CN112564951B - Method, device, computer equipment and storage medium for avoiding alarm storm - Google Patents

Method, device, computer equipment and storage medium for avoiding alarm storm Download PDF

Info

Publication number
CN112564951B
CN112564951B CN202011360309.3A CN202011360309A CN112564951B CN 112564951 B CN112564951 B CN 112564951B CN 202011360309 A CN202011360309 A CN 202011360309A CN 112564951 B CN112564951 B CN 112564951B
Authority
CN
China
Prior art keywords
alarm
sampling
generated
sampling period
records
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202011360309.3A
Other languages
Chinese (zh)
Other versions
CN112564951A (en
Inventor
黄凯涛
资慧
高强
刘永标
张琦
张海川
彭依明
龚森
曹仁威
金田
周水平
王业龙
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Guangzhou Power Supply Bureau of Guangdong Power Grid Co Ltd
Original Assignee
Guangzhou Power Supply Bureau of Guangdong Power Grid Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Guangzhou Power Supply Bureau of Guangdong Power Grid Co Ltd filed Critical Guangzhou Power Supply Bureau of Guangdong Power Grid Co Ltd
Priority to CN202011360309.3A priority Critical patent/CN112564951B/en
Publication of CN112564951A publication Critical patent/CN112564951A/en
Application granted granted Critical
Publication of CN112564951B publication Critical patent/CN112564951B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/0604Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
    • H04L41/0622Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on time
    • GPHYSICS
    • G08SIGNALLING
    • G08BSIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
    • G08B21/00Alarms responsive to a single specified undesired or abnormal condition and not otherwise provided for
    • G08B21/18Status alarms
    • G08B21/182Level alarms, e.g. alarms responsive to variables exceeding a threshold
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/0604Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06Management of faults, events, alarms or notifications
    • H04L41/0681Configuration of triggering conditions

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Emergency Management (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Alarm Systems (AREA)

Abstract

The application relates to a method, a device, computer equipment and a storage medium for avoiding alarm storm. The method comprises the following steps: determining a current sampling time range; sampling alarm data generated by monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point; determining alarm record generation conditions according to a preset threshold range; when the sampling time in the multiple measurement values is continuous and the number of the target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period; and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met. The method can improve the reliability of alarm judgment.

Description

Method, device, computer equipment and storage medium for avoiding alarm storm
Technical Field
The application relates to the technical field of operation and maintenance of power distribution networks, in particular to a method, a device, computer equipment and a storage medium for avoiding an alarm storm.
Background
With the development of the platform of the internet of things, the basic functions of the platform of the internet of things also present a diversified development trend. The main basic functions of the existing internet of things platform comprise five modules of equipment access, equipment management, a rule engine, monitoring operation and maintenance and log service. The analysis is carried out from the angle of distribution network operation and maintenance, the monitoring operation and maintenance module of the existing Internet of things platform is utilized, the alarming and early warning of the environment, equipment and personnel behaviors can be carried out based on the collected real-time data, and the working efficiency of operation and maintenance personnel is effectively improved.
For monitoring operation and maintenance, an alarm processing mechanism adopted by the existing power grid internet of things platform is further realized mainly based on a preset fixed threshold. The process of monitoring operation and maintenance based on the preset fixed threshold specifically comprises the following steps: firstly, carrying out quantitative processing on monitored real-time data, and determining an alarm measurement value; and secondly, triggering an alarm when the calculated alarm measurement value is equal to a preset fixed threshold. However, when data quantization is performed, quantization errors are indirectly generated; the alarm is also considered to be successfully triggered in the special case that the alarm measurement value does not reach but is close to the preset fixed threshold. Therefore, once the monitoring range is enlarged, the formation of an alarm storm is very easy to result.
Disclosure of Invention
In view of the foregoing, it is desirable to provide a method, an apparatus, a computer device, and a storage medium for avoiding an alarm storm, which can improve the reliability of alarm decision.
A method of avoiding an alarm storm, the method comprising:
determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining an alarm record generation condition according to a preset threshold range;
when the sampling time in the plurality of measurement values is continuous and the number of the target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level, and entering the next sampling period;
and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the alarm record generation condition includes:
the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
In one embodiment, the method further comprises:
determining whether an iteration ending condition is met or not according to the total number of the alarm records generated in the alarm record generation process each time, and/or,
and combining the alarm records generated in the last sampling period and the current sampling period to judge the end of iteration.
In one embodiment, the performing, by combining the alarm record generated in the previous sampling period and the alarm record generated in the current sampling period, the iteration ending determination includes:
and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In one embodiment, the performing, by combining the alarm record generated in the previous sampling period and the alarm record generated in the current sampling period, the iteration ending determination includes:
under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period;
and when the times of continuously not meeting the judgment condition is equal to the times of continuously sampling, determining that an iteration ending condition is met, and exiting the alarm generation process if triggered.
In one embodiment, the number of the monitoring devices is multiple, and the method further includes:
determining the equipment type corresponding to each monitoring equipment and the level of the generated alarm record;
and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
An apparatus for evading an alert storm, the apparatus comprising:
the device comprises a first setting module, a second setting module and a control module, wherein the first setting module is used for determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
the sampling module is used for sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
the second setting module is used for determining an alarm record generation condition according to a preset threshold range;
the alarm record generating module is used for generating an alarm record of a corresponding level when the sampling time of the plurality of measurement values has continuity and the number of the target measurement values meeting the alarm record generating condition is the number of times, and entering the next sampling period;
and the iterative computation module is used for determining a sampling time range corresponding to the next sampling period, returning to the step of sampling the alarm data generated by the monitoring equipment in the sampling time range to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the alarm record generation condition includes:
the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
A computer device comprising a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program:
determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining alarm record generation conditions according to a preset threshold range;
when the sampling time in the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period;
and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
A computer-readable storage medium, on which a computer program is stored which, when executed by a processor, carries out the steps of:
determining a current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining an alarm record generation condition according to a preset threshold range;
when the sampling time in the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period;
and determining a sampling time range corresponding to the next sampling period, returning to the step of sampling the alarm data generated by the monitoring equipment in the sampling time range to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
The method, the device, the computer equipment and the storage medium for avoiding the alarm storm judge the generation of the alarm record based on the continuity of the target measurement value in time, thereby avoiding the generation of abnormal alarm records. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
Drawings
FIG. 1 is a diagram of an application environment of a method for avoiding an alarm storm in one embodiment;
FIG. 2 is a flow diagram illustrating a method for avoiding an alert storm in one embodiment;
FIG. 3 is a first front-end interface layout diagram of a method for avoiding an alarm storm in one embodiment;
FIG. 4 is a second front-end interface layout diagram of a method for warning storm avoidance in an embodiment;
FIG. 5 is a flowchart illustrating a method for avoiding an alert storm in accordance with another embodiment;
FIG. 6 is a flow node diagram of a method for warning storm avoidance in one embodiment;
FIG. 7 is a block diagram of an alert storm avoidance apparatus in one embodiment;
FIG. 8 is a diagram of an internal structure of a computer device in one embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of and not restrictive on the broad application.
The method for avoiding the alarm storm can be applied to the application environment shown in fig. 1. Wherein the monitoring device 102 communicates with the computer device 104 over a network. First, a current sampling time range is determined by the computer device based on a preset sampling interval and the number of consecutive samples. Secondly, the alarm data of the determined current sampling time range is sampled by the monitoring equipment, and the obtained sample is further transmitted to the computer equipment through the network. Secondly, a plurality of measurement values are obtained by the computer equipment based on the collected alarm data. Finally, the computer equipment generates alarm records of corresponding levels according to the obtained multiple measurement values and the alarm record generation conditions; and when entering the next sampling period, repeatedly executing the steps until the iteration end condition is met, and exiting the alarm record generation process.
The computer device 104 may specifically be a terminal or a server, and the terminal may specifically be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices. The server may be implemented as a stand-alone server or as a server cluster consisting of a plurality of servers.
In one embodiment, as shown in fig. 2, a method for avoiding an alarm storm is provided, which is described by taking the method as an example applied to the computer device in fig. 1, and comprises the following steps:
step S202, determining a current sampling time range based on a preset sampling interval and the number of consecutive samples.
When the preset sampling interval is T and the continuous sampling frequency is n, determining the current sampling time range T by the following formula:
T=n×t; (1)
it should be noted that, based on the formula (1), in other embodiments, other formulas may also be used to calculate the sampling time range; alternatively, the sampling time range may be calculated by expanding the formula (1), for example, multiplying the formula by a weight coefficient on the basis of "n × t", and calculating the sampling time range based on the expanded formula, which is not limited by the embodiment of the present application.
Step S204, sampling alarm data generated by the monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point.
Specifically, the alarm data is sampled by the computer device within the sampling time range. And carrying out quantitative calculation based on the acquired alarm data to further obtain a corresponding measurement value. It should be noted that the quantitative calculation of the alarm data is to quantize the alarm data into a specific numerical value.
The alarm data comprises concrete, non-concrete or fuzzy data factors, and the purpose of analysis and comparison is achieved based on quantitative calculation of the alarm data. The measured value is the corresponding monitoring index value.
In one embodiment, firstly, the computer device obtains alarm rule configuration data within a sampling time range, and further calculates to obtain a corresponding measurement value after performing quantitative analysis on the obtained alarm rule configuration data. And finally, the computer equipment further judges whether an alarm record of a corresponding level needs to be generated in the current sampling period according to the calculated measurement value.
In the current embodiment, the collected alarm data is subjected to quantization processing, so that the data analysis process is simplified, and the data analysis efficiency is improved.
And step S206, determining alarm record generation conditions according to a preset threshold range.
Wherein, the alarm record generating conditions include: the measurement value is equal to at least one of an upper limit value defined by the threshold range, the measurement value is equal to a lower limit value defined by the threshold range, and the measurement value is equal to any value within the threshold range. For example, when the measurement value obtained by sampling based on step S204 is equal to the upper limit value determined by the threshold range, it is determined that an alarm record of a corresponding level needs to be generated currently, so as to achieve the purpose of warning. The alarm record may be sent to a terminal device held by the user in a short message manner, or the alarm record may be displayed on a terminal display screen provided at the user, which is not limited in the embodiment of the present application.
As shown in fig. 3-4, they are respectively the first and second front-end interface design diagrams of the method for avoiding the alarm storm in one embodiment. In a specific application scenario, when the threshold range is not set, the user may input the relevant parameter (for example, the sampling period, the consecutive times, and the like) according to the front-end display interface shown in fig. 3. For example, in order to further calculate the sampling time range, a user may input a value corresponding to the sampling period into the sampling period input box and a value corresponding to the consecutive times into the consecutive times input box in advance, and then the computer device may obtain the relevant parameters input by the user through the input box, and calculate the sampling time range based on the called execution program. In addition, for a special implementation scenario of setting a threshold range, a user may input related parameters according to the front-end display interface shown in fig. 4, thereby implementing calculation of a sampling time range and the like. In summary, the front-end display interfaces shown in fig. 3 and fig. 4 provide an input channel for the computer device to input relevant parameters, and the computer device can further implement the calculation of the sampling time range, the measurement value, and the like according to the relevant parameters input by the user, such as the sampling period, the alarm value, the number of consecutive times, and the like.
Step S208, when the sampling time of the plurality of measurement values has continuity and the number of target measurement values meeting the alarm record generation condition is the number of times, generating the alarm record of the corresponding level, and entering the next sampling period.
Specifically, it is determined by the computer device whether the number of target measurement values, of the plurality of measurement values, for which the sampling time is continuous and which satisfy the alarm record generation condition is the number of continuous sampling times set in advance in step S202. And, in case the number of the target measured values satisfies the aforementioned consecutive sampling times, an alarm record of a corresponding level is generated.
In one embodiment, the setting of the quantity threshold is performed in advance by the computer device for different alarm levels (for example, a medium alarm level, a high alarm level, and the like, and the embodiment of the present application is not limited thereto). In a specific embodiment, the number of consecutive samples is pre-set by the computer device to 8, the number threshold corresponding to a medium alarm level to 10, and the number threshold corresponding to a high alarm level to 15. When the number of the calculated target measurement values is 11, a medium-level alarm record can be generated currently. In other cases, when the number of the calculated target measurement values is 16, a high-level alarm record may be generated at present, and so on in other cases, which is not described in detail in this embodiment of the present application.
In the current embodiment, the alarm record generation is judged based on the time continuity of the target measurement value, so that the generation of abnormal alarm records is avoided, and the reliability of alarm generation judgment is improved.
Step S210, determining a sampling time range corresponding to the next sampling period, returning to the step of sampling the alarm data generated by the monitoring equipment in the sampling time range to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
Specifically, after the sampling time range corresponding to the next sampling period is determined by the computer device based on step S202, for the next period, step S204-step S210 will be further performed to generate the corresponding alarm record. After a plurality of repeated loop iterations, the iteration end can be judged according to the total number of the alarm records generated in the alarm record generation process each time and/or by combining the alarm records generated in the last sampling period and the current sampling period. And exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the performing of the iteration end judgment by combining the alarm records generated in the last sampling period and the current sampling period includes: and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In another embodiment, the performing the iteration end judgment in combination with the alarm record generated in the last sampling period and the current sampling period includes: under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period; and when the continuous times of not meeting the judgment condition are equal to the continuous sampling times, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In the current embodiment, the alarm records generated in different sampling periods are adapted, so that the alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In the method for avoiding the alarm storm, the generation of the alarm record is judged based on the time continuity of the target measurement value, so that the generation of the abnormal alarm record is avoided. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In another embodiment, the number of the monitoring devices communicating with the computer device is multiple, as shown in fig. 5, or the method is applied to the computer device in fig. 1 as an example, and the method further includes the following steps:
step S502, determining the device type corresponding to each monitoring device and the generated alarm record level.
Wherein the calculation of the alarm recording level may be performed based on step S208. The alarm rule configuration data includes the relevant configuration and factory information of the monitoring device. Therefore, in a specific embodiment, the device type corresponding to the monitoring device may be confirmed based on the alarm rule configuration data; in another embodiment, the user may also input the device type through the terminal, and the computer device performs the classification and aggregation of the monitoring devices based on the received device types.
Step S504, aiming at the monitoring equipment of the same type, the alarm records corresponding to the same level are merged, and unified alarm is carried out on the monitoring equipment of the same type according to the merged alarm records.
Specifically, firstly, the computer device classifies and summarizes the alarm records of the same level for the monitoring devices and the monitoring devices of the same type according to the obtained device types respectively corresponding to the monitoring devices. And secondly, combining the alarm records of the same type and corresponding to the same level by the computer equipment. And finally, the computer equipment performs unified alarm on the monitoring equipment of the same type according to the combined alarm records.
In one embodiment, the alarm records of the same type and the same level are merged in a data compression mode, and in a specific embodiment, the alarm records of the same type and the same level are used as initial alarm records, and the initial alarm records are merged by computer equipment. In the current embodiment, the generation number of the alarm records is further reduced by adapting the alarm records of the same type and the same level, and the avoiding efficiency of the alarm storm is further improved. In another embodiment, the alarm records generated by different types of monitoring devices in the same monitoring range may also be merged according to a preset monitoring range.
Referring to fig. 6, which is a schematic view of a process node of a method for avoiding an alarm storm, a specific implementation process of the present application may be summarized as the following steps:
firstly, reading alarm rule configuration information, and judging whether the measurement value in the current sampling period needs to generate an alarm record of a corresponding level according to the read alarm rule configuration.
Secondly, judging whether unprocessed alarm records exist at present, if so, dividing the following two conditions:
1) When the alarm records of the corresponding levels need to be generated based on the measurement values in the current sampling period, updating the total number of the alarm records generated in the current alarm record generation process;
2) And when the alarm records of the corresponding levels are determined not to be required to be generated, eliminating the alarm rule configuration corresponding to the corresponding measurement values, compressing the acquired alarm rule configuration information and simplifying the alarm process.
Finally, judging whether the total number of the alarm records generated in the alarm record generation process each time exceeds the preset maximum alarm times or not; if not, continuing to sample the alarm data generated by the monitoring equipment, otherwise, exiting the alarm record generation process.
It also needs to determine whether the monitoring device has set a corresponding alarm generation policy (i.e. the execution logic of step S208), and directly generate an alarm record based on the obtained measurement value under the condition that the alarm generation policy is not set; and under the condition that the alarm generation strategy is set, judging whether the total number of the alarm records generated in the alarm record generation process each time exceeds the preset maximum alarm times.
It should be understood that although the various steps in the flow diagrams of fig. 2-3 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 2-3 may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed in turn or alternately with other steps or at least some of the other steps.
In one embodiment, as shown in fig. 7, there is provided an avoidance alert storm apparatus 700, comprising: a first setting module 701, a sampling module 702, a second setting module 703, an alarm record generating module 704 and an iterative calculation module 705, wherein:
a first setting module 701, configured to determine a current sampling time range based on a preset sampling interval and a number of consecutive samples.
A sampling module 702, configured to sample alarm data generated by a monitoring device within a sampling time range to obtain multiple measurement values; wherein each measurement value corresponds to a different sampling time point.
The second setting module 703 determines an alarm record generation condition according to a preset threshold range.
And an alarm record generating module 704, configured to generate an alarm record of a corresponding level when the number of target measurement values that satisfy the alarm record generation condition and have continuity in sampling time among the plurality of measurement values is the number of times, and enter a next sampling period.
And an iterative computation module 705, configured to determine a sampling time range corresponding to the next sampling period, and return to the sampling time range, and perform sampling on alarm data generated by the monitoring device to obtain multiple measurement values, and exit the alarm record generation process until an iteration end condition is met.
In an embodiment, the iteration calculating module 705 is further configured to determine whether an iteration ending condition is met according to the total number of alarm records generated in the alarm record generation process each time, and/or perform iteration ending judgment by combining the alarm records generated in the last sampling period and the current sampling period.
In an embodiment, the iterative computation module 705 is further configured to determine that an iteration end condition is met and trigger exiting of the alarm record generation process when an alarm record is generated in a last sampling period, but no alarm record is generated in a current sampling period, and a sampling period and the number of consecutive samples are not set in the current sampling period.
In one embodiment, the iterative computation module 705 is further configured to determine a sampling period and a number of consecutive samples in a current sampling period when an alarm record is generated in a previous sampling period but no alarm record is generated in the current sampling period; and when the times of continuously not meeting the judgment condition is equal to the times of continuously sampling, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In one embodiment, the avoidance alarm storm apparatus 700 is further configured to determine a device type corresponding to each monitoring device, and a level of a generated alarm record; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
For specific definition of the device for avoiding the storm warning, reference may be made to the above definition of the method for avoiding the storm warning, and details are not described herein again. All or part of each module in the above-mentioned storm avoiding alarm storm device can be realized by software, hardware and their combination. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.
The device for avoiding the alarm storm judges the generation of the alarm record based on the time continuity of the target measurement value, thereby avoiding the generation of the abnormal alarm record. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In one embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as shown in fig. 8. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method of circumventing alarm storms.
Those skilled in the art will appreciate that the architecture shown in fig. 8 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory having a computer program stored therein and a processor that when executing the computer program performs the steps of: determining a current sampling time range based on a preset sampling interval and the number of continuous sampling; sampling alarm data generated by monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point; determining an alarm record generation condition according to a preset threshold range; when the sampling time in the multiple measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period; and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the processor when executing the computer program further performs the steps of: the alarm record generation conditions include: the measured value is equal to at least one of an upper value defined by the threshold range, the measured value is equal to a lower value defined by the threshold range, and the measured value is equal to any value within the threshold range.
In one embodiment, the processor, when executing the computer program, further performs the steps of: and determining whether an iteration ending condition is met or not according to the total number of the alarm records generated in the alarm record generation process each time, and/or judging the iteration ending by combining the alarm records generated in the last sampling period and the current sampling period.
In one embodiment, the processor when executing the computer program further performs the steps of: and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In one embodiment, the processor, when executing the computer program, further performs the steps of: under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period; and when the times of continuously not meeting the judgment condition is equal to the times of continuously sampling, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In one embodiment, the processor when executing the computer program further performs the steps of: determining the equipment type corresponding to each monitoring equipment and the generated alarm record level, wherein the number of the monitoring equipment is multiple; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and carrying out unified alarm on the monitoring equipment of the same type according to the combined alarm records.
The computer equipment judges the generation of the alarm record based on the time continuity of the target measurement value, and avoids the generation of abnormal alarm records. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of: determining the current sampling time range based on a preset sampling interval and the number of continuous sampling; sampling alarm data generated by monitoring equipment within a sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point; determining an alarm record generation condition according to a preset threshold range; when the sampling time in the multiple measurement values is continuous and the number of target measurement values meeting the alarm record generation condition is the number of times, generating an alarm record of a corresponding level and entering the next sampling period; and determining a sampling time range corresponding to the next sampling period, returning to the sampling time range, sampling the alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met.
In one embodiment, the computer program when executed by the processor further performs the steps of: the alarm record generation conditions include: the measured value is equal to at least one of an upper value defined by the threshold range, the measured value is equal to a lower value defined by the threshold range, and the measured value is equal to any value within the threshold range.
In one embodiment, the computer program when executed by the processor further performs the steps of: and determining whether an iteration ending condition is met or not according to the total number of the alarm records generated in the alarm record generation process each time, and/or judging the iteration ending by combining the alarm records generated in the last sampling period and the current sampling period.
In one embodiment, the computer program when executed by the processor further performs the steps of: and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
In one embodiment, the computer program when executed by the processor further performs the steps of: under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period; and when the times of continuously not meeting the judgment condition is equal to the times of continuously sampling, determining that the iteration ending condition is met, and exiting the alarm generation process if triggered.
In one embodiment, the computer program when executed by the processor further performs the steps of: determining the equipment type corresponding to each monitoring equipment and the generated alarm record level, wherein the number of the monitoring equipment is multiple; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
The computer readable storage medium judges the generation of the alarm record based on the continuity of the target measurement value in time, and avoids the generation of abnormal alarm records. In addition, because the acquired alarm data has quantization errors, sampling and adaptation of the alarm data generated by the monitoring equipment are performed by configuring a threshold range and an iteration ending condition, the reliability of alarm generation judgment is further improved, and an alarm storm is effectively avoided on the premise of not influencing the timeliness of the alarm.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware related to instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database or other medium used in the embodiments provided herein can include at least one of non-volatile and volatile memory. Non-volatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical storage, or the like. Volatile Memory can include Random Access Memory (RAM) or external cache Memory. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), among others.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above examples only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent application shall be subject to the appended claims.

Claims (10)

1. A method of avoiding an alarm storm, the method comprising:
determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
determining alarm record generation conditions according to a preset threshold range;
when the sampling time of the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition reaches the number of times, generating an alarm record of a corresponding level according to a number threshold corresponding to a preset alarm level, and entering the next sampling period;
determining a sampling time range corresponding to the next sampling period, and judging whether an alarm record needs to be generated and whether an unprocessed alarm record exists in the current sampling period; if unprocessed alarm records exist and the alarm records need to be generated, alarm compression is carried out, the alarm times are accumulated, the alarm times of the existing alarm records are updated according to the accumulated alarm times, and the alarm level information is updated according to the updated alarm times of the existing alarm records; if no alarm record is needed to be generated, eliminating the current alarm rule configuration, adding one to the alarm elimination frequency count, and eliminating the alarm and corresponding alarm cache statistics when the alarm elimination frequency reaches an elimination set value; if unprocessed alarm records do not exist, returning to the sampling time range, and sampling alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met;
the monitoring equipment comprises a plurality of monitoring equipment, a monitoring server and a monitoring server, wherein the number of the monitoring equipment is multiple, and the equipment type corresponding to each monitoring equipment and the level of a generated alarm record are determined; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and carrying out unified alarm on the monitoring equipment of the same type according to the combined alarm records.
2. The method of claim 1, wherein the alarm record generation condition comprises: the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
3. The method of claim 1, further comprising:
determining whether an iteration end condition is met according to the total number of the alarm records generated in the alarm record generation process each time, and/or,
and combining the alarm records generated in the last sampling period and the current sampling period to judge the end of iteration.
4. The method of claim 3, wherein the determining the end of iteration by combining the alarm records generated in the previous sampling period and the current sampling period comprises:
and under the conditions that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period and the continuous sampling times are not set in the current sampling period, determining that an iteration ending condition is met and triggering to quit the alarm record generation process.
5. The method of claim 3, wherein the determining the end of iteration based on the alarm log generated in the previous sampling period and the current sampling period comprises:
under the condition that an alarm record is generated in the last sampling period but no alarm record is generated in the current sampling period, determining the sampling period and the continuous sampling times in the current sampling period;
and when the times of continuously not meeting the judgment condition is equal to the times of continuously sampling, determining that an iteration ending condition is met, and exiting the alarm generation process if triggered.
6. An apparatus for evading an alert storm, the apparatus comprising:
the device comprises a first setting module, a second setting module and a control module, wherein the first setting module is used for determining the current sampling time range based on a preset sampling interval and the number of continuous sampling;
the sampling module is used for sampling alarm data generated by the monitoring equipment within the sampling time range to obtain a plurality of measurement values; wherein each measurement value corresponds to a different sampling time point;
the second setting module is used for determining alarm record generation conditions according to a preset threshold range;
the alarm record generation module is used for entering the next sampling period when the sampling time in the plurality of measurement values is continuous and the number of target measurement values meeting the alarm record generation condition reaches the times;
the iterative computation module is used for determining a sampling time range corresponding to the next sampling period and judging whether an alarm record needs to be generated and whether an unprocessed alarm record exists in the current sampling period; if unprocessed alarm records exist and the alarm records need to be generated, alarm compression is carried out, the alarm times are accumulated, the alarm times of the existing alarm records are updated according to the accumulated alarm times, and the alarm level information is updated according to the updated alarm times of the existing alarm records; if no alarm record is needed to be generated, eliminating the current alarm rule configuration, adding one to the alarm elimination frequency count, and eliminating the alarm and corresponding alarm cache statistics when the alarm elimination frequency reaches an elimination set value; if unprocessed alarm records do not exist, returning to the sampling time range, and sampling alarm data generated by the monitoring equipment to obtain a plurality of measurement values, and exiting the alarm record generation process until the iteration end condition is met; the method comprises the steps that the number of monitoring devices is multiple, and the device type corresponding to each monitoring device and the level of a generated alarm record are determined; and combining the alarm records corresponding to the same level aiming at the monitoring equipment of the same type, and performing unified alarm on the monitoring equipment of the same type according to the combined alarm records.
7. The apparatus of claim 6, wherein the alarm record generation condition comprises: the measured value is equal to at least one of an upper value determined by the threshold range, the measured value is equal to a lower value determined by the threshold range, and the measured value is equal to any value within the threshold range.
8. The apparatus according to claim 6, wherein the apparatus is further configured to determine whether an iteration end condition is satisfied according to a total number of alarm records generated in each alarm record generation process, and/or perform an iteration end judgment in combination with the alarm records generated in the last sampling period and the current sampling period.
9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method of any of claims 1 to 6.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 6.
CN202011360309.3A 2020-11-27 2020-11-27 Method, device, computer equipment and storage medium for avoiding alarm storm Active CN112564951B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011360309.3A CN112564951B (en) 2020-11-27 2020-11-27 Method, device, computer equipment and storage medium for avoiding alarm storm

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011360309.3A CN112564951B (en) 2020-11-27 2020-11-27 Method, device, computer equipment and storage medium for avoiding alarm storm

Publications (2)

Publication Number Publication Date
CN112564951A CN112564951A (en) 2021-03-26
CN112564951B true CN112564951B (en) 2023-01-20

Family

ID=75046446

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011360309.3A Active CN112564951B (en) 2020-11-27 2020-11-27 Method, device, computer equipment and storage medium for avoiding alarm storm

Country Status (1)

Country Link
CN (1) CN112564951B (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113411672B (en) * 2021-06-15 2022-08-12 贝壳找房(北京)科技有限公司 Communication quality evaluation method and device, readable storage medium and electronic equipment
CN113448805B (en) * 2021-06-29 2024-11-05 中国工商银行股份有限公司 Monitoring method, device, equipment and storage medium based on CPU dynamic threshold
CN113808376B (en) * 2021-09-18 2023-06-16 中国工商银行股份有限公司 Self-service teller machine equipment safety monitoring method and device
CN114448716B (en) * 2022-02-28 2024-06-21 奇安信科技集团股份有限公司 Industrial control safety control method, electronic equipment and storage medium

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011026342A1 (en) * 2009-09-01 2011-03-10 中兴通讯股份有限公司 Processing method and processing device for alarm storm
CN104735719A (en) * 2015-03-13 2015-06-24 京信通信技术(广州)有限公司 Overload control method and device
CN107707380A (en) * 2017-07-31 2018-02-16 贵州白山云科技有限公司 A kind of monitoring alarm method and apparatus
CN108986418A (en) * 2018-09-18 2018-12-11 广东电网有限责任公司 intelligent alarm method, device, equipment and storage medium
CN109412852A (en) * 2018-10-29 2019-03-01 京信通信系统(中国)有限公司 Alarm method, device, computer equipment and storage medium
CN111813638A (en) * 2020-06-30 2020-10-23 厦门科灿信息技术有限公司 Alarm information processing method and device and terminal equipment

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011026342A1 (en) * 2009-09-01 2011-03-10 中兴通讯股份有限公司 Processing method and processing device for alarm storm
CN104735719A (en) * 2015-03-13 2015-06-24 京信通信技术(广州)有限公司 Overload control method and device
CN107707380A (en) * 2017-07-31 2018-02-16 贵州白山云科技有限公司 A kind of monitoring alarm method and apparatus
CN108986418A (en) * 2018-09-18 2018-12-11 广东电网有限责任公司 intelligent alarm method, device, equipment and storage medium
CN109412852A (en) * 2018-10-29 2019-03-01 京信通信系统(中国)有限公司 Alarm method, device, computer equipment and storage medium
CN111813638A (en) * 2020-06-30 2020-10-23 厦门科灿信息技术有限公司 Alarm information processing method and device and terminal equipment

Also Published As

Publication number Publication date
CN112564951A (en) 2021-03-26

Similar Documents

Publication Publication Date Title
CN112564951B (en) Method, device, computer equipment and storage medium for avoiding alarm storm
CN111092852B (en) Network security monitoring method, device, equipment and storage medium based on big data
CN108494810B (en) Attack-oriented network security situation prediction method, device and system
CN110377569B (en) Log monitoring method, device, computer equipment and storage medium
US10558545B2 (en) Multiple modeling paradigm for predictive analytics
CN113407371B (en) Data anomaly monitoring method, device, computer equipment and storage medium
CN109992473B (en) Application system monitoring method, device, equipment and storage medium
CN111585837A (en) Internet of things data link monitoring method and device, computer equipment and storage medium
CN111897700B (en) Application index monitoring method and device, electronic equipment and readable storage medium
CN111241155B (en) Time sequence data abnormality detection method, device, equipment and storage medium
CN115795928A (en) Accelerated degradation test data processing method and device based on gamma process
CN114443441A (en) Storage system management method, device, equipment and readable storage medium
CN111800807A (en) Method and device for alarming number of base station users
WO2024139333A1 (en) Method and device for predicting operating state of storage cluster
KR102426889B1 (en) Apparatus, method and program for analyzing and processing data by log type for large-capacity event log
CN117573412A (en) System fault early warning method and device, electronic equipment and storage medium
CN116187423A (en) Behavior sequence anomaly detection method and system based on unsupervised algorithm
CN113689042B (en) Fault source prediction method for monitoring node
CN116662127A (en) Method, system, equipment and medium for classifying and early warning equipment alarm information
CN114818907A (en) State monitoring method, device and equipment of power transmission line and storage medium
CN115499287A (en) Event analysis method and device
CN118568998B (en) Method, device, equipment, storage medium and program product for determining lightning protection measures of power transmission line
CN111309716A (en) Maintenance method and device applied to PAS case base and computer equipment
US20240036963A1 (en) Multi-contextual anomaly detection
Plessis et al. Unsupervised multi scale anomaly detection in streams of events

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant