CN107707380A - A kind of monitoring alarm method and apparatus - Google Patents
A kind of monitoring alarm method and apparatus Download PDFInfo
- Publication number
- CN107707380A CN107707380A CN201710642112.0A CN201710642112A CN107707380A CN 107707380 A CN107707380 A CN 107707380A CN 201710642112 A CN201710642112 A CN 201710642112A CN 107707380 A CN107707380 A CN 107707380A
- Authority
- CN
- China
- Prior art keywords
- monitoring alarm
- alarm information
- monitoring
- sent
- alarm
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Alarm Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a kind of monitoring alarm method and apparatus.It is related to computer network field；Solve the problems, such as that alerting burst causes system overload and operation maintenance personnel failure judgement difficulty.This method includes：The a plurality of monitoring alarm information with same alike result being collected into is merged, obtains a merging monitoring alarm information；Monitoring alarm information table is generated, the monitoring alarm information table includes the monitoring alarm information that merges monitoring alarm information and/or can not merge；Situation is submitted according to current alarm, the monitoring alarm information table is sent, is alerted.Technical scheme provided by the invention is applied to network monitoring system, realizes the merging to a plurality of monitoring alarm information and sends.
Description
Technical field
The present invention relates to computer network field, more particularly to a kind of monitoring alarm method and apparatus.
Background technology
For the stable operation of Logistics networks system, monitoring system is indispensable at present.In large-scale cluster system
Under scene, monitoring system can be collected, handled, issuing monitoring monitoring alarm information.Once the number of monitoring monitoring alarm information surpasses
Go out the disposal ability scope of operation maintenance personnel, the effect of monitoring will be greatly reduced, risk is brought to system.
For example, every server is required for the monitoring for possessing to basic monitored item, such as disk utilization, cpu, bandwidth
Deng the same monitored item for large number quipments easily occur occurs abnormal, and moment produces a large amount of monitoring alarms.
Likewise, for distributed system, how same application goes wrong, and a large amount of alarms, O＆M also occurs
Personnel can not grasp overall condition as early as possible, if the alarm amount sent exceeds monitoring system ability to bear, can also influence monitoring system
The availability of system itself.
In prior art, monitoring alarm is monitored, judges and accused as granularity using equipment or equipment-monitored item
It is alert, when same problem occurs in the identical monitored item of large number quipments, same node point large number quipments go wrong, same application/system
When largely going wrong, each equipment can all be directed to the monitored item and generate a monitoring alarm information, can produce monitoring alarm and dash forward
Hair, operation maintenance personnel failure judgement scope is difficult and causes the possibility of failure with monitoring system overload.
In prior art, periodically to perform, failure occurs into failover procedure monitoring data collection, can be every
Every a time cycle, monitoring alarm information is all sent, for the failure do not repaired across some cycles, can all be weighed during reparation
Monitoring monitoring alarm information is sent in recurrence, influences the troubleshooting work of monitor system performance and operation maintenance personnel.
The content of the invention
Present invention seek to address that problem as described above.
According to an aspect of the present invention, there is provided a kind of monitoring alarm method, including：
The a plurality of monitoring alarm information with same alike result being collected into is merged, obtains a merging monitoring alarm
Information；
Monitoring alarm information table is generated, the monitoring alarm information table, which includes, to be merged monitoring alarm information and/or can not close
And monitoring alarm information；
Situation is submitted according to current alarm, the monitoring alarm information table is sent, is alerted.
Preferably, the monitoring alarm information comprises at least any or any multinomial in following parameter：
Alarm equipment, monitored item, monitoring data, alarm conditions, alarm level,
Wherein, the equipment that alarm equipment instruction monitoring alarm information is pointed to, monitored item indicate the monitoring alarm information pin
To monitoring project, the obtained data of monitoring data instruction monitoring, the needs that alarm conditions instruction associates with the monitored item enter
The value of row alarm, alarm level indicate the priority of current monitor warning information, and the alarm equipment and monitored item parameter are table
The parameter of the bright monitoring alarm information attribute；
The monitoring alarm information that merges is including at least any or any multinomial in following parameter：
Alarming node, application/systematic name is alerted, alarm equipment list, monitored item, monitoring data, alarm conditions, is merged
Alarm level, alarm equipment accounting in node, using alarm equipment accounting in/system,
Wherein, the node device that the monitoring alarm information that alarming node instruction merges is pointed to, alarm application/systematic name refer to
Show application/system that the monitoring alarm information of merging is pointed to, in node the instruction of alarm equipment accounting be incorporated into merging monitoring and accuse
The number of devices that monitoring alarm information in alert information is related to accounts for the ratio of armamentarium in the node device, using/system
The number of devices that the monitoring alarm information that interior alarm equipment accounting instruction is incorporated into the merging monitoring alarm information is related to accounts for institute
The ratio of armamentarium in application/system is stated, merges the priority that alarm level instruction merges monitoring alarm information.
Preferably, it is specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information points to same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical.
Preferably, a plurality of monitoring alarm information with same alike result being collected into is merged, obtains a merging
The step of monitoring alarm information, includes：
The number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to is calculated to account in node device
Or in application/system armamentarium ratio；
According to the ratio, it is determined that merging alarm level；
Generation merges monitoring alarm information.
Preferably, the step of submitting situation according to current alarm, sending the monitoring alarm information table, alerted is wrapped
Include：
Query warning task interface accumulation monitoring alarm information list to be sent at present；
Newly-generated monitoring alarm information table is incorporated to the accumulation monitoring alarm information list, monitoring to be sent is generated and accuses
Alert information list；
Number of entries in the monitoring alarm information list to be sent determines sending strategy；
The monitoring alarm information list to be sent is sent according to the sending strategy.
Preferably, the step of number of entries in the monitoring alarm information list to be sent determines sending strategy is wrapped
Include：
Judge number of entries in the monitoring alarm information list to be sent whether monitoring alarm transmission interface property
In the range of energy limit；
Number of entries in the monitoring alarm information list to be sent exceedes the property of the monitoring alarm transmission interface
During energy limit, selected section entry is preferentially sent.
Preferably, the step of selected section entry is preferentially sent includes：
When the continuous alarm time of an entry is more than six threshold values, judge that often generation N bars same item is only sent once, N
For the positive integer more than or equal to 2；
When the continuous alarm time of an entry is more than seven threshold values, the partial entry for selecting alarm level higher is preferentially sent out
Send.
According to another aspect of the present invention, there is provided a kind of monitoring alarm device, including：
Monitoring alarm information merging module, for being carried out to a plurality of monitoring alarm information with same alike result being collected into
Merge, obtain a merging monitoring alarm information；
List Generating Module, for generating monitoring alarm information table, the monitoring alarm information table, which includes, merges monitoring announcement
Alert information and/or the monitoring alarm information that can not merge；
Sending module is alerted, for submitting situation according to current alarm, the monitoring alarm information table is sent, is accused
It is alert.
Preferably, it is specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information points to same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical,
The monitoring alarm information merging module includes：
Statistic unit, the number of devices being related to for calculating a plurality of monitoring alarm information with same alike result being collected into
Account in node device or in application/system armamentarium ratio；
Rank confirmation unit, for according to the ratio, it is determined that merging alarm level；
Information generating unit, merge monitoring alarm information for generating.
Preferably, the alarm sending module includes：
Accumulation task confirmation unit, the accumulation monitoring alarm information to be sent at present for query warning task interface row
Table；
Information generating unit to be sent, for newly-generated monitoring alarm information table to be incorporated into the accumulation monitoring alarm letter
List is ceased, generates monitoring alarm information list to be sent；
Sending strategy confirmation unit, hair is determined for the number of entries in the monitoring alarm information list to be sent
Send strategy；
Execution unit is sent, for sending the monitoring alarm information list to be sent according to the sending strategy.
Preferably, the sending strategy confirmation unit includes：
Quantity confirms subelement, for judging whether the number of entries in the monitoring alarm information list to be sent is supervising
In the range of the performance boundary of the alert transmission interface of charge；
Subelement is screened, exceeding the monitoring for the number of entries in the monitoring alarm information list to be sent accuses
During the performance boundary of alert transmission interface, selected section entry is preferentially sent, specifically：
When the continuous alarm time of an entry is more than six threshold values, judge that often generation N bars same item is only sent once, N
For the positive integer more than or equal to 2,
When the continuous alarm time of an entry is more than seven threshold values, the partial entry for selecting alarm level higher is preferentially sent out
Send.
The invention provides a kind of monitoring alarm method and apparatus, to a plurality of prison with same alike result being collected into
Control warning information merges, and obtains a merging monitoring alarm information, generates monitoring alarm information table, carried according to current alarm
Friendship condition, the monitoring alarm information table is sent, is alerted.Realize the merging to a plurality of monitoring alarm information to send, subtract
Monitoring alarm information content is lacked, has solved the problems, such as that alerting burst causes system overload and operation maintenance personnel failure judgement difficulty.
The following description for exemplary embodiment is read with reference to the drawings, other property features of the invention and advantage will
It is apparent from.
Brief description of the drawings
It is incorporated into specification and the accompanying drawing of a part for constitution instruction shows embodiments of the invention, and with
Description is used for the principle for explaining the present invention together.In the drawings, similar reference is used to represent similar key element.Under
Accompanying drawing in the description of face is some embodiments of the present invention, rather than whole embodiments.Come for those of ordinary skill in the art
Say, on the premise of not paying creative work, other accompanying drawings can be obtained according to these accompanying drawings.
Fig. 1 schematically illustrates a kind of flow of monitoring alarm method of the offer of embodiments of the invention one；
Fig. 2 schematically illustrates a kind of structure of monitoring alarm device of the offer of embodiments of the invention two；
Fig. 3 schematically illustrates the structure of monitoring alarm information merging module 201 in Fig. 2；
Fig. 4 schematically illustrates the structure that sending module 203 is alerted in Fig. 2；
Fig. 5 schematically illustrates the structure of sending strategy confirmation unit 403 in Fig. 4.
Embodiment
To make the purpose, technical scheme and advantage of the embodiment of the present invention clearer, below in conjunction with the embodiment of the present invention
In accompanying drawing, the technical scheme in the embodiment of the present invention is clearly and completely described, it is clear that described embodiment is
Part of the embodiment of the present invention, rather than whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art
The every other embodiment obtained under the premise of creative work is not made, belongs to the scope of protection of the invention.Need
Illustrate, in the case where not conflicting, the feature in embodiment and embodiment in the application can be mutually combined.
In prior art, monitoring alarm is monitored, judges and accused as granularity using equipment or equipment-monitored item
It is alert, when same problem occurs in the identical monitored item of large number quipments, same node point large number quipments go wrong, same application/system
When largely going wrong, each equipment can all be directed to the monitored item and generate a monitoring alarm information, can produce monitoring alarm and dash forward
Hair, operation maintenance personnel failure judgement scope is difficult and causes the possibility of failure with monitoring system overload.
In prior art, periodically to perform, failure occurs into failover procedure monitoring data collection, can be every
Every a time cycle, monitoring alarm information is all sent, for the failure do not repaired across some cycles, can all be weighed during reparation
Monitoring monitoring alarm information is sent in recurrence, influences the troubleshooting work of monitor system performance and operation maintenance personnel.
In order to solve the above problems, the embodiment provides a kind of monitoring alarm method and apparatus, and monitoring is supervised
Control warning information merges transmission, reduces monitoring alarm quantity, improves the precision of alarm.Sending monitoring alarm information
When, transmission order, scope are adjusted according to information, dynamics such as the time of monitoring alarm, state, rank, alarm sending port loads
And time delay, ALM pressure is reduced, makes monitoring alarm information more accurate and effective, is advantageous to operation maintenance personnel and obtains monitoring announcement in time
Alert information simultaneously intervenes processing.
First with reference to accompanying drawing, embodiments of the invention one are illustrated.
The embodiments of the invention provide a kind of monitoring alarm method, and the flow of monitoring system alarm is completed such as using this method
Shown in Fig. 1, including：
Step 101, a plurality of monitoring alarm information with same alike result being collected into is merged, obtain a merging
Monitoring alarm information；
In the embodiment of the present invention, the monitoring alarm information comprises at least any or any multinomial in following parameter：
Alarm equipment, monitored item, monitoring data, alarm conditions, alarm level,
Wherein, the equipment that alarm equipment instruction monitoring alarm information is pointed to, monitored item indicate the monitoring alarm information pin
To monitoring project, the obtained data of monitoring data instruction monitoring, the needs that alarm conditions instruction associates with the monitored item enter
The value of row alarm, alarm level indicate the priority of current monitor warning information, and the alarm equipment and monitored item parameter are table
The parameter of the bright monitoring alarm information attribute；
The monitoring alarm information that merges is including at least any or any multinomial in following parameter：
Alarming node, application/systematic name is alerted, alarm equipment list, monitored item, monitoring data, alarm conditions, is merged
Alarm level, alarm equipment accounting in node, using alarm equipment accounting in/system,
Wherein, the node device that the monitoring alarm information that alarming node instruction merges is pointed to, alarm application/systematic name refer to
Show application/system that the monitoring alarm information of merging is pointed to, in node the instruction of alarm equipment accounting be incorporated into merging monitoring and accuse
The number of devices that monitoring alarm information in alert information is related to accounts for the ratio of armamentarium in the node device, using/system
The number of devices that the monitoring alarm information that interior alarm equipment accounting instruction is incorporated into the merging monitoring alarm information is related to accounts for institute
The ratio of armamentarium in application/system is stated, merges the priority that alarm level instruction merges monitoring alarm information.
Merge the form that the monitoring data in monitoring alarm information can be list, include the monitoring alarm letter being all merged
The monitoring data being related in breath.
Specifically referred to same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information points to same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical.
This step specifically includes：
1st, calculate the number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to and account for node device
The ratio of armamentarium in interior or application/system；
Preferably, threshold value can be set, for determine whether to reach can the condition of convergence, i.e., whether tackle monitoring alarm information and enter
Row merges.
2nd, according to the ratio, it is determined that merging alarm level；
3rd, generation merges monitoring alarm information.
Step 102, generation monitoring alarm information table, the monitoring alarm information table include merge monitoring alarm information and/
Or the monitoring alarm information that can not merge；
In this step, after the merging to annexable monitoring alarm information has been performed, final monitoring alarm letter is generated
Table is ceased, contains merge monitoring alarm information wherein, also contains the monitoring alarm information that can not merge.
Step 103, according to current alarm submit situation, send the monitoring alarm information table, alerted；
This step specifically includes：
1st, query warning task interface accumulation monitoring alarm information list to be sent at present.
2nd, newly-generated monitoring alarm information table is incorporated to the accumulation monitoring alarm information list, generates monitoring to be sent
Warning information list.
3rd, the number of entries in the monitoring alarm information list to be sent determines sending strategy；
First, judge the number of entries in the monitoring alarm information list to be sent whether in monitoring alarm transmission interface
Performance boundary in the range of, number of entries in the monitoring alarm information list to be sent is sent more than the monitoring alarm
During the performance boundary of interface, selected section entry is preferentially sent.
It is below the citing of two kinds of selected section entries：
When the continuous alarm time of an entry is more than six threshold values, judge that often generation N bars same item is only sent once, N
For the positive integer more than or equal to 2；
When the continuous alarm time of an entry is more than seven threshold values, the partial entry for selecting alarm level higher is preferentially sent out
Send.
4th, the monitoring alarm information list to be sent is sent according to the sending strategy.
Below in conjunction with the accompanying drawings, embodiments of the invention two are illustrated.
The embodiments of the invention provide a kind of monitoring alarm device, its structure as shown in Fig. 2 including：
Monitoring alarm information merging module 201, for a plurality of monitoring alarm information with same alike result to being collected into
Merge, obtain a merging monitoring alarm information；
List Generating Module 202, for generating monitoring alarm information table, the monitoring alarm information table is included to merge and monitored
Warning information and/or the monitoring alarm information that can not merge；
Sending module 203 is alerted, for submitting situation according to current alarm, the monitoring alarm information table is sent, carries out
Alarm.
Preferably, it is specially with same alike result：
Monitored item content of parameter is identical；Or,
Monitoring alarm information points to same node device and monitored item content of parameter is identical；Or,
Monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical,
It is described as shown in figure 3, including：
Statistic unit 301, the equipment being related to for calculating a plurality of monitoring alarm information with same alike result being collected into
Quantity account in node device or in application/system armamentarium ratio；
Rank confirmation unit 302, for according to the ratio, it is determined that merging alarm level；
Information generating unit 303, merge monitoring alarm information for generating.
Preferably, it is described alarm sending module 203 structure as shown in figure 4, including：
Accumulation task confirmation unit 401, the accumulation monitoring alarm information to be sent at present for query warning task interface
List；
Information generating unit 402 to be sent, accused for newly-generated monitoring alarm information table to be incorporated into the accumulation monitoring
Alert information list, generates monitoring alarm information list to be sent；
Sending strategy confirmation unit 403, it is true for the number of entries in the monitoring alarm information list to be sent
Determine sending strategy；
Execution unit 404 is sent, for sending the monitoring alarm information list to be sent according to the sending strategy.
Preferably, the sending strategy confirmation unit 403 structure as shown in figure 5, including：
Quantity confirms subelement 501, for whether judging the number of entries in the monitoring alarm information list to be sent
In the range of the performance boundary of monitoring alarm transmission interface；
Subelement 502 is screened, exceedes the prison for the number of entries in the monitoring alarm information list to be sent
During the performance boundary of the alert transmission interface of charge, selected section entry is preferentially sent, specifically：
When the continuous alarm time of an entry is more than six threshold values, judge that often generation N bars same item is only sent once, N
For the positive integer more than or equal to 2,
When the continuous alarm time of an entry is more than seven threshold values, the partial entry for selecting alarm level higher is preferentially sent out
Send.
Below in conjunction with the accompanying drawings, embodiments of the invention three are illustrated.
The embodiments of the invention provide a kind of monitoring alarm method, before monitoring monitoring alarm information is sent, to mutually similar
The monitoring alarm information of type, which merges convergence, reduces quantity, and judges that time of monitoring alarm, state, rank, alarm are sent
The information such as port load, dynamic adjust transmission order, scope and time delay, reach the mesh for reducing unit interval monitoring alarm quantity
, ensure O＆M to effective processing of monitoring and the stability of monitoring system.Idiographic flow is as follows：
1st, monitoring data is obtained, determines whether to reach monitoring alarm threshold value
1) monitoring data is obtained every a time cycle, and stored
2) monitoring data of each monitored item is contrasted with the monitoring alarm threshold value set in advance, if meeting monitoring
Alarm conditions, then monitored item is set to alarm status
3) according to monitoring alarm information model, the monitoring alarm information that monitored item is alarm status is obtained respectively, forms prison
Control monitoring alarm information table.Monitoring alarm information includes " alarm equipment, monitored item, monitoring data, alarm conditions, alarm level "
Etc..
Citing：
- equipment dev1, dev2, dev3 being present, monitored item is DF (disk utilization rate), when alarm conditions are that DF is more than 90
Alarm
- obtain monitoring data dev1：DF=95, dev2：DF=95, dev3：DF=95
- because alarm data meets alarm conditions, then dev1, dev2, dev3 DF are set to alarm status
The monitoring alarm information table of-DF monitored item is：Alarm equipment, monitored item, monitoring data, alarm conditions, alert level
Not
- monitoring monitoring alarm information table be
Dev1DF 95 alerts more than 90 three-levels
Dev2DF 95 alerts more than 90 three-levels
Dev3DF 95 alerts more than 90 three-levels
2nd, monitoring monitoring alarm information table is restrained, is formed and merge monitoring alarm
Three kinds of monitoring alarm information Unite principles with same alike result are illustrated below, three kinds of situations are respectively：
Monitored item content of parameter is identical；
Monitoring alarm information points to same node device and monitored item content of parameter is identical；
Monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical.
1) monitored item content of parameter is identical.
Judge whether the alarm equipment of identical monitored item in monitoring monitoring alarm information table is more than first threshold, if greater than
This monitored item is then judged for monitored item can be restrained, and the monitoring alarm information comprising this monitored item is merged into a monitoring alarm letter
Breath, and preserve.
A. extract respectively in Statistical monitor warning information table comprising the monitoring alarm information bar number for specifying monitored item.
B. judge that this monitored item can be received if the monitoring alarm information bar number comprising specified monitored item is more than first threshold
Hold back.
C. can convergent monitored item be merged into " merge monitoring monitoring alarm information ", remaining can not convergent monitoring alarm
Information directly retains, and ultimately forms merging monitoring monitoring alarm information table；Merging monitoring monitoring alarm information format is：Alarm is set
Standby list, monitored item, monitoring data, alarm conditions, alarm equipment accounting, alarm level.
D. wherein alarm level is obtained by the monitored item-alarm equipment accounting-alarm level mapping relations pre-set
Take, and replace the alarm level of original single monitoring alarm information.
DF is more than 90% Level 1Alarming
Such as：
Dev1, dev2, dev3DF 95,95,95 is more than 90 100% Level 1Alarmings
2) monitoring alarm information points to same node device and monitored item content of parameter is identical.
Judge whether the quantity of the identical monitored item alarm of same node point equipment in monitoring monitoring alarm information table is more than the
Two threshold values, if greater than this monitored item is then judged for monitored item can be restrained, the monitoring alarm information comprising this monitored item is merged
Into a monitoring alarm information, and preserve.
A. query node list of devices, extract respectively in Statistical monitor warning information table comprising the same node for specifying monitored item
Equipment (node up to standard) bar number.
B. if being more than Second Threshold with the monitoring alarm information bar number of node device comprising the sensing of specified monitored item and reaching
Mark node total number is less than the 3rd threshold value, then judges that the monitored item of this node device can restrain (if node up to standard is more than the 3rd threshold
Value, then can only be restrained according to identical monitored item)
C. can convergent node device monitored item be merged into " merge monitoring monitoring alarm information ", remaining can not be convergent
Monitoring alarm information directly retains, and ultimately forms merging monitoring monitoring alarm information table；Merge monitoring monitoring alarm information format
For：Alarm equipment accounting, alert level in alarming node, alarm equipment list, monitored item, monitoring data, alarm conditions, node
Not.
D. wherein alarm level is obtained by the monitored item-alarm equipment accounting-alarm level mapping relations pre-set
Take, and replace the alarm level of original single monitoring alarm information.
DF single nodes are more than 80% Level 1Alarming
DF single nodes alert more than 40% two level
Such as：
Dev1 and dev2 is that same node point equipment node1, node1 share 4 equipment
Node1dev1, dev2DF 95 alerts more than 90 50% two levels
Dev3DF 95 alerts more than 90 three-levels
3) monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical.
Judge whether the identical monitored item alarm of same application/system equipment in monitoring monitoring alarm information table is more than first
Threshold value, if greater than this monitored item is then judged for monitored item can be restrained, the monitoring alarm information comprising this monitored item is merged into
One monitoring alarm information, and preserve.
A. application/system equipment list is inquired about, is extracted respectively in Statistical monitor warning information table comprising specified monitored item
Same application/system equipment bar number.
B. if same application/system equipment article number comprising specified monitored item is more than the 4th threshold value, then this application/be is judged
The monitored item of system can restrain.
C. can convergent application/system equipment monitored item be merged into " merge monitoring monitoring alarm information ", remaining can not
Convergent monitoring alarm information directly retains, and ultimately forms merging monitoring monitoring alarm information table；Merge monitoring monitoring alarm letter
Ceasing form is：Accounted for using alarm equipment in/systematic name, alarm equipment list, monitored item, monitoring data, alarm conditions, node
Than, alarm level
D. wherein alarm level is obtained by the monitored item-alarm equipment accounting-alarm level mapping relations pre-set
Take, and replace the alarm level of original single monitoring alarm information
DF single systems are more than 80% great alarm
DF single systems are more than 40% Level 1Alarming
Such as：
Dev1 and dev2 is same application/system call system equipment, and scheduling system shares 4 equipment
Scheduling system dev1, dev2DF 95 is more than 90 50% Level 1Alarmings
Dev3DF 95 alerts more than 90 three-levels
3rd, judge to merge monitoring monitoring alarm information state, adjustment alarm transmission order, scope and time delay.
1) query history merges monitoring alarm information table, confirms the time that monitoring monitoring alarm information continuously alerts.
Query history merges in monitoring alarm information table, and monitoring alarm information is identical and continuous alert arrives current time
Time interval, be continuous alarm time.
2) the monitoring alarm information transmission task that current mail transmission interface is left is added to be used as with newly-increased transmission task to be treated
Number of tasks is sent, judges whether number of tasks to be sent exceedes the performance boundary of transmission interface.
A. query task interface obtains accumulation number of tasks at present, the corresponding task of each entry in list.
B. query monitor warning information table, newly-increased monitoring alarm information bar number, i.e. the monitoring alarm letter of this generation are obtained
The number of entries included in breath table.
C. number of tasks and the summation of newly-increased monitoring alarm information bar number will be accumulated, forms number of tasks to be sent.
D. judging whether number of tasks to be sent is more than the 5th threshold value, the 5th threshold value is the performance boundary numerical value of transmission interface,
If it is greater, then assert that current monitoring alarm transmission interface will overload.When transmission interface exists and overloads dangerous, it is necessary to formulate
Corresponding sending strategy, mitigate transmission interface pressure, ensure that alarm is normally carried out.
3) determine a need for adjusting transmission delay, scope, order, ensure that transmission interface and monitoring system are stable.
A. judge whether continuous alarm time is more than the 6th threshold value, if it is greater, then alarm is only sent once per n times, N is
Integer more than or equal to 2, such as N values are 5.
B. judge whether continuous alarm time is more than the 7th threshold value, if it is greater, then range of transmission is revised as emergent small
Group personnel.
C. judge that current monitor alarm transmission interface will overload, then according to the descending order of failure rank, choose
The monitoring monitoring alarm information of Rational number is transmitted.If significant trouble alreadys exceed performance boundary, preferential send merges
Monitoring alarm information is monitored, if still exceeded, is sent according to information table sequencing.Ensure in performance range
4) monitoring alarm information table will be merged according to detection time point, file and merge monitoring alarm information table for history.
4th, according to range of transmission, monitoring alarm is sent.
The embodiment provides a kind of monitoring alarm method and apparatus, have the more of same alike result to what is be collected into
Bar monitoring alarm information merges, and obtains a merging monitoring alarm information, generates monitoring alarm information table, is accused according to current
Alert submission situation, sends the monitoring alarm information table, is alerted.Realize the merging hair to a plurality of monitoring alarm information
Send, reduce monitoring alarm information content, solving alarm burst causes system overload and operation maintenance personnel failure judgement difficult
Problem.By merging convergence to the monitoring alarm information with same alike result, reduce by 90% monitoring alarm quantity, improve alarm
Precision.When sending monitoring alarm information, according to the time of monitoring alarm, state, rank, alarm sending port load etc.
Information, dynamic generation sending strategy, adjustment transmission order, scope and time delay, eliminate the overload of 99% monitoring alarm transmission interface
Problem.
Descriptions above can combine implementation individually or in a variety of ways, and these variants all exist
Within protection scope of the present invention.
Finally it should be noted that：The above embodiments are merely illustrative of the technical solutions of the present invention, rather than its limitations.Although
The present invention is described in detail with reference to the foregoing embodiments, it will be understood by those within the art that：It still may be used
To be modified to the technical scheme described in foregoing embodiments, or equivalent substitution is carried out to which part technical characteristic；
And these modification or replace, do not make appropriate technical solution essence depart from various embodiments of the present invention technical scheme spirit and
Scope.
Claims (11)
- A kind of 1. monitoring alarm method, it is characterised in that including：The a plurality of monitoring alarm information with same alike result being collected into is merged, one is obtained and merges monitoring alarm letter Breath；Monitoring alarm information table is generated, the monitoring alarm information table includes what is merged monitoring alarm information and/or can not merge Monitoring alarm information；Situation is submitted according to current alarm, the monitoring alarm information table is sent, is alerted.
- 2. monitoring alarm method according to claim 1, it is characterised in thatThe monitoring alarm information comprises at least any or any multinomial in following parameter：Alarm equipment, monitored item, monitoring data, alarm conditions, alarm level,Wherein, the equipment that alarm equipment instruction monitoring alarm information is pointed to, monitored item indicate what the monitoring alarm information was directed to Monitoring project, the data that monitoring data instruction monitoring obtains, the needs that alarm conditions instruction associates with the monitored item are accused Alert value, alarm level indicate the priority of current monitor warning information, and the alarm equipment is with monitored item parameter to show State the parameter of monitoring alarm information attribute；The monitoring alarm information that merges is including at least any or any multinomial in following parameter：Alarming node, application/systematic name is alerted, alarm equipment list, monitored item, monitoring data, alarm conditions, merges alarm Rank, alarm equipment accounting in node, using alarm equipment accounting in/system,Wherein, the node device that the monitoring alarm information that alarming node instruction merges is pointed to, alarm application/systematic name instruction are closed And application/system for pointing to of monitoring alarm information, in node the instruction of alarm equipment accounting be incorporated into merging monitoring alarm letter The number of devices that monitoring alarm information in breath is related to accounts for the ratio of armamentarium in the node device, using being accused in/system The number of devices that the monitoring alarm information that alert equipment accounting instruction is incorporated into the merging monitoring alarm information is related to accounts for described answer With the ratio of armamentarium in/system, merge the priority that alarm level instruction merges monitoring alarm information.
- 3. monitoring alarm method according to claim 2, it is characterised in that be specially with same alike result：Monitored item content of parameter is identical；Or,Monitoring alarm information points to same node device and monitored item content of parameter is identical；Or,Monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical.
- 4. monitoring alarm method according to claim 3, it is characterised in that there is a plurality of of same alike result to what is be collected into Monitoring alarm information merges, obtain one merge monitoring alarm information the step of include：The number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to is calculated to account in node device or answer With the ratio of armamentarium in/system；According to the ratio, it is determined that merging alarm level；Generation merges monitoring alarm information.
- 5. monitoring alarm method according to any one of claims 1 to 4, it is characterised in that situation is submitted according to current alarm, The step of sending the monitoring alarm information table, being alerted includes：Query warning task interface accumulation monitoring alarm information list to be sent at present；Newly-generated monitoring alarm information table is incorporated to the accumulation monitoring alarm information list, generates monitoring alarm letter to be sent Cease list；Number of entries in the monitoring alarm information list to be sent determines sending strategy；The monitoring alarm information list to be sent is sent according to the sending strategy.
- 6. monitoring alarm method according to claim 5, it is characterised in that arranged according to the monitoring alarm information to be sent The step of number of entries in table determines sending strategy includes：Judge the number of entries in the monitoring alarm information list to be sent whether in the performance pole of monitoring alarm transmission interface In the range of limit；Number of entries in the monitoring alarm information list to be sent exceedes the performance pole of the monitoring alarm transmission interface In limited time, selected section entry is preferentially sent.
- 7. monitoring alarm method according to claim 6, it is characterised in that the step of selected section entry is preferentially sent is wrapped Include：When the continuous alarm time of an entry is more than six threshold values, judge that often generation N bars same item is only sent once, N is big In the positive integer equal to 2；When the continuous alarm time of an entry is more than seven threshold values, the partial entry for selecting alarm level higher is preferentially sent.
- A kind of 8. monitoring alarm device, it is characterised in that including：Monitoring alarm information merging module, for being closed to a plurality of monitoring alarm information with same alike result being collected into And obtain a merging monitoring alarm information；List Generating Module, for generating monitoring alarm information table, the monitoring alarm information table, which includes, merges monitoring alarm letter Breath and/or the monitoring alarm information that can not merge；Sending module is alerted, for submitting situation according to current alarm, the monitoring alarm information table is sent, is alerted.
- 9. monitoring alarm device according to claim 8, it is characterised in that be specially with same alike result：Monitored item content of parameter is identical；Or,Monitoring alarm information points to same node device and monitored item content of parameter is identical；Or,Monitoring alarm information points to same application or the same node device in system and monitored item content of parameter is identical,The monitoring alarm information merging module includes：Statistic unit, section is accounted for for calculating the number of devices that a plurality of monitoring alarm information with same alike result being collected into is related to The ratio of armamentarium in point device or in application/system；Rank confirmation unit, for according to the ratio, it is determined that merging alarm level；Information generating unit, merge monitoring alarm information for generating.
- 10. the monitoring alarm device according to right 8, it is characterised in that the alarm sending module includes：Accumulation task confirmation unit, the accumulation monitoring alarm information list to be sent at present for query warning task interface；Information generating unit to be sent, for newly-generated monitoring alarm information table to be incorporated into the accumulation monitoring alarm information row Table, generate monitoring alarm information list to be sent；Sending strategy confirmation unit, determine to send plan for the number of entries in the monitoring alarm information list to be sent Slightly；Execution unit is sent, for sending the monitoring alarm information list to be sent according to the sending strategy.
- 11. monitoring alarm device according to claim 10, it is characterised in that the sending strategy confirmation unit includes：Whether quantity confirms subelement, for judging the number of entries in the monitoring alarm information list to be sent in monitoring announcement In the range of the performance boundary of alert transmission interface；Subelement is screened, is sent out for the number of entries in the monitoring alarm information list to be sent more than the monitoring alarm When sending the performance boundary of interface, selected section entry is preferentially sent, specifically：When the continuous alarm time of an entry is more than six threshold values, judge that often generation N bars same item is only sent once, N is big In the positive integer equal to 2,When the continuous alarm time of an entry is more than seven threshold values, the partial entry for selecting alarm level higher is preferentially sent.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710642112.0A CN107707380B (en) | 2017-07-31 | 2017-07-31 | A kind of monitoring alarm method and apparatus |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710642112.0A CN107707380B (en) | 2017-07-31 | 2017-07-31 | A kind of monitoring alarm method and apparatus |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107707380A true CN107707380A (en) | 2018-02-16 |
| CN107707380B CN107707380B (en) | 2018-10-23 |
Family
ID=61170118
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710642112.0A Active CN107707380B (en) | 2017-07-31 | 2017-07-31 | A kind of monitoring alarm method and apparatus |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107707380B (en) |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108710334A (en) * | 2018-04-20 | 2018-10-26 | 高新兴科技集团股份有限公司 | A kind of alarm monitoring platform |
| CN109167681A (en) * | 2018-08-07 | 2019-01-08 | 北京云迹科技有限公司 | Method for monitoring state and device |
| CN109191023A (en) * | 2018-11-07 | 2019-01-11 | 广东电网有限责任公司 | A kind of power grid warning information immediate processing method and device |
| CN109194532A (en) * | 2018-11-07 | 2019-01-11 | 广东电网有限责任公司 | A kind of method for pushing and device of power grid warning information |
| CN109686043A (en) * | 2018-12-19 | 2019-04-26 | 广东电网有限责任公司 | A kind of the information association alarm method and device of intelligent power distribution room monitoring system |
| CN110113208A (en) * | 2019-05-08 | 2019-08-09 | 深圳前海微众银行股份有限公司 | Alarm information processing method, device, equipment and computer readable storage medium |
| CN111245779A (en) * | 2019-12-17 | 2020-06-05 | 北京威努特技术有限公司 | Industrial control firewall alarm message merging method and device |
| CN112104480A (en) * | 2020-08-05 | 2020-12-18 | 福建天泉教育科技有限公司 | Method and system for improving alarm quality |
| CN112564951A (en) * | 2020-11-27 | 2021-03-26 | 广东电网有限责任公司广州供电局 | Method, device, computer equipment and storage medium for avoiding alarm storm |
| CN113377559A (en) * | 2020-03-10 | 2021-09-10 | 北京同邦卓益科技有限公司 | Big data based exception handling method, device, equipment and storage medium |
Citations (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101247269A (en) * | 2008-03-05 | 2008-08-20 | 中兴通讯股份有限公司 | Method for automatically discovering association rule for judging redundant alarm |
| CN101582807A (en) * | 2009-07-02 | 2009-11-18 | 北京讯风光通信技术开发有限责任公司 | Method and system based on northbound interface to realize network management |
| CN101931558A (en) * | 2010-09-02 | 2010-12-29 | 罗显平 | Large-area fault intercept system and realization method thereof |
| CN102340422A (en) * | 2011-10-28 | 2012-02-01 | 青岛海信传媒网络技术有限公司 | Alarm processing method and system |
| CN103023695A (en) * | 2012-11-28 | 2013-04-03 | 绍兴电力局 | Master station system monitoring model based on power dispatching automation |
| CN103067884A (en) * | 2011-10-21 | 2013-04-24 | 阿里巴巴集团控股有限公司 | Method and device for alarming information processing |
| CN103618635A (en) * | 2013-12-11 | 2014-03-05 | 广东电网公司汕头供电局 | Classified association management and control system of informationized equipment |
| CN103684880A (en) * | 2013-12-31 | 2014-03-26 | 上海斐讯数据通信技术有限公司 | Alarming control method and alarming device |
| US20150271018A1 (en) * | 2012-09-18 | 2015-09-24 | Amazon Technologies, Inc. | Dynamically allocating network addresses |
| CN105656696A (en) * | 2016-03-21 | 2016-06-08 | 上海天跃科技股份有限公司 | Maintenance system and method |
| CN105763387A (en) * | 2016-05-16 | 2016-07-13 | 北京百度网讯科技有限公司 | Network traffic monitoring method and device |
| CN105991337A (en) * | 2015-03-02 | 2016-10-05 | ***通信集团广东有限公司 | Alarm compression method and alarm compression device |
| CN106713049A (en) * | 2017-02-04 | 2017-05-24 | 杭州迪普科技股份有限公司 | Alarm method and device of monitor |
-
2017
- 2017-07-31 CN CN201710642112.0A patent/CN107707380B/en active Active
Patent Citations (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101247269A (en) * | 2008-03-05 | 2008-08-20 | 中兴通讯股份有限公司 | Method for automatically discovering association rule for judging redundant alarm |
| CN101582807A (en) * | 2009-07-02 | 2009-11-18 | 北京讯风光通信技术开发有限责任公司 | Method and system based on northbound interface to realize network management |
| CN101931558A (en) * | 2010-09-02 | 2010-12-29 | 罗显平 | Large-area fault intercept system and realization method thereof |
| CN103067884A (en) * | 2011-10-21 | 2013-04-24 | 阿里巴巴集团控股有限公司 | Method and device for alarming information processing |
| CN102340422A (en) * | 2011-10-28 | 2012-02-01 | 青岛海信传媒网络技术有限公司 | Alarm processing method and system |
| US20150271018A1 (en) * | 2012-09-18 | 2015-09-24 | Amazon Technologies, Inc. | Dynamically allocating network addresses |
| CN103023695A (en) * | 2012-11-28 | 2013-04-03 | 绍兴电力局 | Master station system monitoring model based on power dispatching automation |
| CN103618635A (en) * | 2013-12-11 | 2014-03-05 | 广东电网公司汕头供电局 | Classified association management and control system of informationized equipment |
| CN103684880A (en) * | 2013-12-31 | 2014-03-26 | 上海斐讯数据通信技术有限公司 | Alarming control method and alarming device |
| CN105991337A (en) * | 2015-03-02 | 2016-10-05 | ***通信集团广东有限公司 | Alarm compression method and alarm compression device |
| CN105656696A (en) * | 2016-03-21 | 2016-06-08 | 上海天跃科技股份有限公司 | Maintenance system and method |
| CN105763387A (en) * | 2016-05-16 | 2016-07-13 | 北京百度网讯科技有限公司 | Network traffic monitoring method and device |
| CN106713049A (en) * | 2017-02-04 | 2017-05-24 | 杭州迪普科技股份有限公司 | Alarm method and device of monitor |
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108710334A (en) * | 2018-04-20 | 2018-10-26 | 高新兴科技集团股份有限公司 | A kind of alarm monitoring platform |
| CN109167681A (en) * | 2018-08-07 | 2019-01-08 | 北京云迹科技有限公司 | Method for monitoring state and device |
| CN109167681B (en) * | 2018-08-07 | 2021-08-17 | 北京云迹科技有限公司 | State monitoring method and device |
| CN109194532A (en) * | 2018-11-07 | 2019-01-11 | 广东电网有限责任公司 | A kind of method for pushing and device of power grid warning information |
| CN109191023A (en) * | 2018-11-07 | 2019-01-11 | 广东电网有限责任公司 | A kind of power grid warning information immediate processing method and device |
| CN109686043A (en) * | 2018-12-19 | 2019-04-26 | 广东电网有限责任公司 | A kind of the information association alarm method and device of intelligent power distribution room monitoring system |
| CN110113208A (en) * | 2019-05-08 | 2019-08-09 | 深圳前海微众银行股份有限公司 | Alarm information processing method, device, equipment and computer readable storage medium |
| CN111245779A (en) * | 2019-12-17 | 2020-06-05 | 北京威努特技术有限公司 | Industrial control firewall alarm message merging method and device |
| CN111245779B (en) * | 2019-12-17 | 2022-05-03 | 北京威努特技术有限公司 | Industrial control firewall alarm message merging method and device |
| CN113377559A (en) * | 2020-03-10 | 2021-09-10 | 北京同邦卓益科技有限公司 | Big data based exception handling method, device, equipment and storage medium |
| CN112104480A (en) * | 2020-08-05 | 2020-12-18 | 福建天泉教育科技有限公司 | Method and system for improving alarm quality |
| CN112564951A (en) * | 2020-11-27 | 2021-03-26 | 广东电网有限责任公司广州供电局 | Method, device, computer equipment and storage medium for avoiding alarm storm |
| CN112564951B (en) * | 2020-11-27 | 2023-01-20 | 广东电网有限责任公司广州供电局 | Method, device, computer equipment and storage medium for avoiding alarm storm |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107707380B (en) | 2018-10-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107707380A (en) | A kind of monitoring alarm method and apparatus | |
| CN103544093B (en) | Monitoring alarm control method and system thereof | |
| CN109039833B (en) | Method and device for monitoring bandwidth state | |
| CN109660380A (en) | Monitoring method, platform, system and the readable storage medium storing program for executing of operation condition of server | |
| JP6647824B2 (en) | Error diagnosis system and error diagnosis method | |
| CN109639504B (en) | Alarm information processing method and device based on cloud platform | |
| CN108295408A (en) | Fire extinguisher monitoring and managing method, system and terminal device | |
| CN107291868A (en) | A kind of monitoring data processing unit and monitoring data processing method | |
| CN105426290A (en) | Intelligent abnormal information processing method and system | |
| JP4502414B2 (en) | Production management information output device and production management information output method | |
| CN106655158A (en) | Smart grid based distribution network self-healing control system and method | |
| CN103227662B (en) | A kind of electric power communication device safety detection method based on mode control and system | |
| CN105871581A (en) | Method and device for processing of alarm information in cloud calculation | |
| CN112286770A (en) | Alarm notification method, device, computer equipment and storage medium | |
| CN106453504A (en) | Monitoring system and method based on NGINX server cluster | |
| CN104468224B (en) | A kind of data center monitoring system fault alarming method of double filtration | |
| CN109005076A (en) | A kind of intelligent substation switch monitoring system and interchanger monitoring method | |
| CN108039971A (en) | A kind of alarm method and device | |
| JP6223594B2 (en) | Remote integrated monitoring and operation system | |
| CN115085371A (en) | Intelligent power distribution network engineering auxiliary management system | |
| CN108171265A (en) | A kind of label preparation method, device and electronic equipment | |
| CN110310009A (en) | A kind of alarm of dispatching of power netwoks operation risk and panorama appraisal procedure | |
| CN108460517A (en) | A kind of power distribution network management-control method and device | |
| CN107612755A (en) | The management method and its device of a kind of cloud resource | |
| CN111381567B (en) | Safety detection system and method for industrial control system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP01 | Change in the name or title of a patent holder | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 100015 5 floor, block E, 201 IT tower, electronic city, 10 Jiuxianqiao Road, Chaoyang District, Beijing. Patentee after: Guizhou Baishan cloud Polytron Technologies Inc Address before: 100015 5 floor, block E, 201 IT tower, electronic city, 10 Jiuxianqiao Road, Chaoyang District, Beijing. Patentee before: Guizhou white cloud Technology Co., Ltd. |