息技术股份有限公司 | Method and device for discovering link layer network topology |
| US20170134240A1 (en) * | 2014-07-08 | 2017-05-11 | Telefonaktiebolaget Lm Ercisson (Publ) | Network Topology Estimation Based on Event Correlation |
| CN110932889A (en) * | 2019-11-18 | 2020-03-27 | 中盈优创资讯科技有限公司 | Method and device for constructing and maintaining network logic topology |
| CN113792008A (en) * | 2021-08-31 | 2021-12-14 | 北京百度网讯科技有限公司 | Method and device for acquiring network topology structure, electronic equipment and storage medium |
| CN114020581A (en) * | 2021-11-23 | 2022-02-08 | 浪潮通信信息系统有限公司 | Alarm correlation method based on topological optimization FP-Growth algorithm |
| WO2022127435A1 (en) * | 2020-12-14 | 2022-06-23 | 华为技术有限公司 | Alarm processing method and apparatus, device, and readable storage medium |
-
2022
- 2022-11-15 CN CN202211429614.2A patent/CN115801589B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101668025A (en) * | 2008-09-04 | 2010-03-10 | 北京启明星辰信息技术股份有限公司 | Method and device for discovering link layer network topology |
| US20170134240A1 (en) * | 2014-07-08 | 2017-05-11 | Telefonaktiebolaget Lm Ercisson (Publ) | Network Topology Estimation Based on Event Correlation |
| CN110932889A (en) * | 2019-11-18 | 2020-03-27 | 中盈优创资讯科技有限公司 | Method and device for constructing and maintaining network logic topology |
| WO2022127435A1 (en) * | 2020-12-14 | 2022-06-23 | 华为技术有限公司 | Alarm processing method and apparatus, device, and readable storage medium |
| CN113792008A (en) * | 2021-08-31 | 2021-12-14 | 北京百度网讯科技有限公司 | Method and device for acquiring network topology structure, electronic equipment and storage medium |
| CN114020581A (en) * | 2021-11-23 | 2022-02-08 | 浪潮通信信息系统有限公司 | Alarm correlation method based on topological optimization FP-Growth algorithm |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115801589B (en) | 2023-07-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN115033463B (en) | System exception type determining method, device, equipment and storage medium | |
| CN114861039A (en) | Parameter configuration method, device, equipment and storage medium of search engine | |
| CN115048352B (en) | Log field extraction method, device, equipment and storage medium | |
| CN116414814A (en) | Data checking method, device, equipment, storage medium and program product | |
| CN115794744A (en) | Log display method, device, equipment and storage medium | |
| CN115801589B (en) | Event topological relation determination method, device, equipment and storage medium | |
| CN115599687A (en) | Method, device, equipment and medium for determining software test scene | |
| CN115438056A (en) | Data acquisition method, device, equipment and storage medium | |
| CN115757304A (en) | Log storage method, device and system, electronic equipment and storage medium | |
| CN115687406A (en) | Sampling method, device and equipment of call chain data and storage medium | |
| CN115665783A (en) | Abnormal index tracing method and device, electronic equipment and storage medium | |
| CN115455091A (en) | Data generation method and device, electronic equipment and storage medium | |
| CN115599679A (en) | Test rule base updating method and device, electronic equipment and storage medium | |
| CN115344627A (en) | Data screening method and device, electronic equipment and storage medium | |
| CN115017047A (en) | Test method, system, equipment and medium based on B/S architecture | |
| CN115203873A (en) | Topological relation construction method, device, equipment and medium applied to power distribution network | |
| CN114416583A (en) | Workload determination method, device, equipment and storage medium for automatic test | |
| CN116149933B (en) | Abnormal log data determining method, device, equipment and storage medium | |
| CN116627695B (en) | Alarm event root cause recommendation method, device, equipment and storage medium | |
| CN116431698B (en) | Data extraction method, device, equipment and storage medium | |
| CN115858325B (en) | Project log adjusting method, device, equipment and storage medium | |
| CN114706578A (en) | Data processing method, device, equipment and medium | |
| CN115774648A (en) | Abnormity positioning method, device, equipment and storage medium | |
| CN116089499A (en) | Data statistics method, device and medium based on kafka data volume | |
| CN115905492A (en) | Alarm information analysis method, device, equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |