Fault positioning method, system and device and storage medium

Abstract

The invention discloses a fault positioning method, system and device and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: collecting alarm data, carrying out the entity relation extraction and link traceability tracking of the alarm data, and obtaining a corresponding text entity relation triple and a potential fault propagation path; performing multi-dimensional alarm association aggregation on the alarm data to generate a corresponding alarm clustering set; and in combination with variable information and multi-dimensional feature values in the text entity relationship triple, performing deep aggregation and association degree evaluation on the alarm clustering set to obtain a target fault set and a corresponding association degree score, and in combination with the association degree score and a potential fault propagation path, positioning a target root cause fault. According to the method, identification and convergence of alarm storm are realized through multi-dimensional alarm association aggregation, and root cause faults are quickly positioned in combination with a fault propagation path and a text entity relationship triple.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to fault location methods, systems, devices, and storage media. Background Technology

[0002] In current system operation and maintenance, developers and operations personnel often rely on manual analysis of various alarm events to discover and handle faults. This method is inefficient and prone to missing critical information. How to automate and intelligently discover faults from a large number of alarm events, accurately locate faulty systems, and assist users in troubleshooting and emergency response has become a core problem that urgently needs to be solved in the operation and maintenance field.

[0003] However, existing similar applications still suffer from insufficient algorithm generalization capabilities and are limited by issues such as customization and rule bases. At the same time, the efficiency of multi-source data fusion is low, and existing technologies are unable to effectively integrate heterogeneous data. For example, cross-system alarms rely on manual correlation. In addition, the complex and diverse causes of system failures, the dynamic changes in service call links and topology, and the abnormal link jitter caused by root cause nodes, which trigger alarm storms, further exacerbate the difficulty of fault detection. Summary of the Invention

[0004] The main objective of this application is to provide a fault location method, system, device, and storage medium, which aims to solve the technical problem of how to quickly and accurately locate the root cause of a fault.

[0005] To achieve the above objectives, this application proposes a fault location method, the fault location method comprising:

[0006] Collect alarm data, and extract entity relationships and trace the source of the alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths;

[0007] The alarm data is subjected to multi-dimensional alarm association aggregation to generate corresponding alarm cluster sets;

[0008] By combining the variable information and multi-dimensional feature values ​​in the text entity relationship triples, the alarm cluster set is deeply aggregated and the correlation is evaluated to obtain the target fault set and the corresponding correlation score. Then, by combining the correlation score and the potential fault propagation path, the target root cause fault is located.

[0009] In one embodiment, the step of extracting entity relationships and tracing the source of alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths includes:

[0010] Entity relations are extracted from unstructured text information in alarm data to obtain text entity relation triples;

[0011] The alarm data is subjected to in-depth fault point tracing, and the link tracing identification information is extracted to determine the potential fault propagation path.

[0012] In one embodiment, the step of extracting entity relationships from the unstructured text information in the alarm data to obtain text entity relationship triples includes:

[0013] Identify the set of text variables in the unstructured text information, and replace the variable information in the set of text variables with uniform placeholders to generate standardized text;

[0014] The standardized text is processed by sentence segmentation and word segmentation to generate a word segmentation set;

[0015] Part-of-speech tagging and dependency parsing are performed on the word segmentation set to obtain the part-of-speech tagging results and dependency parsing structure.

[0016] Based on the part-of-speech tagging results and the dependency syntax structure, semantic units corresponding to subject-verb-object structures and attributive-head structures are extracted through preset grammatical pattern matching and parsed into text entity relation triples containing variable names, variable values, and entity relation tags.

[0017] In one embodiment, the step of performing deep fault point tracing on the alarm data and extracting link tracing identification information to determine potential fault propagation paths includes:

[0018] Analyze the alarm data and extract the link tracing identification information;

[0019] Perform a single link query based on the link tracing identification information to obtain the corresponding link data;

[0020] The link data is parsed to obtain the parsed link data;

[0021] The parsed link data is traversed using a depth-first search algorithm to identify target nodes with abnormal return codes or whose child node time exceeds a preset threshold.

[0022] The call path containing the target node is identified as a potential fault propagation path.

[0023] In one embodiment, the step of performing multi-dimensional alarm correlation aggregation on the alarm data to generate a corresponding alarm cluster set includes:

[0024] Perform topological correlation aggregation on the alarm data to generate a topological cluster set; and / or

[0025] Perform text association and aggregation on the alarm data to generate a text cluster set; and / or

[0026] Using a preset frequent pattern mining algorithm, the alarm data is aggregated based on time co-occurrence to generate a co-occurrence association set.

[0027] In one embodiment, the step of performing topological association aggregation on the alarm data to generate a topological cluster set includes:

[0028] The alarm data is parsed into a topology graph structure, wherein the topology graph structure contains at least node information, edges, and associated variables;

[0029] The topological correlation between the node information is determined by alarm routing, and clustering is performed based on the topological correlation to generate an initial topological cluster.

[0030] Based on the first preset filtering conditions, the initial topological clusters are filtered to obtain topological cluster aggregations.

[0031] In one embodiment, the step of performing text association aggregation on the alarm data based on the semantic similarity features of text entity relation triples to generate a text cluster set includes:

[0032] The text content in the alarm data is subjected to structured phrase parsing and unstructured word segmentation to obtain the parsed text features;

[0033] A preset text similarity algorithm is used to calculate the similarity score between the features of each parsed alarm text;

[0034] Based on the similarity scores, text clustering is performed to mine similar sets of alarm points and generate an initial text cluster set;

[0035] Based on the second preset filtering condition, the initial text cluster set is filtered to obtain the final text cluster set.

[0036] In one embodiment, the step of using the preset frequent pattern mining algorithm model to perform time co-occurrence association aggregation on the alarm data and generate a co-occurrence association set includes:

[0037] The alarm data is segmented using a preset time window sliding window strategy to generate frequent itemsets;

[0038] The frequent itemset is input into a preset frequent pattern mining algorithm model, and the feature value of each frequent item is calculated.

[0039] According to the preset association degree aggregation rules, the feature values ​​of the target frequent itemset and the frequent itemsets associated with the target frequent itemset are vector-accumulated to obtain the association degree feature vector of the target frequent itemset.

[0040] Based on the third preset filtering condition, the correlation feature vector is filtered to obtain the co-occurrence correlation set.

[0041] In one embodiment, the step of combining the variable information in the text entity relation triples and multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster set to obtain the target fault set and the corresponding correlation score, and combining the correlation score and the potential fault propagation path to locate the target root cause fault includes:

[0042] By combining historical alarm aggregation results, variable information in the text entity relationship triples, the topological clustering set, the text clustering set, and the co-occurrence association set, a deep aggregation is performed to obtain the target fault set.

[0043] The correlation score of the target fault set is calculated using the multidimensional feature values;

[0044] By combining the correlation score, key indicators, and potential fault propagation paths, the root cause of the target fault can be located.

[0045] Furthermore, to achieve the above objectives, this application also proposes a fault location system, the fault location system comprising:

[0046] The data processing module is used to collect alarm data and perform entity relationship extraction and link tracing on the alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths.

[0047] The association aggregation module is used to perform multi-dimensional alarm aggregation analysis on the alarm data and generate corresponding alarm cluster sets.

[0048] The fault location module is used to combine the variable information in the text entity relationship triplet and multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster set, obtain the target fault set and the corresponding correlation score, and locate the target root cause fault by combining the correlation score and the potential fault propagation path.

[0049] In addition, to achieve the above objectives, this application also proposes a fault location device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the fault location method as described above.

[0050] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the fault location method described above.

[0051] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the fault location method described above.

[0052] This application proposes a fault location method, system, device, and storage medium. The method includes: collecting alarm data, extracting entity relationships and tracing the source of the alarm data to obtain corresponding text entity relationship triples and potential fault propagation paths; performing multi-dimensional alarm correlation aggregation on the alarm data to generate corresponding alarm cluster sets; combining variable information in the text entity relationship triples and multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster sets to obtain target fault sets and corresponding correlation scores; and combining the correlation scores and the potential fault propagation paths to locate the target root cause fault. This scheme effectively identifies high-incidence and strongly correlated alarm clusters in alarm data through multi-dimensional alarm correlation aggregation, realizing automatic discovery and aggregation convergence of alarm storms; and significantly improves the accuracy and response speed of root cause location by combining potential fault propagation paths and comprehensive correlation evaluation, accurately locating the faulty system. Attached Figure Description

[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0054] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart illustrating an embodiment of the fault location method of this application.

[0056] Figure 2 This is a flowchart of the association aggregation and fault analysis provided in Embodiment 1 of this application;

[0057] Figure 3 This is a flowchart illustrating Embodiment 2 of the fault location method of this application;

[0058] Figure 4 This is a flowchart illustrating Embodiment 3 of the fault location method of this application;

[0059] Figure 5 This is a flowchart illustrating Embodiment 4 of the fault location method of this application;

[0060] Figure 6 This is a schematic diagram of the overall architecture of the fault location method provided in Embodiment 1 of this application;

[0061] Figure 7 Topological map of observable indicators provided for the fault location method of this application;

[0062] Figure 8 Flowchart of the entity relation extraction algorithm provided for the fault location method of this application;

[0063] Figure 9 A flowchart of the fault location method provided in this application for deep link tracing of fault points;

[0064] Figure 10 This is a schematic diagram of the module structure of the fault location system according to an embodiment of this application;

[0065] Figure 11 This is a schematic diagram of the device structure of the hardware operating environment involved in the fault location method in this application embodiment.

[0066] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0067] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0068] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0069] The main solution of this application embodiment is as follows: collect alarm data, extract entity relationships and trace the source of the alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths; perform multi-dimensional alarm association aggregation on the alarm data to generate corresponding alarm cluster sets; combine the variable information in the text entity relationship triples and multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster sets to obtain the target fault set and the corresponding correlation score; and combine the correlation score and the potential fault propagation path to locate the target root cause fault.

[0070] In this embodiment, for ease of description, the fault location system will be used as the execution subject in the following description.

[0071] Existing fault location methods still suffer from insufficient algorithm generalization capabilities and are limited by issues such as customization and rule bases. Furthermore, the efficiency of multi-source data fusion is low, and existing technologies struggle to effectively integrate heterogeneous data. For example, cross-system alarms rely on manual correlation. The diverse causes of faults, dynamic changes in call link topology, and root cause nodes causing abnormal link jitter that triggers alarm storms further exacerbate the difficulty of fault detection.

[0072] This application provides a fault location method, system, device, and storage medium. The method covers over a dozen types of alarm indicators, comprehensively analyzes topology, text, and co-occurrence relationships across multiple dimensions to identify and converge alarm storms, thus pinpointing the root cause of the fault. Furthermore, it utilizes a custom alarm text entity relationship extraction component adapted for various types of alarms and log text parsing, and a fault point link deep tracing component to assist in root cause location. In summary, this application can quickly and accurately converge alarms and detect faults, facilitating diagnosis and troubleshooting by development and operations personnel.

[0073] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions. The following description uses a personal computer as an example to illustrate this embodiment and the subsequent embodiments.

[0074] Based on this, embodiments of this application provide a fault location method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the fault location method of this application.

[0075] In this embodiment, the fault location method includes steps S10 to S30:

[0076] Step S10: Collect alarm data, and extract entity relationships and trace the source of the alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths.

[0077] It should be noted that the alarm data includes various monitoring information from the distributed system, specifically covering types such as interface call anomalies, URL access failures, transaction code errors, system exception logs, and event reports. This alarm data includes structured fields (such as timestamps, host IPs, and service names) and unstructured fields.

[0078] Understandably, due to the heterogeneous sources, semantic ambiguity, and implicit causal relationships of alarm data, direct root cause analysis can easily lead to misjudgment or omission. Therefore, step S10 is performed to extract text entity relationship triples in the form of "subject-relationship-object" from unstructured / semi-structured alarm texts. By combining system topology and dependency relationships to construct potential fault propagation paths, the semantic association and fault propagation logic between alarms can be explicitly modeled, providing high-quality semantic input for subsequent multi-dimensional alarm aggregation, correlation assessment, and root cause localization.

[0079] In one feasible implementation, step S10 may include steps S11 to S12:

[0080] Step S11: Extract entity relationships from the unstructured text information in the alarm data to obtain text entity relationship triples;

[0081] The text entity relation triple refers to a structured semantic unit extracted from unstructured text, represented in the form of <subject, predicate, object>, used to characterize the interactivity or dependency relationships between system components. For example, in the alert text "Order service calls payment service and returns 500 error", the triples that can be extracted are: <order service, calls, payment service> and <payment service, returns, 500 error>. This text entity relation triple can explicitly express key semantic information such as the calling relationship and exception type between components.

[0082] In another feasible embodiment, step S11 may further include steps A1 to A4:

[0083] Step A1: Identify the set of text variables in the unstructured text information, and replace the variable information in the set of text variables with uniform placeholders to generate standardized text;

[0084] It should be noted that the unstructured text information includes, but is not limited to, various log texts, oracle event texts, business description texts, etc.

[0085] In this embodiment, firstly, the collected text information is preprocessed using a custom text entity relationship extraction component. The dynamic variables (such as IP address, timestamp, transaction number, error code, etc.) in the text are extracted using the two-pointer method, and all variable information is replaced with a uniform placeholder "var" to generate standardized text.

[0086] Among them, the double-pointer method is an efficient string matching algorithm based on character traversal. By setting two cursor pointers (including a front pointer and a rear pointer) to slide in the text, it identifies substrings that conform to a preset variable pattern. Specifically, the rear pointer locates the starting position of the variable (such as after a number, colon, or parenthesis); the front pointer extends the variable range until a non-variable character (such as a space or punctuation) is recognized; subsequently, the two pointers move collaboratively to scan the alarm text content segment by segment, identifying all candidate variable segments; at the same time, combined with a regular expression rule library (such as matching IP addresses, time formats, hexadecimal IDs, etc.) to verify the candidate variable segments, and after confirming that they are valid variables, perform unified replacement. For example, for the original alarm text "Service A called Service B (IP: 0.0.0.0) at 2025-09-01 14:25:36 and timed out, and the transaction code TXXXXX failed". The variables are identified by the double-pointer: timestamp (2025-09-01 14:25:36), IP address (0.0.0.0), transaction code (TXXXXX). After uniformly replacing them with "var", the standardized text "Service A called Service B (IP: var) at var and timed out, and the transaction code var failed" is obtained.

[0087] Through the above steps, the interference of variable differences to subsequent semantic analysis can be eliminated, the core semantic structure is retained, and the accuracy and generalization ability of subsequent entity relationship extraction and similarity calculation are improved.

[0088] Step A2: Perform sentence segmentation and word segmentation on the standardized text to generate a word segmentation set;

[0089] In this step, the generated standardized text is segmented into sentences based on sentence delimiters (such as full stops, exclamation marks, question marks, etc.). Subsequently, word segmentation is performed on each segmented sentence. Before word segmentation, optionally remove stop words (such as虚词 or conjunctions without significant semantics like "de", "le", "ze", "he", etc.) to reduce noise interference and improve the efficiency of subsequent analysis.

[0090] Furthermore, a natural language processing tool is used to perform fine-grained word segmentation on each sentence, decomposing the sentence into an ordered sequence of words or phrases to generate a word segmentation set. In one implementation, the natural language processing tool is the HanLP (High Accuracy Natural Language Processing) toolkit, which supports Chinese word segmentation, out-of-vocabulary word recognition, and domain term segmentation, and can effectively process compound words in technical logs (such as "timeout", "call failure", "connection pool exhaustion", etc.), ensuring the accuracy and integrity of the word segmentation results.

[0091] Through the above steps, the original unstructured text is transformed into a structured sequence of words, providing basic language units for subsequent part-of-speech tagging, dependency parsing, and entity relation triple extraction.

[0092] Step A3: Perform part-of-speech tagging and dependency parsing on the word segmentation set to obtain the part-of-speech tagging results and dependency parsing structure;

[0093] In this step, based on the word segmentation set generated in step A2, natural language processing tools are used for part-of-speech tagging and dependency parsing to obtain deep syntactic structure information of the text.

[0094] Specifically, each segmented structure in the word segmentation set is first labeled with its corresponding part-of-speech category, such as noun, verb, adjective, adverb, time word, numeral, etc., forming a part-of-speech tagging set. The part-of-speech tagging results are used to identify the grammatical roles of each word in the sentence, providing a linguistic basis for subsequent semantic unit identification.

[0095] Furthermore, dependency parsing is used to construct grammatical dependencies between words, generating a dependency parsing structure tree. This dependency parsing structure is represented as a set of triples in the form of <headword, dependency relation, modifier>. For example, the standard text is "Service A timed out calling service B (IP: var) at var, transaction code var failed". From this, we can obtain the subject-verb relation (SBV): <call, SBV, service A>; the verb-object relation (VOB): <call, VOB, service B>; and the attributive-head relation (ATT): <error, ATT, 500>.

[0096] In one embodiment, the part-of-speech tagging and dependency parsing are implemented using HanLP, and the output includes a word segmentation sequence, a corresponding part-of-speech tagging sequence, and a set of dependency parsing relations.

[0097] Through the above steps, the analyzed linear text is transformed into a hierarchical representation with grammatical structure, which provides key support for the accurate extraction of subject-verb-object and attributive-head structures in the subsequent step A4, and significantly improves the accuracy and robustness of entity relation triple extraction.

[0098] Step A4: Based on the part-of-speech tagging results and the dependency syntax structure, extract the semantic units corresponding to the subject-verb-object structure and the attributive-head structure through preset grammatical pattern matching, and parse them into text entity relation triples containing variable names, variable values ​​and entity relation tags.

[0099] In this step, a custom reverse backtracking algorithm is used to traverse and extract entity relation triples (name, var, parser) from "n+v+ws" subject-verb-object structures and "ATT" modifier-head structures. Here, name is the variable name, var is the variable value, and parser is the entity relation label.

[0100] For example, from the alarm text "Order service called payment service and returned a 500 error," the triples can be extracted: <order service, called, payment service> and <payment service, returned, 500 error>. Through these steps, the unstructured text information in the alarm data is preprocessed and transformed into a structured form, providing high-quality semantic input for subsequent multi-dimensional correlation and aggregation analysis, thereby improving the accuracy and efficiency of fault location.

[0101] Step S12: Extract link tracing identification information from the alarm data to determine potential fault propagation paths;

[0102] It should be noted that the potential fault propagation path refers to the call chain subgraph or call sequence formed by propagating upwards along service call dependencies from the root cause fault. This path reflects the scope and direction of the fault's impact in the system topology and is used to assist in locating the root cause node.

[0103] The trace identification information refers to a global trace identifier, commonly known as a traceId, used in a distributed system to uniquely identify a complete business request call chain. This identifier runs through the call process of a request across multiple services, interfaces, and components, and can associate logs and alarm information scattered across different nodes, serving as a key anchor point for cross-system fault tracing.

[0104] Understandably, traditional alarm analysis methods struggle to trace the source of problems across service boundaries, and massive alarms lack contextual correlation, resulting in low efficiency and high misjudgment rate in fault location. Therefore, by executing step S12, extracting link-level context information and constructing a call path view, it is possible to visualize and reconstruct the fault propagation process, significantly improving the accuracy and interpretability of root cause location.

[0105] In another feasible embodiment, step S12 may include steps B1 to B5:

[0106] Step B1: Parse the alarm data and extract the link tracing identification information;

[0107] In this embodiment, the heterogeneous alarm data from multiple sources, including user operation logs, system operation logs, link monitoring warnings, job execution records, and event reports, is first subjected to structured parsing. The link tracing context fields contained within are identified, and globally unique link tracing identifier information (i.e., a valid traceId) is extracted. This traceId is a core field in the distributed system used to identify a complete business request call chain, providing a crucial index for subsequent call chain tracing.

[0108] Step B2: Perform a single link query based on the link tracing identifier information to obtain the corresponding link data;

[0109] After obtaining a valid traceId, the chain tracing system initiates a single chain query request, retrieving complete call chain data based on the traceId. This chain data is in JSON format, including information such as all service nodes involved in the request, the order of interface calls, call duration, response code, timestamp, and context parameters.

[0110] This step enables context restoration from discrete alarms to the call chain, constructs a visual path diagram of cross-service calls, and provides a data foundation for fault propagation analysis.

[0111] Step B3: Parse the link data to obtain the parsed link data;

[0112] After obtaining the raw JSON data of the call chain, it undergoes structured parsing and standardization. Specifically, firstly, the call relationships of each service node are extracted, constructing a call tree structure with the entry service as the root node, expanding downstream dependent nodes layer by layer; simultaneously, the timestamp format is standardized, and the time unit (e.g., milliseconds) is unified; then, the return code, execution time, IP address, service name, and other attributes of each node are parsed; additionally, unstructured extended fields are converted into analyzable key-value pairs. Finally, parsed JSON data of the call chain containing node attributes, call order, and dependencies is generated, serving as input for subsequent depth-first traversal analysis.

[0113] Step B4: Using a depth-first search algorithm, traverse the parsed link data to identify target nodes with abnormal return codes or whose child node time exceeds a preset threshold.

[0114] In this embodiment, the call tree constructed based on the parsed link JSON data is traversed and analyzed using a depth-first search algorithm.

[0115] The depth-first search algorithm starts from the entry service, prioritizes going deep into a certain branch until the leaf node, and performs anomaly detection for each node during the traversal.

[0116] Specifically, the return code of a node is compared with a preset success code set (such as HTTP 200, business code "0000"). If there is a mismatch and the code falls within the error code range (such as 500, 404, custom exception codes), it is marked as an abnormal node. Simultaneously, the execution time of the current node is calculated and compared with the historical average execution time or dynamic baseline value of similar interfaces; if it exceeds a preset threshold, it is determined to be a performance bottleneck node.

[0117] A node that meets any of the above conditions is identified as a target node, which is a potential failure point.

[0118] Step B5: The call path containing the target node is identified as a potential fault propagation path.

[0119] After the traversal is complete, for each identified target node, the upstream caller is traced back to generate a complete call path from the entry service to the target node. This path reflects the possible propagation direction and scope of the fault.

[0120] In addition, if there are multiple target nodes, corresponding call sub-paths are generated for each node, and they are sorted according to the severity of the anomaly (such as error level and time consumption deviation), with the path with the highest priority being selected as the main propagation path.

[0121] Ultimately, the call path containing the underlying abnormal nodes and their upstream dependencies was identified as a potential fault propagation path for subsequent correlation analysis with other dimensions and root cause localization.

[0122] Through the above steps, traceIds are extracted from alarm data and the call chain is reconstructed. Combined with depth-first search and multi-dimensional anomaly criteria, abnormal nodes are accurately identified and fault propagation paths are constructed. Compared to traditional rule-based or threshold-based alarm filtering methods, this embodiment possesses stronger context awareness and cross-service tracing capabilities, significantly improving the accuracy and efficiency of fault location in a microservice architecture.

[0123] Step S20: Perform multi-dimensional alarm aggregation analysis on the alarm data to generate a corresponding alarm cluster set;

[0124] It should be noted that the alarm clustering set includes, but is not limited to, topological clustering set, text clustering set, and co-occurrence association set.

[0125] Understandably, traditional alarm aggregation methods typically perform simple clustering based only on time windows or host dimensions, making it difficult to identify complex fault modes across services and modalities. This results in alarm storms failing to converge effectively, with high false alarm rates and difficulties in root cause localization. Therefore, step S20 is executed to perform multi-dimensional collaborative aggregation of massive alarm data by integrating three orthogonal dimensions of analysis: topological dependency, semantic similarity, and temporal co-occurrence. This significantly improves the accuracy of alarm correlation identification and enables structured convergence and semantic attribution of alarm storms.

[0126] In one feasible embodiment, step S20 may include steps S21 to S23:

[0127] Step S21: Perform topological association aggregation on the alarm data to generate a topological cluster set;

[0128] In this embodiment, alarm information is modeled as a topological graph structure consisting of nodes (alarm items and types), edges (associations between alarms), and associated variables. By traversing the alarm set for routing analysis, topological associations between indicators are identified and edges are generated to dynamically construct clusters. Subsequently, the associated variable information is updated, and the clusters are cleaned to remove invalid clusters with fewer than 3 nodes or lacking strong associations such as service units, hosts, interfaces, and return codes. Finally, a topological cluster set with a clear structure and explicit semantics is output.

[0129] Step S22: Perform text association analysis on the alarm data to generate a text cluster set;

[0130] In this embodiment, the text content in the alarm data is classified into structured and unstructured text. For unstructured text, structured phrase parsing and unstructured HanLP (Natural Language Processing Package) word segmentation similarity calculation are superimposed to jointly construct an unstructured text similarity algorithm to improve the accuracy of text association analysis. The similarity is implemented using the Jarrcard (bag-of-words model) algorithm.

[0131] Step S23: Using a preset frequent pattern mining algorithm, perform time co-occurrence correlation analysis on the alarm data to generate a co-occurrence correlation set.

[0132] In this embodiment, the temporal co-occurrence association is implemented based on FP-growth (frequent pattern mining algorithm). The frequent pattern mining algorithm can extract frequent co-occurrence alarms with a certain degree of correlation, that is, the co-occurrence association set. However, such associations are weak associations and can be used as a supplement and extension to the above-mentioned topological or textual strong association set.

[0133] In summary, topological correlation analysis, starting from the system architecture dependencies, identifies cascading alarms caused by cascading calls, reflecting the propagation trajectory of faults along physical or logical paths. Textual correlation analysis, utilizing natural language processing techniques and text similarity algorithms, improves the accuracy of textual correlation analysis. Temporal co-occurrence correlation analysis, combined with frequent pattern mining algorithms, identifies alarm combinations occurring with high concurrency, revealing potential functional module anomalies or resource bottlenecks. The resulting topological clustering set, textual clustering set, and co-occurrence correlation set provide a high-quality, multi-perspective input foundation for subsequent comprehensive correlation assessment and root cause localization. This helps operations and maintenance personnel quickly identify the scope of fault impact, reconstruct fault propagation paths, and accurately locate root cause nodes, significantly improving operational efficiency and system availability.

[0134] Step S30: Combining the variable information in the text entity relationship triplet and the multi-dimensional feature values, perform deep aggregation and correlation evaluation on the alarm cluster set to obtain the target fault set and the corresponding correlation score. Then, combine the correlation score and the potential fault propagation path to locate the target root cause fault.

[0135] Understandably, in complex distributed systems, alarm data is characterized by high concurrency, multi-source heterogeneity, and semantic ambiguity. Single-dimensional analysis is difficult to accurately identify the true root cause of the fault and is easily affected by noise, leading to misjudgment. Therefore, step S30 is executed to perform deep aggregation of the current alarm cluster set and historical aggregation results, and introduce a multi-dimensional weighted correlation evaluation mechanism. This enables refined modeling of the complex correlation between alarms, and then, by combining text entity relationship triples and potential fault propagation paths, the root cause fault can be accurately located.

[0136] Alternatively, please refer to Figure 2 , Figure 2 This is a flowchart of the association aggregation and fault analysis process. In this embodiment, the association aggregation results are further aggregated and analyzed to complete the convergence of topology, text, and co-occurrence sets within the batch, as well as the deep aggregation of historical batches and the results of the current round, outputting the target fault set. Subsequently, based on multi-dimensional feature values, the association degree score of the target fault set is calculated, and then the target root cause fault is located by combining the association degree score, key indicators, and potential fault propagation paths.

[0137] Furthermore, step S30 may include steps S31 to S33:

[0138] Step S31: Combine the historical alarm aggregation results, the variable information in the text entity relationship triples, the topological clustering set, the text clustering set, and the co-occurrence association set to perform deep aggregation to obtain the target fault set;

[0139] It should be noted that the historical alarm aggregation results refer to alarm clustering results generated in previous operation and maintenance cycles using the same or multi-dimensional aggregation analysis methods, including historical topological clustering, text clustering, and co-occurrence association sets.

[0140] In this step, the obtained topological clustering set, text clustering set, and time co-occurrence association set are further aggregated and analyzed by combining the historical alarm aggregation results and the variable information in the text entity relationship triples. This completes the convergence of the topological, text, and co-occurrence sets within the batch, as well as the deep aggregation of historical batches and the results of this round, and outputs the target fault set.

[0141] Step S32: Calculate the correlation score of the target fault set using the multidimensional feature values;

[0142] It should be noted that the multi-dimensional feature values ​​include, but are not limited to, strong correlation topology, text correlation, alarm level, support, confidence, and lift.

[0143] The correlation score is a comprehensive scoring indicator used to quantify the degree of correlation between a set of alarms or faults and other alarms across multiple dimensions, including topological structure, semantic content, temporal behavior, and historical patterns. The higher the score, the more likely the alarm is to have a causal or common-cause relationship with other abnormal events, and the greater its potential to be a potential root cause or a key propagation node.

[0144] Specifically, after obtaining the target fault set, a correlation score is calculated for the target fault set based on multi-dimensional feature values ​​such as strong correlation topology, text correlation, alarm level, support, confidence, and lift. The correlation score algorithm is defined as follows:

[0145]

[0146] In the formula, TP(a_type,a_num) is the topology feature weighted calculation, including a_type alarm type and a_num key indicator correlation degree; TI(a_time,lift,confidence,support) is the result of time series distribution and co-occurrence feature vector weight calculation; Level(a_level) is the result of alarm level score weight calculation; δ is the topology feature weight parameter; υ represents the weighting parameter for time-series features; υ represents the weighting parameter for alarm levels.

[0147] Furthermore, if textual association exists, the weight parameter δ is increased. Influence.

[0148] In summary, the relevance score is calculated by weighting multiple features (strong relevance topology, text relevance, support, confidence, lift, and alarm level).

[0149] Step 33: Combine the correlation score, key indicators, and potential fault propagation paths to locate the target root cause fault.

[0150] In this step, based on the correlation score calculated in step S32, the key performance indicators monitored (such as CPU utilization, memory usage, response latency, error rate, etc.), and the potential fault propagation paths identified in step S10, the root cause fault most likely to cause the current fault phenomenon is determined through multi-dimensional collaborative analysis and priority ranking mechanism.

[0151] Specifically, firstly, the alarms in the target fault set generated in step S31 are sorted in descending order according to their correlation scores. Components with scores higher than a preset threshold or ranked Nth are selected as a set of highly correlated candidate root causes. Among them, the components in this set are strongly correlated in terms of topological dependency, semantic description, and temporal co-occurrence, and have the preliminary conditions to become root causes.

[0152] Then, for each component in the highly correlated candidate root cause set, the historical trends and real-time status of its associated key performance indicators are further analyzed. If a key indicator of an entity is found to be not only abnormally significant, but its deterioration time is earlier than or synchronous with other related alarms, then its causal correlation with the fault is determined to be enhanced, and its priority is increased.

[0153] Subsequently, candidate entities are mapped to the potential fault propagation paths (i.e., call chain tree structures) generated in step S10, and their logical positions within the paths are analyzed. For example, if a component in the highly correlated candidate root cause set is located at the bottom layer or leaf node of the call chain (such as a database or caching service), and multiple upstream services experience performance degradation or errors, while the entity itself has resource bottlenecks or error codes, it is determined to be the propagation starting point. If an entity is abnormal but located at the upstream entry point of the call chain, and its downstream dependent entities experience more severe performance degradation, it is excluded as a root cause, and its abnormality is determined to be the result of a cascading effect. In other words, the rationality of the candidate root cause set is verified through the potential fault propagation paths, and its conformity to the topological logic and temporal order of fault propagation is evaluated. When a candidate root cause fault meets the preset validity judgment conditions, it is determined to be a valid root cause.

[0154] Finally, based on the comprehensive correlation score, the degree of anomaly of key indicators, and the effectiveness of the path, the root cause failure with the highest correlation, the most significant anomaly, and meeting the preset effectiveness judgment conditions was identified as the target root cause failure.

[0155] Furthermore, after identifying the root cause of the fault, to further support operations and maintenance personnel in quickly understanding the fault context, formulating handling strategies, and promoting problem closure, this embodiment further conducts multi-dimensional in-depth analysis of the root cause fault, generating structured fault diagnosis summary information, including but not limited to fault details, abnormal links, scope of impact, multi-source alarm aggregation and correlation ranking, root cause fault system, alarm point troubleshooting details, etc. This summary information is then visualized through a fault summary interface.

[0156] Through the above steps, combined with historical alarm aggregation results, the current topological clustering, text clustering, and co-occurrence association set are fused and analyzed, effectively improving the stability and accuracy of association judgment. By constructing a multi-dimensional weighted association score model, which comprehensively considers factors such as system topological dependence, semantic similarity, temporal co-occurrence patterns, and alarm severity levels, a quantitative assessment of complex alarm relationships is achieved. Furthermore, by combining the trend changes of key performance indicators and potential fault propagation paths, the root cause fault is accurately identified.

[0157] The above-described method collects alarm data and performs entity relationship extraction and link tracing on the alarm data to obtain corresponding text entity relationship triples and potential fault propagation paths. Multi-dimensional alarm association aggregation is performed on the alarm data to generate corresponding alarm cluster sets. Combining the variable information and multi-dimensional feature values ​​in the text entity relationship triples, deep aggregation and correlation evaluation are performed on the alarm cluster sets to obtain the target fault set and its corresponding correlation score. Based on the correlation score and the potential fault propagation path, the root cause fault is located. This method incorporates multiple alarm data sources, achieving multi-dimensional information association aggregation of topology, text, and time co-occurrence. Combined with the topological relationship data of implemented monitoring indicators, it converges alarm storms and achieves fault discovery and location.

[0158] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 To further explain step S21, the fault location method also includes steps A211 to A213:

[0159] Step A211: Parse the alarm data into a topology graph structure, wherein the topology graph structure includes at least node information, edges, and associated variables;

[0160] It should be noted that the topology graph structure includes, but is not limited to, the topology information extracted from the alarm data itself, the variable information mined by the entity triplet component from the alarm point information, and the relevant underlying fault node information obtained by the link tracing component.

[0161] In this embodiment, the alarm information is parsed into a topological graph result of points, edges, and associated variables. The point structure is NodeIterm = {id, item} and NodeType = {id, type}. The NodeItem point information is the original information such as comprehensive alarm indicators, logs, and events, and NodeType stores the corresponding alarm type. The edge structure is EdageVar = {idi, idj, vari, varj} and EdageType = {idi, idj, vari-type, varj-type}. The EdageVar edge information stores the associated alarm ID and its associated variable, and EdageType stores the associated variable type. The associated variable structure is VarId = {var, idi, idj, ...}, VarType = {var, var-type}, and VarNum = {var, num}. VarId is the mapping relationship between the associated variable and each point, VarType is the associated variable type, and VarNum is the associated variable count.

[0162] Step A212: Determine the topological correlation between each node through alarm routing, and perform clustering based on the topological correlation to generate an initial topological cluster.

[0163] In this step, based on the alarm routing between service nodes in the distributed system, the response dependencies between nodes during the fault occurrence process are analyzed to quantify their topological correlation. Based on this, nodes with high correlation are clustered to generate initial topological clusters. During the clustering process, the system continuously traverses all edges and dynamically updates the correlation variable information of each edge, including but not limited to cumulative co-occurrence counts, the most recent co-occurrence time, average time offset, and historical stability score.

[0164] Step A213: Based on the first preset filtering conditions, the initial topological clusters are filtered to obtain topological cluster aggregation.

[0165] In this embodiment, to improve the accuracy and computational efficiency of subsequent root cause analysis, the initial topological clusters generated in step B312 need to be screened for validity. Since some clusters may consist of noisy alarms, sporadic anomalies, or weakly correlated nodes, which do not represent the actual fault propagation mode, this embodiment introduces a first preset filtering condition to remove invalid or low-confidence clustering results, retain high-correlation clusters with practical diagnostic significance, and finally generate topological clusters with clear structure and explicit semantics.

[0166] The first preset filtering condition is to clean up small clusters with fewer than a preset threshold of nodes. In this embodiment, the threshold is set to 3 nodes. That is, if an initial topology cluster contains fewer than 3 system components (such as services, interfaces, hosts, etc.), it is determined that it is insufficient to represent a complete fault impact domain, and is regarded as an isolated event or noise interference, and is thus eliminated.

[0167] The remaining candidate clusters are further verified to determine whether strong correlations exist within them. Strong correlations refer to explicit and interpretable technical dependencies or behavioral consistency among nodes within a cluster within the system's runtime context. These include, but are not limited to, correlations or self-correlationships among indicators such as service units, hosts, interface-level call dependencies, and return codes.

[0168] After the above dual-condition screening, only the effective clusters that meet the criteria of "≥3 nodes" and "have strong correlations" are retained to form the final topological cluster set, which serves as one of the important inputs for subsequent multi-dimensional fusion analysis.

[0169] For example, if an initial cluster contains only two nodes, "Gateway Service" and "User Service," and there is no direct evidence of calls between them, and the alarms are triggered only because of their similar timing, it will be judged as an invalid cluster and removed. On the other hand, if another cluster contains three components, "Payment Service," "Order Service," and "Database A," and there is a clear call chain among the three, high latency alarms are co-occurring, and the database returns a "connection timeout" error code, it will be retained as a valid topology cluster.

[0170] In summary, this embodiment constructs an automated and high-precision topology-driven alarm aggregation process through a three-stage collaborative mechanism of "graph structure modeling - correlation clustering - validity filtering". This not only enhances the system's ability to perceive complex fault propagation paths, but also provides high-quality structured input for multi-dimensional fusion analysis and intelligent root cause localization, significantly improving the intelligence level and fault response efficiency of the operation and maintenance system.

[0171] Based on the first embodiment of this application, in the third embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 To further explain step S22, the fault location method also includes steps B221 to B224:

[0172] Step B221: Perform structured phrase parsing and unstructured word segmentation on the text content in the alarm data to obtain the parsed alarm text features;

[0173] In this embodiment, the text content in the original alarm data is first classified to obtain structured text or unstructured text. Structured text refers to log templates with a fixed format, while unstructured text refers to freely descriptive alarm information.

[0174] For structured text, directly parse its field content, extract key entities and action verbs, and construct standard triples <subject, predicate, object>, such as <payment service, call, order service>, <database, connection timeout, connection pool>;

[0175] For unstructured text, preliminary structuring is first performed through rule matching or template recognition, and then deep semantic parsing is performed by combining natural language processing techniques (such as HanLP).

[0176] Finally, the set of triples corresponding to each alarm is used as its semantic feature set to standardize the core anomaly language of that alarm. This language feature set not only contains entity and relation information, but can also be extended to include auxiliary features such as alarm type, error code, and temporal context, providing structured input for subsequent similarity calculations.

[0177] Step B222: Using a preset text similarity algorithm, calculate the similarity score between the features of each parsed alarm text;

[0178] In this step, a preset text similarity algorithm (such as Jarrcard similarity, based on the bag-of-words model) is used to calculate the similarity score between the alarm text features obtained after parsing in step B221.

[0179] Specifically, the text features of each alert (including triples obtained from structured phrase parsing and unstructured word segmentation results) are uniformly represented as a keyword set. For example, the triple <payment service, call failure, order service> can be mapped to the set {payment service, call failure, order service}, and the HanLP word segmentation results {response, slow, database} serve as another set. Subsequently, for any two alerts corresponding to different text feature sets, a preset text similarity formula is used to calculate their similarity score.

[0180] The score reflects the degree of overlap in semantic keywords between two alarms; a value closer to 1 indicates greater semantic similarity. Finally, a similarity score matrix is ​​generated for all alarm pairs, serving as input for subsequent clustering analysis.

[0181] Step B223: Based on the similarity score, perform text clustering, mine similar sets of alarm points, and generate an initial text cluster set;

[0182] Specifically, based on the similarity score matrix output in step B222, a clustering algorithm is used to group the alarm points and mine semantically similar alarm sets. The clustering algorithm includes, but is not limited to, hierarchical clustering and spectral clustering.

[0183] During the clustering process, Jaccard similarity is used as the distance metric to aggregate semantically highly similar alarm points into a cluster, forming multiple "alarm point similarity sets". The final output is an initial text cluster set, where each set represents a semantically related alarm pattern.

[0184] Step B224: Based on the second preset filtering conditions, the initial text cluster set is filtered to obtain the final text cluster set.

[0185] To ensure the validity and diagnostic value of the output results, this embodiment uses a second preset filtering condition to verify the validity of the generated initial text cluster set.

[0186] The second preset filtering condition includes: removing clustering results with fewer than two nodes within a cluster. That is, if a text cluster contains only a single alarm point, it is considered an isolated event or a mismatch, and is determined to be an invalid cluster and not retained.

[0187] After filtering, only valid clusters that meet the conditions are included, forming the final text cluster set, which serves as an important component of multi-dimensional alarm aggregation analysis.

[0188] The methods described above effectively realize semantic understanding and intelligent aggregation of massive alarm data, significantly improve the accuracy and efficiency of fault correlation analysis, enhance the system's ability to identify potential common problems in complex scenarios, and provide reliable semantic support for intelligent root cause localization.

[0189] Based on the first embodiment of this application, in the fourth embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 5 To further explain step S23, the fault location method also includes steps C231 to C234:

[0190] Step C231: Using a preset time window sliding window strategy, the alarm data is segmented to generate frequent itemsets;

[0191] In this embodiment, a preset time window sliding window strategy is used to segment alarm data to capture alarm co-occurrence patterns at different time granularities. Specifically, the width (win) and step (step) of the sliding window are set to divide continuous alarm data into multiple segments according to time intervals. Simultaneous alarm items are counted within each window to form candidate itemsets. This embodiment provides two types of windows: win=5min, step=3, and win=3min, step=1. By performing frequency statistics on alarm sets under different window parameters, alarm combinations with a frequency higher than a preset threshold are selected to generate frequent itemsets, which serve as the basic input for subsequent pattern mining.

[0192] Step C232: Input the frequent itemset into the preset frequent pattern mining algorithm model and calculate the feature value of each frequent item;

[0193] In this step, the frequent itemsets generated in step C331 are input into a preset frequent pattern mining algorithm (such as FP-growth) model to further mine strong association rules and potential dependencies among alarms. The model performs in-depth analysis on each frequent itemset and calculates its key feature values. These feature values ​​include, but are not limited to, support, confidence, and lift.

[0194] By comprehensively evaluating the above feature values, alarm combinations with statistical significance can be effectively identified, noise interference from accidental co-occurrence can be eliminated, and quantitative basis can be provided for subsequent time-dimensional association clustering.

[0195] Step C233: According to the preset association degree aggregation rule, the feature values ​​of the target frequent itemset and the frequent itemsets associated with the target frequent itemset are vector-accumulated to obtain the association degree feature vector of the target frequent itemset.

[0196] In this step, to enhance the comprehensive representation capability of frequent alarm combinations, a correlation aggregation mechanism is introduced to perform feature fusion on frequent itemsets with inclusion or association relationships. Specifically, taking a high-frequency frequent itemset (denoted as target frequent itemset B) as the core, other frequent itemsets (denoted as frequent itemsets A) that have co-occurrence or subset relationships with it are identified and included, constructing a correlation structure of "B as the main and A as the auxiliary".

[0197] For example, if the frequent itemset B = {database overload, log write failure} occurs frequently, and = {Database overload} = {Log write failed}、 If {high disk I / O, database overload} are all subsets or related combinations of A itemsets, then these A itemsets are considered as associated itemsets related to B.

[0198] Subsequently, according to the preset association aggregation rules, the support, confidence, and lift of all associated frequent itemsets A are vector-accumulated and superimposed on the original feature values ​​of the target frequent itemset B to form its enhanced association feature vector.

[0199] In addition, deduplication is performed before accumulation to avoid the same associated item being calculated repeatedly, thus ensuring the accuracy and stability of the feature vector.

[0200] Through the above steps, the cumulative gain of weak signals is achieved, enabling low-frequency combinations that may not reach the threshold when counted individually but are semantically consistent to improve the expressive power of the overall association strength by contributing features to the main itemset, thereby enhancing the sensitivity to the identification of complex fault modes.

[0201] Step C234: Based on the third preset filtering condition, filter the correlation feature vector to obtain the co-occurrence correlation set.

[0202] To ensure the quality and diagnostic value of the output results, the aggregated correlation feature vectors need to be filtered for effectiveness. This step introduces a third preset filtering condition to filter all frequent itemsets of the target.

[0203] The third preset filtering condition includes deleting association terms with confidence < 1. This condition indicates that if the confidence of an alarm combination is less than 1, it means that the probability of its occurrence is low, and it does not have a stable causal or co-causal relationship, and is considered a weak association or accidental co-occurrence. Simultaneously, association terms with lift < 0.5 are deleted. A lift of less than 0.5 indicates that the co-occurrence frequency of the two alarm data is much lower than expected randomly, and may even have a negative correlation, indicating that they have no actual correlation significance.

[0204] Through the above filtering, only effective frequent itemsets with high support, strong confidence, and significant improvement are retained, forming the final co-occurrence association set. Each item in this set represents a group of alarm combinations that are highly coordinated in the time dimension, statistically significant, and have potential fault correlations, which can serve as an important basis for subsequent multi-dimensional fusion analysis and root cause localization.

[0205] Through the methods described above, in-depth mining and quality control of temporal co-occurrence patterns are achieved, improving the ability to identify low-frequency but semantically consistent alarm combinations and enhancing the expressiveness and robustness of feature vectors. At the same time, noise interference and spurious associations are effectively suppressed, ensuring the credibility of the output results and providing a data foundation for building a high-precision co-occurrence association model.

[0206] For example, to help understand the implementation flow of the fault location method obtained by combining this embodiment with the above embodiment one, please refer to... Figure 6 , Figure 6 A schematic diagram of the overall architecture of a fault location method is provided, specifically:

[0207] This embodiment addresses scenarios involving alarm storms, heterogeneous metric data, and dynamic link topology by designing and implementing a multi-dimensional correlation and aggregation fault discovery solution. It can cover the correlation and aggregation analysis of various alarm types, such as interfaces, URLs, transaction codes, exception logs, and event reports, automatically locating root cause faults. This embodiment includes multiple modules such as basic parsing, correlation aggregation, fault location, and user interaction.

[0208] Among these, monitoring the topological relationships between observable metrics is the foundation for alarm aggregation and fault detection. This embodiment first cleanses application logs, link logs, infrastructure configurations, and the topological relationships between metrics within the resource management system to construct a dataset of observable metric topological relationships, equipped with a periodic preservation mechanism. The dataset of observable metric topological relationships includes service units, IPs, domain names, servers, return codes, interfaces, transaction codes, clusters, instances, etc. Please refer to... Figure 7 , Figure 7 This is a topological diagram of observable indicators.

[0209] In this embodiment, the basic parsing module includes a general alarm text entity relationship extraction component and a fault link deep tracing component, providing general parsing capabilities for heterogeneous data; the association aggregation module integrates three dimensions: topology, text, and co-occurrence, customizes topology clustering and text aggregation, and combines FP-growth (association analysis algorithm) to mine frequent patterns and extract association information; the fault location module deeply aggregates historical batches of associated alarms, calculates association scores, and locates faulty systems; the user interaction module provides a fault summary interface design to visualize the fault location process.

[0210] This embodiment uses a custom text entity relationship extraction component to parse and extract entity relationship triples from various alarm descriptions, event texts, and log texts. This embodiment includes various types of abnormal log texts, system business description texts, and event report texts, which are then used to assist in topology and text association analysis after entity relationship extraction. Please refer to... Figure 8 , Figure 8 Flowchart of the entity relation extraction algorithm.

[0211] Furthermore, this embodiment utilizes a fault link deep tracing component to extract valid traceId (trace identifier, used to mark a service call) information from alarm content such as user, system, link log alarms, and event reports. Based on a single call link, combined with a depth-first search algorithm, time consumption analysis, and error code filtering analysis, it achieves underlying system fault tracing and obtains potential fault propagation paths. Please refer to... Figure 9 , Figure 9 A flowchart for in-depth source tracing of fault points.

[0212] Furthermore, the association aggregation module in this embodiment consists of three parts: topological association, text association, and time co-occurrence association. It integrates multiple dimensions to achieve a general alarm aggregation convergence scheme and improves the accuracy of fault point association aggregation. The topological association refers to the construction of a topological graph structure based on alarm information, which is a node-edge-variable topological graph structure. By traversing the alarm set for routing analysis, edges reflecting the degree of topological association are generated, and the association variable information is dynamically updated. Finally, by combining the minimum cluster size and strong association rules, invalid clusters are filtered out, and a structured topological cluster set is output. The textual association relies on the semantic information of alarm logs. By integrating structured phrase parsing and unstructured natural language processing (such as HanLP segmentation), the semantic feature representation of alarm text is constructed. Similarity algorithms such as Jaccard are used to calculate the semantic distance between alarms. Finally, the alarm point set is clustered based on similarity features, and a semantically related text cluster set is output. The temporal co-occurrence association is based on the time series features of alarm occurrence. A sliding time window and frequent pattern mining algorithm (such as FP-Growth) are used to count high-frequency concurrent alarm combinations within the same time interval, and the association strength is quantified by indicators such as support, confidence, and lift.

[0213] Finally, the above-mentioned correlation and aggregation results are further integrated and analyzed to complete the convergence of topology, text, and co-occurrence sets within the batch, as well as the deep aggregation of historical batches and current round results, outputting the target fault set. The correlation score of the target fault set is then calculated, and the root cause fault is located by combining the correlation score, key indicators, and potential fault propagation paths.

[0214] The methods described above incorporate multiple alarm sources, aggregating topological, textual, and temporal co-occurrence data to deliver rich monitoring indicator topological relationship data. Simultaneously, through components such as text entity relationship extraction, topological association clustering, and text unstructured similarity algorithms, generalized and easily extensible fault detection capabilities are provided.

[0215] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the fault location method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0216] This application also provides a fault location system, please refer to... Figure 10 The fault location system includes:

[0217] The data processing module 10 is used to collect alarm data and perform entity relationship extraction and link tracing on the alarm data to obtain the corresponding text entity relationship triplet and potential fault propagation path.

[0218] The association aggregation module 20 is used to perform multi-dimensional alarm aggregation analysis on the alarm data and generate a corresponding alarm cluster set.

[0219] The fault location module 30 is used to combine the variable information in the text entity relationship triplet and the multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster set, obtain the target fault set and the corresponding correlation score, and locate the target root cause fault by combining the correlation score and the potential fault propagation path.

[0220] The fault location system provided in this application, employing the fault location method in the above embodiments, can solve the technical problem of how to quickly and accurately locate the root cause of faults. Compared with the prior art, the beneficial effects of the fault location system provided in this application are the same as those of the fault location method provided in the above embodiments, and other technical features of the fault location system are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0221] This application provides a fault location device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the fault location method in the first embodiment described above.

[0222] The following is for reference. Figure 11 The diagram illustrates a structural schematic suitable for implementing the fault location device in the embodiments of this application. The fault location device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 11 The fault location device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0223] like Figure 11As shown, the fault location device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in the read-only memory 1002 or a program loaded from the storage device 1003 into the random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the fault location device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the fault location device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows fault location devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0224] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0225] The fault location device provided in this application, employing the fault location method in the above embodiments, can solve the technical problem of how to quickly and accurately locate the root cause of a fault. Compared with the prior art, the beneficial effects of the fault location device provided in this application are the same as those of the fault location method provided in the above embodiments, and other technical features of the fault location device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0226] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0227] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0228] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the fault location method in the above embodiments.

[0229] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0230] The aforementioned computer-readable storage medium may be included in the fault location device; or it may exist independently and not assembled into the fault location device.

[0231] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the fault location device, the fault location device performs the following actions: collects alarm data, extracts entity relationships and traces the source of the alarm data to obtain corresponding text entity relationship triples and potential fault propagation paths; performs multi-dimensional alarm association aggregation on the alarm data to generate corresponding alarm cluster sets; combines the variable information in the text entity relationship triples and multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster sets to obtain target fault sets and corresponding correlation scores; and combines the correlation scores and the potential fault propagation paths to locate the target root cause fault.

[0232] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0233] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0234] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0235] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described fault location method, thereby solving the technical problem of how to quickly and accurately locate root cause faults. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the fault location method provided in the above embodiments, and will not be repeated here.

[0236] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the fault location method described above.

[0237] The computer program product provided in this application can solve the technical problem of how to quickly and accurately locate the root cause of a fault. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the fault location method provided in the above embodiments, and will not be repeated here.

[0238] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A fault location method, characterized in that, The fault location method includes: Collect alarm data, and extract entity relationships and trace the source of the alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths; The alarm data is subjected to multi-dimensional alarm association aggregation to generate corresponding alarm cluster sets; By combining the variable information and multi-dimensional feature values ​​in the text entity relationship triples, the alarm cluster set is deeply aggregated and the correlation is evaluated to obtain the target fault set and the corresponding correlation score. Then, by combining the correlation score and the potential fault propagation path, the target root cause fault is located.

2. The fault location method as described in claim 1, characterized in that, The steps of extracting entity relationships and tracing the source of alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths include: Entity relations are extracted from unstructured text information in alarm data to obtain text entity relation triples; The alarm data is subjected to in-depth fault point tracing, and the link tracing identification information is extracted to determine the potential fault propagation path.

3. The fault location method as described in claim 2, characterized in that, The step of extracting entity relationships from the unstructured text information in the alarm data and obtaining text entity relationship triples includes: Identify the set of text variables in the unstructured text information, and replace the variable information in the set of text variables with uniform placeholders to generate standardized text; The standardized text is processed by sentence segmentation and word segmentation to generate a word segmentation set; Part-of-speech tagging and dependency parsing are performed on the word segmentation set to obtain the part-of-speech tagging results and dependency parsing structure; Based on the part-of-speech tagging results and the dependency syntax structure, semantic units corresponding to subject-verb-object structures and attributive-head structures are extracted through preset grammatical pattern matching and parsed into text entity relation triples containing variable names, variable values, and entity relation tags.

4. The fault location method as described in claim 2, characterized in that, The steps of performing deep fault point tracing on the alarm data and extracting link tracing identification information to determine potential fault propagation paths include: Analyze the alarm data and extract the link tracing identification information; Perform a single link query based on the link tracing identification information to obtain the corresponding link data; The link data is parsed to obtain the parsed link data; The parsed link data is traversed using a depth-first search algorithm to identify target nodes with abnormal return codes or whose child node time exceeds a preset threshold. The call path containing the target node is identified as a potential fault propagation path.

5. The fault location method as described in claim 1, characterized in that, The step of performing multi-dimensional alarm correlation aggregation on the alarm data to generate a corresponding alarm cluster set includes: Perform topological association aggregation on the alarm data to generate a topological cluster set; and / or Perform text association and aggregation on the alarm data to generate a text cluster set; and / or Using a preset frequent pattern mining algorithm, the alarm data is aggregated based on time co-occurrence to generate a co-occurrence association set.

6. The fault location method as described in claim 5, characterized in that, The step of performing topological association aggregation on the alarm data to generate a topological cluster set includes: The alarm data is parsed into a topology graph structure, wherein the topology graph structure contains at least node information, edges, and associated variables; The topological correlation between the node information is determined by alarm routing, and clustering is performed based on the topological correlation to generate an initial topological cluster. Based on the first preset filtering conditions, the initial topological clusters are filtered to obtain topological cluster aggregations.

7. The fault location method as described in claim 5, characterized in that, The step of performing text association and aggregation on the alarm data to generate a text cluster set includes: The text content in the alarm data is subjected to structured phrase parsing and unstructured word segmentation to obtain the parsed alarm text features; A preset text similarity algorithm is used to calculate the similarity score between the features of each parsed alarm text; Based on the similarity scores, text clustering is performed to mine similar sets of alarm points and generate an initial text cluster set; Based on the second preset filtering condition, the initial text cluster set is filtered to obtain the final text cluster set.

8. The fault location method as described in claim 5, characterized in that, The step of using the preset frequent pattern mining algorithm model to perform time co-occurrence association aggregation on the alarm data and generate a co-occurrence association set includes: The alarm data is segmented using a preset time window sliding window strategy to generate frequent itemsets; The frequent itemset is input into a preset frequent pattern mining algorithm model, and the feature value of each frequent item is calculated. According to the preset association degree aggregation rules, the feature values ​​of the target frequent itemset and the frequent itemsets associated with the target frequent itemset are vector-accumulated to obtain the association degree feature vector of the target frequent itemset. Based on the third preset filtering condition, the correlation feature vector is filtered to obtain the co-occurrence correlation set.

9. The fault location method as described in claim 5, characterized in that, The steps of combining the variable information in the text entity relation triples and multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster set to obtain the target fault set and the corresponding correlation score, and combining the correlation score and the potential fault propagation path to locate the target root cause fault include: By combining historical alarm aggregation results, variable information in the text entity relationship triples, the topological clustering set, the text clustering set, and the co-occurrence association set, a deep aggregation is performed to obtain the target fault set. The correlation score of the target fault set is calculated using the multidimensional feature values; By combining the correlation score, key indicators, and potential fault propagation paths, the root cause of the target fault can be located.

10. A fault location system, characterized in that, The fault location system includes: The data processing module is used to collect alarm data and perform entity relationship extraction and link tracing on the alarm data to obtain the corresponding text entity relationship triples and potential fault propagation paths. The association aggregation module is used to perform multi-dimensional alarm aggregation analysis on the alarm data and generate corresponding alarm cluster sets. The fault location module is used to combine the variable information in the text entity relationship triplet and multi-dimensional feature values ​​to perform deep aggregation and correlation evaluation on the alarm cluster set, obtain the target fault set and the corresponding correlation score, and locate the target root cause fault by combining the correlation score and the potential fault propagation path.

11. A fault location device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the fault location method as described in any one of claims 1 to 9.

12. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the fault location method as described in any one of claims 1 to 9.

Images