CN116132257A - Derived alarm determining method and device based on stream computing - Google Patents
Derived alarm determining method and device based on stream computing Download PDFInfo
- Publication number
- CN116132257A CN116132257A CN202211493524.XA CN202211493524A CN116132257A CN 116132257 A CN116132257 A CN 116132257A CN 202211493524 A CN202211493524 A CN 202211493524A CN 116132257 A CN116132257 A CN 116132257A
- Authority
- CN
- China
- Prior art keywords
- alarm data
- alarm
- data
- rule
- statistical result
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Alarm Systems (AREA)
- Maintenance And Management Of Digital Transmission (AREA)
Abstract
The invention provides a method and a device for determining derived alarms based on stream computing, wherein the method comprises the following steps: acquiring first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation; converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result; and if the statistical result accords with a set threshold rule, generating a derivative alarm according to the set rule and the statistical result, wherein the threshold rule at least comprises a threshold. The invention stores the alarm data into the memory by using the streaming calculation, improves the data processing speed, generates the derivative alarm according to the set rule and the statistical result, shows the internal association relation of the faults, rapidly locates the faults to be processed, and reduces the operation and maintenance cost of network maintenance.
Description
Technical Field
The present invention relates to the field of operation and maintenance technologies, and in particular, to a method and an apparatus for determining derived alarms based on stream computing.
Background
With the upgrading and updating of the operator network, the communication network infrastructure is more and more, the number of times of faults is more, and the fault monitoring of the communication network infrastructure is also subject to higher requirements. The fault data has the following characteristics: the fault data size is large, the real-time requirement of data processing is improved, and the relevance between the data is more and more complex. In addition, the infrastructure virtualization and the network equipment software have the new characteristics of realizing resource flexible allocation, dynamic scheduling and the like, the network complexity is further increased, and the generated fault data also increase new difficulty for network operation and maintenance.
Therefore, it is necessary to provide a technical scheme for timely data processing and deriving fault alarm information containing the association relation between faults.
Disclosure of Invention
The invention provides a method and a device for determining derived alarms based on stream calculation, which utilize stream calculation to store alarm data into a memory, improve data processing speed, generate derived alarms according to set rules and statistical results, show the inherent association relationship of faults, quickly locate the faults to be processed and reduce the operation and maintenance cost of network maintenance.
The invention provides a derivative alarm determining method based on stream calculation, which comprises the following steps:
acquiring first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result;
and if the statistical result accords with a set threshold rule, generating a derivative alarm according to the set rule and the statistical result, wherein the threshold rule at least comprises a threshold.
According to the derived alarm determining method based on stream computing provided by the invention, the second alarm data is converted into a set data structure and then stored in a memory for classified statistics to obtain a statistical result, and the method comprises the following steps:
converting the second alarm data into JSON serialized alarm data;
converting the JSON serialized alarm data into tabular alarm data, and storing the tabular alarm data into a memory;
and carrying out classified statistics on the tabular alarm data based on the set screening formula to obtain a statistical result.
According to the derived alarm determining method based on stream computing provided by the invention, the method for converting the JSON serialized alarm data into the tabular alarm data comprises the following steps:
extracting an alarm field from the JSON serialization alarm data to serve as a header;
extracting an alarm value corresponding to the alarm field from the JSON serialization alarm data;
and obtaining the tabular alarm data according to the header and the alarm value.
According to the derived alarm determining method based on stream computing provided by the invention, the second alarm data is converted into a set data structure and then stored in a memory for classified statistics to obtain a statistical result, and the method comprises the following steps:
converting the second alarm data into set collective alarm data, and storing the collective alarm data into a memory;
and counting the collective alarm data based on the streaming calculation to obtain a statistical result.
According to the derived alarm determining method based on stream calculation, the second alarm data conforming to the set rule is screened out from the first alarm data based on stream calculation, and the method comprises the following steps:
aggregating the first alert data based on a sliding time window of the streaming computation;
and screening alarm data conforming to a set rule from the aggregated first alarm data, and recording the alarm data as second alarm data.
According to the derived alarm determining method based on the streaming computing, the threshold rule comprises a plurality of thresholds based on logical AND and/or logical OR combination.
The invention also provides a derivative alarm determining device based on stream calculation, which comprises:
the screening module is used for acquiring the first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
the statistics module is used for converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result;
and the determining module is used for generating a derived alarm according to the set rule and the statistical result if the statistical result accords with the set threshold rule, wherein the threshold rule at least comprises a threshold.
The invention also provides an electronic device, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the processor realizes the derivative alarm determining method based on stream calculation when executing the program.
The present invention also provides a non-transitory computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the derived alert determination method based on streaming computation.
The invention also provides a computer program product comprising a computer program which when executed by a processor implements the derived alert determination method based on streaming computing.
According to the method and the device for determining the derived alarms based on the streaming calculation, the streaming calculation is utilized to store the alarm data into the memory, so that the data processing speed is improved, the derived alarms are generated according to the set rules and the statistical result, the inherent association relation of faults is shown, the faults needing to be processed are rapidly located, and the operation and maintenance cost of network maintenance is reduced.
Drawings
In order to more clearly illustrate the invention or the technical solutions of the prior art, the following description will briefly explain the drawings used in the embodiments or the description of the prior art, and it is obvious that the drawings in the following description are some embodiments of the invention, and other drawings can be obtained according to the drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a derived alert determination method based on stream computation according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart of step S120 in FIG. 1 according to an embodiment of the present invention;
FIG. 3 is a second flowchart of step S120 in FIG. 1 according to an embodiment of the present invention;
fig. 4 is a schematic flow chart of step S110 in fig. 1 according to an embodiment of the present invention;
FIG. 5 is a second flow chart of a derived alert determination method based on streaming computing according to an embodiment of the present invention;
FIG. 6 is a functional block diagram of a derived alert determination apparatus based on streaming computing provided by an embodiment of the present invention;
fig. 7 is a schematic structural diagram of an electronic device provided by the present invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the present invention more apparent, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings, and it is apparent that the described embodiments are some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the embodiments of the present application. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.
FIG. 1 is a schematic flow diagram of a method for determining derived alarms based on stream computation according to an embodiment of the present invention; referring to fig. 1, the present invention provides a derived alert determination method based on streaming computing, including but not limited to the following steps:
s110, acquiring first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
s120, converting the second alarm data into a set data structure, and then storing the data structure into a memory for classified statistics to obtain a statistical result;
and S130, if the statistical result accords with a set threshold rule, generating a derivative alarm according to the set rule and the statistical result, wherein the threshold rule at least comprises a threshold.
Optionally, the first alarm data includes a plurality of alarm messages, and each alarm message includes a most basic alarm event.
Streaming computing is a major big data computing model, streaming data (or data stream) refers to an infinite series of dynamic data aggregates in terms of time distribution and quantity, the value of which decreases over time, and therefore must be computed in real time to give a second-level response. Streaming computing, as its name implies, is to process a data stream, which is real-time computing.
Optionally, the derived alarm represents a complex alarm event, the complex alarm event is composed of simple alarm events conforming to a plurality of rules, for example, a rule is set as "city" = "xx city" and "alarm title" = "xxx base station is taken out of service", alarm information conforming to the rule is screened out from original alarm data, i.e. the first alarm data, and then the alarm information is counted, the number of alarm information is counted, and if the number of alarm information is higher than a set threshold, for example, the number of alarm information is greater than 30, a derived alarm is produced: xx city base station is taken out of service more than 30. The complex alarm event to be processed can be split into a plurality of rules, and the rules are used for screening from massive fault data, so that the fault data with common time and space and common characteristics can be aggregated together, the inherent relation of the fault data is analyzed and calculated, and new alarms are derived for service processing such as dispatching.
Alternatively, massive amounts of fault data may be matched by CEP (Complex Event Processing, composite event processing) complex event processing rule matching models. CEP is an analysis technique based on event streams in a dynamic environment, where events are usually meaningful state changes, by analyzing relationships between events, and by using filtering, association, aggregation and other techniques, a detection rule is formulated according to a time sequence relationship and an aggregation relationship between events, a sequence of events meeting requirements is continuously queried from the event streams, and finally, more complex composite events are obtained through analysis.
Optionally, the pattern rule: the fault alarm data or event data with large data volume can be rapidly configured and matched through pattern matching, and the alarm input target crossing time is selected through a pattern rule frame. Mode processing: an intrinsic relation between simple events is identified, and a plurality of alarms conforming to a certain rule constitute a complex event. And (3) outputting: an alert is generated based on the complex event. The same city (internal relation) is identified through CEP pattern matching, whether the number of times of occurrence of alarms reaches 30 or not is calculated and identified, the alarm data conforming to the pattern form a generating condition of a complex event, and new alarm information is output.
It can be understood that the invention uses stream computation to store the alarm data into the memory, improves the data processing speed, generates derivative alarms according to the set rules and the statistical result, shows the internal association relationship of faults, rapidly locates the faults to be processed, and reduces the operation and maintenance cost of network maintenance.
Fig. 2 is one of the flow charts of step S120 in fig. 1 provided in the embodiment of the present invention, referring to fig. 2, as an optional embodiment, on the basis of the foregoing embodiment, the step of converting the second alarm data into a set data structure, and then storing the data structure in a memory, and performing classification statistics to obtain a statistical result includes:
s210, converting the second alarm data into JSON serial alarm data;
s220, converting the JSON serialized alarm data into tabular alarm data, and storing the tabular alarm data into a memory;
s230, classifying and counting the tabular alarm data based on the set screening formula to obtain a statistical result.
Optionally, the converting the JSON serialized alarm data into tabular alarm data includes:
extracting an alarm field from the JSON serialization alarm data to serve as a header;
extracting an alarm value corresponding to the alarm field from the JSON serialization alarm data;
and obtaining the tabular alarm data according to the header and the alarm value.
Optionally, the alarm data is saved in JSON serialization format, and the saved alarm is as follows:
multiple similar alarms are stored in a virtual table, such as alarm_table1, in memory.
The alarm_table1 is shown in the following table:
and classifying and counting the tabular alarm data based on a set screening formula to obtain a statistical result, namely performing statistical calculation on the tabular alarm data stored in a similar SQL mode, such as select ne_name, count (x) from alarm_table1 group by ne_name.
It can be appreciated that the invention provides a technical scheme for converting alarm data into structured data, and gathers together fault data with common space-time and common characteristics, so as to be convenient for analyzing and calculating the internal relation of the fault data, realize concurrent processing and concurrent calculation of big data, and flexibly count, inquire and present related data.
Fig. 3 is a second schematic flow chart of step S120 in fig. 1 provided in the embodiment of the present invention, referring to fig. 3, as an optional embodiment based on the above embodiment, the step of converting the second alarm data into a set data structure and then storing the data structure in a memory to perform classification statistics to obtain a statistical result includes:
s310, converting the second alarm data into set collective alarm data, and storing the collective alarm data into a memory;
s320, counting the collective alarm data based on the flow calculation to obtain a counting result.
Optionally, the invention uses the data structure of the collection to store the alarm, which can be List, map, set, then uses the stream mode to count the collection, then compares the count result with a plurality of complex thresholds, and then derives the alarm when the threshold rule is satisfied.
It can be appreciated that the invention provides a technical scheme for converting alarm data into structured data, and gathers together fault data with common space-time and common characteristics, so as to be convenient for analyzing and calculating the internal relation of the fault data, realize concurrent processing and concurrent calculation of big data, and flexibly count, inquire and present related data.
Fig. 4 is a schematic flow chart of step S110 in fig. 1 provided in the embodiment of the present invention, referring to fig. 4, as an alternative embodiment, based on the above embodiment, the screening, based on the stream calculation, second alarm data that meets a set rule from the first alarm data includes:
s410, aggregating the first alarm data based on the sliding time window of the stream calculation;
s420, screening out alarm data conforming to a set rule from the aggregated first alarm data, and recording the alarm data as second alarm data.
Optionally, a sliding time window is used for carrying out the alarm of aggregation related time and space, the sliding time window algorithm frame is used for selecting alarm data with specific time length, the window is slid forward according to the sliding stride, and the latest alarm data is calculated.
It can be understood that the invention uses a time window mechanism in stream computation to slide the frame to select the alarm data crossing the time, thereby improving the real-time computing efficiency.
Based on the above embodiments, as an alternative embodiment, the threshold rule includes a plurality of thresholds based on logical and/or logical or combination.
It can be understood that the derivative alarm supports multiple derivative threshold setting and calculation, and performs free combination logic and logic OR operation on multiple thresholds, so that fault information of different rules and different thresholds can be counted flexibly, and the operation and maintenance difficulty of network maintenance is reduced.
FIG. 5 is a second flow chart of a derived alert determination method based on streaming computing according to an embodiment of the present invention; referring to fig. 5, the present invention utilizes a streaming computation and CEP (Complex Event Processing) complex event processing rule matching model. Real-time performance of alarm data processing is guaranteed by utilizing a computing idea of stream computing, space-time alarm aggregation is carried out through a sliding time window, and pattern rule formulation, pattern matching and pattern output are carried out by utilizing CEP (Complex Event Processing) complex event processing rules. And for the received real-time alarm data, the received real-time alarm data is stored in the memory in a structured way after aggregation, so that calculation and statistics can be performed rapidly. The derivative alarm supports multiple derivative threshold settings and calculations, and performs a logical AND logical OR operation of the multiple thresholds in free combination. The derivative alarms can be counted and summarized through structured data, and the obtained counting result can be backfilled into the derivative alarms.
The invention can effectively solve the concurrent computation capability under the real-time environment of large data volume, improve the concurrent processing and concurrent computation of large data and quickly find the internal association relation of faults through a specific rule configuration mode, derive the fault information to be presented, flexibly count, inquire and present related data and reduce the operation and maintenance cost of network maintenance.
The description of the derived alarm determining device based on the streaming calculation provided by the invention is provided below, and the derived alarm determining device based on the streaming calculation described below and the derived alarm determining method based on the streaming calculation described above can be referred to correspondingly.
FIG. 6 is a functional block diagram of a derived alert determination apparatus based on streaming computing provided by an embodiment of the present invention; referring to fig. 6, the present invention further provides a derived alarm determining apparatus based on stream computation, including:
the screening module 610 is configured to obtain first alarm data, and screen second alarm data that meets a set rule from the first alarm data based on stream computation;
the statistics module 620 is configured to convert the second alarm data into a set data structure, store the data structure in the memory, and perform classification statistics to obtain a statistics result;
and the determining module 630 is configured to generate a derived alarm according to the set rule and the statistical result if the statistical result meets the set threshold rule, where the threshold rule includes at least one threshold.
The statistics module 620 is further configured to, for one embodiment:
converting the second alarm data into JSON serialized alarm data;
converting the JSON serialized alarm data into tabular alarm data, and storing the tabular alarm data into a memory;
and carrying out classified statistics on the tabular alarm data based on the set screening formula to obtain a statistical result.
The statistics module 620 is further configured to, for one embodiment:
extracting an alarm field from the JSON serialization alarm data to serve as a header;
extracting an alarm value corresponding to the alarm field from the JSON serialization alarm data;
and obtaining the tabular alarm data according to the header and the alarm value.
The statistics module 620 is further configured to, for one embodiment:
converting the second alarm data into set collective alarm data, and storing the collective alarm data into a memory;
and counting the collective alarm data based on the streaming calculation to obtain a statistical result.
The screening module 610 is further configured to, for one embodiment:
aggregating the first alert data based on a sliding time window of the streaming computation;
and screening alarm data conforming to a set rule from the aggregated first alarm data, and recording the alarm data as second alarm data.
As an embodiment, the threshold rule comprises a plurality of thresholds based on logical and/or logical or combinations.
Fig. 7 illustrates a physical schematic diagram of an electronic device, as shown in fig. 7, which may include: processor 710, communication interface (Communications Interface) 720, memory 730, and communication bus 740, wherein processor 710, communication interface 720, memory 730 communicate with each other via communication bus 740. Processor 710 may invoke logic instructions in memory 730 to perform a derived alert determination method based on streaming calculations, the method comprising:
acquiring first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result;
and if the statistical result accords with a set threshold rule, generating a derivative alarm according to the set rule and the statistical result, wherein the threshold rule at least comprises a threshold.
Further, the logic instructions in the memory 730 described above may be implemented in the form of software functional units and may be stored in a computer readable storage medium when sold or used as a stand alone product. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
In another aspect, the present invention also provides a computer program product comprising a computer program storable on a non-transitory computer readable storage medium, the computer program, when executed by a processor, is capable of performing a streaming-based derived alert determination method, the method comprising:
acquiring first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result;
and if the statistical result accords with a set threshold rule, generating a derivative alarm according to the set rule and the statistical result, wherein the threshold rule at least comprises a threshold.
In yet another aspect, the present invention also provides a non-transitory computer readable storage medium having stored thereon a computer program which, when executed by a processor, is implemented to perform a method of derived alert determination based on streaming computation, the method comprising:
acquiring first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result;
and if the statistical result accords with a set threshold rule, generating a derivative alarm according to the set rule and the statistical result, wherein the threshold rule at least comprises a threshold.
The apparatus embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
From the above description of the embodiments, it will be apparent to those skilled in the art that the embodiments may be implemented by means of software plus necessary general hardware platforms, or of course may be implemented by means of hardware. Based on this understanding, the foregoing technical solution may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a computer readable storage medium, such as ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method described in the respective embodiments or some parts of the embodiments.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims (10)
1. A method for determining derived alarms based on streaming computing, comprising:
acquiring first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result;
and if the statistical result accords with a set threshold rule, generating a derivative alarm according to the set rule and the statistical result, wherein the threshold rule at least comprises a threshold.
2. The method for determining derived alarms based on stream computation according to claim 1, wherein the step of converting the second alarm data into a set data structure and then storing the data structure in a memory for classification statistics to obtain statistical results includes:
converting the second alarm data into JSON serialized alarm data;
converting the JSON serialized alarm data into tabular alarm data, and storing the tabular alarm data into a memory;
and carrying out classified statistics on the tabular alarm data based on the set screening formula to obtain a statistical result.
3. The method for determining derived alarms based on stream computation according to claim 2, wherein the converting the JSON serialized alarm data into tabular alarm data comprises:
extracting an alarm field from the JSON serialization alarm data to serve as a header;
extracting an alarm value corresponding to the alarm field from the JSON serialization alarm data;
and obtaining the tabular alarm data according to the header and the alarm value.
4. The method for determining derived alarms based on stream computation according to claim 1, wherein the step of converting the second alarm data into a set data structure and then storing the data structure in a memory for classification statistics to obtain statistical results includes:
converting the second alarm data into set collective alarm data, and storing the collective alarm data into a memory;
and counting the collective alarm data based on the streaming calculation to obtain a statistical result.
5. The method of claim 1, wherein the step of screening out second alarm data conforming to a set rule from the first alarm data based on the streaming calculation comprises:
aggregating the first alert data based on a sliding time window of the streaming computation;
and screening alarm data conforming to a set rule from the aggregated first alarm data, and recording the alarm data as second alarm data.
6. The streaming calculation based derived alert determination method according to claim 1, wherein the threshold rule comprises a plurality of logical and/or logical or combination based thresholds.
7. A derived alert determination apparatus based on streaming computing, comprising:
the screening module is used for acquiring the first alarm data, and screening second alarm data conforming to a set rule from the first alarm data based on stream calculation;
the statistics module is used for converting the second alarm data into a set data structure, then storing the data structure into a memory, and carrying out classified statistics to obtain a statistical result;
and the determining module is used for generating a derived alarm according to the set rule and the statistical result if the statistical result accords with the set threshold rule, wherein the threshold rule at least comprises a threshold.
8. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the derived alert determination method based on streaming computation of any one of claims 1 to 6 when the program is executed by the processor.
9. A non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor implements the derived alert determination method based on streaming computation according to any of claims 1 to 6.
10. A computer program product comprising a computer program which, when executed by a processor, implements a derived alert determination method based on streaming computation according to any of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211493524.XA CN116132257A (en) | 2022-11-25 | 2022-11-25 | Derived alarm determining method and device based on stream computing |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211493524.XA CN116132257A (en) | 2022-11-25 | 2022-11-25 | Derived alarm determining method and device based on stream computing |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116132257A true CN116132257A (en) | 2023-05-16 |
Family
ID=86303412
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211493524.XA Pending CN116132257A (en) | 2022-11-25 | 2022-11-25 | Derived alarm determining method and device based on stream computing |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116132257A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109358602A (en) * | 2018-10-23 | 2019-02-19 | 山东中创软件商用中间件股份有限公司 | A kind of failure analysis methods, device and relevant device |
| CN112564949A (en) * | 2020-11-27 | 2021-03-26 | 中盈优创资讯科技有限公司 | Analysis method and device based on cross-professional alarm association rule |
| CN112699106A (en) * | 2020-12-23 | 2021-04-23 | 中国电力科学研究院有限公司 | Multi-dimensional alarm information time sequence incidence relation analysis method for relay protection device based on Apriori algorithm |
| CN114070709A (en) * | 2020-08-26 | 2022-02-18 | 北京市天元网络技术股份有限公司 | Alarm correlation analysis method and device |
| US20220086036A1 (en) * | 2019-05-25 | 2022-03-17 | Huawei Technologies Co., Ltd. | Alarm Analysis Method and Related Device |
| CN115333922A (en) * | 2022-10-13 | 2022-11-11 | 广州极能信息技术有限公司 | Operation and maintenance support network alarm data mining method, system and storage medium |
-
2022
- 2022-11-25 CN CN202211493524.XA patent/CN116132257A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109358602A (en) * | 2018-10-23 | 2019-02-19 | 山东中创软件商用中间件股份有限公司 | A kind of failure analysis methods, device and relevant device |
| US20220086036A1 (en) * | 2019-05-25 | 2022-03-17 | Huawei Technologies Co., Ltd. | Alarm Analysis Method and Related Device |
| CN114070709A (en) * | 2020-08-26 | 2022-02-18 | 北京市天元网络技术股份有限公司 | Alarm correlation analysis method and device |
| CN112564949A (en) * | 2020-11-27 | 2021-03-26 | 中盈优创资讯科技有限公司 | Analysis method and device based on cross-professional alarm association rule |
| CN112699106A (en) * | 2020-12-23 | 2021-04-23 | 中国电力科学研究院有限公司 | Multi-dimensional alarm information time sequence incidence relation analysis method for relay protection device based on Apriori algorithm |
| CN115333922A (en) * | 2022-10-13 | 2022-11-11 | 广州极能信息技术有限公司 | Operation and maintenance support network alarm data mining method, system and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20200372039A1 (en) | Data processing method, apparatus, and system | |
| US20230146912A1 (en) | Method, Apparatus, and Computing Device for Constructing Prediction Model, and Storage Medium | |
| CN110851321B (en) | Service alarm method, equipment and storage medium | |
| CN104396188A (en) | System and method for root cause analysis of mobile network performance problems | |
| CN110675194A (en) | Funnel analysis method, device, equipment and readable medium | |
| CN111522786A (en) | Log processing system and method | |
| CN110362544A (en) | Log processing system, log processing method, terminal and storage medium | |
| CN111740884A (en) | Log processing method, electronic equipment, server and storage medium | |
| CN113448812A (en) | Monitoring alarm method and device under micro-service scene | |
| CN112711614B (en) | Service data management method and device | |
| CN112953738A (en) | Root cause alarm positioning system, method and device and computer equipment | |
| CN111881930A (en) | A heat map generation method, device, storage medium and device | |
| CN111062431A (en) | Image clustering method, image clustering device, electronic device, and storage medium | |
| CN106557483B (en) | Data processing method, data query method, data processing equipment and data query equipment | |
| CN116016628A (en) | API gateway buried point analysis method and device | |
| CN113688284B (en) | Processing method and device of Internet of vehicles service data, electronic equipment and storage medium | |
| CN116132257A (en) | Derived alarm determining method and device based on stream computing | |
| CN118505474A (en) | Urban operation data monitoring system, method, electronic device and readable medium | |
| CN118113504A (en) | Log-based business error analysis method, device and computer storage medium | |
| CN117251414A (en) | Data storage and processing method based on heterogeneous technology | |
| CN113449008B (en) | A modeling method and device | |
| CN114595363A (en) | Business log processing method, system, storage medium and terminal based on lightweight architecture | |
| CN114493358A (en) | Index decomposition method and device and electronic equipment | |
| Yan et al. | Cloud city traffic state assessment system using a novel architecture of big data | |
| CN112363774A (en) | Storm real-time task configuration method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |