CN114461506A - Cluster alarm control method, device, electronic device and storage medium - Google Patents

Abstract

The embodiment of the invention provides a cluster alarm control method, which comprises the following steps: in the cluster working process, under the condition that a first alarm item on a management side is detected, judging whether a second alarm item on a user side having a relationship with the first alarm item exists or not; if the second alarm item exists currently, whether alarm information aiming at the first alarm item is sent out or not is judged according to the relation between the alarm data of the first alarm item and the alarm data of the second alarm item. By applying the technical scheme provided by the embodiment of the invention, the alarm item at the management side and the alarm item at the user side are combined to judge whether the alarm information is sent out or not, so that the accuracy of the alarm information can be improved, the false alarm rate of the alarm information is reduced, and the unnecessary cost of manpower and material resources can be effectively avoided being consumed. The embodiment of the invention also provides a cluster alarm control device, electronic equipment and a computer readable storage medium, and the cluster alarm control device, the electronic equipment and the computer readable storage medium have corresponding technical effects.

Description

Cluster alarm control method, device, electronic device and storage medium

technical field

The present invention relates to the technical field of computer applications, in particular to a cluster alarm control method, device, electronic device and storage medium.

Background technique

With the rapid development of computer technology, cluster technology has gradually developed. Through cluster technology, relatively high benefits in terms of performance, reliability, flexibility, etc. can be obtained at a lower cost. In enterprises and institutions, more and more clusters are deployed to improve business processing capabilities.

To ensure the stability of the cluster, an alarm mechanism is usually set on the management side to diagnose the health status of the cluster. Once there is a problem with the cluster, an alert message will be issued. The administrator can view the cluster based on the alarm information and solve the problem.

At present, this alarm processing method can solve the problems of the cluster in time to a certain extent. However, because the cluster has a certain self-healing ability, it can automatically recover in a short time after a problem occurs. Sending alarm information will result in false alarm information. If the false alarm rate is high, the process of viewing the cluster based on the alarm information will cost the administrator unnecessary labor and material costs.

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present invention is to provide a cluster alarm control method, device, electronic device and storage medium, so as to reduce the false alarm rate of alarm information and avoid unnecessary labor and material costs. The specific technical solutions are as follows:

In the first aspect of the implementation of the present invention, a cluster alarm control method is first provided, including:

During the cluster operation, when the first alarm item on the management side is detected, determine whether there is currently a second alarm item on the user side that is associated with the first alarm item;

If the second alarm item currently exists, according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item, it is determined whether to send alarm information for the first alarm item.

In a specific embodiment of the present invention, determining whether to issue an alarm for the first alarm item according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item information, including:

According to the alarm data of the first alarm item and the alarm data of the second alarm item, determine the magnitude relationship between the alarm level of the first alarm item and the alarm level of the second alarm item;

If the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, it is determined to send alarm information for the first alarm item.

In a specific embodiment of the present invention, in the case that the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, when the determination is made to issue an alarm for the first alarm item Before the alarm information, it also includes:

According to the alarm data of the first alarm item and the alarm data of the second alarm item, determine the inclusion relationship between the management-side associated alarm item set of the second alarm item and the first alarm item, and the second alarm item The set of alarm items associated with the management side of the alarm item includes a preset alarm item on the management side that has an associated relationship with the second alarm item;

If the management-side associated alarm item set of the second alarm item includes the first alarm item, the step of determining to issue alarm information for the first alarm item is performed.

In a specific implementation manner of the present invention, when the second alarm item does not currently exist, the method further includes:

Judging whether there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item within the judgment waiting time period before the moment when the first alarm item is detected;

If there is no unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item, the first alarm item is ignored.

In a specific embodiment of the present invention, when there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item, the method further includes:

According to the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item, it is determined whether to send alarm information for the first alarm item.

In a specific embodiment of the present invention, it is determined whether to send alarm information for the first alarm item according to the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item, include:

If the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item is within the set first number range, ignore the first alarm item;

If the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item is within the set second number range, determine to send alarm information for the first alarm item;

The upper limit value of the first quantity range is smaller than the lower limit value of the second quantity range.

In a specific embodiment of the present invention, when the first alarm item on the management side is detected, in the process of determining whether there is currently a second alarm item on the user side that is associated with the first alarm item Before, also included:

determining the alarm type of the first alarm item;

If the alarm type of the first alarm item is the set low-sensitivity type, determine whether the alarm event corresponding to the first alarm item is successfully recovered when the allowable waiting time for self-healing of the first alarm item is reached. ;

If the alarm event corresponding to the first alarm item is not successfully recovered, the step of judging whether there is currently a second alarm item on the user side that is associated with the first alarm item is performed.

In a specific embodiment of the present invention, when the alarm type of the first alarm item is the set low-sensitivity type, the method further includes:

marking the alarm state of the first alarm item as a pre-recovery state;

If the alarm event corresponding to the first alarm item is successfully recovered within the allowable waiting time for self-healing of the first alarm item, the alarm state of the first alarm item is updated from the pre-recovery state to recovery state;

If the alarm event corresponding to the first alarm item is not successfully recovered within the allowable waiting time for self-healing of the first alarm item, the alarm state of the first alarm item is updated from the pre-recovery state to If the alarm event corresponding to the first alarm item is detected to be successfully processed after the alarm information for the first alarm item is sent, the alarm state of the first alarm item is changed from the fault state to the fault state. The status is updated to processing complete status.

In a second aspect of the implementation of the present invention, a cluster alarm control device is also provided, including:

The module for determining whether the associated alarm item exists is used to determine whether there is currently a second alarm on the user side that is associated with the first alarm item when the first alarm item on the management side is detected during the cluster operation. item;

A module for judging whether the alarm information is sent out is used to determine whether to send out the alarm information according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item when the second alarm item currently exists Alarm information for the first alarm item.

In yet another aspect of the implementation of the present invention, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

memory for storing computer programs;

The processor is configured to implement the steps of the above cluster alarm control method when executing the program stored in the memory.

In another aspect of the implementation of the present invention, there is also provided a computer-readable storage medium on which a computer program is stored, characterized in that, when the program is executed by a processor, the above-mentioned cluster alarm control method is implemented.

In yet another aspect of the implementation of the present invention, there is also provided a computer program product including instructions, which, when running on a computer, enables the computer to execute the above-mentioned cluster alarm control method.

In the technical solution provided by the embodiment of the present invention, when the first alarm item on the management side is detected, instead of directly sending out alarm information for the first alarm item, it is first judged whether there is currently an association with the first alarm item. If the second alarm item on the user side of the relationship exists, it is considered that the alarm event corresponding to the first alarm item on the management side may have affected the use of the user side. The relationship between the alarm data, to determine whether to send the alarm information for the first alarm item, that is, to determine whether to send the alarm information through the combination of the alarm item on the management side and the alarm item on the user side, which can improve the accuracy of the alarm information. It can reduce the false alarm rate of alarm information, and can effectively avoid unnecessary labor and material costs.

Description of drawings

In order to illustrate the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that are required in the description of the embodiments or the prior art.

1 is a schematic diagram of the composition structure of a monitoring and alarm platform in an embodiment of the present invention;

FIG. 2 is an implementation flowchart of a cluster alarm control method in an embodiment of the present invention;

FIG. 3 is a schematic diagram of a specific process of cluster alarm control in an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a cluster alarm control device in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an electronic device in an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.

The core of the present invention is to provide a cluster alarm control method, which can be applied to a monitoring and alarm platform. In order to facilitate understanding, the composition structure of the monitoring and alarm platform to which the technical solution of the present invention is applied will be introduced first.

Referring to FIG. 1 , it shows the composition architecture of the monitoring and alarming platform. In the monitoring and alarm platform, the cluster control center can monitor the health status of one or more clusters, such as the health status of cluster A, cluster B, cluster C, ..., cluster n-1, cluster n, cluster n+1, etc. The status is monitored, and when there is a problem with the cluster, an alarm item on the management side can be generated. At the same time, when a problem in the cluster affects the use of the user, the user application management center can generate an alarm item on the user side. The alarm control center can obtain the alarm items on the management side and the alarm items on the user side, and combine the alarm items on the management side and the alarm items on the user side to determine whether to send alarm information. In this way, the accuracy of the alarm information can be improved, the false alarm rate of the alarm information can be reduced, and the unnecessary cost of manpower and material resources can be effectively avoided.

The technical solutions of the embodiments of the present invention are generally described above from the perspective of the monitoring and alarm platform applied in the embodiments of the present invention, and the specific implementation of the embodiments of the present invention is described in detail below.

Referring to FIG. 2, it is an implementation flowchart of a cluster alarm control method provided by an embodiment of the present invention. The method can be applied to an alarm control center in a monitoring and alarm platform, and may include the following steps:

S210: In the case of detecting the first alarm item on the management side during the cluster operation, determine whether there is currently a second alarm item on the user side that is associated with the first alarm item.

It is understandable that some problems will inevitably occur during the working process of the cluster, for example, the application program interface server (api-server) process is abnormal, the controller manager (controller manager) process is abnormal, and the remaining free space on the disk is less than the set space threshold. And other issues. When there is a problem with the cluster, an alarm item on the management side will be generated. The alarm items on the management side can be considered as alarm items from the administrator's perspective, which are generated based on the alarm mechanism set in the administrator's perspective.

When a problem in the cluster affects the usage on the user side, an alarm item on the user side will be generated. The alarm items on the user side can be considered as alarm items from the user's perspective, which are generated based on the alarm mechanism set in the user's perspective.

Specifically, the alarm item on the management side can be generated by the cluster control center in the monitoring and alarm platform when there is a problem with the cluster, and the alarm item on the user side can be the user application management center in the monitoring and alarm platform. Generated when the user uses it. That is to say, the alarm items on the management side can be obtained through the cluster control center, and the alarm items on the user side can be obtained through the user application management center.

However, it is understandable that not all problems in the cluster will affect the use of the user side. For example, when the remaining free disk space of the cluster is less than the set space threshold, an alarm item on the management side will be generated for this problem, but the The problem will not affect the usage on the user side, and thus no alarm items on the user side will be generated.

其对应的有关联关系的用户侧的告警项集合，即用户侧关联告警项集合可以记为

用户侧的告警项可以记为

其对应的有关联关系的管理侧的告警项集合，即管理侧关联告警项集合可以记为

同时，可以设定每个告警项与其对应的关联告警项集合中的每个告警项的关联性，如强关联性或弱关联性等。针对于一个告警项而言，还可以通过多个告警项集合表示与该告警项具有不同关联关系的告警项。In this embodiment of the present invention, an association relationship between an alarm item on the management side and an alarm item on the user side may be established in advance. For example, the alarm item on the management side can be recorded as

The corresponding set of alarm items on the user side with associated relationship, that is, the set of related alarm items on the user side can be recorded as

The alarm item on the user side can be recorded as

The corresponding set of alarm items on the management side with the associated relationship, that is, the set of related alarm items on the management side can be recorded as

At the same time, the correlation between each alarm item and each alarm item in the corresponding set of associated alarm items can be set, such as strong correlation or weak correlation. For an alarm item, multiple alarm item sets may also be used to represent alarm items that have different correlations with the alarm item.

During the cluster operation, if the first alarm item on the management side is detected, it may be first determined whether there is currently a second alarm item on the user side that is associated with the first alarm item. Specifically, it may be determined whether there is currently a second alarm item on the user side associated with the first alarm item according to the pre-established association relationship between the alarm item on the management side and the alarm item on the user side. The relationship between the alarm item on the management side and the alarm item on the user side can be recorded in the database. When the alarm control center detects the first alarm item on the management side, it can check the relationship recorded in the database to determine whether there is currently a relationship with the first alarm item. An alarm item is associated with a second alarm item on the user side.

If there is currently a second alarm item on the user side that is associated with the first alarm item, it can be considered that the alarm event corresponding to the first alarm item has affected the use of the user side, and the operations of the subsequent steps can be continued. If there is currently no second alarm item on the user side that is associated with the first alarm item, it can be considered that the alarm event corresponding to the first alarm item has not yet affected the use of the user side, and the first alarm item can be ignored. Or process it based on other processing rules.

S220: If the second alarm item currently exists, determine whether to send alarm information for the first alarm item according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item.

In this embodiment of the present invention, the first data format of the alarm data of the alarm item on the management side and the second data format of the alarm data of the alarm item on the user side may be preset. After the alarm item on the management side is generated, the alarm data of the alarm item may be formatted according to the set first data format, and converted into alarm data having the first data format. After the alarm item on the user side is generated, the alarm data of the alarm item may be formatted according to the set second data format, and converted into alarm data having the second data format. In order to facilitate subsequent relationship determination based on the alarm data.

具有第二数据格式的用户侧的告警项的告警数据为：

For example, the alarm data of the alarm item on the management side having the first data format is:

The alarm data of the alarm item on the user side with the second data format is:

为用户侧关联告警项集合；

为管理侧关联告警项集合；

为管理侧的告警项的告警状态；P为告警等级；Htime为自愈允许等待时长，如果告警项的告警类型为高灵敏类型，则Htime为0，即高灵敏类型的告警项没有自愈等待时长；Wtime为判断等待时长，单位可以为秒。Among them, Alert is the specific alarm content, that is, the alarm event;

A collection of associated alarm items for the user side;

A collection of associated alarm items for the management side;

is the alarm status of the alarm item on the management side; P is the alarm level; Htime is the allowable waiting time for self-healing. If the alarm type of the alarm item is a high-sensitivity type, Htime is 0, that is, the alarm item of the high-sensitivity type has no self-healing waiting time. Duration; Wtime is the waiting time for judgment, and the unit can be seconds.

It should be noted that the above-mentioned first data format and second data format are only specific examples, and other different formats may be set in the specific implementation process, and the data items included therein may also be increased or decreased.

When the first alarm item on the management side is detected, if it is determined that there is currently a second alarm item on the user side that is associated with the first alarm item, it can be considered that the alarm event corresponding to the first alarm item has affected the user By using the side, the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item can be further determined. Then, according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item, it is determined whether to send alarm information for the first alarm item.

By applying the method provided by the embodiment of the present invention, when the first alarm item on the management side is detected, instead of directly sending out alarm information for the first alarm item, it is first judged whether there is currently a problem with the first alarm item. If the second alarm item on the user side of the associated relationship exists, it is considered that the alarm event corresponding to the first alarm item on the management side may have affected the use of the user side. Then, according to the alarm data of the first alarm item and the second alarm item The relationship between the alarm data and the alarm data, determine whether to send the alarm information for the first alarm item, that is to say, through the combination of the alarm item on the management side and the alarm item on the user side, judging whether to send the alarm information can improve the accuracy of the alarm information. Accuracy, reduce the false alarm rate of alarm information, and can effectively avoid unnecessary labor and material costs.

In an embodiment of the present invention, step S220 may include the following steps:

Step 1: according to the alarm data of the first alarm item and the alarm data of the second alarm item, determine the magnitude relationship between the alarm level of the first alarm item and the alarm level of the second alarm item;

Step 2: If the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, it is determined to send alarm information for the first alarm item.

For the convenience of description, the above two steps are combined for description.

In this embodiment of the present invention, when the first alarm item on the management side is detected, if it is determined that there is currently a second alarm item on the user side that is associated with the first alarm item, it can be considered that the first alarm item corresponds to The alarm event of the first alarm item has affected the usage on the user side, and the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item can be further determined.

Specifically, according to the alarm data of the first alarm item and the alarm data of the second alarm item, the magnitude relationship between the alarm level of the first alarm item and the alarm level of the second alarm item can be obtained by comparison. After determining the magnitude relationship between the alarm level of the first alarm item and the alarm level of the second alarm item, it is judged whether to send alarm information for the first alarm item according to the magnitude relationship.

The alarm items on the management side and the alarm items on the user side can correspond to alarm levels, and can be divided into multiple alarm levels according to the impact degree of the alarm event. For example, it is divided into 4 alarm levels: P1, P2, P3, and P4. Among them, the alarm events with the alarm level of P1 are important alarm events, which need to be dealt with immediately once they occur; the alarm events with the alarm level of P2 are more important alarm events and can be recovered within a few minutes; the alarm events with the alarm level of P3 are unimportant alarms The event is allowed to recover within an hour-level time; an alarm event with an alarm level of P4 is a notification event and generally does not require attention. Of course, these four alarm levels are only specific examples, and more or less alarm levels may be set in the specific implementation process.

If the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, it can be considered that the alarm event corresponding to the first alarm item has a greater impact on the usage on the user side. Alarm information of an alarm item. This can improve the accuracy of alarm information and reduce false positives.

In a specific embodiment of the present invention, when the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, before it is determined to send the alarm information for the first alarm item, the The alarm data of an alarm item and the alarm data of the second alarm item, determine the inclusion relationship between the management-side associated alarm item set of the second alarm item and the first alarm item, if the management-side associated alarm item set of the second alarm item includes the first alarm item an alarm item, the step of determining to issue alarm information for the first alarm item may be performed. The set of alarm items associated with the management side of the second alarm item includes preset alarm items on the management side that have an associated relationship with the second alarm item.

It can be understood that if the alarm data of the first alarm item is abnormal, the correlation between the first alarm item and the second alarm item determined by the alarm data of the first alarm item will be incorrect. In this case , it may still lead to a false alarm of the alarm information for the first alarm item. Therefore, in the case that the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, it can be further determined whether the set of alarm items associated with the management side of the second alarm item contains the first alarm item, and if it contains the first alarm item item, it is considered that the first alarm item and the second alarm item do have an associated relationship, and it can be determined that alarm information for the first alarm item is sent. That is, when the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, and the set of alarm items associated with the management side of the second alarm item includes the first alarm item, it is determined to issue an alarm for the first alarm item information to further improve the accuracy of alarm information and reduce false positives.

If the alarm level of the second alarm item is lower than the alarm level of the first alarm item, or the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, but the management-side associated alarm item set of the second alarm item does not contain For the first alarm item, the first alarm item may be ignored first, and it may be recorded in a file such as a log, and the alarm information for the first alarm item will not be issued. In order to reduce false positives and avoid wasting more unnecessary human and material costs.

In the specific implementation process, when the first alarm item on the management side is detected, and it is determined that there is currently a second alarm item on the user side that is associated with the first alarm item, the second alarm item and the first alarm item can be determined first. The correlation of an alarm item, such as strong correlation or weak correlation.

If the second alarm item has a strong correlation with the first alarm item, the alarm level of the second alarm item may be greater than or equal to the alarm level of the first alarm item, and the associated alarm item set of the second alarm item includes the first alarm In the case of the item, it is determined to issue alarm information for the first alarm item.

If the second alarm item has a weak correlation with the first alarm item, it may be determined that alarm information for the first alarm item is issued when the number of the second alarm items is greater than the set number threshold.

In an embodiment of the present invention, in the case that the second alarm item does not currently exist, the method may further include the following steps:

Step 1: judging whether there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item within the judgment waiting time period before the moment when the first alarm item is detected;

Step 2: If there is no unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item, the first alarm item is ignored.

For the convenience of description, the above two steps are combined for description.

As described above, the alarm data of the alarm item on the management side may have the first data format, which includes the alarm event, the corresponding set of related alarm items on the user side, the alarm level, the alarm state, the allowable waiting time for self-healing, and the waiting time for judgment. and other data items. The judgment waiting time for different alarm items can be set based on the alarm level, which can be the same or different.

When the first alarm item on the management side is detected, if there is currently no second alarm item on the user side that is associated with the first alarm item, it can be considered that the alarm event corresponding to the first alarm item does not affect the Using the user side, it is possible to further determine whether there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item within the judgment waiting time period before the moment when the first alarm item is detected. Alarm items with the same alarm event have the same judgment waiting time.

If there is no unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item within the judgment waiting period before the first alarm item is detected, it can be considered that the first alarm item is the first alarm item within the judgment waiting period. For the detected alarm item with the alarm event, the first alarm item may be ignored, and no alarm information for the first alarm item is sent. In this way, false alarms of alarm information can be effectively avoided. At the same time, the alarm state of the first alarm item can be marked as a pre-recovery state, so that when an alarm item that is the same as the alarm event corresponding to the first alarm item is detected again, it can be determined according to the alarm state that the first alarm item is unprocessed. alarm item. If the first alarm item is successfully recovered within the judgment waiting time period after the first alarm item is detected, the alarm state of the first alarm item may be marked as the recovery state, so that when the first alarm item is detected again, the alarm state corresponding to the first alarm item is detected again. When the alarm events of the same alarm items are the same, it can be determined according to the alarm state that the first alarm item is not an unprocessed alarm item.

In an embodiment of the present invention, when there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item, the method may further include the following steps:

According to the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item, it is determined whether to send alarm information for the first alarm item.

When the first alarm item on the management side is detected, if there is currently no second alarm item on the user side that is associated with the first alarm item, it can be considered that the alarm event corresponding to the first alarm item does not affect the Using the user side, it is possible to further determine whether there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item within the judgment waiting time period before the moment when the first alarm item is detected.

If there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item within the judgment waiting time period before the first alarm item is detected, it can be considered that there are still alarm items with the same alarm before the first alarm item is generated The alarm item of the event has not been processed yet. In this case, the same number of unprocessed alarm items as the alarm event corresponding to the first alarm item can be determined. According to the number, it can be determined whether to send alarm information for the first alarm item.

Specifically, if the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item is within the set first number range, the first alarm item is ignored; if the alarm event corresponding to the first alarm item is If the quantity of the same unprocessed alarm items is within the set second quantity range, it is determined to send alarm information for the first alarm item; the upper limit value of the first quantity range is smaller than the lower limit value of the second quantity range.

In this embodiment of the present invention, the first quantity range and the second quantity range may be preset, and the upper limit value of the first quantity range is smaller than the lower limit value of the second quantity range. For example, set the first number range to (0,1], and set the second number range to [2,5].

If the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item is within the set first number range, it can be considered that the alarm event corresponding to the first alarm item may be recovering itself, and the first alarm item can be ignored. Alarm item, no alarm information for the first alarm item is sent. In this way, false alarms of alarm information can be effectively avoided.

If the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item is within the set second number range, it can be considered that the alarm event corresponding to the first alarm item is relatively urgent and may not be self-recovery. It is determined to issue alarm information for the first alarm item, so as to perform troubleshooting in a timely manner based on the alarm information. At the same time, the alarm state of the first alarm item may be marked as a fault state, and after the processing is completed, the alarm state of the first alarm item may be marked as a processing completed state.

In an embodiment of the present invention, when the first alarm item on the management side is detected, before judging whether there is currently a second alarm item on the user side that is associated with the first alarm item, the method may also Include the following steps:

The first step: determine the alarm type of the first alarm item;

The second step: if the alarm type of the first alarm item is the set low-sensitivity type, determine whether the alarm event corresponding to the first alarm item is successfully recovered when the allowable waiting time for self-healing of the first alarm item is reached;

The third step: if the alarm event corresponding to the first alarm item is not successfully recovered, the step of judging whether there is currently a second alarm item on the user side associated with the first alarm item is performed.

For the convenience of description, the above three steps are combined for description.

The alarm items on the management side can have multiple alarm types, such as high-sensitivity types and low-sensitivity types. Alarm items of high sensitivity type need to send alarm information in time, such as the corresponding alarm items such as application program interface server process abnormality, controller manager process abnormality, DNS server/forwarder failure to start, etc. Low-sensitivity alarm items can wait for a period of time for redundancy. For example, the remaining free disk space is less than the set space threshold, a certain machine is restarted, and the container collection has too much backlog.

The allowable waiting time for self-healing of alarm items of high sensitivity type can be set to 0, and the allowable waiting time for self-healing of alarm items of low sensitivity type can be set according to the alarm level.

In the embodiment of the present invention, when the first alarm item on the management side is detected, the alarm type of the first alarm item may be determined first.

If the alarm type of the first alarm item is the set low sensitivity type, it can be determined whether the alarm event corresponding to the first alarm item is successfully recovered when the allowable waiting time for self-healing of the first alarm item is reached. If the alarm event corresponding to the first alarm item is not successfully recovered within the allowable waiting time for self-healing, it can be considered that the alarm event corresponding to the first alarm item cannot be self-healing, and a judgment can be performed to determine whether there is a current associated with the first alarm item. The second alarm item on the user side of the relationship and the following steps, that is, in combination with the alarm item on the user side, it is judged whether to send alarm information for the first alarm item, so as to reduce the false alarm rate.

If the alarm type of the first alarm item is the set high-sensitivity type, the steps of judging whether there is currently a second alarm item on the user side associated with the first alarm item and the following steps can be directly performed, that is, combining with the user side The alarm item of the first alarm item is judged whether to send the alarm information for the first alarm item, so as to judge whether the alarm information is sent out in time, which can improve the alarm efficiency while reducing the false alarm rate.

In an embodiment of the present invention, when the alarm type of the first alarm item is the set low-sensitivity type, the method may further include the following steps:

The first step: marking the alarm state of the first alarm item as a pre-recovery state;

Step 2: if the alarm event corresponding to the first alarm item is successfully recovered within the allowable waiting time for self-healing of the first alarm item, update the alarm state of the first alarm item from the pre-recovery state to the recovery state;

Step 3: If the alarm event corresponding to the first alarm item is not successfully recovered within the allowable waiting time for self-healing of the first alarm item, update the alarm state of the first alarm item from the pre-recovery state to the fault state, And when it is detected that the alarm event corresponding to the first alarm item has been successfully processed after the alarm information for the first alarm item is sent, the alarm state of the first alarm item is updated from the fault state to the processing completed state.

For the convenience of description, the above three steps are combined for description.

In this embodiment of the present invention, when the first alarm item on the management side is detected, if it is determined that the alarm type of the first alarm item is a low-sensitivity type, the alarm state of the first alarm item may be marked as a pre-recovery state , and then start timing, and rotate the query according to the set time interval to determine whether the alarm event of the first alarm item is successfully recovered within the allowable waiting time for self-healing of the first alarm item.

If the alarm event corresponding to the first alarm item is successfully recovered within the allowable waiting time for self-healing of the first alarm item, the alarm state of the first alarm item may be updated from the pre-recovery state to the recovery state. To determine whether to perform further operations according to the alarm status of the alarm item, for example, to determine whether to send alarm information in combination with the alarm item on the user side.

If the alarm event corresponding to the first alarm item is not successfully recovered within the allowable waiting time for self-healing of the first alarm item, it can be considered that the alarm event corresponding to the first alarm item cannot heal itself, and the alarm of the first alarm item can be set to The state is updated from the pre-recovery state to the fault state, and it is judged whether to send out alarm information in combination with the alarm items on the user side. And after sending the alarm information for the first alarm item, if it is detected that the alarm event corresponding to the first alarm item is successfully processed, the alarm state of the first alarm item can be updated from the fault state to the processing completed state.

That is to say, the alarm state in this embodiment of the present invention has diversity, and may include a pre-recovery state, a recovery state, a fault state, and a processing completion state. For example, (pre_recovery, recovery, problem, OK), in which the alarm information will not be issued for the alarm items of the pre-recovery state pre_recovery and the recovery state of recovery, which can be recorded in the log, and the alarm items for the fault state of the problem can be sent after further confirmation. Alarm information. After the processing is complete, the alarm status of the alarm item is OK.

That is, the alarm status update process of a high-sensitivity type of alarm item can be: problem->after successful processing->OK;

There are two types of alarm status update processes for low-sensitivity alarm items: pre_recovery->self-healing allowable waiting time to be successfully recovered->recovery; pre_recovery->self-healing allowable waiting time to be unsuccessfully restored->problem– > After successful processing -> OK.

Through the multi-dimensional processing of the alarm status of the alarm item, it is helpful to accurately determine whether the alarm information should be issued for the alarm item.

For ease of understanding, the embodiment of the present invention will be described again by taking the specific implementation process shown in FIG. 3 as an example.

When there is an alarm item on the management side, first determine the alarm type of the alarm item.

If it is a highly sensitive type, the alarm data is directly formatted and transferred to the alarm control process.

If it is a low-sensitivity type, perform pre-recovery processing, mark the alarm state as a pre-recovery state, and determine whether it has been successfully recovered. If successfully recovered, the alarm state may be marked as the recovery state, and the process ends. If it is not successfully recovered, it can be judged whether it has timed out, that is, the allowable waiting time for self-healing has been reached. If it does not time out, you can continue to judge whether it has been successfully recovered. If it times out, the alarm data can be formatted and transferred to the alarm control process.

When there is an alarm item on the user side, the alarm data is directly formatted and transferred to the alarm control process.

During the alarm control process, it is determined whether there is currently an alarm item on the user side that is associated with the alarm item on the management side. If there is, according to the relationship between the alarm data of the alarm item on the management side and the alarm data of the alarm item on the user side, determine whether to send the alarm information, and when it is determined to send the alarm information, send out the alarm information by voice, email, text, etc. Warning information.

In the embodiment of the present invention, by combining the alarm items on the management side and the alarm items on the user side, it is judged whether to send out alarm information, and the self-healing alarm items can be filtered out, the false alarm rate of the alarm information is reduced, and the reliability of the cluster and its services is improved. stability.

Corresponding to the above method embodiments, the embodiments of the present invention further provide a cluster alarm control apparatus, and the cluster alarm control apparatus described below and the cluster alarm control method described above may refer to each other correspondingly.

Referring to Figure 4, the device may include the following modules:

The judgment module 410 is configured to determine whether there is a second alarm item on the user side that is associated with the first alarm item when the first alarm item on the management side is detected during the cluster operation process. ;

The judgment module 420 for whether the alarm information is sent is configured to judge whether to send out the first alarm item according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item when the second alarm item currently exists alarm information.

By applying the device provided by the embodiment of the present invention, when the first alarm item on the management side is detected, the alarm information for the first alarm item is not directly sent, but it is first judged whether there is currently a problem with the first alarm item. If the second alarm item on the user side of the associated relationship exists, it is considered that the alarm event corresponding to the first alarm item on the management side may have affected the use of the user side. Then, according to the alarm data of the first alarm item and the second alarm item The relationship between the alarm data and the alarm data, determine whether to send the alarm information for the first alarm item, that is to say, through the combination of the alarm item on the management side and the alarm item on the user side, judging whether to send the alarm information can improve the accuracy of the alarm information. Accuracy, reduce the false alarm rate of alarm information, and can effectively avoid unnecessary labor and material costs.

In a specific embodiment of the present invention, the judging module 420 for whether the alarm information is sent is used for:

According to the alarm data of the first alarm item and the alarm data of the second alarm item, determine the magnitude relationship between the alarm level of the first alarm item and the alarm level of the second alarm item;

If the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, it is determined to send alarm information for the first alarm item.

In a specific embodiment of the present invention, the judging module 420 for whether the alarm information is sent is also used for:

In the case that the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, before it is determined to issue the alarm information for the first alarm item, the alarm data of the first alarm item and the alarm of the second alarm item are determined according to the alarm data of the first alarm item. data, to determine the inclusion relationship between the management-side associated alarm item set of the second alarm item and the first alarm item, and the management-side associated alarm item set of the second alarm item includes a preset management-side associated relationship with the second alarm item. the alarm item;

If the management-side associated alarm item set of the second alarm item includes the first alarm item, the step of determining to issue alarm information for the first alarm item is performed.

In a specific embodiment of the present invention, it also includes:

Whether the alarm items are the same or not is a judging module for judging whether there is an alarm event that is the same as the alarm event corresponding to the first alarm item within the judgment waiting time period before the moment when the first alarm item is detected when the second alarm item does not currently exist. Unprocessed alarm items;

The alarm item processing module is configured to ignore the first alarm item when there is no unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item.

In a specific embodiment of the present invention, the judging module 420 for whether the alarm information is sent is also used for:

In the case that there is an unprocessed alarm item that is the same as the alarm event corresponding to the first alarm item, according to the number of the same unprocessed alarm items as the alarm event corresponding to the first alarm item, it is judged whether to issue an alarm for the first alarm item. Alarm information of the alarm item.

In a specific embodiment of the present invention, the judging module 420 for whether the alarm information is sent is used for:

In the case that the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item is within the set first number range, ignore the first alarm item;

In the case that the number of unprocessed alarm items that are the same as the alarm event corresponding to the first alarm item is within the set second number range, determine to send alarm information for the first alarm item;

The upper limit value of the first quantity range is smaller than the lower limit value of the second quantity range.

In a specific embodiment of the present invention, it also includes:

The alarm type determination module is configured to, when the first alarm item on the management side is detected, before judging whether there is currently a second alarm item on the user side that is associated with the first alarm item, determine the type of the first alarm item alarm type;

A recovery or not judgment module, configured to judge the alarm event corresponding to the first alarm item when the allowable waiting time for self-healing of the first alarm item is reached when the alarm type of the first alarm item is the set low-sensitivity type Whether the alarm event is successfully recovered; if the alarm event corresponding to the first alarm item is not successfully recovered, trigger the associated alarm item existence judgment module 410 to determine whether there is currently a user-side second alarm item that is associated with the first alarm item. A step of.

In a specific embodiment of the present invention, it also includes an alarm state marking module, which is used for:

When the alarm type of the first alarm item is the set low-sensitivity type, marking the alarm state of the first alarm item as a pre-recovery state;

If the alarm event corresponding to the first alarm item is successfully recovered within the allowable waiting time for self-healing of the first alarm item, the alarm state of the first alarm item is updated from the pre-recovery state to the recovery state;

If the alarm event corresponding to the first alarm item is not successfully recovered within the allowable waiting time for self-healing of the first alarm item, the alarm state of the first alarm item is updated from the pre-recovery state to the fault state, and an alarm for the first alarm item is issued When it is detected that the alarm event corresponding to the first alarm item has been successfully processed after the alarm information of an alarm item, the alarm state of the first alarm item is updated from the fault state to the processing completed state.

An embodiment of the present invention further provides an electronic device, as shown in FIG. 5 , including a processor 501 , a communication interface 502 , a memory 503 and a communication bus 504 , wherein the processor 501 , the communication interface 502 , and the memory 503 pass through the communication bus 504 complete communication with each other, among which,

a memory 503 for storing computer programs;

When the processor 501 is used to execute the program stored in the memory 503, the following steps are implemented:

During the cluster operation, when the first alarm item on the management side is detected, determine whether there is currently a second alarm item on the user side that is associated with the first alarm item;

If the second alarm item currently exists, according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item, it is determined whether to send alarm information for the first alarm item.

The communication bus mentioned by the above terminal may be a Peripheral Component Interconnect (PCI for short) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA for short) bus or the like. The communication bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

The communication interface is used for communication between the above-mentioned terminal and other devices.

The memory may include random access memory (Random Access Memory, RAM for short), and may also include non-volatile memory (non-volatile memory), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU for short), a network processor (NP for short), etc.; it may also be a digital signal processor (Digital Signal Processing, DSP for short) , Application Specific Integrated Circuit (ASIC for short), Field-Programmable Gate Array (FPGA for short) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

In yet another embodiment provided by the present invention, a computer-readable storage medium is also provided, where instructions are stored in the computer-readable storage medium, when the computer-readable storage medium is run on a computer, the computer is made to execute any one of the above-mentioned embodiments. cluster alarm control method.

In yet another embodiment provided by the present invention, there is also provided a computer program product including instructions, which, when running on a computer, causes the computer to execute any of the cluster alarm control methods in the foregoing embodiments.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVD), or semiconductor media (eg, Solid State Disk (SSD)), among others.

It should be noted that, in this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device comprising a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

Each embodiment in this specification is described in a related manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for related parts, please refer to the partial descriptions of the method embodiments.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims (11)

1. A cluster alarm control method is characterized by comprising the following steps:

in the cluster working process, under the condition that a first alarm item on a management side is detected, judging whether a second alarm item on a user side which has a relationship with the first alarm item exists or not at present;

and if the second alarm item exists currently, judging whether to send out alarm information aiming at the first alarm item according to the relation between the alarm data of the first alarm item and the alarm data of the second alarm item.

2. The method according to claim 1, wherein the determining whether to issue the alarm information for the first alarm item according to the relationship between the alarm data of the first alarm item and the alarm data of the second alarm item includes:

determining the magnitude relation between the alarm level of the first alarm item and the alarm level of the second alarm item according to the alarm data of the first alarm item and the alarm data of the second alarm item;

and if the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, determining to send out alarm information aiming at the first alarm item.

3. The method according to claim 2, wherein, in a case that the alarm level of the second alarm item is greater than or equal to the alarm level of the first alarm item, before the determining to issue the alarm information for the first alarm item, the method further comprises:

determining the inclusion relationship between the management side associated alarm item set of the second alarm item and the first alarm item according to the alarm data of the first alarm item and the alarm data of the second alarm item, wherein the management side associated alarm item set of the second alarm item comprises preset management side alarm items having association relationship with the second alarm item;

and if the management side associated alarm item set of the second alarm item contains the first alarm item, executing the step of determining to send out the alarm information aiming at the first alarm item.

4. The method according to claim 1, wherein in case that the second alarm item does not exist currently, the method further comprises:

judging whether unprocessed alarm items identical to the alarm events corresponding to the first alarm items exist in the judgment waiting time before the moment of detecting the first alarm items;

and if the unprocessed and finished alarm items which are the same as the alarm events corresponding to the first alarm item do not exist, ignoring the first alarm item.

5. The method according to claim 4, wherein in case that there is an unprocessed completed alarm item that is the same as the alarm event corresponding to the first alarm item, further comprising:

and judging whether to send out alarm information aiming at the first alarm item according to the number of the unprocessed alarm items which are the same as the alarm events corresponding to the first alarm item.

6. The method according to claim 5, wherein the determining whether to issue the alarm information for the first alarm item according to the number of unprocessed completed alarm items that are the same as the alarm event corresponding to the first alarm item includes:

if the number of the unprocessed finished alarm items which are the same as the alarm events corresponding to the first alarm item is within a set first number range, ignoring the first alarm item;

if the number of the unprocessed alarm items which are the same as the alarm events corresponding to the first alarm item is within a set second number range, determining to send out alarm information aiming at the first alarm item;

an upper value of the first range of numbers is less than a lower value of the second range of numbers.

7. The method according to any one of claims 1 to 6, wherein, in a case where a first alarm item on a management side is detected, before the determining whether a second alarm item on a user side having an association relationship with the first alarm item currently exists, the method further comprises:

determining an alarm type of the first alarm item;

if the alarm type of the first alarm item is a set low-sensitivity type, judging whether the alarm event corresponding to the first alarm item is successfully recovered when the self-healing allowable waiting time of the first alarm item is reached;

and if the alarm event corresponding to the first alarm item is not successfully recovered, executing the step of judging whether a second alarm item at the user side having the association relation with the first alarm item exists currently.

8. The method according to claim 7, wherein in case that the alarm type of the first alarm item is a set low sensitivity type, the method further comprises:

marking the alarm state of the first alarm item as a pre-recovery state;

if the alarm event corresponding to the first alarm item is successfully recovered within the self-healing allowable waiting time of the first alarm item, updating the alarm state of the first alarm item from the pre-recovery state to a recovery state;

if the alarm event corresponding to the first alarm item is not successfully recovered within the self-healing allowable waiting time of the first alarm item, updating the alarm state of the first alarm item from the pre-recovery state to a fault state, and updating the alarm state of the first alarm item from the fault state to a processing completion state under the condition that the alarm event corresponding to the first alarm item is successfully processed after the alarm information aiming at the first alarm item is sent out.

9. A cluster alarm control device, comprising:

the device comprises a correlation alarm item existence judging module, a cluster management module and a judgment module, wherein the correlation alarm item existence judging module is used for judging whether a second alarm item at a user side which has a correlation with a first alarm item exists at present under the condition that the first alarm item at a management side is detected in the cluster working process;

and the alarm information sending judging module is used for judging whether to send the alarm information aiming at the first alarm item according to the relation between the alarm data of the first alarm item and the alarm data of the second alarm item under the condition that the second alarm item exists currently.

10. An electronic device is characterized by comprising a processor, a communication interface, a memory and a communication bus, wherein the processor and the communication interface are used for realizing mutual communication by the memory through the communication bus;

a memory for storing a computer program;

a processor for implementing the steps of the cluster alarm control method of any of claims 1-8 when executing a program stored on a memory.

11. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out a cluster alarm control method according to any one of claims 1-8.

Images