CN117950960A

CN117950960A - Alarm data processing method and device, electronic equipment and storage medium

Info

Publication number: CN117950960A
Application number: CN202410034265.7A
Authority: CN
Inventors: 宋文杰; 沙升升; 朱宏; 侍晶晶; 邓程
Original assignee: China United Network Communications Group Co Ltd
Current assignee: China United Network Communications Group Co Ltd
Priority date: 2024-01-09
Filing date: 2024-01-09
Publication date: 2024-04-30

Abstract

The application provides an alarm data processing method, an alarm data processing device, electronic equipment and a storage medium, relates to the technical field of computer fault warning, and is used for completing the processing of alarm data in an efficient manner. The method comprises the following steps: under the condition that the newly added alarm processing information in the buffer queue is detected, determining whether the meta alarm information corresponding to the alarm processing information exists or not; the alarm processing message is used for processing the meta alarm message; and in the absence of the meta-alert message, converting the alert processing message into a temporary alert message and storing the temporary alert message in a corresponding storage node.

Description

Alarm data processing method and device, electronic equipment and storage medium

Technical Field

The present application relates to the field of computer fault warning technologies, and in particular, to a method and apparatus for processing alarm data, an electronic device, and a storage medium.

Background

Various faults and abnormal conditions can occur in the running process of network equipment and application programs, and the faults and abnormal conditions can influence the normal running and stability of the network. In order to discover and handle these faults and anomalies in time, network alarm monitoring systems have evolved.

In related art network alarm monitoring systems, the processing of updating, clearing and storing alarm data may be by means of a relational database (relational database, RDB), a full text search (lucene) based search server (ELATICSEARCH, ES) and a separate external cache like reiteration (redis).

However, in the face of the alarm out-of-order condition, the related art processes are as follows: and creating an additional data structure for storing the first-in alarm processing message, and acquiring the alarm processing message to process the meta alarm message when the meta alarm message arrives so as to achieve the fault tolerance effect. However, this approach increases the complexity and maintenance costs of the system and presents challenges in terms of processing efficiency and simplicity.

Disclosure of Invention

The application provides an alarm data processing method, an alarm data processing device, electronic equipment and a storage medium, which are used for efficiently and simply processing alarm data.

In a first aspect, the present application provides an alarm data processing method, including: under the condition that the newly added alarm processing information in the buffer queue is detected, determining whether the meta alarm information corresponding to the alarm processing information exists or not; the alarm processing message is used for processing the meta alarm message; and in the absence of the meta-alert message, converting the alert processing message into a temporary alert message and storing the temporary alert message in a corresponding storage node.

The technical scheme provided by the application has at least the following beneficial effects: firstly, determining whether a meta-alert message corresponding to a newly added alert processing message exists or not through a cache queue; and in the absence of the meta-alert message, converting the alert processing message into a temporary alert message and storing the temporary alert message in a corresponding storage node. It can be seen that the method provided by the application can solve the problem of alarm disorder, and compared with the scheme that a data structure for storing alarm processing information is additionally required to be established in the related art, the method provided by the application only needs to establish a buffer queue to buffer alarm data, so that the alarm data processing is more concise and efficient.

As a possible implementation manner, the above-mentioned converting the alarm processing message into the temporary alarm message includes: adding an extended information field for the alarm processing message; the extended information field is the same as the field included in the alarm message; the augmentation information field includes a type field, and the type of alarm characterized by the type field is a temporary alarm.

As another possible implementation manner, the alarm processing message includes at least one of the following: the alarm update message is used for updating a target field in the meta alarm message; an alarm clearing message, the alarm clearing message being used to mark the clearing status of the meta alarm message as cleared; and the alarm association relation message is used for indicating the relation between the meta alarm message and other alarm messages.

As another possible implementation manner, in the case where the meta alert message does not exist, the alert processing message is converted into an temporary alert message, and after the temporary alert message is stored in the corresponding storage node, the method further includes: and under the condition that the meta-alert message is received, the meta-alert message is processed according to the alert processing message to obtain the target alert message.

As another possible implementation manner, the storage periods corresponding to different alarm messages are different

As another possible implementation manner, the storage periods of different alarm messages are respectively adjusted according to the access times of the different alarm messages.

As another possible implementation manner, the cache queue may be divided into a plurality of slices, where the plurality of slices are respectively located in a plurality of storage nodes; wherein one segment corresponds to one storage node

In a second aspect, the present application provides an alarm data processing apparatus, the apparatus comprising: the determining module is used for determining whether the meta-alert message corresponding to the alert processing message exists or not under the condition that the newly added alert processing message in the buffer queue is detected; the alarm processing message is used for processing the meta alarm message; and the processing module is used for converting the alarm processing message into the temporary alarm message and storing the temporary alarm message in the corresponding storage node under the condition that the meta alarm message does not exist.

As a possible implementation manner, the processing module is specifically configured to add an extended information field to the alarm processing message; the extended information field is the same as the field included in the alarm message; the augmentation information field includes a type field, and the type of alarm characterized by the type field is a temporary alarm.

As another possible implementation manner, the processing module is further configured to, when receiving the meta alarm message, process the meta alarm message according to the alarm processing message to obtain the target alarm message.

As another possible implementation manner, the alarm processing device further includes: and the adjusting module is used for respectively adjusting the storage periods of different alarm messages according to the access times of the different alarm messages.

As another possible implementation manner, the cache queue may be divided into a plurality of slices, where the plurality of slices are respectively located in a plurality of storage nodes; wherein one slice corresponds to one storage node.

In a third aspect, the present application provides an electronic device comprising a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions that are loaded and executed by the processor to cause the computer arrangement to implement the alert data processing method provided in the first aspect and any one of its possible implementations.

In a fourth aspect, the present application provides a computer readable storage medium having instructions stored therein which, when run on a computer, cause the computer to perform any of the alarm data processing methods provided in the first aspect above.

The description of the second to fourth aspects of the present application may refer to the detailed description of the first aspect; also, the advantageous effects described in the second aspect to the fourth aspect may refer to the advantageous effect analysis of the first aspect, and are not described herein.

Drawings

FIG. 1 is a schematic diagram of an alarm data processing apparatus architecture according to some embodiments;

FIG. 2 is a flow chart diagram of a method for processing alarm data according to some embodiments;

FIG. 3 is a diagram of a notification buffer queue distribution according to some embodiments;

FIG. 4 is a flow chart diagram of a method of processing alert data according to some embodiments;

FIG. 5 is a schematic diagram of an alert data access item storage structure in accordance with some embodiments;

FIG. 6 is a schematic diagram of an alarm data processing device according to some embodiments;

FIG. 7 is a second schematic diagram of an alarm data processing apparatus according to some embodiments.

Detailed Description

The following describes a detailed description of an alarm data processing method provided by the present application with reference to the accompanying drawings.

The term "and/or" is herein merely an association relationship describing an associated object, meaning that there may be three relationships, e.g., a and/or B, may represent: a exists alone, A and B exist together, and B exists alone.

The terms "first" and "second" and the like in the description and in the drawings are used for distinguishing between different objects or between different processes of the same object and not for describing a particular order of objects.

Furthermore, references to the terms "comprising" and "having" and any variations thereof in the description of the present application are intended to cover a non-exclusive inclusion. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those listed but may optionally include other steps or elements not listed or inherent to such process, method, article, or apparatus.

It should be noted that, in the embodiments of the present application, words such as "exemplary" or "such as" are used to mean serving as an example, instance, or illustration. Any embodiment or design described herein as "exemplary" or "e.g." in an embodiment should not be taken as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present related concepts in a concrete fashion.

In the description of the present application, unless otherwise indicated, the meaning of "a plurality" means two or more.

In order to facilitate understanding of the technical solutions of the embodiments of the present application, the terms related to the embodiments of the present application will be briefly described below.

1. Alarm data.

The alarm data refers to data generated automatically or manually when a network device or an application program fails or is abnormal. Such alert data typically includes alert type, alert level, alert time, alert source, alert content, alert title, home city, confirmation status, dispatch status, clear status, and the like. In the embodiment of the application, the alarm data comprises: meta alert message and alert process message; the alarm processing message includes: alarm update message, alarm clear message and alarm association relationship message.

2. And (5) alarm updating.

The alarm update refers to the process of updating the existing alarm message in the network alarm monitoring system. In the embodiment of the application, the alarm update is to update a specific attribute of the alarm data, for example, the confirmation state of the alarm data is changed from unconfirmed to confirmed, the dispatch state of the alarm data is changed from unsent to dispatched, and the like.

3. And (5) alarm clearing.

The alarm clearing refers to the process of clearing the existing alarm data; the alarm clearing can be manually cleared in the network alarm monitoring system, or the network equipment or the application program can generate an alarm clearing message and send the alarm clearing message to the network alarm monitoring system, and the network alarm monitoring system clears the alarm data through the indication of the alarm clearing message. In the embodiment of the application, the alarm clearing is to clear the alarm data through the alarm clearing message.

4. And (5) alarm association.

The alarm association refers to a process of associating a plurality of alarm data according to a certain rule and condition to form one or a plurality of alarm events; the purpose of alarm association is to associate alarm data related to the same problem or fault together, thereby facilitating the fault positioning and processing of an administrator and improving the fault processing efficiency and management level; by way of example, alarm association links related alarms in the form of a parent-child relationship, for example, there are three alarms of Alarm1 (Alarm 1), alarm1.1 (Alarm 1.1), and Alarm1.2 (Alarm 1.2), where the attributes of Alarm1.1 and Alarm1.2 are related to Alarm1, then the parent Alarm is Alarm1 and the child alarms are Alarm1.1 and Alarm1.2. In the embodiment of the application, the relation among a plurality of alarm data is indicated by sending an alarm association message.

5. Alarm data is out of order.

The disorder of the alarm data refers to the situation that the arrival sequence of the alarm data is inconsistent with the sequence of the fault or abnormal situation which actually occurs in the network alarm monitoring system; in the embodiment of the application, the alarm data disorder is mainly three, including: the meta alarm message and the alarm clearing message are out of order, the meta alarm message and the alarm updating message are out of order, and the meta alarm message and the alarm association relation message are out of order.

6. And (5) distributed caching.

Distributed caching is a storage way of storing cached data on different storage nodes. Compared with a single-machine cache, the distributed cache can improve the access speed of data and reduce the load of a database. For example, in the existing 3000 pieces of data, a single machine cache is to cache all 3000 pieces of data on a local server, and a distributed cache is to distribute the data on all storage nodes of a cluster according to a certain algorithm, for example, if the number of the distributed storage nodes is 3, 1000 pieces of data may be stored in each storage node, and the total number of the data stored in all storage nodes is 3000.

7. And (5) embedded distributed cache.

An embedded distributed cache is one type of distributed cache that can integrate cache functionality into the interior of an application without requiring additional configuration and deployment; the embedded distributed cache is typically deployed on the same server as the application, thus having lower latency and higher availability.

8. And (5) alarm flowing water display.

The alarm pipelining display refers to the process of displaying alarm data one by one according to a time sequence and a logic relationship in a network alarm processing system, so as to help an administrator to quickly know and locate faults or abnormal conditions; the main functions of the alarm running water display include: the method comprises the steps of displaying the latest alarm data in real time, updating the alarm data in real time, hanging the alarm association relation in real time, removing the cleared alarm in real time, synchronously inquiring the alarm data for a certain period of time (such as within 7 days), and the like.

The foregoing is a description of some concepts related to the embodiments of the present invention, and is not described in detail below.

As described in the background art, in the existing alarm monitoring system, when the alarm disorder situation is faced, the processing manner of the related technology is as follows: and creating an additional data structure for storing the first-in alarm processing message, and acquiring the alarm processing message to process the meta alarm message when the meta alarm message arrives so as to achieve the fault tolerance effect. However, this approach increases the complexity and maintenance costs of the system and presents challenges in terms of processing efficiency and simplicity.

Aiming at the technical problems, the embodiment of the application provides an alarm data processing method, which has the following ideas: firstly, determining whether a meta-alert message corresponding to a newly added alert processing message exists or not through a cache queue; and in the absence of the meta-alert message, converting the alert processing message into a temporary alert message and storing the temporary alert message in a corresponding storage node. It can be seen that the method provided by the application can solve the problem of alarm disorder, and compared with the scheme that a data structure for storing alarm processing information is additionally required to be established in the related art, the method provided by the application only needs to establish a buffer queue to buffer alarm data, so that the alarm data processing is more concise and efficient.

The embodiments of the present application will be described in detail below with reference to the drawings attached to the specification.

Referring to fig. 1, a schematic architecture diagram of an alarm data processing apparatus according to an embodiment of the present application is provided, where the apparatus includes: network device 100 and server 200.

The network device 100 may be a network device of a communication network or a network device of an internet technology (internet technology, IT) system.

In some embodiments, alert data may be automatically or manually generated upon failure or abnormal conditions of network device 100.

By way of example, network device 100 may include, but is not limited to, the following: repeaters, hubs, bridges, switches, routers, gateways.

The server 200 is one of the infrastructures of the internet for providing various services and functions. The server 200 is illustratively primarily used for data storage and management, application running and management, database services, security protection and management, load balancing, distributed deployment, and the like.

In some embodiments, the server 200 is configured to build a distributed cluster, where the distributed cluster includes: a cache queue and a plurality of storage nodes. Wherein, a storage node is used for storing one type of alarm data; for example, one type of alert data may be alert data generated by the same network device; or the alarm data may be alarm data generated by network devices in the same region, which is not limited by the embodiment of the present application.

Illustratively, the storage node may be a virtual machine.

In some embodiments, communication between network device 100 and server 200 is via a kafka system. kafka is a high throughput distributed publish-subscribe messaging system that can process large amounts of data in real time to meet various demand scenarios. The kafka system consists essentially of two modes of messaging: a point-to-point delivery mode and a publish-subscribe delivery mode. In the embodiment of the present application, the mode of message passing between the network device 100 and the server 200 is not particularly limited.

In some embodiments, the network device 100 may publish the generated alert data in the kafka system, and in turn, the alert data is transferred by the kafka system to some storage node of the server 200.

In some embodiments, the kafka system may also pre-process the alarm data and then store the alarm data in slices inside the kafka; when the server 200 needs to acquire the corresponding alarm data, the kafka system transfers the alarm data to a certain storage node of the server 200.

Illustratively, the preprocessing includes storing the alert data in fragments according to attributes of the alert data. For example, kafka may store alarm data in pieces according to regions, for example, alarm data belonging to city a is stored in a piece a of kafka, alarm data belonging to city B is stored in a piece B of kafka, and so on.

In some embodiments, the server 200 is further configured to obtain the alarm data stored in kafka, and process and store the alarm data according to the order in which the alarm data was obtained by the server.

It should be noted that, the system architecture described in the embodiments of the present application is for more clearly describing the technical solution of the embodiments of the present application, and does not constitute a limitation on the technical solution provided by the embodiments of the present application, and those skilled in the art can know that, along with the evolution of the system architecture, the technical solution provided by the embodiments of the present application is equally applicable to similar technical problems.

Referring to fig. 2, a flowchart of a method for processing alarm data is provided in an embodiment of the present application, where the method is applied to the server 200 shown in fig. 1, and the method includes:

S101, under the condition that the newly added alarm processing information in the buffer queue is detected, determining whether the meta alarm information corresponding to the alarm processing information exists.

The cache queue can be divided into a plurality of fragments, the fragments are respectively located in a plurality of storage nodes, and one fragment corresponds to one storage node.

Exemplary, referring to fig. 3, a schematic diagram of a notification buffer queue distribution is provided in an embodiment of the present application. As shown in fig. 3, the server may include: 1 cache queue and 3 storage nodes; the cache queue may be divided into 3 slices, where the 3 slices are located on 3 storage nodes respectively. The 3 slices of the cache queue are unified from the entrance where the kafka system acquired the alarm data.

In some embodiments, after the distributed cluster is started, all storage nodes in the cluster acquire alarm data from the corresponding fragments of kafka respectively. Illustratively, storage node 1 obtains data for the A-patch in kafka and storage node 2 obtains data for the B-patch in kafka.

In some embodiments, the storage node may use the put method of the cache queue to obtain alarm data from the kafka system. Illustratively, assuming the cache Queue is DATACACHE _queue_all, the storage node obtains the alert data characterization as DATACACHE _queue_all. Illustratively, storage node 1 invokes DATACACHE _queue_all.put () get meta-alert message 1 (Alarm 1); the storage node 2 calls DATACACHE _queue_all.put () to acquire the meta-alert message 3 (Alarm 3); the storage node 3 calls DATACACHE _queue_all.put ()'s get meta-alert message 5 (Alarm 5).

In some embodiments, the above method further comprises: detecting whether a new alarm processing message exists in the buffer queue. By way of example, it is possible to detect whether there is a new alarm handling message in the buffer queue by establishing a form of a snoop event. For example, the above listening event includes: the cache queue has new entries (ENTRYCREATED); wherein ENTRYCREATED is used to create an alarm data storage item.

It is also possible to detect whether there is an update in the cache queue, for example by establishing the form of a snoop event. For example, the snoop event includes a cache queued with an update item (entryModified); entryModified are used to update the alert data.

In some embodiments, the amount of alert data buffered by the buffer queue may be set according to the storage capacity of the storage space of the server and the size of the alert data.

For example, assuming that the average size of each alarm data is 10k, and the available memory for buffering by a single storage node is 20G, each storage node may buffer 200 ten thousand alarm data; assuming that the server has 3 storage nodes, the maximum number of alert data that can be cached by the cache queue is 600 tens of thousands.

In some embodiments, the cache queues may be split, fragmented, onto different storage nodes, for a traffic scenario.

Illustratively, the cache queue at storage node 1 handles alarm data from Jiangsu region, the cache queue at storage node 2 handles alarm data from Fujian region, etc.

It can be understood that the buffer queue is split according to the service scene, so that the split fragments are only used in the corresponding service scene, the data volume can be reduced, and the query speed can be improved.

In some embodiments, the alert process message is used to process meta alert messages. Exemplary, the alert processing message includes: alarm update message, alarm clear message and alarm association relationship message.

The alarm updating message is used for updating the target field in the meta alarm message; an alarm clearing message for marking the clear state of the meta alarm message as cleared; and the alarm association relation message is used for indicating the relation between the meta alarm message and other alarm messages.

In some embodiments, the meta alert message and the alert process message each include a plurality of fields.

Illustratively, the meta alert message includes an identification field, an alert indication field, etc.; wherein the identification field comprises the category of the alarm message, and the identification fields of different meta alarm messages may be different; the alarm indication field is used to indicate the specific function of the alarm.

The alert update message includes an identification field and an update field. The identification field of the alarm update message is the same as the identification field of the meta alarm message to be updated of the alarm update message; for example, the identification fields of meta Alarm message 1 (Alarm 1) and Alarm Update message 1 (Alarm 1 Update) are both 1, and the identification fields are the same.

The alert clear message includes an identification field and a clear status field. Wherein the cleared status field is cleared; the identification field of the alarm clearing message is the same as the identification field of the meta alarm message to be cleared by the alarm clearing message; for example, the identification fields of meta Alarm message 1 (Alarm 1) and Alarm Clear message 1 (Alarm 1 Clear) are both 1, and the identification fields are the same.

The Alarm association message includes an identification field, an Alarm attribute field, and an Alarm association field, for example, alarm1.1 and Alarm1.2 have a certain association relationship with the attribute of Alarm1 in the attribute, and may be expressed as the following structure:

<Related_FPList>

<AlarmID＝’Alarm1.1’/>

<AlarmID＝’Alarm1.2’/>

</Related_FPList>

</Relation>

Wherein < Relation > is an element containing an attribute named PARENTALARMID, the value of which is 'Alarm1'; illustratively, PARENTALARMID may represent a relationship between one meta alert message and other meta alert messages; the interior of the < Relation > element includes: a < related_ FPList > element and two < AlarmID > elements; wherein the < related_ FPList > element is used to characterize the other meta-alert message list associated with the alert (whose PARENTALARMID is 'Alarm 1'); two < AlarmID > elements, respectively, contain the identity of the two meta alert messages 'alarm1.1' and 'alarm 1.2'.

The above structure describes the relationship between the meta alert message (PARENTALARMID is 'Alarm 1') and its associated meta alert messages (Alarm 1.1 and Alarm 1.2).

In some embodiments, the presence or absence of the meta-alert message in the storage node may be determined based on an identification field of the meta-alert message and an identification field of the alert process message.

For example, if the identification field of the Alarm1Update is 1, the identification field of the meta Alarm message corresponding to the Alarm1Update is also 1, so that whether the meta Alarm message with the identification field of 1 exists in the storage node can be detected to determine whether the meta Alarm message corresponding to the Alarm1Update exists.

S102, under the condition that the meta-alert message does not exist, the alert processing message is converted into a temporary alert message, and the temporary alert message is stored in a corresponding storage node.

In some embodiments, the above-mentioned converting the alert process message into the temporary alert message includes:

adding an extended information field for the alarm processing message; the extended information field is the same as the field included in the alarm message; the augmentation information field includes a type field, and the type of alarm characterized by the type field is a temporary alarm.

Illustratively, alarm1 comprises: an identification field, an A1 field, an A2 field, an A3 field and an A4 field, wherein the identification field is 1. Under the condition that the buffer queue receives the Alarm Update message Alarm1Update of Alarm1, the Alarm Update message Alarm1Update is converted into a temporary Alarm message for storage. Assuming that the Alarm1Update is used to Update the contents of the A2 field of Alarm1, the Alarm1Update includes an identification field (identification field 1) and an A2 field (different from the contents filled in the A2 field of the meta Alarm message Alarm 1). Further, converting the Alarm1Update into the temporary alert message includes: adding an extended information field for Alarm1 Update; wherein the extended information field includes: a type field, an A1 field, an A3 field, and an A4 field; wherein, the alarm type represented by the type field is a temporary alarm; the A1 field, the A3 field, and the A4 field may be null.

Under the condition that the buffer queue receives the Alarm clearing message Alarm1Clear of Alarm1, the Alarm clearing message Alarm1Clear is converted into a temporary Alarm message for storage. Assuming that Alarm1Clear includes an identification field (identification field is 1) and a Clear status field (Clear status is cleared), converting Alarm1Clear into a temporary alert message includes: adding an extended information field for Alarm1 Clear; wherein the extended information field includes: a type field, an A1 field, an A2 field, an A3 field, and an A4 field; wherein, the alarm type represented by the type field is a temporary alarm; the A1 field, the A2 field, the A3 field, and the A4 field are null.

In some embodiments, the above-mentioned converting the alert process message into the temporary alert message further includes: a type field is added to the alarm processing message, and the alarm type characterized by the type field is a temporary alarm.

Illustratively, it is assumed that there is some correlation of the properties of Alarm1, alarm1.1 and Alarm 1.2. Under the condition that the buffer queue receives the association relation message Alarm1Connect among Alarm1, alarm1.1 and Alarm1.2, the Alarm1Connect is converted into a temporary Alarm message for storage. Assuming that the Alarm1Connect includes an identification field (identification field is 1), an attribute field (attribute field is Alarm 1), a first association field (first association field is identification field of Alarm 1.1), and a second association field (first association field is identification field of Alarm 1.2), converting the Alarm1Connect into a temporary alert message includes: a type field is added for Alarm1Connect, and the Alarm type characterized by the type field is a temporary Alarm.

In some embodiments, the step S102 may be implemented as: and determining a storage node corresponding to the alarm processing message through a hash algorithm according to the identification field of the alarm processing message, and storing the alarm processing message to the corresponding storage node.

For example, assuming that the identification field of a certain alarm processing message is 2, determining a storage node corresponding to the alarm processing message as a storage node 1 through a hash algorithm, and storing the temporary alarm message converted from the alarm processing message onto the corresponding storage node.

It should be noted that, since the alert process message is identical to the identification field of the corresponding meta alert message, the identification field of the temporary alert message converted from the alert process message is identical to the identification field of the meta alert message corresponding to the alert process message, i.e. the storage node of the meta alert message should be identical to the storage node of the temporary alert message converted from the alert process message.

It can be understood that in the alarm data processing method provided by the embodiment of the application, whether the meta alarm message corresponding to the newly added alarm processing message exists or not is determined through the buffer queue; and under the condition that the meta-alert message does not exist, converting the alert processing message into a temporary alert message, and storing the temporary alert message in a corresponding storage node. Compared with the scheme that a data structure for storing alarm processing information is additionally required to be established in the related art, the method provided by the application only needs to establish a buffer queue to buffer the alarm data, so that the alarm data is processed more simply and efficiently.

In some embodiments, as shown in fig. 4, after the step S102 described above, the method further includes the following step S103.

And S103, under the condition that the meta-alert message is received, the meta-alert message is processed according to the alert processing message, and the target alert message is obtained.

In some embodiments, where the alert process message is an alert update message, processing the meta alert message according to the alert update message includes: and replacing the corresponding field in the meta-alert message with an update field included in the alert update message.

Illustratively, the hypothetical meta alert message includes: an identification field, an A1 field, an A2 field, an A3 field, and an A4 field; the update field of the alarm update message is an A2 field (it is understood that the A2 field of the alarm update message is different from the A2 field of the meta alarm message in filling content), and the A2 field of the alarm update message is used to replace the A2 field in the meta alarm message.

In some embodiments, where the alert process message is an alert clear message, processing the meta alert message according to the alert process message includes: the clearing status field in the meta alert message is replaced with a clearing status field included in the alert clearing message.

Illustratively, the hypothetical meta alert message includes: an identification field, an A1 field, an A2 field, an A3 field, and an A4 field; if the clearing status field of the alarm clearing message is cleared (it can be understood that the clearing status field of the meta alarm message is not cleared), the clearing status field of the alarm clearing message is used to replace the alarm clearing status field in the meta alarm message, the storage period of the meta alarm message is reset to zero, and the storage period of the alarm clearing message is shortened.

In some embodiments, in the case where the alert process message is an alert association message, processing the meta alert message according to the alert process message includes: and placing the meta-alert messages related to the attributes into an attribute set.

Illustratively, assume that there is some correlation of the properties of Alarm1, alarm1.1, and Alarm 1.2; alarm1Connect includes an identification field (identification field is 1), a first association field (identification field of the first association field being Alarm 1.1) and a second association field (identification field of the first association field being Alarm 1.2), then Alarm1, alarm1.1 and Alarm1.2 are put into one set.

In some embodiments, the method further includes that the storage node may query the alarm data using a get method of a cache queue. For example, assuming the cache Queue is DATACACHE _queue_all, storage node query element alert message 1 is characterized as DATACACHE _queue_all.get (1).

In some embodiments, the method may further include the storage node obtaining the alarm data from the storage node to update the meta-alarm message using a getLocalDataContainer method of a cache queue. For example, assuming that the cache Queue is DATACACHE _queue_all, in the case that the array 1 is received (the identification field of array 1 is 1), the storage node calls DATACACHE _queue_all.getlocaldatacontainer method to obtain the storage node fragments, and then calls put method of the storage node fragments to complete updating, and the distributed cluster only involves one remote network operation. The put method contains two parameters, including: an identification field for Alarm1 and updated Alarm1.

In some embodiments, the above method further comprises: and dynamically managing the alarm messages stored in the cache nodes.

As one possible implementation, different storage periods may be set for different alert data.

Illustratively, a default alarm expiration policy is set for different meta-alarm messages, the alarm expiration policy comprising: the expiration time of the common meta-alert message is 3 days, the expiration time of the important meta-alert message is 7 days, and the expiration time of the meta-alert message which is cleared is 4 hours; wherein the importance level of the meta-alert message is included in the attribute of the meta-alert message.

As one possible implementation, it is possible to detect whether there is an expired item in the cache queue by establishing a form of snoop event. Illustratively, the snoop event includes a cache queue having an expiration item (entryExpired); entryExpired are used to monitor whether the buffering period of the buffered alert data has expired.

In some embodiments, the storage periods of different alarm messages are respectively adjusted according to the access times of the different alarm messages.

For example, according to the requirement of a certain service, the alarm data 1 needs to be queried, the access times of the alarm data 1 are increased by 1 once per query element, and when the access times exceed a preset threshold, the storage period of the alarm data 1 is adjusted.

As one possible implementation, whether there is an accessed item in the cache queue may be detected by establishing a form of snoop event. Illustratively, the snoop event includes a cache queue being accessed (ENTRYVISITED); ENTRYVISITED is used for storing the access times of the alarm data, so as to facilitate updating the buffer memory period of the alarm data.

In some embodiments, the storage node may sort the alert messages by the number of accesses to each alert message and store the identification field and the number of accesses of the alert message.

Exemplary, referring to fig. 5, a schematic diagram of an alert data access item storage structure according to an embodiment of the present application is provided. As shown in fig. 5, under a certain service requirement, the number of times of querying the Alarm1 in the storage node 1 is 10, and the number of times of querying the Alarm2 in the storage node 1 is 20, and the data structure stored in ALARMVISITS of the storage node is shown in fig. 5.

It can be understood that the method provided by the embodiment of the application can adjust the storage period of the alarm message based on the access times of the alarm message, so that the prolonged survival of the thermal data can be realized, the resource investment is reduced, and the service requirement is met.

It will be appreciated that since the cache queues have good localization characteristics and can be organically combined with snoop events, each type of snoop event occurs on a storage node having alarm data.

For example, the storage node 1 acquires the Alarm1 through the cache queue, determines that the storage node of the Alarm1 is the storage node 2 according to the hash algorithm and the identification field of the Alarm1, and if it is determined that the storage node 2 has no Alarm data identical to the identification field of the Alarm1 according to the identification field of the Alarm1, the storage node 2 triggers ENTRYCREATED an event, the Alarm1 is stored in the storage node 2, and other storage nodes do not trigger ENTRYCREATED events; in case it is determined from the Alarm1 identification field that there is Alarm data in the storage node 2 that is identical to the Alarm1 identification field, the storage node 2 triggers entryModified an event, updates Alarm1, and the other nodes do not trigger entryModified events.

It can be seen that the foregoing description of the solution provided by the embodiments of the present application has been presented mainly from a method perspective. To achieve the above-mentioned functions, embodiments of the present application provide corresponding hardware structures and/or software modules that perform the respective functions. Those of skill in the art will readily appreciate that the various illustrative modules and algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is implemented as hardware or computer software driven hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

The embodiment of the application can divide the functional modules of the network node according to the method example, for example, each functional module can be divided corresponding to each function, and two or more functions can be integrated in one processing module. The integrated modules may be implemented in hardware or in software functional modules. Optionally, the division of the modules in the embodiment of the present application is schematic, which is merely a logic function division, and other division manners may be implemented in practice.

Referring to fig. 6, a schematic structural diagram of an alarm processing device according to an embodiment of the present application is shown. The modules in the device shown in fig. 6 have the functions of implementing the steps in fig. 2, and achieve the corresponding technical effects. As shown in fig. 6, the alarm processing apparatus 600 may include: a determination module 601 and a processing module 602.

The determining module 601 is configured to determine whether a meta alarm message corresponding to an alarm processing message exists when detecting that an alarm processing message is newly added to the buffer queue.

And the processing module 602 is configured to convert the alarm processing message into a temporary alarm message and store the temporary alarm message in a corresponding storage node in the case where the meta alarm message does not exist.

In some embodiments, the processing module 602 is specifically configured to convert the alarm processing message into an temporary alarm message, including: adding an extended information field for the alarm processing message; the extended information field is the same as the field included in the alarm message; the augmentation information field includes a type field, and the type of alarm characterized by the type field is a temporary alarm.

In some embodiments, the alert process message includes at least one of: the alarm update message is used for updating a target field in the meta alarm message; an alarm clearing message, the alarm clearing message being used to mark the clearing status of the meta alarm message as cleared; and the alarm association relation message is used for indicating the relation between the meta alarm message and other alarm messages.

In some embodiments, the processing module 602 is further configured to, in case of receiving the meta alert message, process the meta alert message according to the alert processing message to obtain the target alert message.

In some embodiments, the storage periods corresponding to different alert messages are different.

In some embodiments, the alarm processing device further includes: the adjusting module 603 is configured to adjust storage periods of different alarm messages according to access times of the different alarm messages.

In some embodiments, the cache queue may be divided into a plurality of slices, where the plurality of slices are respectively located in a plurality of storage nodes; wherein one slice corresponds to one storage node.

In the case of implementing the functions of the integrated modules in the form of hardware, the embodiment of the present invention provides another possible structural schematic diagram of the alarm data processing device involved in the above embodiment. As shown in fig. 7, the alarm data processing apparatus includes: a processor 702, a communication interface 703, and a bus 704. Optionally, the alert data processing apparatus may also include a memory 701.

The processor 702 may be any means for implementing or executing the various exemplary logic blocks, modules, and circuits described in connection with this disclosure. The processor 702 may be a central processor, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. Which may implement or perform the various exemplary logic blocks, modules and circuits described in connection with this disclosure. The processor 702 may also be a combination of computing functions, e.g., including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

A communication interface 703 for connecting with other devices via a communication network. The communication network may be an ethernet, a radio access network, a wireless local area network (wireless local area networks, WLAN), etc.

The memory 701 may be, but is not limited to, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (random access memory, RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (ELECTRICALLY ERASABLE PROGRAMMABLE READ-only memory, EEPROM), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.

As a possible implementation, the memory 701 may exist separately from the processor 702, and the memory 701 may be connected to the processor 702 through the bus 704 for storing instructions or program codes. The processor 702, when calling and executing instructions or program code stored in the memory 701, is capable of implementing the alarm data processing method provided by the embodiment of the present invention.

In another possible implementation, the memory 701 may also be integrated with the processor 702.

Bus 704, which may be an extended industry standard architecture (extended industry standard architecture, EISA) bus, or the like. The bus 704 may be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, only one thick line is shown in fig. 7, but not only one bus or one type of bus.

It will be apparent to those skilled in the art from this description that, for convenience and brevity of description, only the above-described division of the functional modules is illustrated, and in practical application, the above-described functional allocation may be performed by different functional modules according to needs, that is, the internal structure of the alarm data processing device is divided into different functional modules to perform all or part of the above-described functions.

The embodiment of the application also provides a computer readable storage medium. All or part of the flow in the above method embodiments may be implemented by computer instructions to instruct related hardware, and the program may be stored in the above computer readable storage medium, and the program may include the flow in the above method embodiments when executed. The computer readable storage medium may be any of the foregoing embodiments or memory. The computer readable storage medium may be an external storage device of the alarm data processing apparatus, for example, a plug-in hard disk, a smart card (SMART MEDIA CARD, SMC), a Secure Digital (SD) card, a flash memory card (FLASH CARD) or the like, which are provided in the alarm data processing apparatus. Further, the computer readable storage medium may further include both an internal storage unit and an external storage device of the alarm data processing apparatus. The computer readable storage medium is used for storing the computer program and other programs and data required by the alarm data processing device. The above-described computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

Embodiments of the present application also provide a computer program product comprising a computer program which, when run on a computer, causes the computer to perform any of the alarm data processing methods provided in the embodiments above.

The foregoing is merely illustrative of specific embodiments of the present application, and the scope of the present application is not limited thereto, but any changes or substitutions within the technical scope of the present application should be covered by the scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An alarm data processing method, comprising:

Under the condition that a new alarm processing message in a cache queue is detected, determining whether a meta alarm message corresponding to the alarm processing message exists or not; wherein, the alarm processing message is used for processing the meta alarm message;

And under the condition that the meta-alarm message does not exist, converting the alarm processing message into a temporary alarm message, and storing the temporary alarm message in a corresponding storage node.

2. The method of claim 1, wherein said converting said alert process message into an interim alert message comprises:

Adding an extended information field for the alarm processing message; wherein, the extended information field is the same as the field included in the alarm message; the augmentation information field includes a type field, and the alarm type characterized by the type field is a temporary alarm.

3. The method of claim 1, wherein the alert process message comprises at least one of:

The alarm update message is used for updating a target field in the meta alarm message;

An alarm clearing message, wherein the alarm clearing message is used for marking the clearing state of the meta alarm message as cleared;

And the alarm association relation message is used for indicating the relation between the meta alarm message and other alarm messages.

4. The method of claim 1, wherein the converting the alert process message to a temporary alert message in the absence of the meta alert message, after storing in a corresponding storage node, further comprises:

And under the condition that the meta-alert message is received, processing the meta-alert message according to the alert processing message to obtain a target alert message.

5. The method of claim 1, wherein the storage periods for different alert messages are different.

6. The method of claim 5, wherein the method further comprises:

And respectively adjusting the storage period of different alarm messages according to the access times of the different alarm messages.

7. The method of claim 1, wherein the cache queue is divided into a plurality of slices, and wherein a plurality of the slices are respectively located in a plurality of the storage nodes; wherein one of the tiles corresponds to one of the storage nodes.

8. An alert data processing apparatus, the apparatus comprising:

The determining module is used for determining whether the meta-alarm message corresponding to the alarm processing message exists or not under the condition that the newly added alarm processing message in the buffer queue is detected; wherein, the alarm processing message is used for processing the meta alarm message;

And the processing module is used for converting the alarm processing message into a temporary alarm message and storing the temporary alarm message in a corresponding storage node under the condition that the meta alarm message does not exist.

9. An electronic device comprising a processor and a memory, the processor coupled to the memory; the memory is for storing computer instructions that are loaded and executed by the processor to cause a computer apparatus to implement the alert data processing method of any one of claims 1 to 7.

10. A computer readable storage medium comprising computer executable instructions which, when run on a computer, cause the computer to perform the alarm data processing method of any of claims 1 to 7.