CN116225866A

CN116225866A - Alarm information processing method and device, electronic equipment and readable storage medium

Info

Publication number: CN116225866A
Application number: CN202211703092.0A
Authority: CN
Inventors: 陈浩; 余坤
Original assignee: Nanjing Leading Technology Co Ltd
Current assignee: Nanjing Leading Technology Co Ltd
Priority date: 2022-12-28
Filing date: 2022-12-28
Publication date: 2023-06-06

Abstract

The invention provides an alarm information processing method, an alarm information processing device, electronic equipment and a readable storage medium. The alarm information processing method comprises the following steps: when the generation of the first alarm is detected, acquiring first alarm information; searching a first time wheel data structure corresponding to the first alarm information based on the first alarm information; counting the number of the first alarms in each time period in the first time wheel data structure when the first time wheel data structure corresponding to the first alarm information is found; and sending second alarm information based on the number of each time period. And the time wheel data structure is used for carrying out automatic statistics and induction of alarm convergence noise reduction, so that a stable and reliable alarm information processing effect is realized.

Description

Alarm information processing method and device, electronic equipment and readable storage medium

Technical Field

The present invention relates to the field of big data monitoring technologies, and in particular, to an alarm information processing method, an alarm information processing device, an electronic device, and a readable storage medium.

Background

Along with the continuous progress of scientific technology, big data technology is also increasingly widely applied in our lives. In a big data environment, various tasks need to run continuously for 24 hours, and a large amount of monitoring needs are usually required, so that the big data tasks can be performed smoothly and without abnormality.

At present, when an abnormality occurs in the big data operation process, the monitoring system generally generates alarm information, the alarm information is finally pushed to equipment of related personnel through the alarm system, the related personnel need to deal with and find an alarm after receiving the alarm push message, and a corresponding link is called to acquire target monitoring information and alarm information.

However, with the continuous development of big data technology, the scale of monitoring the alarm system is gradually increased, the number of alarms is also increased, the repeated alarms and the newly added alarms are mixed together, and related personnel cannot effectively distinguish the repeated alarms from the newly added alarms in the processing process, so that the alarms cannot be processed in time when generated.

Disclosure of Invention

The embodiment of the invention provides an alarm information processing method, an alarm information processing device, electronic equipment and a readable storage medium _， The method solves the problems that in the related technology, the alarm information quantity is large, repeated alarms and newly added alarms cannot be effectively distinguished, and the newly added alarms cannot be processed immediately.

In order to solve the above technical problems, an embodiment of the present invention provides an alarm information processing method, including:

under the condition that the generation of the first alarm is detected, acquiring first alarm information; the method comprises the steps of carrying out a first treatment on the surface of the

Searching a first time wheel data structure corresponding to the first alarm information based on the first alarm information;

under the condition that a first time wheel data structure corresponding to the first alarm information is found, counting the number of the first alarms in each time period in the first time wheel data structure;

and transmitting second alarm information based on the number of each time period.

Optionally, after searching the first time wheel data structure corresponding to the first alarm information based on the first alarm information, the method further includes:

and under the condition that the first time wheel data structure corresponding to the first alarm information is not found, creating the first time wheel data structure based on the first alarm information.

Optionally, the creating a first time wheel data structure based on the first alarm information includes:

creating the first time wheel data structure and acquiring a first moment of creating the first time wheel data structure;

setting a plurality of second time scales with time spans increased in the first time wheel data structure by taking the first time as a starting time scale, and taking time periods between the first time and the plurality of second time scales as N time periods to obtain a time wheel data structure;

Under the condition that a first time wheel data structure corresponding to the first alarm information is found, counting the number of the first alarms in each time period in the first time wheel data structure, wherein the counting comprises the following steps:

under the condition that a first time wheel data structure corresponding to the first alarm information is found, determining an Mth time period to which the first alarm information belongs;

counting the number of the detected first alarms in the Mth time period;

wherein N is an integer greater than 0, M is an integer greater than 0 and less than or equal to N.

Optionally, after the time periods between the first time and the plurality of second time scales are taken as N time periods, the method further includes:

setting a counter corresponding to each time period M;

the counting the number of the detected first alarms in the Mth time period comprises the following steps:

counting the number of the detected first alarms in an Mth time period through an Mth counter corresponding to the Mth time period.

Optionally, the determining the mth time period to which the first alarm information belongs includes:

acquiring a second moment when the first alarm is detected;

Calculating a time difference between the second moment and the first moment according to the first moment and the second moment;

according to the time difference value, determining an Mth time period corresponding to the time difference value;

the counting of the number of the detected first alarms in the mth time period through the mth counter corresponding to the mth time period comprises the following steps:

adding 1 to the value of an Mth counter corresponding to the Mth time period; the value of the mth counter corresponds to the first number of alarms statistically detected during the mth time period.

Optionally, the sending the second alarm information based on the number of each time period includes:

comparing the number of the first alarms counted corresponding to the adjacent time periods;

transmitting second alarm information under the condition that the number corresponding to the M+1th time period is greater than the number corresponding to the M time period;

and under the condition that the number corresponding to the M+1th time period is equal to the number corresponding to the M time period, no alarm information is sent.

Optionally, after sending the second alarm information based on the number of each time period, the method further includes:

deleting the first time wheel data structure under the condition that M+1 is equal to N and the number corresponding to the M+1th time period is equal to the number corresponding to the M time period;

And when the M+1 is equal to N and the number corresponding to the M+1th time period is greater than the number corresponding to the M time period, sending second alarm information and deleting the first time wheel data structure.

selecting one alarm information from the first alarm information as second alarm information;

carrying out alarm classification on the second alarm information and generating an alarm keyword corresponding to the second alarm information;

determining a target contact according to the alarm classification and the alarm keyword of the second alarm information;

and notifying the second alarm information in a preset format to the target contact person.

Optionally, before carrying out alarm grading on the second alarm information and generating the alarm keyword corresponding to the second alarm information, the method further comprises:

determining a preset processing rule corresponding to the second alarm information according to the second alarm information;

and converting the second alarm information into second alarm information in a preset format according to the preset processing rule.

In order to solve the above technical problem, an embodiment of the present invention further provides an alarm information processing apparatus, including:

The acquisition module is used for acquiring the first alarm information under the condition that the generation of the first alarm is detected;

the searching module is used for searching a first time wheel data structure corresponding to the first alarm information based on the first alarm information;

the statistics module is used for counting the number of the first alarms in each time period in the first time round data structure under the condition that the first time round data structure corresponding to the first alarm information is found;

and the sending module is used for sending the second alarm information based on the number of each time period.

In order to solve the technical problem, the embodiment of the invention also provides electronic equipment, which comprises a memory and a processor, wherein the memory is used for storing a computer program, and the processor is used for realizing the alarm information processing method according to any one of the above when executing the computer program.

To solve the above technical problem, embodiments of the present invention further provide a readable storage medium storing a computer program that implements the alarm information processing method according to any one of the above when executed by a processor.

In the embodiment of the invention, under the condition that the generation of the first alarm is detected, a first time wheel data structure corresponding to the first alarm is created according to the first alarm information of the first alarm, the number of the first alarms is counted in each time period in the first time wheel data structure, and the second alarm information is sent outwards based on the number of each time period. After statistics and analysis of the number of the first alarms in each time in the first time wheel data structure are performed, second alarm information is sent outwards according to analysis results, classification of the first alarms and convergence induction of alarm times sent outwards are achieved through the first time wheel data structure, statistics and analysis of alarm times are performed through the time wheel data structure when the alarm information is sent timely under the condition that the alarms occur, the second alarm information is flexibly classified and accurately sent in real time, and the problem that repeated alarms and newly added alarms cannot be effectively distinguished due to the fact that the alarm information is complicated and messy is avoided, and then the newly added alarms cannot be processed timely is solved. According to the embodiment of the invention, under the condition that the generation of the alarm is detected, a time wheel data structure is created according to the alarm information, and the alarm convergence noise reduction automatic statistics and induction are carried out through the time wheel data structure, so that a stable and reliable alarm information processing effect is realized.

The foregoing description is only an overview of the present invention, and is intended to be implemented in accordance with the teachings of the present invention in order that the same may be more clearly understood and to make the same and other objects, features and advantages of the present invention more readily apparent.

Drawings

FIG. 1 is a flow chart of steps of an alarm information processing method according to an embodiment of the present invention;

FIG. 2 is a flowchart illustrating steps of another method for processing alarm information according to an embodiment of the present invention;

FIG. 3 is a logic block diagram of an alarm information processing method according to an embodiment of the present invention;

fig. 4 is a logic block diagram of an alarm information processing apparatus according to an embodiment of the present invention.

Detailed Description

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

For a better understanding of the present invention, the following description is given to illustrate the concepts related to the present invention to those skilled in the art:

big data: big data refers to a collection of data whose content cannot be crawled, managed, and processed with conventional software tools for a certain period of time. The method mainly has the characteristics of large capacity, multiple types, high access speed, high application value and the like, is firstly applied to the IT industry, and is currently rapidly developed into a new generation of information technology and service business state which are huge in number, distributed in sources and various in formats for collecting, storing and associated analyzing, discovering new knowledge, creating new value and improving new capability. Big data must adopt a distributed architecture to perform distributed data mining on massive data, so that distributed processing, a distributed database and cloud storage and virtualization technologies of cloud computing must be relied on. The method, the device and the electronic equipment for processing the alarm information in the embodiment of the invention can be the method, the device and the electronic equipment for processing the alarm information based on a big data link.

Kafka: kafka is an open source stream processing platform developed by the Apache software foundation, written by Scala and Java. Kafka is a high-throughput distributed publish-subscribe messaging system that can handle all action flow data for consumers in a web site. Such actions (web browsing, searching and other user operations) are a key factor in many social functions on modern networks. These data are typically addressed by processing logs and log aggregations due to throughput requirements.

Flink: flink is an open source big data processing framework under the Apache foundation. Applied to distributed, high-performance, high-availability data stream applications. Limited and unlimited data streams, i.e. data streams with and without boundaries, can be handled. An unbounded data stream is stream data in the true sense, so that the Flink is stream-computing-enabled. The bordered data stream is the batch data, so batch processing is also supported. However, the application of the Flink to stream processing is more extensive than the application to batch processing, and unified batch processing and stream processing are also one of the Flink targets. The Flink can be deployed in various cluster environments, and can be used for quickly calculating data with various sizes.

Prometheus open source alert System (Prometheus): prometheus is an open source monitoring alarm system and time series database (TSDB, time Series Database) developed by SoundCloud, germany. Prometaus is a key component designed for Target monitoring; other components within the aggregate ecosystem, such as pushGateway, altermanager and Grafana, etc., may constitute a complete IT monitoring system.

Time series database (TSDB, time Series Database): a time series database is a specialized database for managing time series data. The time sequence database provides multiple capabilities such as high-efficiency reading and writing, high compression ratio storage, time sequence data interpolation and aggregation calculation functions, multi-ecology support and the like. The method is widely applied to scenes with massive time sequence data such as internet of things (IoT), enterprise energy management, internet monitoring, power detection systems, big data and the like, and can also realize real-time monitoring and prediction alarming of equipment and business services.

Hook technology: also called as a hook function, the hook program captures the message before the system calls the function, and the hook function obtains control first, so that the hook function can process (change) the execution behavior of the function and can force the end of the transfer of the message. That is, the hook technique pulls up the program of the system to become the user's own piece of execution code.

JSON (JavaScript Object Notation ): JSON is a format that is based on text, superior to lightweight, and used to exchange data. JSON is a text-based data format, and is therefore a string that fits in this format, commonly referred to as a "JSON string," when passed, as opposed to binary-based data.

In the embodiment of the present invention, fig. 1 shows a step flowchart of an alarm information processing method provided in the embodiment of the present invention, and as shown in fig. 1, the method may include the following steps:

step S110, under the condition that the generation of the first alarm is detected, the first alarm information is acquired.

In the embodiment of the invention, the first alarm can be an alarm generated by a big data link. Specifically, the signal generated with respect to the first alarm may be acquired through a hook technique, and the first alarm information is acquired in the case that the generation of the first alarm is detected through the hook technique. The first alarm information is information related to the generation of the first alarm, and the first alarm information can include a first alarm source and a first alarm theme.

In the implementation of the invention, the big data alarm can be monitored in real time through three alarm monitoring links, wherein the three alarm monitoring links specifically comprise a big data component alarm link, a Promitus alarm link and a cloud cluster alarm link; specifically, the big data component alarm link is used for monitoring alarms generated by the big data component and the digital storehouse tool service; the Promega repair alarm link is used for monitoring alarms of hardware classes of big data equipment, such as k8s container alarms and the like; the cloud cluster alarm link can be specifically a cloud cluster alarm link and/or an ali cloud cluster alarm link and the like, and is used for realizing the hosting of big data alarm monitoring.

It should be noted that, the first alarm information may include a first alarm source and a first alarm theme; specifically, the first alarm source is a source location for generating the first alarm, and may specifically be a link type for generating the first alarm. The first alert source may be, for example, a big data component alert link and/or a Promitus alert link and/or a cloud cluster alert link. The first alarm theme is an alarm item corresponding to the first alarm, and may specifically include an alarm item of a certain loop and/or a certain position.

Step S120, searching a first time-wheel data structure corresponding to the first alarm information based on the first alarm information.

In the embodiment of the invention, a key value can be generated based on the first alarm source and the first alarm theme in the first alarm information, and a first time wheel data structure corresponding to the key value can be searched based on the key value. It should be noted that, according to the combination of the first alarm source and the first alarm theme, a first time wheel data structure corresponding to the combination of the first alarm source and the first alarm theme may be determined; of course, for a combination of a second alert source and a second alert topic that is different from the combination of the first alert source and the first alert topic, a second time-wheel data structure that uniquely corresponds to the combination of the second alert source and the second alert topic may also be determined, and so on, different time-wheel data structures that correspond to the combination of different alert sources and alert topics may be determined from the combination of different alert sources and alert topics.

In the embodiment of the present invention, the first time-round data structure is a time-round algorithm data structure created according to the first alarm source and the first alarm theme, and is used for performing a convergence induction operation on the detected first alarm, where a specific execution process of the convergence induction operation is detailed in step S130.

Optionally, after searching the first time wheel data structure corresponding to the first alarm information based on the first alarm information, the method may further include:

and step S121, creating a first time wheel data structure based on the first alarm information under the condition that the first time wheel data structure corresponding to the first alarm information is not found.

It should be noted that, when the first time-wheel data structure corresponding to the first alarm information is not found, the operation of creating the first time-wheel data structure based on the first alarm information is performed. When a first time wheel data structure corresponding to the first alarm information is searched based on the first alarm information, the first time wheel data structure corresponding to the first alarm information is not searched, and the fact that the first time wheel data structure corresponding to the first alarm information is not created currently is indicated, and the first time wheel data structure needs to be re-created according to the first time wheel data structure corresponding to the current first alarm information; in the preset time when the creation of the first time wheel data structure is completed, under the condition that the generation of the first alarm is detected, the first alarm information corresponding to the first alarm can be uniquely matched with the first time wheel data structure without recreating the time wheel data structure corresponding to the first alarm information.

In the embodiment of the present invention, after the first time-wheel data structure is created based on the first alarm information, step S120 is executed again, and the first time-wheel data structure corresponding to the first alarm information may be found, and after the first time-wheel data structure corresponding to the first alarm information is found, step S130 is executed.

Optionally, the creating the first time wheel data structure based on the first alarm information may include the following substeps:

substep S1211, creating the first time wheel data structure and obtaining a first time of creation of the first time wheel data structure.

In the embodiment of the invention, a first time wheel data structure corresponding to the first alarm information is searched based on the first alarm information, and when the creation of the first time wheel data structure is completed, the time for completing the creation of the first time wheel data structure is required to be acquired and recorded as a first moment; the first time is the initial time when the current first time round data structure is recorded to finish creation.

In the substep S1212, the first time is taken as a starting time scale, a plurality of second time scales with gradually increased time spans are set in the first time wheel data structure, and a time period between the first time and the plurality of second time scales is taken as N time periods, so as to obtain a time wheel data structure.

In the embodiment of the present invention, N is an integer greater than 0.

It should be noted that, the first time wheel data structure is provided with a plurality of time periods, and the time periods are divided by a first time and a plurality of second time scales; the method comprises the steps of carrying out a first treatment on the surface of the Specifically, a first time point when the first time wheel data structure is created is taken as a starting time scale, a plurality of second time scales which take the starting data scale as a starting point and gradually increase time span are set from the starting data scale, and N time periods are formed between the starting time scale and the second time scales.

Illustratively, the first time may be set to 0 minutes (minutes) as a starting time scale; after the start time scale 5 second time scales with increasing time span are set: 1min, 5min, 20min, 30min and 60min; at the start time scale 0min and 5 second time scales with increasing time span: between 1min, 5min, 20min, 30min and 60min, 5 time periods are formed: the first time period is 0-1min, the second time period is 0-5min, the third time period is 0-20min, the fourth time period is 0-30min and the fifth time period is 0-60 min, and a first time wheel data structure with 5 time periods is acquired, wherein N=5 in the time wheel data structure. It should be noted that, the starting time scale of the first time wheel data structure is 0min, and the ending time scale is 60min.

In the embodiment of the present invention, the number of time scales in the first time wheel data structure and the data amounts of the corresponding N time periods, and the specific time length of each time period may be set according to the rule and the frequency of the alarm generated by the monitoring link, which is not specifically limited in the embodiment of the present invention.

It should be noted that the preset time may be a termination time scale of the first time wheel data structure, and may be set according to an actual alarm information processing requirement. If the preset time is set too long, the first alarm with the first alarm information corresponding to the first time wheel data structure is not generated any more, and if the first time wheel data structure exists all the time, the alarm information processing function is not realized, so that the memory resource is occupied; if the preset time is too short, the first alarm information generated in the same time period cannot be processed through the same time wheel data structure, and the effect of the first time wheel data structure cannot be fully utilized. Therefore, in the actual application process, the setting can be performed according to the rule and the frequency of the alarm generated by the monitored link, which is not particularly limited in the embodiment of the present invention.

In the embodiment of the invention, after searching the first time wheel data structure corresponding to the first alarm information based on the first alarm information, the first alarm can be used as a second alarm, and the second alarm information can be sent.

Step S130, counting the number of the first alarms in each time period in the first time wheel data structure.

It should be noted that, when the first time-round data structure corresponding to the first alarm information is found, the operation of counting the number of the first alarms in each time period in the first time-round data structure is performed. When the first time wheel data structure corresponding to the first alarm information is searched based on the first alarm information, the fact that the first time wheel data structure corresponding to the first alarm information is created in the preset time before the first time wheel data structure is explained, and the first time wheel data structure does not need to be created according to the current first alarm information.

In the embodiment of the invention, in the preset time when the creation of the first time wheel data structure is completed, under the condition that the generation of the first alarm is detected, the first alarm information corresponding to the first alarm can be uniquely matched with the first time wheel data structure without recreating the time wheel data structure corresponding to the first alarm information.

Optionally, in the case that the first time wheel data structure corresponding to the first alarm information is found, counting the number of the first alarms in each time period in the first time wheel data structure may include the following substeps:

and step S131, determining an Mth time period to which the first alarm information belongs under the condition that a first time wheel data structure corresponding to the first alarm information is found.

It should be noted that, the mth time period to which the first alarm information belongs may be any one of N time periods of the first data structure, and specifically, it needs to be determined according to a spaced relationship between a time when the first alarm generation is detected and a first time created by the first time round data structure.

Optionally, the determining the mth time period to which the first alarm information belongs may further include the following substeps:

substep S1311, obtaining a second moment when the first alarm is detected.

In the embodiment of the present invention, the second time when the first alarm is detected may specifically be a time when the first alarm is generated, or may be a time when the first alarm is detected by a hook technology. Specifically, the second time may be the same as or different from the first time, and in the case that the second time is the same as the first time, it is stated that, in the case that the generation of the first alarm is detected, the first time wheel data structure corresponding to the first alarm information is not searched based on the first alarm information, and the first time wheel data structure is created based on the first alarm information, where the second time when the first alarm is detected and the first time when the first time wheel data structure is created may be the same time; when the second time is different from the first time, it is stated that, when the generation of the first alarm is detected, the first time wheel data structure corresponding to the first alarm information can be searched based on the first alarm information, at this time, the second time is two times different from the first time, and the second time is any time after the first time.

Substep S1312, calculating a time difference between the second time instant and the first time instant according to the first time instant and the second time instant.

Substep S1313, determining, according to the time difference, an mth time period corresponding to the time difference.

In the embodiment of the invention, under the condition that the second moment is the same as the first moment, calculating the time difference value between the second moment and the first moment to be 0, indicating that the second moment is the starting time scale of the first time wheel data structure, and under the condition that the second moment is the starting time scale, executing the operation of sending the second alarm information; under the condition that the second moment is different from the first moment, calculating that the time difference between the second moment and the first moment is a positive number larger than 0, and indicating that the second moment is a moment between the starting time scale and the ending time scale of the first time wheel data structure, according to the time difference, matching with N time periods of the first time wheel data structure, and determining an Mth time period corresponding to the time difference.

For example, a first time of the first time wheel data structure is 11:31, when a second time of detecting the first alarm is 11:31, calculating a time difference value between the second time and the first time to be 0, indicating that the second time is a start time scale of the first time wheel data structure, and executing an operation of sending second alarm information when the second time is the start time scale; when the second time when the first alarm is detected is 11:39, calculating that the time difference between the second time and the first time is 8min, and the time period matched with the time difference of 8min is the third time period of 0-20min, so that according to the time difference, the Mth time period corresponding to the time difference is determined to be the third time period, and M=3.

It should be noted that the second alarm information may be the same alarm information as the first alarm information.

Substep S132, counting the number of detected first alarms during the mth time period.

The N is an integer greater than 0, and M is an integer greater than 0 and less than or equal to N.

In the embodiment of the invention, after the M-th time period to which the first alarm information belongs is determined, the number of the first alarms in each time period in the first time wheel data structure can be obtained by counting the number of the first alarms in the M-th time period.

Optionally, after the time periods between the first time and the plurality of second time scales are taken as N time periods, the method may further include: for each time period M, a counter corresponding to the time period is set.

In the embodiment of the present invention, the counters are set in one-to-one correspondence with N time periods in the first data structure, and the counter corresponding to the mth time period in the N time periods is the mth counter. The counter is used for counting the number of first alarms in each time period in the first data structure.

Optionally, counting the number of the detected first alarms in the mth time period may include: counting the number of the detected first alarms in an Mth time period through an Mth counter corresponding to the Mth time period.

It should be noted that, the counter may be a program counter, and the program counter may be a smaller memory space in the first data structure, and after determining an mth time period corresponding to the first alarm, count, in the mth time period, the number of detected first alarms belonging to the mth time period by the mth counter corresponding to the mth time period.

Step S140, transmitting second alarm information based on the number of each time period.

It should be noted that, the second alarm information may be the same alarm information as the first alarm information, and the number of times of sending the second alarm information is smaller than the number of times of detecting the first alarm.

In the embodiment of the invention, the first alarm information is the original alarm information generated in the slave device monitoring alarm link, that is, how many original alarms are generated in the monitoring alarm link; under the condition that a first time wheel data structure corresponding to the first alarm information is not found, creating a first time wheel data structure based on a first alarm source and a first alarm theme in the first alarm information; under the condition that a first time wheel data structure corresponding to the first alarm information is found, counting the number of the first alarms in each time period in the first time wheel data structure; and finally, determining whether to send the second alarm information or not based on the number of each time period in the first time wheel data structure. Therefore, the second alarm information is the second alarm information which is sent outwards after the first alarm is subjected to convergence induction operation processing based on the first time wheel data structure, so the number of times of sending the second alarm information is smaller than the number of times of detecting the first alarm.

Optionally, the sending the second alarm information based on the number of the respective time periods may include the following sub-steps:

substep S141, comparing the number of first alarms corresponding to statistics of adjacent time periods.

In the embodiment of the present invention, the sending the second alarm information based on the number of each time period compares the numbers of the two counters corresponding to two adjacent time periods in the first time wheel data structure, which correspond to the first alarms in the two adjacent time periods, respectively, and determines to send the second alarm information.

In the substep S142, if the number corresponding to the m+1th time period is greater than the number corresponding to the M time period, the second alarm information is sent.

It should be noted that, the number corresponding to the m+1th time period is the number of the first alarms accumulated and counted in the m+1th time period, and similarly, the number corresponding to the M time period is the number of the first alarms accumulated and counted in the M time period; the case where the number corresponding to the m+1th period is greater than the number corresponding to the M period specifically refers to the case where the number of the first alarms accumulated and counted in the m+1th period is greater than the number of the first alarms accumulated and counted in the M period.

In the embodiment of the present invention, the (m+1) th time period is a time period adjacent to the (M) th time period after the (M) th time period, and at this time, the number of the first alarms counted by the (M) th counter corresponding to the (M) th time period is the fixed number, and the number of the first alarms counted by the (m+1) th counter corresponding to the (m+1) th time period is also the fixed number. The comparison of the number of first alarms corresponding to statistics of adjacent time periods is performed at the time when the m+1th time period ends. Illustratively, the second time period is 0-5min, the third time period is 0-20min, and the comparison of the number of the first alarms corresponding to statistics of the adjacent time periods is performed at the end of the 20 th min, where m=2, m+1=3.

It should be noted that, when the time difference between the second time and the first time of the first alarm corresponds to the first time period of 0-1min, there is no adjacent time period that can be compared before the first time period, at the end time of 1min, the second alarm information is not required to be sent, and at the beginning time of the first time period, that is, the starting time scale, the operation of sending the second alarm information is performed in the case where the first time period is started.

In the substep S143, when the number corresponding to the m+1th time period is equal to the number corresponding to the M time period, no alarm information is sent.

In the embodiment of the present invention, the condition that the number corresponding to the m+1th time period is equal to the number corresponding to the M time period indicates that no new first alarm is detected in the m+1th time period after the M time period, so that no alarm information needs to be sent out.

Optionally, after sending the second alarm information based on the number of each time period, the method may further include:

and deleting the first time wheel data structure under the condition that M+1 is equal to N and the number corresponding to the M+1th time period is equal to the number corresponding to the M time period.

In the embodiment of the present invention, when m+1 is equal to N, it indicates that statistics of the mth time period for the first alarm times has ended, and the current time is in the nth time period, that is, the last time period of the first time-round data structure, and when the number corresponding to the mth+1 time period is equal to the number corresponding to the mth time period after the statistics of the nth time period for the first alarm number has ended, it indicates that generation of the first alarm is not detected in the number corresponding to the mth+1 time period relative to the number corresponding to the mth time period, and when the nth time period ends, that is, the ending time scale of the first time-round data structure is reached, the first time-round data structure may be deleted.

It should be noted that, after deleting the first time-round data structure, if the first alarm generation is detected later, a new first time-round data structure may be created based on the first alarm information according to the method described in the above steps S110 to S130. By means of the method, the device and the system, convergence and induction of the first alarm quantity can be achieved, meanwhile, the memory related to the first time wheel data structure is released in preset time, and under the condition that the generation of the first alarm is detected again, a new first time wheel data structure is created based on the first alarm information, and the running space of the memory of the alarm monitoring server is guaranteed.

In the embodiment of the present invention, when m+1 is equal to N, it indicates that statistics of the mth time period for the first alarm times has ended, and the current time is in the nth time period, that is, the last time period of the first time-round data structure, and when the number corresponding to the mth+1 time period is greater than the number corresponding to the mth time period after the statistics of the nth time period for the first alarm number has ended, it indicates that generation of a new first alarm is detected in the mth+1 time period, and second alarm information needs to be sent. And after the nth time period is finished, that is, the ending time scale of the first time wheel data structure is reached, the operation of deleting the first time wheel data structure can be performed. Therefore, when the number of m+1th time periods is greater than the number of M time periods, the second alarm information needs to be sent first, and then the first time-wheel data structure needs to be deleted.

It should be noted that, after deleting the first time-round data structure, if the first alarm generation is detected later, a new first time-round data structure may be created based on the first alarm information according to the method described in the above steps S110 to S130. By means of the method, the device and the system, convergence and induction of the first alarm quantity can be achieved, meanwhile, the memory related to the first time wheel data structure is released in preset time, and under the condition that the generation of the first alarm is detected again, a new first time wheel data structure is created based on the first alarm information, so that enough running space is reserved in the memory of the alarm monitoring server.

substep S1411, selecting one alarm information from the first alarm information as a second alarm information.

It should be noted that the second alarm information may be the same alarm information as the first alarm information, and specifically any alarm information may be selected from the first alarm information to be used as the second alarm information. Of course, the first alarm information acquired for the first time may be used as the second alarm information, and the first alarm information may be sent as the second alarm information when it is determined that the second alarm information sending condition is met.

Substep S1412, performing alarm classification on the second alarm information and generating an alarm keyword corresponding to the second alarm information.

In the embodiment of the invention, the second alarm information can be subjected to alarm classification according to the first alarm theme in the second alarm information, and the alarm keyword corresponding to the second alarm information is generated.

It should be noted that, since the second alarm information may be the same alarm information as the first alarm information, the second alarm information includes the first alarm source and the first alarm theme.

In the embodiment of the present invention, the first alarm theme is an alarm item corresponding to the first alarm, and may specifically include an alarm item in a certain loop and/or a certain position. The second alarm information may be classified into three classes, namely, emergency (P0 class), important (P1 class) and minor (P2 class) according to specific alarm items. Wherein, the fault of the P0 level affects the service provided by the system, and corresponding operation is needed to be immediately adopted to process the fault. If certain equipment or resources are completely unavailable, immediate recovery is needed, namely, when a P0 level fault occurs, even if the fault occurs in a non-working time, relevant personnel are needed to immediately take measures for processing; a failure of the P1 class affects the quality of service provided by the system and requires emergency actions to be taken to handle the failure. If the service quality of a certain device or resource is reduced, the device or resource needs to be restored to restore the whole capability, namely, measures are needed to be immediately taken for processing in the working time when the P1 level fault occurs; the failure of the P2 stage has not affected the quality of service provided by the system, but in order to avoid more serious failures due to further degradation of the failure of the P2 stage, it is necessary for the relevant personnel to process or further observe within a suitable time.

Illustratively, the P0 level fault may include a host downtime, an application service downtime, and the like; the P1 level fault may include hardware faults of a CPU (Central Processing Unit/Processor, central processing unit), memory, disk, etc.; the failure of the P2 level may include alarms in terms of file handle, network io (input/output), etc.

In the embodiment of the invention, the alarm keywords are keywords related to the first alarm generated according to specific alarm matters in the first alarm theme, and the alarm keywords can include but are not limited to characteristic keywords of information such as alarm content, alarm type and the like.

Sub-step S1413, determining a target contact according to the alarm classification and the alarm keyword of the second alarm information.

In the embodiment of the invention, the information of the responsible person related to the second alarm information and the leading information related to the first alarm can be matched according to the alarm classification of the second alarm information and the alarm keyword, and the responsible person related to the second alarm information and the leading related to the first alarm are determined to be target contacts.

In the embodiment of the invention, the target contact person is the responsible person and/or the leader related to the second alarm information, and when the second alarm is sent out, the personnel in the target contact person are required to be notified.

And step S1414, notifying the second alarm information in a preset format to the target contact person.

In the embodiment of the invention, the preset format can be a unified alarm format in the user company, so that the second alarm information can be conveniently notified to the target contact person through the unified alarm format.

It should be noted that, the method for notifying the target contact of the second alarm information in the preset format may be a telephone notification method and a message notification method, where the message notification method may include, but is not limited to, a method of nailing a message notification and/or a method of flying book message notification.

Optionally, before performing alarm classification on the second alarm information and generating an alarm keyword corresponding to the second alarm information, the method may further include the following substeps:

and step S14121, determining a preset processing rule corresponding to the second alarm information according to the second alarm information.

Specifically, a preset processing rule corresponding to a first alarm source in the second alarm information may be determined according to the first alarm source of the second alarm information.

In the embodiment of the invention, the first alarm sources correspond to different alarm sources, and the first alarm sources can be a big data component alarm link and/or a Promitus alarm link and/or a cloud cluster alarm link. And determining preset processing rules corresponding to the alarm sources according to different alarm sources.

And step S14122, converting the second alarm information into second alarm information in a preset format according to the preset processing rule.

In the embodiment of the invention, for the first alarm generated by the alarm link of the big data component, the corresponding preset processing rule can be specifically that a unified extraction rule and a threshold value are configured according to the configurable rule template through the characteristic configuration of the big data component, and the second alarm information is formed into a configurable JSON format; storing second alarm information in JSON format into an asynchronous queue, and taking out the alarm and pushing the alarm to a message server, wherein the message server can be a kafka message server by a daemon thread polling the synchronous non-blocking queue; for the first alarm generated by the Promega repair alarm link, the corresponding preset processing rule can be specifically that an alarm consumption end is closed by Prometaus self-contained alarm protocol, the original second alarm information in various yml or JSON formats is converted into a unified alarm format in a user company, and the second alarm information is pushed to a message server; for the first alarm generated by the cloud cluster alarm link, the corresponding preset processing rule can specifically be to process and forward the second alarm information generated by the cloud cluster link through the relevant label template, and push the second alarm information to the message server.

It should be noted that, the second alarm information in the preset format is sent from the alarm monitoring service, and the second alarm information is sent in a classified and grouped manner under the condition that the message server receives the second alarm information in the preset format. Fig. 2 is a flowchart of steps of another method for processing alarm information according to an embodiment of the present invention, as shown in fig. 2, the method may include the following steps:

step S161, the message server receives the second alarm information.

It should be noted that, the message server may be a kafka message server, configured to receive the second alarm information in the preset format sent by the alarm monitoring server, and perform classified group sending on the second alarm information by using the alarm classification and the alarm keyword of the second alarm information in the preset format.

Step S162, the message server sends the second alarm information to the alarm group where the target contact is located.

In the embodiment of the invention, the alarm corresponding to the P0 level fault can be simultaneously notified to the target contact person through the telephone alarm and the alarm group in the chat client, and the alarm corresponding to the P1 level fault and the P2 level fault can be notified to the target contact person through the telephone alarm and the alarm group of the target contact person in the chat client, wherein the chat client can comprise a flying book client, a nailing client and the like.

Step S163, the chat client monitors the second alarm information sent to the alarm group.

In the embodiment of the invention, the derivative robot is arranged in the chat client, and the second alarm information in the alarm group where the target contact person in the chat client is located can be monitored through the derivative robot when the message server is sent to the alarm group.

Step S164, capturing the alarm keywords of the second alarm information through the derivative robot arranged in the chat client.

In the embodiment of the invention, after the message server sends the second alarm information to the alarm group where the target contact is located and the derivative robot arranged in the chat client monitors the alarm key words of the second alarm information, the derivative robot automatically grabs the alarm key words related to the second alarm information in the alarm group. In addition, the derived robot may further perform yml configuration on the captured alert keywords.

Note that yml (Aint Markup Language, markup language) is a markup language, and a file with a suffix of. yml or.yaml is an intuitive data serialization format that can be recognized by a computer, is easy to read by a human, is easy to interact with a scripting language, can be imported by a different programming language program supporting yml library, and is a language that is specially used for writing configuration files.

Step S165, the second alarm information is further notified to the target contact person according to the alarm keyword.

In the embodiment of the invention, the derivative robot in the chat client side setting further notifies the second alarm information to the target contact person according to the alarm keyword after yml configuration. Specifically, the second alarm information can be notified to the target contact person in the chat client according to the alarm keyword @ the target contact person in the alarm group where the target contact person of the chat client is located, and according to the alarm keyword, the target contact person can be ensured to acquire the second alarm information at the first time.

In the embodiment of the invention, the second alarm information in the preset format can be notified to the target contact person in different modes according to the alarm classification. Specifically, the P0 level fault needs to be immediately processed, so that the second alarm information corresponding to the P0 level fault can be notified to the target contact person in a telephone alarm mode to ensure the safety of the big data link continuously for 24 hours; for the faults of the P1 level and the P2 level, the target contact person is required to be processed in the working time, so that the second alarm information corresponding to the faults of the P1 level and the P2 level can be notified to the target contact person through the alarm group of the target contact person in the chat client, and the chat client can specifically comprise a chat client such as a flying book, a nail and the like.

FIG. 3 is a logic block diagram of an alarm information processing method according to an embodiment of the present invention, where, as shown in FIG. 3, when the generation of an alarm is detected by the hook technology according to different alarm sources, after processing through a time round data structure, the alarm information is pushed to a message server, and then the message server performs a telephone alarm and/or a message alarm according to the alarm information, according to different alarm sources, a specific implementation manner may include:

under the condition that the alarm source is a big data component alarm link alarm, under the condition that the generation of a first alarm is detected by a hook technology, first alarm information is acquired, wherein the first alarm information comprises a first alarm source and a first alarm theme; searching a first time wheel data structure corresponding to the first alarm information based on the first alarm source and a first alarm theme; under the condition that a first time wheel data structure corresponding to the first alarm information is not found, creating a first time wheel data structure based on the first alarm source and a first alarm theme; under the condition that a first time wheel data structure corresponding to the first alarm information is found, counting the number of the first alarms in each time period in the first time wheel data structure; and based on the number of each time period, sending second alarm information to a message server, and carrying out telephone alarm and/or message alarm according to the second alarm information by the message server.

Under the condition that the alarm source is a Promitus alarm link alarm, the Promitus alarm link alarm is divided into two types of alarms of self-configuration acquisition information and index information according to the Promitus capability, and then the two types of alarms are converged into a time sequence database of the Promitus, first alarm information is acquired, and the first alarm information comprises a first alarm source and a first alarm theme; searching a first time wheel data structure corresponding to the first alarm information based on the first alarm source and a first alarm theme; under the condition that a first time wheel data structure corresponding to the first alarm information is not found, creating a first time wheel data structure based on the first alarm source and a first alarm theme; under the condition that a first time wheel data structure corresponding to the first alarm information is found, counting the number of the first alarms in each time period in the first time wheel data structure; and based on the number of each time period, sending second alarm information, and sending the second alarm information subjected to template matching through the alarm management module and the dump message service plug-in module to a message server, wherein the message server carries out telephone alarm and/or message alarm according to the second alarm information.

Under the condition that a cloud cluster alarm link alarms, under the condition that the generation of a first alarm is detected by a hook technology, first alarm information is acquired, wherein the first alarm information comprises a first alarm source and a first alarm subject; searching a first time wheel data structure corresponding to the first alarm information based on the first alarm source and a first alarm theme; under the condition that a first time wheel data structure corresponding to the first alarm information is not found, creating a first time wheel data structure based on the first alarm source and a first alarm theme; under the condition that a first time wheel data structure corresponding to the first alarm information is found, counting the number of the first alarms in each time period in the first time wheel data structure; based on the number of each time period, second alarm information is sent, subscribers are added for the capability of an cloud cluster alarm template, and an alarm bidirectional link is realized for the subscriber service of the alarm source, on one hand, the format of the second alarm information conversion alarm template is classified into groups according to the alarm format, after the message is assembled by the automatic association responsible person, the second alarm information is pushed to a message server, and the message server carries out telephone alarm and/or message alarm according to the second alarm information; on one hand, under the offline analysis theme of the push message server with the JSON format, the alarm original source abnormality is extracted and integrated, the real-time task consumption of the Flink offline storage database is started, the alarm abnormality is written into an alarm offline analysis log table of the column storage database, and the large data SQL (Structured Query Language ) is used for inquiring and analyzing the offline log table to perform relevant positioning analysis and statistics.

It should be noted that, the above alert links are unified in downstream using the link, so that the original text can send the second alert text to the alert group where the target contact of the chat client is located; and finally, uniformly setting a derivative robot on the chat client, and automatically forwarding or urgent second alarm information of the group key identification group key through the capability support configuration of the chat client.

In the embodiment of the invention, under the condition that the generation of the first alarm is detected, a first time wheel data structure corresponding to the first alarm is created according to the first alarm information, the number of the first alarms is counted in each time period in the first time wheel data structure, and the second alarm information is sent outwards based on the number of each time period. After statistics and analysis of the number of the first alarms in each time in the first time wheel data structure are performed, second alarm information is sent outwards according to analysis results, classification of the first alarms and convergence induction of alarm times sent outwards are achieved through the first time wheel data structure, statistics and analysis of alarm times are performed through the time wheel data structure when the alarm information is sent timely under the condition that the alarms occur, flexible classification is performed, the second alarm information is sent accurately in real time, and the problem that important alarm information cannot be processed timely due to complex and messy alarm information is avoided. According to the embodiment of the invention, under the condition that the generation of the alarm is detected, a time wheel data structure is created according to the alarm information, and the alarm convergence noise reduction automatic statistics and induction are carried out through the time wheel data structure, so that a stable and reliable alarm information processing effect is realized.

Fig. 4 is a logic block diagram of an alarm information processing apparatus according to an embodiment of the present invention, as shown in fig. 4, where the alarm information processing apparatus includes:

an obtaining module 410, configured to obtain first alarm information when the first alarm generation is detected;

a searching module 420, configured to search a first time wheel data structure corresponding to the first alarm information based on the first alarm information;

a statistics module 430, configured to, in case that a first time-round data structure corresponding to the first alarm information is found, count the number of the first alarms in each time period in the first time-round data structure;

and a transmitting module 440 for transmitting the second alarm information based on the number of each time period.

Optionally, the alarm information processing device further includes:

the creation module is used for creating a first time wheel data structure based on the first alarm information under the condition that the first time wheel data structure corresponding to the first alarm information is not found.

Optionally, the creating module includes:

the acquisition sub-module is used for creating the first time wheel data structure and acquiring a first moment of creating the first time wheel data structure;

And the setting submodule is used for taking the first moment as a starting time scale, setting a plurality of second time scales with gradually increased time spans in the first time wheel data structure, taking time periods between the first moment and the plurality of second time scales as N time periods, and obtaining the time wheel data structure.

Optionally, the statistics module 430 includes:

the first determining submodule is used for determining an Mth time period to which the first alarm information belongs under the condition that a first time wheel data structure corresponding to the first alarm information is found;

a statistics sub-module, configured to count the number of detected first alarms in an mth time period;

Optionally, the setting submodule includes:

a setting unit configured to set, for each time period M, a counter corresponding to the time period.

Optionally, the statistics submodule includes:

and the counting unit is used for counting the number of the detected first alarms in the Mth time period through an Mth counter corresponding to the Mth time period.

Optionally, the first determining sub-module includes:

An acquisition unit, configured to acquire a second time when the first alarm is detected; the method comprises the steps of carrying out a first treatment on the surface of the

A calculating unit, configured to calculate a time difference between the second time and the first time according to the first time and the second time;

and the determining unit is used for determining an Mth time period corresponding to the time difference value according to the time difference value.

Optionally, the statistics unit includes:

a calculating subunit, configured to increment a value of an mth counter corresponding to the mth time period by 1; the value of the mth counter corresponds to the first number of alarms statistically detected during the mth time period.

Optionally, the sending module 440 includes:

the comparison sub-module is used for comparing the number of the first alarms counted corresponding to the adjacent time period;

a sending sub-module, configured to send second alarm information when the number corresponding to the (m+1) th time period is greater than the number corresponding to the (M) th time period;

and the suppression sending submodule is used for not sending the alarm information under the condition that the number corresponding to the M+1th time period is equal to the number corresponding to the M time period.

Optionally, the alarm information processing device further includes:

A first deleting module, configured to delete the first time-wheel data structure when the m+1 is equal to N and the number corresponding to the m+1th time period is equal to the number corresponding to the M time period;

and the second deleting module is used for sending second alarm information and deleting the first time wheel data structure when the M+1 is equal to N and the number corresponding to the M+1 time period is greater than the number corresponding to the M time period.

Optionally, the sending module 440 further includes:

a selecting sub-module, configured to select one alarm information from the first alarm information as a second alarm information;

the classifying sub-module is used for classifying the second alarm information and generating alarm keywords corresponding to the second alarm information;

the second determining submodule is used for determining a target contact person according to the alarm classification of the second alarm information and the alarm keyword;

and the notification sub-module is used for notifying the second alarm information in a preset format to the target contact person.

Optionally, the sending module 440 further includes:

a third determining submodule, configured to determine, according to the second alarm information, a preset processing rule corresponding to the second alarm information;

And the conversion sub-module is used for converting the second alarm information into second alarm information in a preset format according to the preset processing rule.

An embodiment of the present invention provides an electronic device, which is characterized by including a memory and a processor, where the memory is configured to store a computer program, and the processor is configured to implement the alarm information processing method as described above when executing the computer program.

An embodiment of the present invention further provides a readable storage medium, where the readable storage medium stores a computer program, where the computer program when executed by a processor implements the alarm information processing method as described above.

It will be apparent to those skilled in the art that embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, embodiments of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the invention may take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

Embodiments of the present invention are described with reference to flowchart illustrations and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiment and all such alterations and modifications as fall within the scope of the embodiments of the invention.

Finally, it is further noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or terminal device comprising the element.

The foregoing has described in detail a business process configuration method and a business process configuration device provided by the present invention, and specific examples have been applied herein to illustrate the principles and embodiments of the present invention, and the above description of the examples is only for helping to understand the method and core ideas of the present invention; meanwhile, as those skilled in the art will have variations in the specific embodiments and application scope in accordance with the ideas of the present invention, the present description should not be construed as limiting the present invention in view of the above.

Claims

1. An alarm information processing method, comprising:

2. The method of claim 1, further comprising, after searching for a first time-wheel data structure corresponding to the first alert information based on the first alert information:

3. The method of claim 2, wherein creating a first time wheel data structure based on the first alert information comprises:

counting the number of the detected first alarms in the Mth time period;

4. A method according to claim 3, wherein said taking the time period between the first time instant and the plurality of second time scales as N time periods, respectively, further comprises:

setting a counter corresponding to each time period M;

5. The method of claim 4, wherein the determining the mth time period to which the first alert information belongs comprises:

acquiring a second moment when the first alarm is detected;

6. A method according to claim 3, wherein said transmitting second alert information based on said number of respective time periods comprises:

7. The method of claim 6, wherein after transmitting the second alert information based on the number of each time period, further comprising:

8. The method of claim 1, wherein the sending the second alert information based on the number of time periods comprises:

9. The method of claim 8, wherein, in ranking the second alert information and generating the alert information with the second alert information

Before the alarm keyword corresponding to the second alarm information, the method further comprises:

10. An alert information processing apparatus, comprising:

11. An electronic device comprising a memory for storing a computer program and a processor for implementing the alarm information processing method according to any one of claims 1 to 9 when the computer program is executed.

12. A readable storage medium, characterized in that the readable storage medium stores a computer program which, when executed by a processor, implements the alarm information processing method according to any one of claims 1 to 9.