WO2018119776A1 - Alarm processing method and device - Google Patents

Abstract

An alarm processing method and device. The alarm processing method is applied to a data center. The alarm processing method comprises the steps of: when an alarm is detected, determining, according to a master-slave database, the alarm is a master alarm (S100); and it yes, reporting the master alarm, and not reporting a related alarm when the related alarm corresponding to the master alarm is subsequently detected before the master alarm is disarmed (S200). The method achieves the effects of avoiding an alarm storm and improving alarm processing efficiency.

Description

告警处理方法和装置Alarm processing method and device 技术领域Technical field

本发明涉及数据管理领域，特别涉及告警处理方法和装置。The present invention relates to the field of data management, and in particular, to an alarm processing method and apparatus.

背景技术Background technique

近年来随着大数据的快速发展，数据中心的建设也处于快速发展期，而且数据中心的规模越来越大，动辄数量达到万记的机架，数量达到百万级别的IT设备。当出现类似市电停电的告警时，会同时出现大量电压低，电流低的告警，导致运维人员淹没在大量的告警之中，无法快速找到根源告警，影响运维效率。In recent years, with the rapid development of big data, the construction of data centers is also in a period of rapid development, and the scale of data centers is getting larger and larger, and the number of racks reaches 10,000, and the number of IT equipment reaches one million. When an alarm similar to the power failure occurs, a large number of alarms with low voltage and low current will occur at the same time, causing the operation and maintenance personnel to be flooded with a large number of alarms, and the root cause alarm cannot be quickly found, which affects the operation and maintenance efficiency.

发明内容Summary of the invention

本发明的主要目的是提供告警处理方法和装置，旨在避免告警风暴，提高告警处理效率。The main purpose of the present invention is to provide an alarm processing method and apparatus, aiming at avoiding an alarm storm and improving the alarm processing efficiency.

为实现上述目的，本发明提出的一种告警处理方法，用于数据中心，所述告警处理方法包括步骤：An alarm processing method is provided for the data center, and the alarm processing method includes the following steps:

在检测到告警时，根据主从关系判断所述告警是否为主告警；When the alarm is detected, it is determined whether the alarm is a main alarm according to the master-slave relationship;

若是主告警，则上报所述主告警，并且在所述主告警解除之前，在后续检测到对应所述主告警的相关告警时，不上报所述相关告警。If the primary alarm is generated, the primary alarm is reported, and the related alarm is not reported when the related alarm corresponding to the primary alarm is detected.

优选的，所述主从关系的获得步骤包括：Preferably, the obtaining the master-slave relationship comprises:

获得预设期间内所有告警的告警数量和告警时间；Obtain the number of alarms and alarm time of all alarms in the preset period;

若统计获得第一告警出现n次，其中，m次为第一告警出现之后出现第二告警，m/n≥第一预设比率，则所述第一告警标记为主告警，第二告警标记为对应第一告警的相关告警。If the first alarm is obtained n times, wherein m times is the second alarm after the first alarm occurs, and m/n ≥ the first preset ratio, the first alarm is marked as a primary alarm, and the second alarm is marked. Corresponding to the alarm related to the first alarm.

优选的，所述告警处理方法包括还步骤：Preferably, the alarm processing method includes the following steps:

若不是主告警，则判断是否为相关告警；If it is not the primary alarm, it is determined whether it is a related alarm;

若是相关告警，则获得后续第一预设时间内的其他相关告警； If the alarm is related, the other related alarms in the first preset time period are obtained;

根据所获的相关告警和概率关系获得产生对应主告警的概率；Obtaining a probability of generating a corresponding primary alarm according to the obtained related alarm and probability relationship;

在所述概率超过预设概率时，则不上报对应所述主告警的相关告警；When the probability exceeds the preset probability, the related alarm corresponding to the primary alarm is not reported;

判断在第二预设时间内是否出现所述主告警；Determining whether the primary alarm occurs within a second preset time;

若未出现所述主告警，则上报未上报的相关告警；否则，上报所述主告警，并且维持不上报所述相关告警。If the primary alarm is not generated, the related alarm that is not reported is reported; otherwise, the primary alarm is reported, and the related alarm is not reported.

优选的，所述概率关系的获得步骤包括：Preferably, the obtaining the probability relationship comprises:

获得预设期间内主告警数量和告警时间，以及对应相关告警数量和告警时间；Obtain the number of primary alarms and alarm time in the preset period, and the corresponding number of alarms and alarm time;

若统计获得一相关告警出现a次，其中，b次为该相关告警出现之后出现主告警，则出现该相关告警时，主告警的出现概率为b/a；If the statistics obtains a related alarm, the primary alarm is generated after the occurrence of the related alarm, and the probability of occurrence of the primary alarm is b/a.

使用通过多种相关告警进行拟合，以及利用马尔可夫假设获得的概率计算公式，产生所述主告警的概率为：Using the probability of fitting through a variety of related alarms and using the Markov assumption, the probability of generating the primary alarm is:

∑[P(W₁)*P(W₂|W₁)...P(W_n|W_n-1)+P(U₁)*P(U₂|U₁)...P(U_n|U_n-1)+P(V₁)*P(V₂|V₁)...P(V_n|V_n-1)]∑[P(W ₁ )*P(W ₂ |W ₁ )...P(W _n |W _n-1 )+P(U ₁ )*P(U ₂ |U ₁ )...P(U _n |U _n-1 )+P(V ₁ )*P(V ₂ |V ₁ )...P(V _n |V _n-1 )]

优选的，所述告警处理方法还包括步骤：Preferably, the alarm processing method further includes the following steps:

在检测到所述主告警消除时，重新判断未上报的相关告警是否存在；When the detection of the primary alarm is detected, it is determined whether the related alarm that is not reported exists.

若存在，则上报所述相关告警；否则，消除所述相关告警。If yes, the related alarm is reported; otherwise, the related alarm is eliminated.

本发明提供的一种告警处理装置，用于数据中心，所述告警处理装置包括：The invention provides an alarm processing device for a data center, and the alarm processing device includes:

第一判断模块，用于在检测到告警时，根据主从关系判断所述告警是否为主告警；The first judging module is configured to determine, according to the master-slave relationship, whether the alarm is a main alarm when the alarm is detected;

第一上报模块，用于在所述第一判断模块判定是主告警时，则上报所述主告警，并且在所述主告警解除之前，在后续检测到对应所述主告警的相关告警时，不上报所述相关告警。a first reporting module, configured to report the primary alarm when the first determining module determines that the primary alarm is generated, and when the related alarm corresponding to the primary alarm is detected subsequently, before the primary alarm is released, The related alarms are not reported.

优选的，所述告警处理装置还包括用于确定所述主从关系的主从确定模块，Preferably, the alarm processing apparatus further includes a master-slave determining module for determining the master-slave relationship,

所述主从确定模块，用于获得预设期间内所有告警的告警数量和告警时间；若统计获得第一告警出现n次，其中，m次为第一告警出现之后出现第二告警，m/n≥第一预设比率，则所述第一告警标记为主告警，第二告警标记为对应第一告警的相关告警。 The master-slave determining module is configured to obtain the number of alarms and the alarm time of all the alarms in the preset period; if the first alarm is obtained n times, wherein the second alarm occurs after the first alarm occurs, m/ n ≥ the first preset ratio, the first alarm is marked as a primary alarm, and the second alarm is marked as a related alarm corresponding to the first alarm.

优选的，所述告警处理装置还包括：Preferably, the alarm processing device further includes:

第二判断模块，用于在所述第一判断模块判定不是主告警时，则判断是否为相关告警；a second determining module, configured to determine, when the first determining module determines that it is not a primary alarm, whether it is a related alarm;

后续获得模块，用于在所述第二判断模块判定是相关告警，则获得后续第一预设时间内的其他相关告警；a subsequent obtaining module, configured to determine, in the second determining module, that the related alarm is obtained, and obtain other related alarms in the subsequent first preset time;

告警获得模块，用于根据所获的相关告警和概率关系获得产生对应主告警的概率；An alarm obtaining module, configured to obtain a probability of generating a corresponding primary alarm according to the obtained related alarm and probability relationship;

第二上报模块，用于在概率获得模块所获概率超过预设概率时，则不上报对应所述主告警的相关告警；The second reporting module is configured to not report the related alarm corresponding to the primary alarm when the probability obtained by the probability obtaining module exceeds a preset probability;

第三判断模块，用于判断在第二预设时间内是否出现所述主告警；a third determining module, configured to determine whether the primary alarm occurs within a second preset time;

第三上报模块，用于在所述第三判断模块判定未出现所述主告警时，则上报未上报的相关告警；否则，维持不上报。The third reporting module is configured to report, when the third determining module determines that the primary alarm does not occur, report the related alarm that is not reported; otherwise, the report is not reported.

优选的，所述告警处理装置还包括用于确定所述概率关系的概率确定模块，Preferably, the alarm processing apparatus further includes a probability determining module for determining the probability relationship,

所述概率确定模块，用于获得预设期间内主告警数量和告警时间，以及对应相关告警数量和告警时间；若统计获得一相关告警出现a次，其中，b次为该相关告警出现之后出现主告警，则出现该相关告警时，主告警的出现概率为b/a；使用通过多种相关告警进行拟合，以及利用马尔可夫假设获得的概率计算公式，产生所述主告警的概率为：The probability determining module is configured to obtain the number of primary alarms and the alarm time in the preset period, and the corresponding number of related alarms and the alarm time; if the statistics obtain a related alarm occurs once, wherein b times appear after the related alarm occurs The primary alarm, when the related alarm occurs, the probability of occurrence of the primary alarm is b/a; the probability of generating the primary alarm is obtained by fitting with a plurality of related alarms and using a probability calculation formula obtained by the Markov assumption :

∑[P(W₁)*P(W₂|W₁)...P(W_n|W_n-1)+P(U₁)*P(U₂|U₁)...P(U_n|U_n-1)+P(V₁)*P(V₂|V₁)...P(V_n|V_n-1)]∑[P(W ₁ )*P(W ₂ |W ₁ )...P(W _n |W _n-1 )+P(U ₁ )*P(U ₂ |U ₁ )...P(U _n |U _n-1 )+P(V ₁ )*P(V ₂ |V ₁ )...P(V _n |V _n-1 )]

优选的，所述告警处理装置还包括：Preferably, the alarm processing device further includes:

复检模块，用于在检测到所述主告警消除时，重新判断未上报的相关告警是否存在；The rechecking module is configured to re-determine whether the unreported related alarm exists when the main alarm is detected;

第四上报模块，用于在所述复检模块判定为存在时，则上报所述相关告警；否则，消除所述相关告警。The fourth reporting module is configured to report the related alarm when the rechecking module determines that the rechecking module is present; otherwise, the related alarm is eliminated.

本发明所提供的告警处理方法，通过主从关系来判断告警的性质，若为主告警，则仅上报主告警而不上报伴生的相关告警，从而能够更清楚的展示事故的原因，避免产生告警海啸，便于工作人员了解告警的真实来源，而达到提高运维管理的效率。 The alarm processing method provided by the present invention determines the nature of the alarm through the master-slave relationship. If the master alarm is used, only the main alarm is reported and the associated alarm is not reported, so that the cause of the accident can be more clearly displayed and the alarm can be avoided. The tsunami makes it easy for the staff to understand the true source of the alarm and improve the efficiency of operation and maintenance management.

附图说明DRAWINGS

为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图示出的结构获得其他的附图。In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and those skilled in the art can obtain other drawings according to the structures shown in the drawings without any creative work.

图1为本发明告警处理方法第一实施例的流程图；1 is a flowchart of a first embodiment of an alarm processing method according to the present invention;

图2为图1所示告警处理方法中主从关系的获得流程图；2 is a flowchart of obtaining a master-slave relationship in the alarm processing method shown in FIG. 1;

图3为本发明告警处理方法第二实施例的流程图；3 is a flowchart of a second embodiment of an alarm processing method according to the present invention;

图4为图3所示告警处理方法中概率关系的获得流程图；4 is a flowchart of obtaining a probability relationship in the alarm processing method shown in FIG. 3;

图5为本发明告警处理方法第三实施例的流程图；5 is a flowchart of a third embodiment of an alarm processing method according to the present invention;

图6为本发明告警处理方法一实施例的模块示意图。FIG. 6 is a schematic block diagram of an embodiment of an alarm processing method according to the present invention.

本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

具体实施方式detailed description

应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

请参看图1，本发明告警处理方法第一实施例，用于数据中心，所述告警处理方法包括步骤：Referring to FIG. 1 , a first embodiment of the alarm processing method of the present invention is used in a data center, and the alarm processing method includes the following steps:

步骤S100，在检测到告警时，根据主从关系判断所述告警是否为主告警；若是，则执行步骤S200，若否则执行步骤S300。其中，主从关系例如停电告警为主告警，在停电的同时将产生电压低告警和电流低告警等，则这些伴生的告警为停电告警的相关告警。主从关系可以是预先配置的，也可以是设备根据算法自行学习的；例如管理人员利用电路相关知识以及历史告警数据，找到因市电停电产生的相关告警，把相关的数据配置到数据库中保存下来；再例如设备通过统计告警，计算告警产生的相关性，从而获得主告警和伴生 的相关告警的主从关系。In step S100, when the alarm is detected, it is determined whether the alarm is a main alarm according to the master-slave relationship; if yes, step S200 is performed, otherwise step S300 is performed. Among them, the master-slave relationship, such as the power failure alarm is the main alarm, and the low voltage alarm and the low current alarm will be generated at the same time of power failure, and these associated alarms are related alarms of the power failure alarm. The master-slave relationship can be pre-configured, or the device can learn by itself according to the algorithm; for example, the manager uses the circuit related knowledge and historical alarm data to find relevant alarms generated by the power outage, and configure the relevant data to be stored in the database. Down; for example, the device calculates the correlation of the alarms through statistical alarms, thereby obtaining the main alarm and associated The master-slave relationship of related alarms.

步骤S200，上报所述主告警，并且在所述主告警解除之前，在后续检测到对应所述主告警的相关告警时，不上报所述相关告警。In step S200, the main alarm is reported, and the related alarm is not reported when the related alarm corresponding to the main alarm is detected after the main alarm is released.

步骤S300，上报所述告警。In step S300, the alarm is reported.

本实施例，通过主从关系来判断告警的性质，若为主告警，则仅上报主告警而不上报伴生的相关告警，从而能够更清楚的展示事故的原因，避免产生告警海啸，便于工作人员了解告警的真实来源，而达到提高运维管理的效率。In this embodiment, the nature of the alarm is determined by the master-slave relationship. If the alarm is the primary alarm, only the main alarm is reported and the associated alarm is not reported, so that the cause of the accident can be clearly displayed, and the alarm tsunami can be avoided, which is convenient for the staff. Understand the true source of the alarm and improve the efficiency of operation and maintenance management.

请参看图2，本实施例优选采用设备自行学习的方案来获得和维持所述主从关系。具体的，所述主从关系的获得步骤包括：Referring to FIG. 2, the embodiment preferably adopts a device self-learning scheme to obtain and maintain the master-slave relationship. Specifically, the obtaining the master-slave relationship includes:

步骤S400，获得预设期间内所有告警的告警数量和告警时间。其中，预设期间可以是所有时间，也可以是最近一年等。In step S400, the number of alarms and the alarm time of all the alarms in the preset period are obtained. The preset period may be all time, or may be the most recent year.

步骤S410，若统计获得第一告警出现n次，其中，m次为第一告警出现之后出现第二告警，m/n≥第一预设比率，则所述第一告警标记为主告警，第二告警标记为对应第一告警的相关告警。Step S410, if the first alarm is obtained n times, wherein m times is the second alarm occurs after the first alarm occurs, and m/n ≥ the first preset ratio, the first alarm flag is a primary alarm, The two alarms are marked as related alarms corresponding to the first alarm.

例如，第一告警为停电告警，第二告警为电压低告警；若统计获得停电告警30次，其中，在这30次停电告警中，有28次停电告警后，例如1～10min之内，紧随发生了电压低告警，则n＝30，m＝28，m/n＝93.3％；此时若第一预设比率为80％，则认为第一告警和第二告警具有较高的相关性，从而认为第二告警为第一告警的相关告警。For example, the first alarm is a power failure alarm, and the second alarm is a low voltage alarm; if the power failure alarm is obtained 30 times, among the 30 power failure alarms, there are 28 power failure alarms, for example, within 1 to 10 minutes, With the low voltage alarm, n=30, m=28, m/n=93.3%; if the first preset ratio is 80%, the first alarm and the second alarm are considered to have higher correlation. Therefore, the second alarm is considered to be a related alarm of the first alarm.

优选的，第一预设比率设置为70％～90％，进一步的设置为80％为较佳方案，能够较为准确的反应告警之间的相关性。进一步的，所述主从关系可以通过一线程来统计，并且将统计结果汇总为于数据库，并且定期更新该数据库，从而当发生告警时，可以直接从数据库中调取主从关系的数据，而直接判断是否为主告警或相关告警。Preferably, the first preset ratio is set to 70% to 90%, and the further setting is 80% is a preferred solution, which can accurately reflect the correlation between alarms. Further, the master-slave relationship may be counted by a thread, and the statistics are summarized into a database, and the database is periodically updated, so that when an alarm occurs, the data of the master-slave relationship can be directly retrieved from the database, and Determine whether the alarm is the primary alarm or related alarm.

本实施例，通过获得历史告警信息，并通过相关性计算公式来获得告警之间的相关性，具有效率高，以及历史数据越多，相关性的判定越准确的效果。 In this embodiment, by obtaining the historical alarm information and obtaining the correlation between the alarms through the correlation calculation formula, the efficiency is high, and the more the historical data, the more accurate the correlation determination.

请参看图3，本发明告警处理方法第二实施例，本实施例以第一实施例为基础，新增了步骤S510，步骤S520，步骤S530，步骤S540，步骤S550，步骤S560，步骤S570和步骤S580。具体的，所述告警处理方法包括还步骤：Referring to FIG. 3, a second embodiment of the alarm processing method of the present invention is based on the first embodiment, and steps S510, S520, S530, S540, S550, S560, S570 and Step S580. Specifically, the alarm processing method includes the following steps:

在步骤S100判定若不是主告警时，执行步骤S510。If it is determined in step S100 that it is not the main alarm, step S510 is performed.

步骤S510，判断是否为相关告警；若是，则执行步骤S520；若否，则执行步骤S300。Step S510, determining whether it is a related alarm; if yes, executing step S520; if not, executing step S300.

步骤S520，获得后续第一预设时间内的其他相关告警；其中，可以设置第一预设时间为1～5min之内。Step S520: Obtain other related alarms in the first preset time period; wherein the first preset time may be set within 1 to 5 minutes.

步骤S530，根据所获的相关告警和概率关系获得产生对应主告警的概率。其中，所述概率关系可以是预先配置的，也可以是设备根据算法自行学习的；例如管理人员利用电路相关知识以及历史告警数据，找到因市电停电产生的相关告警；例如，设置当出现A相电压告警时，市电停电告警的概率为20％；设置当出现A相电压告警并且B相电压告警时，市电停电告警的概率为40％；设置当出现A相电压告警、B相电压告警并且C相电压告警时，市电停电告警的概率为50％等等。又例如，设备根据历史数据，统计获得当A相电压告警时，市电停电告警的概率为20％；统计获得当A相电压告警并且B相电压告警时，市电停电告警的概率为30％；统计获得当A相电压告警、B相电压告警并且C相告警时，市电停电告警的概率为60％等等。Step S530: Obtain a probability of generating a corresponding primary alarm according to the obtained related alarm and probability relationship. The probability relationship may be pre-configured, or the device may learn by itself according to an algorithm; for example, the management personnel use circuit related knowledge and historical alarm data to find related alarms generated by the power outage; for example, when A occurs When the phase voltage is alarmed, the probability of the mains power failure alarm is 20%; when the A phase voltage alarm and the B phase voltage alarm occur, the probability of the mains power failure alarm is 40%; when the A phase voltage alarm occurs, the B phase voltage is set. When the alarm is issued and the C-phase voltage is alarmed, the probability of the mains power failure alarm is 50%, and so on. For another example, according to the historical data, the device obtains a probability that the power failure alarm is 20% when the A phase voltage is alarmed; when the A phase voltage alarm and the B phase voltage alarm are obtained, the probability of the utility power failure alarm is 30%. When the statistics get the A phase voltage alarm, the B phase voltage alarm and the C phase alarm, the probability of the mains power failure alarm is 60% and so on.

步骤S540，判断所述概率是否超过预设概率；若是，则执行步骤S550；若否，则执行步骤S300；优选设置该预设概率为40％～60％，进一步设置预设概率为50％，能够较为准确的反应告警之间的相关性。Step S540, determining whether the probability exceeds a preset probability; if yes, executing step S550; if not, executing step S300; preferably setting the preset probability to be 40% to 60%, and further setting the preset probability to 50%, Can more accurately reflect the correlation between alarms.

步骤S550，不上报对应所述主告警的相关告警。In step S550, the related alarm corresponding to the primary alarm is not reported.

步骤S560，判断在第二预设时间内是否出现所述主告警；若是，则执行步骤S570，若否，则执行步骤S580；其中，可以设置第二预设时间为1～5min。Step S560, determining whether the main alarm occurs in the second preset time; if yes, executing step S570; if not, executing step S580; wherein, the second preset time may be set to be 1 to 5 minutes.

步骤S570，上报所述主告警，并且维持不上报所述相关告警；Step S570, reporting the main alarm, and maintaining the related alarm is not reported;

步骤S580，上报未上报的相关告警。In step S580, the related alarms that are not reported are reported.

本实施例，通过在判定产生的告警为相关告警时，延迟上报，等待是否存在对应的主告警，从而可以避免相关告警先产生而主告警后产生时，相关告警集中爆发而导致的告警海啸。 In this embodiment, when it is determined that the generated alarm is a related alarm, the delay is reported, and the corresponding main alarm is waited for, so that the related alarm is generated first and the alarm is generated after the main alarm is generated.

请参看图4，本实施例优选采用设备自行学习的方案来获得和维持所述概率关系。具体的，所述概率关系的获得步骤包括：Referring to FIG. 4, the embodiment preferably adopts a device self-learning scheme to obtain and maintain the probability relationship. Specifically, the obtaining the probability relationship includes:

步骤S600，获得预设期间内主告警数量和告警时间，以及对应相关告警数量和告警时间；其中，预设期间可以是所有时间，也可以是最近一年等。In step S600, the number of the main alarms and the alarm time in the preset period, and the corresponding number of alarms and the alarm time are obtained. The preset period may be all times, or may be the latest year.

步骤S610，若统计获得一相关告警出现a次，其中，b次为该相关告警出现之后出现主告警，则出现该相关告警时，主告警的出现概率为b/a；例如，主告警为停电告警，一相关告警为电压低告警；若统计获得电压低告警30次，其中，在这30次电压低告警中，有28次电压低告警后，例如1～10min之内，紧随发生了停电告警，则a＝30，b＝28，b/a＝93.3％。In step S610, if a related alarm is obtained a times, wherein b times is the main alarm after the related alarm occurs, the probability of occurrence of the main alarm is b/a when the related alarm occurs; for example, the main alarm is power failure Alarm, a related alarm is a low voltage alarm; if the statistics get a low voltage alarm 30 times, among the 30 low voltage alarms, there are 28 low voltage alarms, for example, within 1 to 10 minutes, followed by a power outage For the alarm, a=30, b=28, b/a=93.3%.

步骤S620，使用通过多种相关告警进行拟合，以及利用马尔可夫假设获得的概率计算公式，产生所述主告警的概率为：Step S620, using a plurality of related alarms for fitting, and using a probability calculation formula obtained by the Markov assumption, the probability of generating the main alarm is:

∑[P(W₁)*P(W₂|W₁)...P(W_n|W_n-1)+P(U₁)*P(U₂|U₁)...P(U_n|U_n-1)+P(V₁)*P(V₂|V₁)...P(V_n|V_n-1)]∑[P(W ₁ )*P(W ₂ |W ₁ )...P(W _n |W _n-1 )+P(U ₁ )*P(U ₂ |U ₁ )...P(U _n |U _n-1 )+P(V ₁ )*P(V ₂ |V ₁ )...P(V _n |V _n-1 )]

其中，P(W₁)指，当第一相关告警产生时，产生主告警的概率；Where P(W ₁ ) refers to the probability of generating a primary alarm when the first related alarm is generated;

P(W₂|W₁)指，当第一相关告警时，第二相关告警产生的概率；P(W ₂ |W ₁ ) refers to the probability that the second related alarm is generated when the first related alarm is generated;

P(W_n|W_n-1)指，当第N-1相关告警时，第N相关告警产生的概率；P(W _n |W _n-1 ) refers to the probability that the Nth related alarm is generated when the N-1th related alarm is generated;

需要说明的是，N代表主告警对应的相关告警数量；W_n、U_n和V_n分别表示第一相关告警作为第一，第二相关告警作为第一，和第三告警作为第一时的三组概率计算。此处仅提供了三组概率计算，但是应当理解为公式的简写，而并非完整公式；完整的公式应当为，当存在N个相关告警数量时，应当存在N组概率计算；例如N为2时，有W_n和U_n两组计算；例如N为3时，有W_n、U_n和V_n三组计算；例如N为4时，有W_n、U_n、V_n和Y_n四组计算。It should be noted that N represents the number of related alarms corresponding to the primary alarm; W _n , U _n and V _n respectively represent the first related alarm as the first, the second related alarm as the first, and the third alarm as the first Three sets of probability calculations. Only three sets of probability calculations are provided here, but should be understood as a shorthand for the formula, but not a complete formula; the complete formula should be that when there are N related alarm quantities, there should be N sets of probability calculations; for example, when N is 2 There are two sets of calculations of W _n and U _n ; for example, when N is 3, there are three sets of calculations of W _n , U _n and V _n ; for example, when N is 4, there are four groups of W _n , U _n , V _n and Y _n . Calculation.

具体的：假设市电停电告警为主告警，其对应的相关告警有两个，则N＝2。Specifically: Assume that the mains blackout alarm is the main alarm, and there are two corresponding related alarms, then N=2.

两个相关告警分别为A相电压告警和B相电压告警；The two related alarms are A phase voltage alarm and B phase voltage alarm respectively;

通过统计计算获得A相电压告警产生时，市电停电告警产生的概率为b/a(统计方法如上文获得b/a的方法)，记录为P(W₁)；通过统计计算获得A相电压告警产生时，B相电压告警产生的概率为c/d，记录为P(W₂|W₁)；When the A-phase voltage alarm is generated through statistical calculation, the probability of the power-off blackout alarm is b/a (the statistical method is as follows: b/a), and the record is P(W ₁ ); the phase A voltage is obtained through statistical calculation. When the alarm is generated, the probability of the B-phase voltage alarm is c/d, which is recorded as P(W ₂ |W ₁ );

通过统计计算获得B相电压告警产生时，市电停电告警产生的概率为e/f，记录为P(U₁)；通过统计计算获得A相电压告警产生时，B相电压告警产生的概率为c/d，记录为P(U₂|U₁)；When the B-phase voltage alarm is generated by statistical calculation, the probability of the power-off blackout alarm is e/f, which is recorded as P(U ₁ ). When the A-phase voltage alarm is generated through statistical calculation, the probability of the B-phase voltage alarm is c/d, recorded as P(U ₂ |U ₁ );

即： which is:

A相电压告警产生时，市电停电告警产生的概率为P(W₁)；When the A-phase voltage alarm is generated, the probability of generating a power failure alarm is P(W ₁ );

A相电压告警产生时，B相电压告警产生的概率为P(W₂|W₁)；When the phase A voltage alarm is generated, the probability of the B phase voltage alarm is P(W ₂ |W ₁ );

------------------------

B相电压告警产生时，市电停电告警产生的概率为P(U₁)；When the B-phase voltage alarm is generated, the probability of the mains power failure alarm is P(U ₁ );

B相电压告警产生时，A相电压告警产生的概率为P(U₂|U₁)；When the B-phase voltage alarm is generated, the probability of the A-phase voltage alarm is P(U ₂ |U ₁ );

则：then:

市电停电告警的概率为：P(W₁)*P(W₂|W₁)+P(U₁)*P(U₂|U₁)。The probability of the mains blackout alarm is: P(W ₁ )*P(W ₂ |W ₁ )+P(U ₁ )*P(U ₂ |U ₁ ).

假设市电停电告警为主告警，其对应的相关告警有四个，则N＝4；Assume that the mains blackout alarm is the main alarm, and there are four corresponding alarms, then N=4;

四个相关告警分别为第一相关告警、第二相关告警、第三相关告警和第四相关告警。其中，第一、第二、第三和第四并非按重要排序，而仅仅是代号。The four related alarms are a first related alarm, a second related alarm, a third related alarm, and a fourth related alarm, respectively. Among them, the first, second, third and fourth are not sorted by importance, but merely code.

第一组概率计算中，编号1为第一相关告警，编号2为第二相关告警，编号3为第三相关告警，编号4为第四相关告警。In the first set of probability calculations, number 1 is the first related alarm, number 2 is the second related alarm, number 3 is the third related alarm, and number 4 is the fourth related alarm.

第一相关告警产生时，市电停电告警产生的概率为P(W₁)；When the first related alarm is generated, the probability of generating a power failure alarm is P(W ₁ );

第一相关告警产生时，第二相关告警产生的概率为P(W₂|W₁)；When the first related alarm is generated, the probability of the second related alarm is P(W ₂ |W ₁ );

第二相关告警产生时，第三相关告警产生的概率为P(W₃|W₂)；When the second related alarm is generated, the probability of the third related alarm is P(W ₃ |W ₂ );

第三相关告警产生时，第四相关告警产生的概率为P(W₄|W₃)；When the third related alarm is generated, the probability of the fourth related alarm is P(W ₄ |W ₃ );

------------------------

第二组概率计算中，编号1为第二相关告警，编号2为第三相关告警，编号3为第四相关告警，编号4为第一相关告警。In the second set of probability calculations, number 1 is the second related alarm, number 2 is the third related alarm, number 3 is the fourth related alarm, and number 4 is the first related alarm.

第二相关告警产生时，市电停电告警产生的概率为P(U₁)；When the second related alarm is generated, the probability of generating a power failure alarm is P(U ₁ );

第二相关告警产生时，第三相关告警产生的概率为P(U₂|U₁)；When the second related alarm is generated, the probability of the third related alarm is P(U ₂ |U ₁ );

第三相关告警产生时，第四相关告警产生的概率为P(U₃|U₂)；When the third related alarm is generated, the probability of the fourth related alarm is P(U ₃ |U ₂ );

第四相关告警产生时，第一相关告警产生的概率为P(U₄|U₃)；When the fourth related alarm is generated, the probability of the first related alarm is P(U ₄ |U ₃ );

------------------------

第三组概率计算中，编号1为第三相关告警，编号2为第四相关告警，编号3为第一相关告警，编号4为第二相关告警。In the third group of probability calculations, number 1 is the third related alarm, number 2 is the fourth related alarm, number 3 is the first related alarm, and number 4 is the second related alarm.

第三相关告警产生时，市电停电告警产生的概率为P(V₁)；When the third related alarm is generated, the probability of generating a power failure alarm is P(V ₁ );

第三相关告警产生时，第四相关告警产生的概率为P(V₂|V₁)；When the third related alarm is generated, the probability of the fourth related alarm is P(V ₂ |V ₁ );

第四相关告警产生时，第一相关告警产生的概率为P(V₃|V₂)； When the fourth related alarm is generated, the probability of the first related alarm is P(V ₃ |V ₂ );

第一相关告警产生时，第二相关告警产生的概率为P(V₄|V₃)；When the first related alarm is generated, the probability of generating the second related alarm is P(V ₄ |V ₃ );

------------------------

第四组概率计算中，编号1为第四相关告警，编号2为第一相关告警，编号3为第二相关告警，编号4为第三相关告警。In the fourth group of probability calculations, number 1 is the fourth related alarm, number 2 is the first related alarm, number 3 is the second related alarm, and number 4 is the third related alarm.

第四相关告警产生时，市电停电告警产生的概率为P(Y₁)；When the fourth related alarm is generated, the probability of generating a power failure alarm is P(Y ₁ );

第四相关告警产生时，第一相关告警产生的概率为P(Y₂|Y₁)；When the fourth related alarm is generated, the probability of the first related alarm is P(Y ₂ |Y ₁ );

第一相关告警产生时，第二相关告警产生的概率为P(Y₃|Y₂)；When the first related alarm is generated, the probability of the second related alarm is P(Y ₃ |Y ₂ );

第二相关告警产生时，第三相关告警产生的概率为P(Y₄|Y₃)；When the second related alarm is generated, the probability of the third related alarm is P(Y ₄ |Y ₃ );

进一步的，所述主从关系可以通过一线程来统计，并且将统计结果汇总为于数据库，并且定期更新该数据库，从而当发生告警时，可以直接从数据库中调取概率关系的数据，而直接判断产生主告警的概率为多少。Further, the master-slave relationship may be counted by a thread, and the statistics are summarized into a database, and the database is periodically updated, so that when an alarm occurs, the data of the probability relationship can be directly retrieved from the database, and directly Determine the probability of generating a primary alarm.

本实施例，通过获得历史告警信息，并通过相关性计算公式来获得当前产生的相关告警伴随主告警产生的概率，具有效率高，以及历史数据越多，相关性的判定越准确的效果。In this embodiment, by obtaining the historical alarm information and obtaining the probability that the currently generated related alarm is accompanied by the main alarm by using the correlation calculation formula, the efficiency is high, and the more the historical data, the more accurate the correlation determination.

请参看图5，本发明告警处理方法第三实施例，本实施例以第二实施例为基础，新增了步骤S700，步骤S710，步骤S720，所述告警处理方法还包括步骤：Referring to FIG. 5, the third embodiment of the alarm processing method of the present invention is based on the second embodiment. Step S700, step S710, and step S720 are added. The alarm processing method further includes the following steps:

步骤S700，在检测到所述主告警消除时，重新判断未上报的相关告警是否存在；若是，则执行步骤S710；若否，则执行步骤S720。Step S700: When it is detected that the main alarm is cleared, it is determined whether the unreported related alarm exists; if yes, step S710 is performed; if no, step S720 is performed.

步骤S710，上报所述相关告警。Step S710, reporting the related alarm.

步骤S720，消除所述相关告警。Step S720, eliminating the related alarm.

本实施例，通过在主告警消除后再次确认相关告警是否存在，则可以避免相关告警的产生源并非主告警，而导致的漏报情况发生，因此本方案具有判断更准确可靠的效果。In this embodiment, by confirming whether the related alarm exists after the main alarm is cleared, the source of the related alarm is prevented from being the main alarm, and the missed report occurs. Therefore, the solution has the effect of more accurate and reliable judgment.

请参看图6，本发明告警处理装置一实施例，所述告警处理装置包括：Referring to FIG. 6, an embodiment of the alarm processing apparatus of the present invention includes:

第一判断模块100，用于在检测到告警时，根据主从关系判断所述告警是否为主告警；其中，主从关系例如停电告警为主告警，在停电的同时将产生 电压低告警和电流低告警等，则这些伴生的告警为停电告警的相关告警。主从关系可以是预先配置的，也可以是设备根据算法自行学习的；例如管理人员利用电路相关知识以及历史告警数据，找到因市电停电产生的相关告警，把相关的数据配置到数据库中保存下来；再例如设备通过统计告警，计算告警产生的相关性，从而获得主告警和伴生的相关告警的主从关系。The first judging module 100 is configured to determine, according to the master-slave relationship, whether the alarm is a main alarm according to the master-slave relationship, wherein the master-slave relationship, for example, the power failure alarm is a main alarm, and is generated at the same time of power failure For low voltage alarms and low current alarms, these associated alarms are related alarms for power failure alarms. The master-slave relationship can be pre-configured, or the device can learn by itself according to the algorithm; for example, the manager uses the circuit related knowledge and historical alarm data to find relevant alarms generated by the power outage, and configure the relevant data to be stored in the database. Then, for example, the device calculates the correlation of the alarm generation through statistical alarms, thereby obtaining the master-slave relationship between the primary alarm and the associated related alarm.

第一上报模块200，用于在所述第一判断模块100判定是主告警时，则上报所述主告警，并且在所述主告警解除之前，在后续检测到对应所述主告警的相关告警时，不上报所述相关告警。The first reporting module 200 is configured to report the main alarm when the first determining module 100 determines that it is a primary alarm, and subsequently detect a related alarm corresponding to the primary alarm before the primary alarm is released. The related alarms are not reported.

本实施例，通过主从关系来判断告警的性质，若为主告警，则仅上报主告警而不上报伴生的相关告警，从而能够更清楚的展示事故的原因，避免产生告警海啸，便于工作人员了解告警的真实来源，而达到提高运维管理的效率。In this embodiment, the nature of the alarm is determined by the master-slave relationship. If the alarm is the primary alarm, only the main alarm is reported and the associated alarm is not reported, so that the cause of the accident can be clearly displayed, and the alarm tsunami can be avoided, which is convenient for the staff. Understand the true source of the alarm and improve the efficiency of operation and maintenance management.

优选的，所述告警处理装置还包括用于确定所述主从关系的主从确定模块300。Preferably, the alarm processing apparatus further includes a master-slave determination module 300 for determining the master-slave relationship.

所述主从确定模块300，用于获得预设期间内所有告警的告警数量和告警时间；其中，预设期间可以是所有时间，也可以是最近一年等。若统计获得第一告警出现n次，其中，m次为第一告警出现之后出现第二告警，m/n≥第一预设比率，则所述第一告警标记为主告警，第二告警标记为对应第一告警的相关告警。The master-slave determination module 300 is configured to obtain the number of alarms and the alarm time of all the alarms in the preset period; wherein the preset period may be all times, or may be the latest year or the like. If the first alarm is obtained n times, wherein m times is the second alarm after the first alarm occurs, and m/n ≥ the first preset ratio, the first alarm is marked as a primary alarm, and the second alarm is marked. Corresponding to the alarm related to the first alarm.

例如，第一告警为停电告警，第二告警为电压低告警；若统计获得停电告警30次，其中，在这30次停电告警中，有28次停电告警后，例如1～10min之内，紧随发生了电压低告警，则n＝30，m＝28，m/n＝93.3％；此时若第一预设比率为80％，则认为第一告警和第二告警具有较高的相关性，从而认为第二告警为第一告警的相关告警。For example, the first alarm is a power failure alarm, and the second alarm is a low voltage alarm; if the power failure alarm is obtained 30 times, among the 30 power failure alarms, there are 28 power failure alarms, for example, within 1 to 10 minutes, With the low voltage alarm, n=30, m=28, m/n=93.3%; if the first preset ratio is 80%, the first alarm and the second alarm are considered to have higher correlation. Therefore, the second alarm is considered to be a related alarm of the first alarm.

优选的，第一预设比率设置为70％～90％，进一步的设置为80％为较佳方案，能够较为准确的反应告警之间的相关性。进一步的，所述主从关系可以通过一线程来统计，并且将统计结果汇总为于数据库，并且定期更新该数据库，从而当发生告警时，可以直接从数据库中调取主从关系的数据，而直接判断是否为主告警或相关告警。Preferably, the first preset ratio is set to 70% to 90%, and the further setting is 80% is a preferred solution, which can accurately reflect the correlation between alarms. Further, the master-slave relationship may be counted by a thread, and the statistics are summarized into a database, and the database is periodically updated, so that when an alarm occurs, the data of the master-slave relationship can be directly retrieved from the database, and Determine whether the alarm is the primary alarm or related alarm.

本实施例，通过获得历史告警信息，并通过相关性计算公式来获得告警 之间的相关性，具有效率高，以及历史数据越多，相关性的判定越准确的效果。In this embodiment, the historical alarm information is obtained, and the alarm is obtained through the correlation calculation formula. The correlation between the correlation, the efficiency, and the more historical data, the more accurate the correlation determination.

优选的，所述告警处理装置还包括：Preferably, the alarm processing device further includes:

第二判断模块400，用于在所述第一判断模块100判定不是主告警时，则判断是否为相关告警。The second determining module 400 is configured to determine, when the first determining module 100 determines that it is not a primary alarm, whether it is a related alarm.

后续获得模块500，用于在所述第二判断模块400判定是相关告警，则获得后续第一预设时间内的其他相关告警；其中，可以设置第一预设时间为1～5min之内。The subsequent obtaining module 500 is configured to obtain other related alarms in the first preset time period after determining that the second determining module 400 is a related alarm; wherein the first preset time may be set within 1 to 5 minutes.

告警获得模块600，用于根据所获的相关告警和概率关系获得产生对应主告警的概率；其中，所述概率关系可以是预先配置的，也可以是设备根据算法自行学习的；例如管理人员利用电路相关知识以及历史告警数据，找到因市电停电产生的相关告警；例如，设置当出现A相电压告警时，市电停电告警的概率为20％；设置当出现A相电压告警并且B相电压告警时，市电停电告警的概率为40％；设置当出现A相电压告警、B相电压告警并且C相电压告警时，市电停电告警的概率为50％等等。又例如，设备根据历史数据，统计获得当A相电压告警时，市电停电告警的概率为20％；统计获得当A相电压告警并且B相电压告警时，市电停电告警的概率为30％；统计获得当A相电压告警、B相电压告警并且C相告警时，市电停电告警的概率为60％等等。The alarm obtaining module 600 is configured to obtain a probability of generating a corresponding primary alarm according to the obtained related alarm and probability relationship; wherein the probability relationship may be pre-configured, or the device may learn according to an algorithm; for example, the management personnel utilizes Circuit related knowledge and historical alarm data, find related alarms caused by power failure; for example, set the probability of power failure alarm when the A phase voltage alarm occurs, 20%; set the A phase voltage alarm and B phase voltage When the alarm occurs, the probability of the mains power failure alarm is 40%; when the A phase voltage alarm, the B phase voltage alarm and the C phase voltage alarm occur, the probability of the mains power failure alarm is 50% and so on. For another example, according to the historical data, the device obtains a probability that the power failure alarm is 20% when the A phase voltage is alarmed; when the A phase voltage alarm and the B phase voltage alarm are obtained, the probability of the utility power failure alarm is 30%. When the statistics get the A phase voltage alarm, the B phase voltage alarm and the C phase alarm, the probability of the mains power failure alarm is 60% and so on.

第二上报模块700，用于在概率获得模块所获概率超过预设概率时，则不上报对应所述主告警的相关告警；优选设置该预设概率为40％～60％，进一步设置预设概率为50％，能够较为准确的反应告警之间的相关性。The second reporting module 700 is configured to not report the related alarm corresponding to the primary alarm when the probability obtained by the probability obtaining module exceeds the preset probability; preferably, the preset probability is set to 40% to 60%, and the preset is further set. The probability is 50%, which can more accurately reflect the correlation between alarms.

第三判断模块800，用于判断在第二预设时间内是否出现所述主告警；其中，可以设置第二预设时间为1～5min。The third determining module 800 is configured to determine whether the main alarm occurs in the second preset time; wherein the second preset time may be set to be 1 to 5 minutes.

第三上报模块900，用于在所述第三判断模块800判定未出现所述主告警时，则上报未上报的相关告警；否则，维持不上报。The third reporting module 900 is configured to report, when the third determining module 800 determines that the primary alarm does not occur, report the related alarm that is not reported; otherwise, the report is not reported.

本实施例，通过在判定产生的告警为相关告警时，延迟上报，等待是否存在对应的主告警，从而可以避免相关告警先产生而主告警后产生时，相关告警集中爆发而导致的告警海啸。 In this embodiment, when it is determined that the generated alarm is a related alarm, the delay is reported, and the corresponding main alarm is waited for, so that the related alarm is generated first and the alarm is generated after the main alarm is generated.

优选的，所述告警处理装置还包括用于确定所述概率关系的概率确定模块1000，Preferably, the alarm processing apparatus further includes a probability determining module 1000 for determining the probability relationship,

所述概率确定模块1000，用于获得预设期间内主告警数量和告警时间，以及对应相关告警数量和告警时间；其中，预设期间可以是所有时间，也可以是最近一年等。若统计获得一相关告警出现a次，其中，b次为该相关告警出现之后出现主告警，则出现该相关告警时，主告警的出现概率为b/a；其中，在这30次电压低告警中，有28次电压低告警后，例如1～10min之内，紧随发生了停电告警，则a＝30，b＝28，b/a＝93.3％。使用通过多种相关告警进行拟合，以及利用马尔可夫假设获得的概率计算公式，产生所述主告警的概率为：The probability determining module 1000 is configured to obtain the number of primary alarms and the alarm time in the preset period, and the corresponding number of alarms and the alarm time; wherein the preset period may be all time, or may be the latest year. If the statistics obtains a related alarm, the primary alarm is generated after the occurrence of the related alarm, and the probability of occurrence of the primary alarm is b/a when the related alarm occurs; wherein, the 30 low voltage alarms occur. In the middle, after 28 times of low voltage alarm, for example, within 1 to 10 minutes, immediately following the occurrence of power failure alarm, a=30, b=28, b/a=93.3%. Using the probability of fitting through a variety of related alarms and using the Markov assumption, the probability of generating the primary alarm is:

∑[P(W₁)*P(W₂|W₁)...P(W_n|W_n-1)+P(U₁)*P(U₂|U₁)...P(U_n|U_n-1)+P(V₁)*P(V₂|V₁)...P(V_n|V_n-1)]∑[P(W ₁ )*P(W ₂ |W ₁ )...P(W _n |W _n-1 )+P(U ₁ )*P(U ₂ |U ₁ )...P(U _n |U _n-1 )+P(V ₁ )*P(V ₂ |V ₁ )...P(V _n |V _n-1 )]

其中，P(W₁)指，当第一相关告警产生时，产生主告警的概率；Where P(W ₁ ) refers to the probability of generating a primary alarm when the first related alarm is generated;

P(W₂|W₁)指，当第一相关告警时，第二相关告警产生的概率；P(W ₂ |W ₁ ) refers to the probability that the second related alarm is generated when the first related alarm is generated;

P(W_n|W_n-1)指，当第N-1相关告警时，第N相关告警产生的概率；P(W _n |W _n-1 ) refers to the probability that the Nth related alarm is generated when the N-1th related alarm is generated;

需要说明的是，N代表主告警对应的相关告警数量；W_n、U_n和V_n分别表示第一相关告警作为第一，第二相关告警作为第一，和第三告警作为第一时的三组概率计算。此处仅提供了三组概率计算，但是应当理解为公式的简写，而并非完整公式；完整的公式应当为，当存在N个相关告警数量时，应当存在N组概率计算；例如N为2时，有W_n和U_n两组计算；例如N为3时，有W_n、U_n和V_n三组计算；例如N为4时，有W_n、U_n、V_n和Y_n四组计算。It should be noted that N represents the number of related alarms corresponding to the primary alarm; W _n , U _n and V _n respectively represent the first related alarm as the first, the second related alarm as the first, and the third alarm as the first Three sets of probability calculations. Only three sets of probability calculations are provided here, but should be understood as a shorthand for the formula, but not a complete formula; the complete formula should be that when there are N related alarm quantities, there should be N sets of probability calculations; for example, when N is 2 There are two sets of calculations of W _n and U _n ; for example, when N is 3, there are three sets of calculations of W _n , U _n and V _n ; for example, when N is 4, there are four groups of W _n , U _n , V _n and Y _n . Calculation.

具体的：假设市电停电告警为主告警，其对应的相关告警有两个，则N＝2。Specifically: Assume that the mains blackout alarm is the main alarm, and there are two corresponding related alarms, then N=2.

两个相关告警分别为A相电压告警和B相电压告警；The two related alarms are A phase voltage alarm and B phase voltage alarm respectively;

通过统计计算获得A相电压告警产生时，市电停电告警产生的概率为b/a(统计方法如上文获得b/a的方法)，记录为P(W₁)；通过统计计算获得A相电压告警产生时，B相电压告警产生的概率为c/d，记录为P(W₂|W₁)；When the A-phase voltage alarm is generated through statistical calculation, the probability of the power-off blackout alarm is b/a (the statistical method is as follows: b/a), and the record is P(W ₁ ); the phase A voltage is obtained through statistical calculation. When the alarm is generated, the probability of the B-phase voltage alarm is c/d, which is recorded as P(W ₂ |W ₁ );

通过统计计算获得B相电压告警产生时，市电停电告警产生的概率为e/f，记录为P(U₁)；通过统计计算获得A相电压告警产生时，B相电压告警产生的概率为c/d，记录为P(U₂|U₁)；When the B-phase voltage alarm is generated by statistical calculation, the probability of the power-off blackout alarm is e/f, which is recorded as P(U ₁ ). When the A-phase voltage alarm is generated through statistical calculation, the probability of the B-phase voltage alarm is c/d, recorded as P(U ₂ |U ₁ );

即：which is:

A相电压告警产生时，市电停电告警产生的概率为P(W₁)；When the A-phase voltage alarm is generated, the probability of generating a power failure alarm is P(W ₁ );

A相电压告警产生时，B相电压告警产生的概率为P(W₂|W₁)； When the phase A voltage alarm is generated, the probability of the B phase voltage alarm is P(W ₂ |W ₁ );

------------------------

B相电压告警产生时，市电停电告警产生的概率为P(U₁)；When the B-phase voltage alarm is generated, the probability of the mains power failure alarm is P(U ₁ );

B相电压告警产生时，A相电压告警产生的概率为P(U₂|U₁)；When the B-phase voltage alarm is generated, the probability of the A-phase voltage alarm is P(U ₂ |U ₁ );

则：then:

市电停电告警的概率为：P(W₁)*P(W₂|W₁)+P(U₁)*P(U₂|U₁)。The probability of the mains blackout alarm is: P(W ₁ )*P(W ₂ |W ₁ )+P(U ₁ )*P(U ₂ |U ₁ ).

假设市电停电告警为主告警，其对应的相关告警有四个，则N＝4；Assume that the mains blackout alarm is the main alarm, and there are four corresponding alarms, then N=4;

四个相关告警分别为第一相关告警、第二相关告警、第三相关告警和第四相关告警。其中，第一、第二、第三和第四并非按重要排序，而仅仅是代号。The four related alarms are a first related alarm, a second related alarm, a third related alarm, and a fourth related alarm, respectively. Among them, the first, second, third and fourth are not sorted by importance, but merely code.

第一组概率计算中，编号1为第一相关告警，编号2为第二相关告警，编号3为第三相关告警，编号4为第四相关告警。In the first set of probability calculations, number 1 is the first related alarm, number 2 is the second related alarm, number 3 is the third related alarm, and number 4 is the fourth related alarm.

第一相关告警产生时，市电停电告警产生的概率为P(W₁)；When the first related alarm is generated, the probability of generating a power failure alarm is P(W ₁ );

第一相关告警产生时，第二相关告警产生的概率为P(W₂|W₁)；When the first related alarm is generated, the probability of the second related alarm is P(W ₂ |W ₁ );

第二相关告警产生时，第三相关告警产生的概率为P(W₃|W₂)；When the second related alarm is generated, the probability of the third related alarm is P(W ₃ |W ₂ );

第三相关告警产生时，第四相关告警产生的概率为P(W₄|W₃)；When the third related alarm is generated, the probability of the fourth related alarm is P(W ₄ |W ₃ );

------------------------

第二组概率计算中，编号1为第二相关告警，编号2为第三相关告警，编号3为第四相关告警，编号4为第一相关告警。In the second set of probability calculations, number 1 is the second related alarm, number 2 is the third related alarm, number 3 is the fourth related alarm, and number 4 is the first related alarm.

第二相关告警产生时，市电停电告警产生的概率为P(U₁)；When the second related alarm is generated, the probability of generating a power failure alarm is P(U ₁ );

第二相关告警产生时，第三相关告警产生的概率为P(U₂|U₁)；When the second related alarm is generated, the probability of the third related alarm is P(U ₂ |U ₁ );

第三相关告警产生时，第四相关告警产生的概率为P(U₃|U₂)；When the third related alarm is generated, the probability of the fourth related alarm is P(U ₃ |U ₂ );

第四相关告警产生时，第一相关告警产生的概率为P(U₄|U₃)；When the fourth related alarm is generated, the probability of the first related alarm is P(U ₄ |U ₃ );

------------------------

第三组概率计算中，编号1为第三相关告警，编号2为第四相关告警，编号3为第一相关告警，编号4为第二相关告警。In the third group of probability calculations, number 1 is the third related alarm, number 2 is the fourth related alarm, number 3 is the first related alarm, and number 4 is the second related alarm.

第三相关告警产生时，市电停电告警产生的概率为P(V₁)；When the third related alarm is generated, the probability of generating a power failure alarm is P(V ₁ );

第三相关告警产生时，第四相关告警产生的概率为P(V₂|V₁)；When the third related alarm is generated, the probability of the fourth related alarm is P(V ₂ |V ₁ );

第四相关告警产生时，第一相关告警产生的概率为P(V₃|V₂)；When the fourth related alarm is generated, the probability of the first related alarm is P(V ₃ |V ₂ );

第一相关告警产生时，第二相关告警产生的概率为P(V₄|V₃)；When the first related alarm is generated, the probability of generating the second related alarm is P(V ₄ |V ₃ );

------------ ------------

第四组概率计算中，编号1为第四相关告警，编号2为第一相关告警，编号3为第二相关告警，编号4为第三相关告警。In the fourth group of probability calculations, number 1 is the fourth related alarm, number 2 is the first related alarm, number 3 is the second related alarm, and number 4 is the third related alarm.

第四相关告警产生时，市电停电告警产生的概率为P(Y₁)；When the fourth related alarm is generated, the probability of generating a power failure alarm is P(Y ₁ );

第四相关告警产生时，第一相关告警产生的概率为P(Y₂|Y₁)；When the fourth related alarm is generated, the probability of the first related alarm is P(Y ₂ |Y ₁ );

第一相关告警产生时，第二相关告警产生的概率为P(Y₃|Y₂)；When the first related alarm is generated, the probability of the second related alarm is P(Y ₃ |Y ₂ );

第二相关告警产生时，第三相关告警产生的概率为P(Y₄|Y₃)；When the second related alarm is generated, the probability of the third related alarm is P(Y ₄ |Y ₃ );

进一步的，所述主从关系可以通过一线程来统计，并且将统计结果汇总为于数据库，并且定期更新该数据库，从而当发生告警时，可以直接从数据库中调取概率关系的数据，而直接判断产生主告警的概率为多少。Further, the master-slave relationship may be counted by a thread, and the statistics are summarized into a database, and the database is periodically updated, so that when an alarm occurs, the data of the probability relationship can be directly retrieved from the database, and directly Determine the probability of generating a primary alarm.

本实施例，通过获得历史告警信息，并通过相关性计算公式来获得当前产生的相关告警伴随主告警产生的概率，具有效率高，以及历史数据越多，相关性的判定越准确的效果。In this embodiment, by obtaining the historical alarm information and obtaining the probability that the currently generated related alarm is accompanied by the main alarm by using the correlation calculation formula, the efficiency is high, and the more the historical data, the more accurate the correlation determination.

优选的，所述告警处理装置还包括：Preferably, the alarm processing device further includes:

复检模块1100，用于在检测到所述主告警消除时，重新判断未上报的相关告警是否存在；The re-inspection module 1100 is configured to re-determine whether the unreported related alarm exists when detecting the main alarm cancellation;

第四上报模块1200，用于在所述复检模块1100判定为存在时，则上报所述相关告警；否则，消除所述相关告警。The fourth reporting module 1200 is configured to report the related alarm when the re-inspection module 1100 determines that the re-inspection module 1100 is present; otherwise, the related alarm is eliminated.

本实施例，通过在主告警消除后再次确认相关告警是否存在，则可以避免相关告警的产生源并非主告警，而导致的漏报情况发生，因此本方案具有判断更准确可靠的效果。In this embodiment, by confirming whether the related alarm exists after the main alarm is cleared, the source of the related alarm is prevented from being the main alarm, and the missed report occurs. Therefore, the solution has the effect of more accurate and reliable judgment.

需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个......”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。It is to be understood that the term "comprises", "comprising", or any other variants thereof, is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes those elements. It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述 实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是移动终端，计算机，服务器，空调器，或者网络设备等)执行本发明各个实施例所述的方法。Those skilled in the art can clearly understand the above by the description of the above embodiments. The embodiment method can be implemented by means of software plus a necessary general hardware platform, of course, also through hardware, but in many cases the former is a better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a mobile terminal, a computer, a server, an air conditioner, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the present invention and the drawings are directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

工业实用性Industrial applicability

本发明所提供的告警处理方法，通过主从关系来判断告警的性质，若为主告警，则仅上报主告警而不上报伴生的相关告警，从而能够更清楚的展示事故的原因，避免产生告警海啸，便于工作人员了解告警的真实来源，而达到提高运维管理的效率。 The alarm processing method provided by the present invention determines the nature of the alarm through the master-slave relationship. If the master alarm is used, only the main alarm is reported and the associated alarm is not reported, so that the cause of the accident can be more clearly displayed and the alarm can be avoided. The tsunami makes it easy for the staff to understand the true source of the alarm and improve the efficiency of operation and maintenance management.

Claims (10)

1. 一种告警处理方法，用于数据中心，所述告警处理方法包括步骤：An alarm processing method is used in a data center, and the alarm processing method includes the following steps:

   在检测到告警时，根据主从关系判断所述告警是否为主告警；When the alarm is detected, it is determined whether the alarm is a main alarm according to the master-slave relationship;

   若是主告警，则上报所述主告警，并且在所述主告警解除之前，在后续检测到对应所述主告警的相关告警时，不上报所述相关告警。If the primary alarm is generated, the primary alarm is reported, and the related alarm is not reported when the related alarm corresponding to the primary alarm is detected.
2. 如权利要求1所述的告警处理方法，其中，所述主从关系的获得步骤包括：The alarm processing method according to claim 1, wherein the obtaining the master-slave relationship comprises:

   获得预设期间内所有告警的告警数量和告警时间；Obtain the number of alarms and alarm time of all alarms in the preset period;

   若统计获得第一告警出现n次，其中，m次为第一告警出现之后出现第二告警，m/n≥第一预设比率，则所述第一告警标记为主告警，第二告警标记为对应第一告警的相关告警。If the first alarm is obtained n times, wherein m times is the second alarm after the first alarm occurs, and m/n ≥ the first preset ratio, the first alarm is marked as a primary alarm, and the second alarm is marked. Corresponding to the alarm related to the first alarm.
3. 如权利要求1所述的告警处理方法，其中，所述告警处理方法包括还步骤：The alarm processing method according to claim 1, wherein the alarm processing method comprises the further steps of:

   若不是主告警，则判断是否为相关告警；If it is not the primary alarm, it is determined whether it is a related alarm;

   若是相关告警，则获得后续第一预设时间内的其他相关告警；If the alarm is related, the other related alarms in the first preset time period are obtained;

   根据所获的相关告警和概率关系获得产生对应主告警的概率；Obtaining a probability of generating a corresponding primary alarm according to the obtained related alarm and probability relationship;

   在所述概率超过预设概率时，则不上报对应所述主告警的相关告警；When the probability exceeds the preset probability, the related alarm corresponding to the primary alarm is not reported;

   判断在第二预设时间内是否出现所述主告警；Determining whether the primary alarm occurs within a second preset time;

   若未出现所述主告警，则上报未上报的相关告警；否则，上报所述主告警，并且维持不上报所述相关告警。If the primary alarm is not generated, the related alarm that is not reported is reported; otherwise, the primary alarm is reported, and the related alarm is not reported.
4. 如权利要求3所述的告警处理方法，其中，所述概率关系的获得步骤包括：The alarm processing method according to claim 3, wherein the obtaining the probability relationship comprises:

   获得预设期间内主告警数量和告警时间，以及对应相关告警数量和告警时间；Obtain the number of primary alarms and alarm time in the preset period, and the corresponding number of alarms and alarm time;

   若统计获得一相关告警出现a次，其中，b次为该相关告警出现之后出现主告警，则出现该相关告警时，主告警的出现概率为b/a； If the statistics obtains a related alarm, the primary alarm is generated after the occurrence of the related alarm, and the probability of occurrence of the primary alarm is b/a.

   使用通过多种相关告警进行拟合，以及利用马尔可夫假设获得的概率计算公式，产生所述主告警的概率为：Using the probability of fitting through a variety of related alarms and using the Markov assumption, the probability of generating the primary alarm is:

   ∑[P(W₁)*P(W₂|W₁)...P(W_n|W_n-1)+P(U₁)*P(U₂|U₁)...P(U_n|U_n-1)+P(V₁)*P(V₂|V₁)...P(V_n|V_n-1)]∑[P(W ₁ )*P(W ₂ |W ₁ )...P(W _n |W _n-1 )+P(U ₁ )*P(U ₂ |U ₁ )...P(U _n |U _n-1 )+P(V ₁ )*P(V ₂ |V ₁ )...P(V _n |V _n-1 )]
5. 如权利要求1所述的告警处理方法，其中，所述告警处理方法还包括步骤：The alarm processing method according to claim 1, wherein the alarm processing method further comprises the steps of:

   在检测到所述主告警消除时，重新判断未上报的相关告警是否存在；When the detection of the primary alarm is detected, it is determined whether the related alarm that is not reported exists.

   若存在，则上报所述相关告警；否则，消除所述相关告警。If yes, the related alarm is reported; otherwise, the related alarm is eliminated.
6. 一种告警处理装置，用于数据中心，所述告警处理装置包括：An alarm processing device is used in a data center, and the alarm processing device includes:

   第一判断模块，用于在检测到告警时，根据主从关系判断所述告警是否为主告警；The first judging module is configured to determine, according to the master-slave relationship, whether the alarm is a main alarm when the alarm is detected;

   第一上报模块，用于在所述第一判断模块判定是主告警时，则上报所述主告警，并且在所述主告警解除之前，在后续检测到对应所述主告警的相关告警时，不上报所述相关告警。a first reporting module, configured to report the primary alarm when the first determining module determines that the primary alarm is generated, and when the related alarm corresponding to the primary alarm is detected subsequently, before the primary alarm is released, The related alarms are not reported.
7. 如权利要求6所述的告警处理装置，其中，所述告警处理装置还包括用于确定所述主从关系的主从确定模块，The alarm processing apparatus according to claim 6, wherein said alarm processing apparatus further comprises a master-slave determining module for determining said master-slave relationship,

   所述主从确定模块，用于获得预设期间内所有告警的告警数量和告警时间；若统计获得第一告警出现n次，其中，m次为第一告警出现之后出现第二告警，m/n≥第一预设比率，则所述第一告警标记为主告警，第二告警标记为对应第一告警的相关告警。The master-slave determining module is configured to obtain the number of alarms and the alarm time of all the alarms in the preset period; if the first alarm is obtained n times, wherein the second alarm occurs after the first alarm occurs, m/ n ≥ the first preset ratio, the first alarm is marked as a primary alarm, and the second alarm is marked as a related alarm corresponding to the first alarm.
8. 如权利要求6所述的告警处理装置，其中，所述告警处理装置还包括：The alarm processing device of claim 6, wherein the alarm processing device further comprises:

   第二判断模块，用于在所述第一判断模块判定不是主告警时，则判断是否为相关告警；a second determining module, configured to determine, when the first determining module determines that it is not a primary alarm, whether it is a related alarm;

   后续获得模块，用于在所述第二判断模块判定是相关告警，则获得后续第一预设时间内的其他相关告警；a subsequent obtaining module, configured to determine, in the second determining module, that the related alarm is obtained, and obtain other related alarms in the subsequent first preset time;

   告警获得模块，用于根据所获的相关告警和概率关系获得产生对应主告警的概率； An alarm obtaining module, configured to obtain a probability of generating a corresponding primary alarm according to the obtained related alarm and probability relationship;

   第二上报模块，用于在概率获得模块所获概率超过预设概率时，则不上报对应所述主告警的相关告警；The second reporting module is configured to not report the related alarm corresponding to the primary alarm when the probability obtained by the probability obtaining module exceeds a preset probability;

   第三判断模块，用于判断在第二预设时间内是否出现所述主告警；a third determining module, configured to determine whether the primary alarm occurs within a second preset time;

   第三上报模块，用于在所述第三判断模块判定未出现所述主告警时，则上报未上报的相关告警；否则，维持不上报。The third reporting module is configured to report, when the third determining module determines that the primary alarm does not occur, report the related alarm that is not reported; otherwise, the report is not reported.
9. 如权利要求8所述的告警处理装置，其中，所述告警处理装置还包括用于确定所述概率关系的概率确定模块，The alarm processing apparatus according to claim 8, wherein said alarm processing apparatus further comprises a probability determining module for determining said probability relationship,

   所述概率确定模块，用于获得预设期间内主告警数量和告警时间，以及对应相关告警数量和告警时间；若统计获得一相关告警出现a次，其中，b次为该相关告警出现之后出现主告警，则出现该相关告警时，主告警的出现概率为b/a；使用通过多种相关告警进行拟合，以及利用马尔可夫假设获得的概率计算公式，产生所述主告警的概率为：The probability determining module is configured to obtain the number of primary alarms and the alarm time in the preset period, and the corresponding number of related alarms and the alarm time; if the statistics obtain a related alarm occurs once, wherein b times appear after the related alarm occurs The primary alarm, when the related alarm occurs, the probability of occurrence of the primary alarm is b/a; the probability of generating the primary alarm is obtained by fitting with a plurality of related alarms and using a probability calculation formula obtained by the Markov assumption :

   ∑[P(W₁)*P(W₂|W₁)...P(W_n|W_n-1)+P(U₁)*P(U₂|U₁)...P(U_n|U_n-1)+P(V₁)*P(V₂|V₁)...P(V_n|V_n-1)]∑[P(W ₁ )*P(W ₂ |W ₁ )...P(W _n |W _n-1 )+P(U ₁ )*P(U ₂ |U ₁ )...P(U _n |U _n-1 )+P(V ₁ )*P(V ₂ |V ₁ )...P(V _n |V _n-1 )]
10. 如权利要求6所述的告警处理装置，其中，所述告警处理装置还包括：The alarm processing device of claim 6, wherein the alarm processing device further comprises:

    复检模块，用于在检测到所述主告警消除时，重新判断未上报的相关告警是否存在；The rechecking module is configured to re-determine whether the unreported related alarm exists when the main alarm is detected;

    第四上报模块，用于在所述复检模块判定为存在时，则上报所述相关告警；否则，消除所述相关告警。 The fourth reporting module is configured to report the related alarm when the rechecking module determines that the rechecking module is present; otherwise, the related alarm is eliminated.

Images