CN117056169A

CN117056169A - Alarm information processing method and device, storage medium and electronic device

Info

Publication number: CN117056169A
Application number: CN202311086163.1A
Authority: CN
Inventors: 肖佚
Original assignee: China Construction Bank Corp
Current assignee: China Construction Bank Corp
Priority date: 2023-08-25
Filing date: 2023-08-25
Publication date: 2023-11-14

Abstract

The application provides a method and a device for processing alarm information, a storage medium and an electronic device, wherein the method comprises the following steps: extracting alarm key information from target alarm information, wherein the target alarm information is generated under the condition that target equipment has a target abnormal event, and the alarm key information comprises equipment information of the target equipment and target event description information of the target abnormal event; determining target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information with corresponding relation and processing operation are recorded in the preset processing operation set, and the processing operation is used for repairing or stopping an abnormal event described by the corresponding event description information; and determining a current processing operation corresponding to the target device according to the device information of the target device and the target processing operation, wherein the current processing operation is used for repairing or stopping the target abnormal event described by the target event description information appearing on the target device.

Description

Alarm information processing method and device, storage medium and electronic device

[ field of technology ]

The present application relates to the field of data processing technologies, and in particular, to a method and an apparatus for processing alarm information, a storage medium, and an electronic device.

[ background Art ]

At present, when the current running network equipment is in an abnormal condition, the network management monitoring platform can send alarm information to related personnel, and the related personnel analyze the alarm information to determine a solution.

However, the mode of manually determining the alarm information requires that the alarm information is manually judged, and a solution is manually given by combining the judgment result, so that the alarm information processing efficiency is low under the condition that misjudgment exists and an incorrect solution is given. Therefore, the processing method of the alarm information in the related technology has the problem of lower processing efficiency.

[ application ]

The application aims to provide a method and a device for processing alarm information, a storage medium and an electronic device, so as to at least solve the problem of low processing efficiency of the alarm information processing method in the related technology.

According to an aspect of an embodiment of the present application, there is provided a method for processing alarm information, including: extracting alarm key information from target alarm information, wherein the target alarm information is generated under the condition that target equipment has a target abnormal event, and the alarm key information comprises equipment information of the target equipment and target event description information of the target abnormal event; determining target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information with corresponding relation and processing operation are recorded in the preset processing operation set, and the processing operation is used for repairing or stopping an abnormal event described by the corresponding event description information; and determining a current processing operation corresponding to the target equipment according to the equipment information of the target equipment and the target processing operation, wherein the current processing operation is used for repairing or stopping the target abnormal event described by the target event description information appearing on the target equipment.

In an exemplary embodiment, the extracting the alarm key information from the target alarm information includes: extracting the device information from the target alarm information, wherein the device information comprises a device name of the target device; and extracting the target event description information from the target alarm information, wherein the target event description information comprises a target keyword group for describing the target abnormal event.

In an exemplary embodiment, the extracting the target event description information from the target alert information includes: extracting the target keyword group from the target alarm information according to the occurrence frequency of each phrase in the target alarm information in the history alarm information set, wherein the occurrence frequency of the target keyword group in the history alarm information set is highest; determining whether each phrase in the target alarm information is the same as or similar to the phrases recorded in the preset abnormal phrase library, and determining the phrases which are the same as or similar to the phrases recorded in the preset abnormal phrase library in the target alarm information as the target key phrases.

In an exemplary embodiment, before the target keyword group is extracted from the target alert information, the method includes: acquiring the number of times of each phrase in the target alarm information in the historical alarm information set, wherein the historical alarm information set comprises alarm information generated by the occurrence of an abnormal event of the target equipment in a first preset time period, and the abnormal event of the target equipment in the first preset time period is the same type of abnormal event or different types of abnormal event; or obtaining the number of times that each phrase in the target alarm information appears in the historical alarm information set, wherein the historical alarm information set comprises alarm information generated by a group of equipment in which abnormal events appear in a second preset time period, the abnormal events of the group of equipment in the second preset time period are the same type of abnormal event or different types of abnormal event, and the group of equipment comprises the target equipment or does not comprise the target equipment.

In an exemplary embodiment, the extracting the alarm key information from the target alarm information includes: extracting the equipment information and initial event description information of the target abnormal event from the target alarm information; correcting the initial event description information according to a historical event description information set under the condition that the initial event description information is missing, so as to obtain target event description information, wherein the historical event description information comprises event description information of each abnormal event in a preset abnormal event set, the preset abnormal event set comprises abnormal events of the target equipment in a first preset duration, the abnormal events of the target equipment in the first preset duration are abnormal events of the same type or different types, or the preset abnormal event set comprises abnormal events of a group of equipment in a second preset duration, the abnormal events of the group of equipment in the second preset duration are abnormal events of the same type or different types, and the group of equipment comprises the target equipment or does not comprise the target equipment; and determining the initial event description information as the target event description information in the case that the initial event description information is not missing.

In an exemplary embodiment, after the extracting the device information and the initial event description information of the target abnormal event from the target alert information, the method further includes: determining whether the grammar of the initial event description information is a grammar in a preset grammar set, and determining that the initial event description information is missing under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, wherein the preset grammar set comprises a group of preset grammars and/or different grammars of the event description information in the historical event description information; or carrying out semantic recognition on the initial event description information to obtain target semantic information; determining whether the target semantic information is a semantic in a preset semantic set; and determining that the initial event description information is missing under the condition that the target semantic information is not the semantic in the preset semantic set, wherein the preset semantic set comprises a group of preset semantics and/or different semantics of the event description information in the historical event description information.

In an exemplary embodiment, the correcting the initial event description information according to the historical event description information set to obtain the target event description information includes: under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, adding a first preset phrase or deleting a part of phrases in the initial event description information to obtain the target event description information, wherein the grammar of the target event description information is the grammar in the preset grammar set, and the first preset phrase is a phrase appearing in the history event description information; or adding a second preset phrase or deleting a part of phrases in the initial event description information under the condition that the target semantic information is not the semantic in the preset semantic set, so as to obtain the target event description information, wherein the semantic of the target event description information is the semantic in the preset semantic set, and the second preset phrase is the phrase appearing in the history event description information.

In an exemplary embodiment, the determining, according to the device information of the target device and the target processing operation, the current processing operation corresponding to the target device includes: and adjusting the target processing operation to the processing operation executed by the target device indicated by the device information, so as to obtain the current processing operation.

In an exemplary embodiment, after the determining the current processing operation corresponding to the target device according to the device information of the target device and the target processing operation, the method further includes: controlling the target equipment to execute the current processing operation so as to repair or terminate the target abnormal event; or controlling the associated equipment to execute the current processing operation on the target equipment so as to repair or terminate the target abnormal event.

According to another aspect of the embodiment of the present application, there is also provided an apparatus for processing alarm information, including: an extracting unit, configured to extract alert key information from target alert information, where the target alert information is alert information generated when a target device has a target abnormal event, and the alert key information includes device information of the target device and target event description information of the target abnormal event; a first determining unit, configured to determine a target processing operation corresponding to the target event description information in a preset processing operation set, where multiple sets of event description information and processing operations with corresponding relationships are recorded in the preset processing operation set, and the processing operations are used to repair or terminate an abnormal event described by the corresponding event description information; and the second determining unit is used for determining a current processing operation corresponding to the target equipment according to the equipment information of the target equipment and the target processing operation, wherein the current processing operation is used for repairing or stopping the target abnormal event described by the target event description information appearing on the target equipment.

According to still another aspect of the embodiments of the present application, there is also provided a computer-readable storage medium having a computer program stored therein, wherein the computer program is configured to execute the above-described alarm information processing method when run.

According to still another aspect of the embodiment of the present application, there is further provided an electronic device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the above-mentioned alarm information processing method through the computer program.

In the embodiment of the application, the method comprises the steps of extracting key information from target alarm information in a mode of determining processing operation corresponding to the alarm information from a preset processing operation set based on the alarm information, wherein the target alarm information is generated when target equipment has a target abnormal event, and comprises equipment information of the target equipment and target event description information of the target abnormal event; determining target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information with corresponding relation and processing operation are recorded in the preset processing operation set, and the processing operation is used for repairing or stopping an abnormal event described by the corresponding event description information; according to the device information and the target processing operation of the target device, determining the current processing operation corresponding to the target device, wherein the current processing operation is used for repairing or stopping a target abnormal event described by the target event description information appearing on the target device.

[ description of the drawings ]

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and together with the description, serve to explain the principles of the application.

In order to more clearly illustrate the embodiments of the application or the technical solutions of the prior art, the drawings which are used in the description of the embodiments or the prior art will be briefly described, and it will be obvious to a person skilled in the art that other drawings can be obtained from these drawings without inventive effort.

FIG. 1 is a schematic diagram of a hardware environment of an alternative alarm information processing method according to an embodiment of the present application;

FIG. 2 is a flow chart of an alternative method of processing alert information according to an embodiment of the present application;

FIG. 3 is a flow chart of another alternative method for processing alert information according to an embodiment of the present application;

FIG. 4 is a schematic diagram of an alternative method of processing alert information according to an embodiment of the present application;

FIG. 5 is a flow chart of yet another alternative method of processing alert information according to an embodiment of the present application;

FIG. 6 is a flow chart of yet another alternative method of processing alert information according to an embodiment of the present application;

FIG. 7 is a block diagram of an alternative alert information processing apparatus according to an embodiment of the present application;

fig. 8 is a block diagram of an alternative electronic device according to an embodiment of the application.

[ detailed description ] of the application

The application will be described in detail hereinafter with reference to the drawings in conjunction with embodiments. It should be noted that, without conflict, the embodiments of the present application and features of the embodiments may be combined with each other.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present application and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order.

According to one aspect of the embodiment of the application, a method for processing alarm information is provided. Alternatively, in the present embodiment, the above-described processing method of the alert information may be applied to a hardware environment constituted by the terminal device 102 and the server 104 as shown in fig. 1. As shown in fig. 1, the server 104 is connected to the terminal device 102 through a network, and may be used to provide services (such as application services and the like) for a terminal or a client installed on the terminal, a database may be set on the server or independent of the server, for providing data storage services for the server 104, and cloud computing and/or edge computing services may be configured on the server or independent of the server, for providing data computing services for the server 104.

The network may include, but is not limited to, at least one of: wired network, wireless network. The wired network may include, but is not limited to, at least one of: a wide area network, a metropolitan area network, a local area network, and the wireless network may include, but is not limited to, at least one of: WIFI, bluetooth. The terminal device 102 may not be limited to a smart device such as a PC, a mobile phone, a tablet computer, etc.

The picture marking method in the embodiment of the present application may be executed by the server 104, or may be executed by the server 104 and the terminal device 102 together. Taking the server 104 as an example to execute the alarm information processing method in this embodiment, fig. 2 is a schematic flow chart of an alternative alarm information processing method according to an embodiment of the present application, and as shown in fig. 2, the flow of the method may include the following steps:

step S202, extracting alarm key information from target alarm information, wherein the target alarm information is generated under the condition that target equipment has a target abnormal event, and the alarm key information comprises equipment information of the target equipment and target event description information of the target abnormal event.

The alarm information processing method in the embodiment can be applied to a scene of processing abnormal network equipment. The network device may be a dedicated hardware device for interconnecting various types of nodes, such as servers, PCs, application terminals, etc., to form an information communication network, including, but not limited to, switches, routers, firewalls, bridges, hubs, etc.

When an operating network device is in an abnormal condition, the network management monitoring platform can send alarm information to related personnel, but the alarm information only plays a role in notification, high-efficiency help cannot be provided for solving the problem, the follow-up processing of the content in the alarm information generally needs to rely on manual judgment, and the corresponding operation is carried out by manually giving a solution, so that the personnel receiving the alarm information is required to have higher professional knowledge, and therefore, the processing mode of the alarm information in the prior art is easy to have misjudgment and the situation of giving an incorrect solution is easy to occur. And the processing efficiency of the alarm information is lower because the solution is determined manually.

In order to solve at least some of the problems, in this embodiment, a preset processing operation set may be written for an abnormal situation that may occur in a network device, when the alarm information is received, key information is extracted from the alarm information, and a solution corresponding to the alarm information is determined from the preset processing operation set based on the key information, so that automatic generation of the solution of the alarm information is achieved, and efficiency and accuracy of alarm information processing are improved.

In this embodiment, for the received target alert information, alert key information may be extracted from the target alert information. Here, the target alarm information may be alarm information generated when the target device has a target abnormal event, may be alarm information issued by the target device, or may be alarm information issued by another device that is linked with the target device. The alert key information may include device information of the target device and target event description information of the target abnormal event.

The target device may be the aforementioned network device. The target event description information may be key information for describing the alarm problem, and may be one or more phrases or one or more phrases.

Step S204, determining a target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information and processing operations with corresponding relations are recorded in the preset processing operation set, and the processing operations are used for repairing or terminating the abnormal event described by the corresponding event description information.

According to the target event description information in the extracted alarm key information, a target processing operation corresponding to the target event description information can be determined in a preset processing operation set. And a plurality of groups of event description information and processing operations with corresponding relations are recorded in the preset processing operation set. The processing operation, i.e. the solution described above, may be used to repair or terminate the abnormal event described by the corresponding event description information.

The method for determining the target processing operation corresponding to the target event description information in the preset processing operation set may be that the target processing operation corresponding to the target event description information is searched in the preset processing operation set.

Step S206, determining a current processing operation corresponding to the target device according to the device information of the target device and the target processing operation, wherein the current processing operation is used for repairing or terminating the target abnormal event described by the target event description information appearing on the target device.

In view of the fact that there is a situation in which the target processing operation does not completely match the target device in which the target abnormal event actually occurs, in this embodiment, the target processing operation may be appropriately modified according to the device information of the target device and the target processing operation to determine the current processing operation corresponding to the target device. The current processing operation may be used to repair or terminate a target exception event described by target event description information present on the target device.

Extracting alarm key information from the target alarm information through the steps S202 to S206, wherein the target alarm information is generated when the target device has a target abnormal event, and the alarm key information includes device information of the target device and target event description information of the target abnormal event; determining target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information with corresponding relation and processing operation are recorded in the preset processing operation set, and the processing operation is used for repairing or stopping an abnormal event described by the corresponding event description information; according to the equipment information and the target processing operation of the target equipment, determining the current processing operation corresponding to the target equipment, wherein the current processing operation is used for repairing or stopping a target abnormal event described by target event description information appearing on the target equipment, the problem that the processing method of the alarm information in the related technology is low in processing efficiency is solved, and the processing efficiency of the alarm information is improved.

In one exemplary embodiment, extracting alert key information from target alert information includes:

s11, extracting equipment information from the target alarm information, wherein the equipment information comprises the equipment name of the target equipment;

s12, extracting target event description information from the target alarm information, wherein the target event description information comprises a target keyword group for describing a target abnormal event.

In order to improve efficiency of a target processing operation of generating alarm information, in this embodiment, the alarm key information extracted from the target alarm information may include a device name and a target key phrase of the target device, that is, when the alarm key information is extracted from the target alarm information, the device information and the target event description information may be extracted from the target alarm information. Correspondingly, the device information may include a device name of the target device, and the target event description information may include a target keyword group for describing the target abnormal event.

Alternatively, the device type of the target device may be determined from the device list according to the extracted device name of the target device. The device list may be used to record type information for a group of devices including the target device, and may be a locally maintained list. In the case where the target device is the aforementioned network device, the device type of the target device may be one of the device types belonging to the network device, such as a switch, a router, a firewall, load balancing, and the like. Correspondingly, the device inventory may record the specific device type and model of each network device in each machine room.

Optionally, determining the target processing operation corresponding to the target event description information in the preset processing operation set may refer to determining, according to the device type, a set of preset processing schemes corresponding to the device type from the preset processing operation set, and then selecting a target processing operation corresponding to the target keyword group from the set of preset processing schemes.

Taking the processing operation as a solution, taking the target keyword group as a keyword of a specific problem in the alarm information as an example, a technical database for solving various alarm information problems can be stored locally, and the technical database can be respectively recorded with a solution template for processing common alarm information of type equipment according to equipment types. According to the type of the equipment, a catalog of solutions for processing the alarm information corresponding to the equipment of the type can be found in the technical database, and then according to the keywords of specific problems in the alarm information, a solution template of the alarm information corresponding to the keyword is found in the catalog of the solutions. The directory of alarm information handling solutions of the switch, i.e. the switch solution directory, the directory of alarm information handling solutions of the router, i.e. the router solution directory, the directory of alarm information handling solutions of the firewall, i.e. the firewall solution directory, the directory of load balanced alarm information handling solutions, i.e. the load balanced solution directory.

The generation of the solution may be as shown in fig. 3, fig. 3 comprising the steps of:

step S302, the identification of the alarm information content.

Step S304, according to the device name of the network device related to the alarm information, the device type is identified according to the device list of the local area.

Step S306, according to the identified equipment type, a catalog of solutions for processing the alarm information corresponding to the equipment of the type is found, and then a corresponding solution template is found in the catalog of solutions through keywords of specific problems in the alarm information.

Step S308, combining the solution template and the identified alarm information content to determine the solution of the alarm information.

By the embodiment, the device name and the keyword group are extracted from the received alarm information, so that the efficiency of determining the preset processing operation according to the alarm information can be improved, and the processing efficiency of the alarm information is improved.

In one exemplary embodiment, extracting the target event description information from the target alert information includes:

s21, extracting target key phrases from the target alarm information according to the occurrence times of each phrase in the target alarm information in the historical alarm information set, wherein the occurrence times of the target key phrases in the historical alarm information set are highest; or alternatively

S22, determining whether each phrase in the target alarm information is the same as or similar to the phrases recorded in the preset abnormal phrase library, and determining the phrases in the target alarm information which are the same as or similar to the phrases recorded in the preset abnormal phrase library as target key phrases.

When the target keyword group is extracted from the target alarm information, according to the frequency of each word group in the target alarm information in the history alarm information set, the word group with the highest frequency in the history alarm information set is selected as the target keyword group so as to extract the target keyword group in the target alarm information.

Considering that under the condition that the number of the historical alarm information is small, the target keyword group is extracted from the target alarm information according to the occurrence frequency of each phrase in the target alarm information in the historical alarm information set, and the keyword group may not be extracted, in this embodiment, an abnormal phrase library may be preset, as shown in fig. 4, by determining whether each phrase in the target alarm information is the same as or similar to the phrase recorded in the preset abnormal phrase library, the phrase which is the same as or similar to the phrase recorded in the preset abnormal phrase library in the target alarm information may be determined as the target keyword group.

Taking the target device as a network device as an example, the target keyword group extracted from the alarm information may be high utilization burst of a CPU (Central Processing Unit ), high burst of port outflow traffic occupying bandwidth percentage, high burst of average response delay of RPing (Remote Ping), and the like.

By the embodiment, the keyword group in the current alarm information is determined according to the historical alarm information set or the preset abnormal group library, so that the efficiency of determining the keyword group can be improved, and the efficiency of determining the processing operation corresponding to the alarm information is improved.

In an exemplary embodiment, before extracting the target keyword group from the target alert information, the method includes:

s31, obtaining the occurrence times of each phrase in the target alarm information in a historical alarm information set, wherein the historical alarm information set comprises alarm information generated by the occurrence of an abnormal event of the target equipment in a first preset time length, and the abnormal event of the target equipment in the first preset time length is the same type of abnormal event or different types of abnormal event; or alternatively

S32, the number of times that each phrase in the target alarm information appears in a historical alarm information set is obtained, wherein the historical alarm information set comprises alarm information generated by an abnormal event of a group of equipment in a second preset time period, the abnormal event of the group of equipment in the second preset time period is the same type of abnormal event or different types of abnormal event, and the group of equipment comprises or does not comprise the target equipment.

When the target keywords in the target alarm information are extracted according to the occurrence times of each phrase in the target alarm information in the historical alarm information set, the alarm information generated by the abnormal event of the target equipment in the first preset duration can be selected as the historical alarm information set, so that the occurrence times of each phrase in the target alarm information in the historical alarm information set are obtained. The abnormal events of the target device in the first preset duration may be the same type of abnormal event or different types of abnormal event.

In this embodiment, the alert information generated by the occurrence of the abnormal event in the second preset duration may also be selected as the historical alert information set, where a group of devices may have multiple devices, and the multiple devices may include devices of the same type as the target device or may include devices of different types from the target device. A group of devices may or may not include a target device. The abnormal events of the group of devices in the second preset time period can be the same type of abnormal events or different types of abnormal events.

By the embodiment, the key phrase of the target alarm information is determined by selecting the historical alarm information of the target equipment corresponding to the target alarm information, so that the accuracy of the determined key phrase can be improved, and the efficiency of determining the key phrase can be improved by selecting the historical alarm information of a group of equipment to determine the key phrase of the target alarm information.

s41, extracting equipment information and initial event description information of a target abnormal event from target alarm information;

s42, under the condition that the initial event description information is missing, correcting the initial event description information according to a historical event description information set to obtain target event description information, wherein the historical event description information comprises event description information of each abnormal event in a preset abnormal event set, the preset abnormal event set comprises abnormal events of target equipment in a first preset duration, the abnormal events of the target equipment in the first preset duration are the same type of abnormal events or different types of abnormal events, or the preset abnormal event set comprises a group of abnormal events of equipment in a second preset duration, the abnormal events of the group of equipment in the second preset duration are the same type of abnormal events or different types of abnormal events, and the group of equipment comprises or does not comprise the target equipment;

s43, determining the initial event description information as target event description information in the case that the initial event description information is not missing.

In order to avoid the occurrence of a situation in which the target processing operation cannot be determined or an erroneous target processing operation is determined due to the absence of the initial event description information, in this embodiment, after the device information and the initial event description information of the target abnormal event are extracted from the target alarm information, it may be determined whether the extracted initial event description information is absent.

Under the condition that the initial event description information is missing, the initial event description information can be corrected according to the historical event description information set to obtain target event description information. The historical event description information herein may include event description information of each of the preset abnormal events in the set of abnormal events.

Similar to the set of historical alert information in the foregoing embodiment, the set of preset abnormal events may include abnormal events that occur in the target device within the first preset time period. The abnormal events occurring in the target device within the first preset time period may be the same type of abnormal event or different types of abnormal events. The preset abnormal event set may also include abnormal events that occur in a group of devices within a second preset time period. The abnormal events occurring in the group of devices within the second preset time period may be the same type of abnormal event or different types of abnormal events. A group of devices may or may not include a target device.

In the case that it is determined that there is no loss of the initial event description information, the initial event description information may be directly determined as the target event description information to perform the determination of the processing operation.

By the embodiment, whether the information extracted from the alarm information is missing or not is judged and corrected correspondingly, and the processing operation which cannot be acquired or is acquired due to the missing information can be avoided, so that the accuracy of determining the processing operation is improved.

In one exemplary embodiment, after extracting the device information and the initial event description information of the target abnormal event from the target alert information, the method further includes:

s51, determining whether the grammar of the initial event description information is a grammar in a preset grammar set, and determining that the initial event description information is missing under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, wherein the preset grammar set comprises a group of preset grammars and/or different grammars of the event description information in the history event description information; or alternatively

S52, carrying out semantic recognition on the initial event description information to obtain target semantic information; determining whether the target semantic information is a semantic in a preset semantic set; determining that the initial event description information is missing under the condition that the target semantic information is not the semantic in the preset semantic set, wherein the preset semantic set comprises a group of preset semantics and/or different semantics of the event description information in the historical event description information.

When judging whether the extracted initial event description information is missing, determining whether the initial event description information is missing according to grammar or semantics of the initial event description information. When determining whether there is a loss according to the syntax of the initial event description information, it is possible to determine whether there is a loss of the initial event description information by determining whether the syntax of the initial event description information is a syntax in a preset syntax set. The set of preset grammars may include a set of preset grammars and/or different grammars for event description information in the historical event description information.

In the case where the syntax of the initial event description information is not the syntax in the preset syntax set, it may be determined that there is a loss of the initial event description information.

When determining whether the initial event description information is missing according to the semantics of the initial event description information, the initial event description information can be subjected to semantic recognition to obtain target semantic information, and whether the target semantic information is the semantics in a preset semantic set is determined. In the case where the target semantic information is not the semantics in the preset semantic set, it may be determined that there is a miss in the initial event description information. Here, the preset semantic set may include a set of preset semantics and/or different semantics of the event description information in the history event description information.

Optionally, the correcting the initial event description information according to the historical event description information set to obtain the target event description information may be implemented in the following manner:

under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, adding a first preset phrase or deleting part of phrases in the initial event description information to obtain target event description information, wherein the grammar of the target event description information is the grammar in the preset grammar set, and the first preset phrase is the phrase appearing in the history event description information; or alternatively

Under the condition that the target semantic information is not the semantic in the preset semantic set, adding a second preset phrase or deleting part of phrases in the initial event description information to obtain target event description information, wherein the semantic of the target event description information is the semantic in the preset semantic set, and the second preset phrase is a phrase appearing in the historical event description information.

The first preset phrase and the second preset phrase may be the same phrase or different phrases, which is not limited in this embodiment.

According to the embodiment, whether the initial event description information is missing is determined according to grammar or semantics of the initial event description information, so that accuracy in judging whether the initial event description information needs to be corrected can be improved, and processing operation errors which are caused by information missing and cannot be obtained or obtained are avoided.

In one exemplary embodiment, determining a current processing operation corresponding to a target device based on device information of the target device and the target processing operation includes:

s61, the target processing operation is adjusted to the processing operation performed on the target device indicated by the device information, resulting in the current processing operation.

In consideration of the fact that there may be a certain difference between the target processing operation and the abnormal event actually occurring in the target device, in this embodiment, after determining the target processing operation corresponding to the target event description information from the preset processing operation set, the target processing operation may be adjusted to the processing operation performed for the target device indicated by the device information to obtain the current processing operation.

Taking the target processing operation as a solution template for example, the determined solution template of the alarm information can be combined with the identified alarm information content to generate the solution of the alarm information, that is, the solution of the alarm information is generated by extracting the content of the alarm information and combining the empty items in the template.

According to the method and the device for processing the target equipment, the target processing operation is adjusted to the processing operation executed by the target equipment indicated by the equipment information, so that the determined current processing operation can better help to solve the abnormal event of the target equipment.

In an exemplary embodiment, after determining the current processing operation corresponding to the target device according to the device information of the target device and the target processing operation, the method further includes:

s71, controlling the target equipment to execute the current processing operation so as to repair or terminate the target abnormal event; or alternatively

S72, controlling the associated device to execute the current processing operation on the target device so as to repair or terminate the target abnormal event.

For the determined current processing operation, the target device may be controlled to execute the current processing operation to repair or terminate the target abnormal event, and in the case that the target device cannot execute the current processing operation or does not have the capability of executing the current processing operation, the associated device may be controlled to execute the current processing operation on the target device to repair or terminate the target abnormal event. The association device herein may be a device associated with the target device.

In consideration of the fact that the current processing operation cannot be performed by the device, when the alarm key information is extracted from the alarm information, a network system to which the target device belongs can be identified, the network system can comprise a campus network, the internet, a network area, an offshore network and the like, and the position information of the target device with the abnormal event is determined in a locally stored device drop table according to the name of the identified target device.

The extraction of the alarm information may be as shown in fig. 5, and fig. 5 includes the following steps:

step S502, equipment alarms.

In step S504, the device involved in the alarm and the corresponding device type are identified.

Step S506, positioning the system where the alarm device is located.

Step S508, locating the alarm problem.

Step S510, identify the keyword group in the alarm problem.

The location information may be a specific cabinet location of a specific machine room in which the target device is located. The equipment locating table can comprise the specific position of each equipment in each machine room. After determining the current processing operation of the target device, the current processing operation and the location information of the target device may be sent to an object responsible for managing the network system to which the target device belongs, so that the object may process the abnormal event of the target device. The object here may be an associated staff member.

By controlling the target device or the associated device to execute the current processing operation in the embodiment, the solution efficiency of the abnormal situation of the target device can be improved.

The following explains the processing method of the alarm information in the embodiment of the present application with reference to an alternative example. In this alternative example, the processing operation is a solution.

The optional example provides an automatic generation method of an alarm information solution, and by establishing an event library of the solution, a corresponding solution template in the event library is found according to the content of the alarm information, so that the corresponding solution can be automatically generated for different alarm information, the working efficiency is improved, and meanwhile, the human resources and the risks caused by human errors are reduced.

The flow of the alarm information processing method in this alternative example may include the following steps:

step S602, identify key content from the alert information.

And identifying a keyword group comprising a network system to which the alarm equipment belongs, the name of the alarm equipment and a specific problem in the alarm information from the alarm information.

Step S604, searching a solution template in an event library according to the recognized name and key word group of the alarm device.

Step S606, combining the found solution template of the alarm information with the alarm information content to generate a solution of the alarm information.

By the aid of the method and the device, errors and risks possibly caused by manual operation can be avoided, and processing efficiency of alarm information is improved.

It should be noted that, for simplicity of description, the foregoing method embodiments are all described as a series of acts, but it should be understood by those skilled in the art that the present application is not limited by the order of acts described, as some steps may be performed in other orders or concurrently in accordance with the present application. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily required for the present application.

From the description of the above embodiments, it will be clear to a person skilled in the art that the method according to the above embodiments may be implemented by means of software plus the necessary general hardware platform, but of course also by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM (Read-Only Memory)/RAM (Random Access Memory), magnetic disk, optical disk), comprising instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method of the embodiments of the present application.

According to another aspect of the embodiment of the present application, there is also provided an alarm information processing apparatus for implementing the above alarm information processing method. Fig. 7 is a block diagram of an alternative alarm information processing apparatus according to an embodiment of the present application, and as shown in fig. 7, the apparatus may include:

an extracting unit 702, configured to extract alert key information from target alert information, where the target alert information is alert information generated when a target abnormal event occurs in a target device, and the alert key information includes device information of the target device and target event description information of the target abnormal event;

A first determining unit 704, coupled to the extracting unit 702, configured to determine a target processing operation corresponding to the target event description information in a preset processing operation set, where multiple sets of event description information and processing operations with corresponding relationships are recorded in the preset processing operation set, and the processing operations are used to repair or terminate an abnormal event described by the corresponding event description information;

the second determining unit 706 is connected to the first determining unit 704, and is configured to determine, according to the device information of the target device and the target processing operation, a current processing operation corresponding to the target device, where the current processing operation is used to repair or terminate the target abnormal event described by the target event description information appearing on the target device.

It should be noted that, the extracting unit 702 in this embodiment may be used to perform the above-mentioned step S202, the first determining unit 704 in this embodiment may be used to perform the above-mentioned step S204, and the second determining unit 706 in this embodiment may be used to perform the above-mentioned step S206.

Through the module, the alarm key information is extracted from the target alarm information, wherein the target alarm information is generated under the condition that the target equipment has a target abnormal event, and comprises equipment information of the target equipment and target event description information of the target abnormal event; determining target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information with corresponding relation and processing operation are recorded in the preset processing operation set, and the processing operation is used for repairing or stopping an abnormal event described by the corresponding event description information; according to the equipment information and the target processing operation of the target equipment, determining the current processing operation corresponding to the target equipment, wherein the current processing operation is used for repairing or stopping a target abnormal event described by target event description information appearing on the target equipment, the problem that the processing method of the alarm information in the related technology is low in processing efficiency is solved, and the processing efficiency of the alarm information is improved.

In one exemplary embodiment, the extraction unit includes:

a first extraction module, configured to extract device information from the target alarm information, where the device information includes a device name of the target device;

and the second extraction module is used for extracting target event description information from the target alarm information, wherein the target event description information comprises a target keyword group for describing a target abnormal event.

In one exemplary embodiment, the second extraction module includes:

the extraction sub-module is used for extracting target key phrases from the target alarm information according to the occurrence times of each phrase in the target alarm information in the historical alarm information set, wherein the occurrence times of the target key phrases in the historical alarm information set are highest;

and the determining sub-module is used for determining whether each phrase in the target alarm information is the same as or similar to the phrase recorded in the preset abnormal phrase library, and determining the phrase which is the same as or similar to the phrase recorded in the preset abnormal phrase library in the target alarm information as a target key phrase.

In one exemplary embodiment, the apparatus includes:

the first acquisition unit is used for acquiring the occurrence times of each phrase in the target alarm information in the history alarm information set before extracting the target key phrase from the target alarm information, wherein the history alarm information set comprises alarm information generated by the occurrence of an abnormal event of the target equipment in a first preset time length, and the abnormal event of the target equipment in the first preset time length is the same type of abnormal event or different types of abnormal event; or alternatively

The second obtaining unit is configured to obtain the number of times that each phrase in the target alarm information appears in the historical alarm information set, where the historical alarm information set includes alarm information generated by a group of devices having an abnormal event in a second preset duration, and the abnormal event that a group of devices has an abnormal event of the same type or different types in the second preset duration, and a group of devices includes or does not include the target device.

In one exemplary embodiment, the extraction unit includes:

the third extraction module is used for extracting equipment information and initial event description information of the target abnormal event from the target alarm information;

the correction module is used for correcting the initial event description information according to the historical event description information set to obtain target event description information under the condition that the initial event description information is missing, wherein the historical event description information comprises event description information of each abnormal event in the preset abnormal event set, the preset abnormal event set comprises abnormal events of the target equipment in a first preset duration, the abnormal events of the target equipment in the first preset duration are the same type of abnormal events or different types of abnormal events, or the preset abnormal event set comprises a group of abnormal events of the equipment in a second preset duration, and the abnormal events of the group of equipment in the second preset duration are the same type of abnormal events or different types of abnormal events, and the group of equipment comprises or does not comprise the target equipment;

And the determining module is used for determining the initial event description information as target event description information in the case that the initial event description information is not missing.

In an exemplary embodiment, the above apparatus further includes:

the first execution unit is used for determining whether the grammar of the initial event description information is the grammar in a preset grammar set after extracting the equipment information and the initial event description information of the target abnormal event from the target alarm information, and determining that the initial event description information is missing under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, wherein the preset grammar set comprises a group of preset grammars and/or different grammars of the event description information in the history event description information; or alternatively

The second execution unit is used for carrying out semantic recognition on the initial event description information to obtain target semantic information; determining whether the target semantic information is a semantic in a preset semantic set; determining that the initial event description information is missing under the condition that the target semantic information is not the semantic in the preset semantic set, wherein the preset semantic set comprises a group of preset semantics and/or different semantics of the event description information in the historical event description information.

In one exemplary embodiment, the correction module includes:

the first adding sub-module is used for adding a first preset phrase or deleting part of phrases in the initial event description information to obtain target event description information under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, wherein the grammar of the target event description information is the grammar in the preset grammar set, and the first preset phrase is the phrase appearing in the history event description information; or alternatively

And the second adding sub-module is used for adding a second preset phrase or deleting part of phrases in the initial event description information under the condition that the target semantic information is not the semantics in the preset semantic set to obtain the target event description information, wherein the semantics of the target event description information are the semantics in the preset semantic set, and the second preset phrase is the phrase appearing in the history event description information.

In one exemplary embodiment, the second determining unit includes:

and the adjusting module is used for adjusting the target processing operation to the processing operation executed by the target equipment indicated by the equipment information to obtain the current processing operation.

In an exemplary embodiment, after determining the current processing operation corresponding to the target device according to the device information of the target device and the target processing operation, the apparatus further includes:

The first control unit is used for controlling the target equipment to execute the current processing operation so as to repair or terminate the target abnormal event; or alternatively

And the second control unit is used for controlling the associated equipment to execute the current processing operation on the target equipment so as to repair or terminate the target abnormal event.

It should be noted that the above modules are the same as examples and application scenarios implemented by the corresponding steps, but are not limited to what is disclosed in the above embodiments. It should be noted that the above modules may be implemented in software or in hardware as part of the apparatus shown in fig. 1, where the hardware environment includes a network environment.

According to yet another aspect of an embodiment of the present application, there is also provided a storage medium. Alternatively, in this embodiment, the storage medium may be used to execute the program code of the processing method of any of the alarm information described above in the embodiment of the present application.

Alternatively, in this embodiment, the storage medium may be located on at least one network device of the plurality of network devices in the network shown in the above embodiment.

Alternatively, in the present embodiment, the storage medium is configured to store program code for performing the steps of:

S1, extracting alarm key information from target alarm information, wherein the target alarm information is generated under the condition that target equipment has a target abnormal event, and comprises equipment information of the target equipment and target event description information of the target abnormal event;

s2, determining target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information with corresponding relation and processing operation are recorded in the preset processing operation set, and the processing operation is used for repairing or stopping abnormal events described by the corresponding event description information;

s3, determining a current processing operation corresponding to the target device according to the device information of the target device and the target processing operation, wherein the current processing operation is used for repairing or stopping the target abnormal event described by the target event description information appearing on the target device.

Alternatively, specific examples in the present embodiment may refer to examples described in the above embodiments, which are not described in detail in the present embodiment.

Alternatively, in the present embodiment, the storage medium may include, but is not limited to: various media capable of storing program codes, such as a U disk, ROM, RAM, a mobile hard disk, a magnetic disk or an optical disk.

According to still another aspect of the embodiments of the present application, there is also provided an electronic device for implementing the above-mentioned method for processing alert information, where the electronic device may be a server, a terminal, or a combination thereof.

Fig. 8 is a block diagram of an alternative electronic device, according to an embodiment of the present application, as shown in fig. 8, including a processor 802, a communication interface 804, a memory 806, and a communication bus 808, wherein the processor 802, the communication interface 804, and the memory 806 communicate with each other via the communication bus 808, wherein,

a memory 806 for storing a computer program;

the processor 802, when executing the computer program stored on the memory 806, performs the following steps:

Alternatively, in the present embodiment, the communication bus may be a PCI (Peripheral Component Interconnect, peripheral component interconnect standard) bus, or an EISA (Extended Industry Standard Architecture ) bus, or the like. The communication bus may be classified as an address bus, a data bus, a control bus, or the like. For ease of illustration, only one thick line is shown in fig. 8, but not only one bus or one type of bus. The communication interface is used for communication between the electronic device and other equipment.

The memory may include RAM or nonvolatile memory (non-volatile memory), such as at least one disk memory. Optionally, the memory may also be at least one memory device located remotely from the aforementioned processor.

As an example, the above memory 806 may be provided with, but not limited to, the extraction unit 702, the first determination unit 704, and the second determination unit 706 in the control apparatus including the above device. In addition, other module units in the control device of the above apparatus may be included, but are not limited to, and are not described in detail in this example.

The processor may be a general purpose processor and may include, but is not limited to: CPU (Central Processing Unit ), NP (Network Processor, network processor), etc.; but also DSP (Digital Signal Processing, digital signal processor), ASIC (Application Specific Integrated Circuit ), FPGA (Field-Programmable Gate Array, field programmable gate array) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components.

Alternatively, specific examples in this embodiment may refer to examples described in the foregoing embodiments, and this embodiment is not described herein.

It will be understood by those skilled in the art that the structure shown in fig. 8 is only schematic, and the device implementing the above-mentioned method for processing alarm information may be a terminal device, and the terminal device may be a smart phone (such as an Android mobile phone, an iOS mobile phone, etc.), a tablet computer, a palmtop computer, a mobile internet device (Mobile Internet Devices, MID), a PAD, etc. Fig. 8 is not limited to the structure of the electronic device. For example, the electronic device may also include more or fewer components (e.g., network interfaces, display devices, etc.) than shown in FIG. 8, or have a different configuration than shown in FIG. 8.

Those of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be implemented by a program for instructing a terminal device to execute in association with hardware, the program may be stored in a computer readable storage medium, and the storage medium may include: flash disk, ROM, RAM, magnetic or optical disk, etc.

The foregoing embodiment numbers of the present application are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

The integrated units in the above embodiments may be stored in the above-described computer-readable storage medium if implemented in the form of software functional units and sold or used as separate products. Based on such understanding, the technical solution of the present application may be embodied in essence or a part contributing to the prior art or all or part of the technical solution in the form of a software product stored in a storage medium, comprising several instructions for causing one or more computer devices (which may be personal computers, servers or network devices, etc.) to perform all or part of the steps of the method described in the embodiments of the present application.

In the foregoing embodiments of the present application, the descriptions of the embodiments are emphasized, and for a portion of this disclosure that is not described in detail in this embodiment, reference is made to the related descriptions of other embodiments.

In several embodiments provided by the present application, it should be understood that the disclosed client may be implemented in other manners. The above-described embodiments of the apparatus are merely exemplary, and the division of the units, such as the division of the units, is merely a logical function division, and may be implemented in another manner, for example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some interfaces, units or modules, or may be in electrical or other forms.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution provided in the present embodiment.

In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The foregoing is merely a preferred embodiment of the present application and it should be noted that modifications and adaptations to those skilled in the art may be made without departing from the principles of the present application, which are intended to be comprehended within the scope of the present application.

Claims

1. The method for processing the alarm information is characterized by comprising the following steps:

extracting alarm key information from target alarm information, wherein the target alarm information is generated under the condition that target equipment has a target abnormal event, and the alarm key information comprises equipment information of the target equipment and target event description information of the target abnormal event;

determining target processing operation corresponding to the target event description information in a preset processing operation set, wherein a plurality of groups of event description information with corresponding relation and processing operation are recorded in the preset processing operation set, and the processing operation is used for repairing or stopping an abnormal event described by the corresponding event description information;

and determining a current processing operation corresponding to the target equipment according to the equipment information of the target equipment and the target processing operation, wherein the current processing operation is used for repairing or stopping the target abnormal event described by the target event description information appearing on the target equipment.

2. The method of claim 1, wherein the extracting alert key information from the target alert information comprises:

extracting the device information from the target alarm information, wherein the device information comprises a device name of the target device;

and extracting the target event description information from the target alarm information, wherein the target event description information comprises a target keyword group for describing the target abnormal event.

3. The method of claim 2, wherein the extracting the target event description information from the target alert information comprises:

extracting the target keyword group from the target alarm information according to the occurrence frequency of each phrase in the target alarm information in the history alarm information set, wherein the occurrence frequency of the target keyword group in the history alarm information set is highest; or alternatively

Determining whether each phrase in the target alarm information is the same as or similar to the phrases recorded in the preset abnormal phrase library, and determining the phrases which are the same as or similar to the phrases recorded in the preset abnormal phrase library in the target alarm information as the target key phrases.

4. A method according to claim 3, wherein before extracting the target keyword group from the target alert information, the method comprises:

acquiring the number of times of each phrase in the target alarm information in the historical alarm information set, wherein the historical alarm information set comprises alarm information generated by the occurrence of an abnormal event of the target equipment in a first preset time period, and the abnormal event of the target equipment in the first preset time period is the same type of abnormal event or different types of abnormal event; or alternatively

The number of times that each phrase in the target alarm information appears in the historical alarm information set is obtained, wherein the historical alarm information set comprises alarm information generated by an abnormal event of a group of equipment in a second preset time period, the abnormal event of the group of equipment in the second preset time period is the same type of abnormal event or different types of abnormal event, and the group of equipment comprises the target equipment or does not comprise the target equipment.

5. The method of claim 1, wherein the extracting alert key information from the target alert information comprises:

Extracting the equipment information and initial event description information of the target abnormal event from the target alarm information;

correcting the initial event description information according to a historical event description information set under the condition that the initial event description information is missing, so as to obtain target event description information, wherein the historical event description information comprises event description information of each abnormal event in a preset abnormal event set, the preset abnormal event set comprises abnormal events of the target equipment in a first preset duration, the abnormal events of the target equipment in the first preset duration are abnormal events of the same type or different types, or the preset abnormal event set comprises abnormal events of a group of equipment in a second preset duration, the abnormal events of the group of equipment in the second preset duration are abnormal events of the same type or different types, and the group of equipment comprises the target equipment or does not comprise the target equipment;

and determining the initial event description information as the target event description information in the case that the initial event description information is not missing.

6. The method of claim 5, wherein after the extracting the device information and the initial event description information of the target abnormal event from the target alert information, the method further comprises:

determining whether the grammar of the initial event description information is a grammar in a preset grammar set, and determining that the initial event description information is missing under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, wherein the preset grammar set comprises a group of preset grammars and/or different grammars of the event description information in the historical event description information; or alternatively

Carrying out semantic recognition on the initial event description information to obtain target semantic information; determining whether the target semantic information is a semantic in a preset semantic set; and determining that the initial event description information is missing under the condition that the target semantic information is not the semantic in the preset semantic set, wherein the preset semantic set comprises a group of preset semantics and/or different semantics of the event description information in the historical event description information.

7. The method of claim 6, wherein modifying the initial event description information based on the set of historical event description information to obtain the target event description information comprises:

under the condition that the grammar of the initial event description information is not the grammar in the preset grammar set, adding a first preset phrase or deleting a part of phrases in the initial event description information to obtain the target event description information, wherein the grammar of the target event description information is the grammar in the preset grammar set, and the first preset phrase is a phrase appearing in the history event description information; or alternatively

And adding a second preset phrase or deleting part of phrases in the initial event description information under the condition that the target semantic information is not the semantic in the preset semantic set, so as to obtain the target event description information, wherein the semantic of the target event description information is the semantic in the preset semantic set, and the second preset phrase is the phrase appearing in the historical event description information.

8. The method according to any one of claims 1 to 7, wherein the determining a current processing operation corresponding to the target device according to the device information of the target device and the target processing operation comprises:

And adjusting the target processing operation to the processing operation executed by the target device indicated by the device information, so as to obtain the current processing operation.

9. The method according to any one of claims 1 to 7, wherein after the determining of the current processing operation corresponding to the target device from the device information of the target device and the target processing operation, the method further comprises:

controlling the target equipment to execute the current processing operation so as to repair or terminate the target abnormal event; or alternatively

And controlling an associated device to execute the current processing operation on the target device so as to repair or terminate the target abnormal event.

10. An apparatus for processing alarm information, comprising:

an extracting unit, configured to extract alert key information from target alert information, where the target alert information is alert information generated when a target device has a target abnormal event, and the alert key information includes device information of the target device and target event description information of the target abnormal event;

a first determining unit, configured to determine a target processing operation corresponding to the target event description information in a preset processing operation set, where multiple sets of event description information and processing operations with corresponding relationships are recorded in the preset processing operation set, and the processing operations are used to repair or terminate an abnormal event described by the corresponding event description information;

And the second determining unit is used for determining a current processing operation corresponding to the target equipment according to the equipment information of the target equipment and the target processing operation, wherein the current processing operation is used for repairing or stopping the target abnormal event described by the target event description information appearing on the target equipment.

11. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises a stored program, wherein the program when run performs the method of any one of claims 1 to 9.

12. An electronic device comprising a memory and a processor, characterized in that the memory has stored therein a computer program, the processor being arranged to execute the method according to any of claims 1 to 9 by means of the computer program.