Fully automated log analysis and fault handling system and method based on NLP large model

Abstract

Disclosed in the present invention is a fully automated log analysis and fault handling system and method based on an NLP large model. The method comprises: collecting a service state, an operating environment, and log files; extracting and generating log summaries from the log files, extracting key information from the log summaries to obtain state information of a service process; if an error is fed back, the NLP large model performing fault analysis on the error by using the service state and the operating environment as prior knowledge, and recording upstream and downstream key information involved in the error; on the basis of the upstream and downstream key information involved in the error, finding a fault cause and providing a fault handling action; and then executing a plan on the basis of the fault handling action. Log collection of the present invention is not limited to a prescribed format, and an NLP large model using a service state and an operating environment as prior knowledge is introduced for fault analysis.

Description

Fully automatic log analysis and fault handling system and method based on NLP large model Technical Field

[0001] The present invention belongs to the field of computer system operation and maintenance, and in particular relates to a fully automatic log analysis and fault handling system and method based on a large NLP model. Background Art

[0002] Existing computer systems typically utilize complex distributed deployment logic. To ensure overall system reliability, these systems are equipped with operational capabilities such as log printing, log collection, monitoring and alarming, and data analysis. These capabilities help operators identify problems, locate faults, and restore the system to meet required system stability standards. Therefore, how to better and faster analyze logs, locate faults, and restore the system has become a key component of overall system maintenance and ensuring system stability.

[0003] Existing, mature log analysis and troubleshooting solutions standardize the log printing format for each application and deploy log collectors to collect logs from each application in real time. Logs are typically collected by a separately deployed log processing middleware service, which stores the collected logs in a separate log database for secondary data cleansing. After data cleansing, the logs are fed into a data analysis system for statistical analysis (the statistical analysis rules are pre-configured in the data analysis system by operations and maintenance personnel). The resulting analyzed data is then made available to operations and maintenance tool platforms, such as log search and query reporting tools, monitoring and alarm platforms, and data dashboards.

[0004] Fault analysis is generally performed by operations and maintenance developers when they receive an alert or discover an abnormal system status during routine inspections. They use the log analysis capabilities provided by the operations and maintenance tool platform, combined with the application health status of the local system, to determine the specific cause of the fault. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a fully automatic log analysis and fault handling system and method based on NLP large models.

[0006] The object of the present invention is achieved through the following technical solutions: a fully automatic log analysis and fault handling system based on NLP large model, comprising:

[0007] The collection module includes several application monitoring collectors and several log collectors; the application monitoring collectors are used to collect service status and operating environment and save them in the associated information library; the log collectors are used to collect log files;

[0008] An analysis module is used to extract and generate log summaries from the log files, extract key information from the log summaries, and obtain business process status information. If there is an error in the feedback, the NLP large model uses the information in the knowledge base and the associated information base as prior knowledge to perform fault analysis on the error and record the key upstream and downstream information involved in the error.

[0009] The knowledge base includes system architecture, error codes, monitoring indicators, data structures, business processes and coding specifications;

[0010] The fault handling module is used to find out the cause of the fault based on the upstream and downstream key information involved in the error and provide fault handling actions; and then execute the contingency plan according to the fault handling actions.

[0011] Furthermore, the step of extracting and generating a log summary from the log file specifically includes: the NLP big model extracting and generating a log summary from the log file using the system architecture, data structure and coding specification in the knowledge base as prior knowledge;

[0012] The key information extraction from the log summary is specifically as follows: the NLP big model extracts key information from the log summary based on the business process, error code and monitoring indicators in the knowledge base as prior knowledge to obtain status information of the business process.

[0013] Furthermore, it also includes an experience library; the experience library includes a troubleshooting library experience library and a historical fault library;

[0014] The method of finding the cause of the fault based on the upstream and downstream key information involved in the error and giving a fault handling action is specifically: finding the cause of the fault based on the upstream and downstream key information involved in the error and according to the troubleshooting library and experience library; then querying the historical fault library according to the cause of the fault and giving a fault handling action.

[0015] Furthermore, the execution plan in the fault handling module has two triggering modes: automatic triggering and manual confirmation triggering; if the fault execution effect is greater than or equal to the set threshold, it is automatically triggered; if the execution effect is less than the threshold, it is manually confirmed and triggered.

[0016] Furthermore, the plan is executed according to the fault handling action. If this process is manually confirmed and triggered or a new execution effect or feedback information is generated, the historical fault library is updated.

[0017] Furthermore, the log files collected by the log collector are stored in a log database; the log files include business processing logs, interface call logs, database operation logs and user operation logs.

[0018] Furthermore, the service status includes business health status and application process status; the operating environment includes dependent service status and machine performance indicators.

[0019] The present invention also provides a fully automatic log analysis and troubleshooting method based on the NLP large model, including:

[0020] Collect service status, operating environment, and log files;

[0021] Extract and generate a log summary from the log file, extract key information from the log summary, and obtain the status information of the business process; if there is an error in the feedback, the NLP large model uses the knowledge base, service status and operating environment as prior knowledge to perform fault analysis on the error and record the key upstream and downstream information involved in the error;

[0022] The knowledge base includes system architecture, error codes, monitoring indicators, data structures, business processes and coding specifications;

[0023] Based on the upstream and downstream key information involved in the error, find out the cause of the fault and provide fault handling actions; then execute the contingency plan according to the fault handling actions.

[0024] The present invention also provides a fully automatic log analysis and fault handling device based on the NLP large model, including one or more processors for implementing the above-mentioned fully automatic log analysis and fault handling method based on the NLP large model.

[0025] The present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, it is used to implement the above-mentioned fully automatic log analysis and fault handling method based on the NLP large model.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] 1. The log collection of the existing technical solution requires that the application log must be printed in a specified format. Log content that does not conform to the specified format cannot be collected. The present invention can collect and analyze log content as long as it is printed in a normal natural language format.

[0028] 2. This invention also builds a big data knowledge base as a priori knowledge reserve for the NLP large model. It also introduces a troubleshooting experience library and a historical fault library, accumulating classic cases of troubleshooting and troubleshooting, and summarizing log analysis experience. This serves as relevant knowledge for the next log analysis and troubleshooting of the NLP large model. This enables iterative evolution of the large model's log analysis capabilities without relying on the training and optimization of the large model itself.

[0029] 3. The natural language processing capabilities of the NLP large model are introduced for log analysis. This can analyze various types of logs, including user operation logs, business processing logs, interface call logs, and database logs. The preliminary knowledge and related information of log analysis are added to help with log analysis. Exception logs, non-standard logs, and third-party logs that are not captured by the program can also be analyzed and processed.

[0030] 4. The present invention can not only provide system indicators and error alarms, but also dig deeper into potential problems of the system and issue early warnings for possible risks in the system. After a system failure occurs, the fault can be analyzed in combination with the log analysis results, service status, and operating environment at the time of the failure, and the cause of the failure can be given. The fault can be processed and recovered in combination with the existing experience knowledge fault library, and the existing historical fault library can be iteratively updated according to the processing effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] FIG1 is a flow chart of a fully automatic log analysis and fault handling system based on an NLP large model provided by an embodiment of the present invention;

[0033] FIG2 is a flow chart of log collection provided by an embodiment of the present invention;

[0034] FIG3 is a flowchart of a key information extraction method according to an embodiment of the present invention;

[0035] FIG4 is a detailed diagram of key information provided by an embodiment of the present invention;

[0036] FIG5 is a flowchart of a fault handling method according to an embodiment of the present invention;

[0037] FIG6 is a hardware structure diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0039] The terms used in this invention are for the purpose of describing specific embodiments only and are not intended to limit the invention. The singular forms "a," "the," and "the" used in this invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0040] It should be understood that although the terms "first," "second," "third," etc. may be used in the present invention to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0041] The present invention will be described in detail below with reference to the accompanying drawings. Unless there is any conflict, the features of the following embodiments and implementations may be combined with each other.

[0042] The present invention provides a fully automatic log analysis and fault handling system based on a large NLP (Natural Language Processing) model, as shown in FIG1 , comprising:

[0043] The collection module includes several application monitoring collectors and log collectors; the application monitoring collector is used to collect service status and operating environment and save them in the associated information library; the log collector is used to collect log files;

[0044] Log files include application logs, system logs, and other log files, and their types include user operation logs, business processing logs, interface call logs, and database logs.

[0045] The operating environment includes dependent service status and machine performance indicators. The dependent service status includes database connection status and the success rate of dependent service interface calls (middleware, other business applications, etc.). Machine performance indicators include CPU (Central Processing Unit) utilization, memory utilization, disk usage, network traffic, and machine load.

[0046] Service status includes business health status and application process status.

[0047] In one embodiment, as shown in FIG2 , the application monitoring collector is responsible for collecting business health status, application process status, machine performance indicators, and dependent service status, and the log collector is responsible for collecting log files. Both collectors use a real-time reporting mode to upload the collected information to the collection control center.

[0048] The information collected is determined by a configuration file, which contains the five types of information listed above. The collection control center reads the contents of the configuration file and notifies the collector to determine the content to be collected. The configuration file content can be manually configured or automatically generated by system operation and maintenance tools.

[0049] The collected information will be stored in two databases respectively. The operating environment and service status information will be stored in the associated information database, and the log files will be stored in the log database.

[0050] An analysis module is used to extract and generate log summaries from the log files, extract key information from the log summaries, and obtain business process status information. If there is an error in the feedback, the NLP large model uses the information in the knowledge base and the associated information base as prior knowledge to perform fault analysis on the error and record the key upstream and downstream information involved in the error.

[0051] In one embodiment, as shown in FIG3 , a log summary is generated: the summary generation capability of the NLP large model is used, but three preliminary knowledge, namely, coding specifications, data structure, and system architecture, need to be introduced to ensure that the summary generated by the NLP large model does not lose key information related to the application service; that is, the NLP large model uses the system architecture, data structure, and coding specifications as prior knowledge to extract and generate a log summary from the log file; wherein, the coding specifications are used to ensure that the application processing logic such as variable definition, database operation, class declaration, and call in the log can be effectively identified when the summary is generated, the data structure is used to ensure that the application data flow information is correctly identified in the summary, and the system architecture is used to ensure that the summary can include all key module log information and save the association relationship between the logs of each module.

[0052] Key Information Extraction: The NLP model performs secondary processing on log summaries, combining business processes and error codes. It then integrates relevant monitoring logs with monitoring indicators to extract key status information for the entire core business process. If there are errors or exceptions in the logs, all key upstream and downstream information related to the error is recorded and collated for subsequent fault cause analysis and resolution.

[0053] As shown in Figure 4, the core of log summarization is to use the knowledge base to tell the NLP model what content to retain when summarizing the logs. This primarily includes business processing logs, interface call logs, database operation logs, and user operation logs. Furthermore, logs from related businesses are also integrated during the summarization process based on the system architecture. The core of log analysis is to extract key business information from the pre-summarized logs, combining them with knowledge base information such as monitoring metrics, error codes, and business processes. This facilitates subsequent analysis of this key business information, identifying the cause of the fault, and addressing the issue.

[0054] The fault handling module finds the cause of the fault based on the upstream and downstream key information involved in the error and provides fault handling actions; then executes the contingency plan according to the fault handling actions.

[0055] Troubleshooting consists of two stages: troubleshooting and troubleshooting execution.

[0056] Specifically, as shown in Figure 5, fault troubleshooting: Based on the upstream and downstream key information involved in the error, the fault handling module will perform fault location and troubleshooting according to the troubleshooting experience library to find out the cause of the fault, and then query the historical fault library based on the cause of the fault to give a fault handling action.

[0057] Fault handling execution is performed according to the fault handling actions given by the fault troubleshooting;

[0058] Among them, fault handling execution has two triggering execution modes: automatic triggering and manual confirmation triggering; the system will judge the execution effect of historical fault handling solutions. If the fault execution effect is greater than or equal to the set threshold (set to 1 in this embodiment), the current execution is automatically triggered. If the execution effect is less than the threshold, the current execution is manually confirmed.

[0059] Execution effect calculation formula:

[0060]

[0061] Generally, the service success rate will be taken from 5 minutes to 1 hour after this trigger. The definition of service success rate needs to be defined separately for each service. The historical service success rate is generally the average service success rate of 3 days to one month.

[0062] Generally, the success rate of this trigger is not lower than the historical success rate, that is, the execution effect P>=1, then the next execution can be automatically triggered, otherwise it will enter the manual confirmation stage, and it will be manually confirmed whether to execute or whether to use a new method to execute.

[0063] After the execution is completed, the execution effect P value of the existing method is updated according to the execution effect. If it is a new method, the new execution method and the execution effect P of the new method are updated.

[0064] Execute the plan according to the fault handling action. If this process is manually confirmed and triggered or generates new execution results or feedback information, the historical fault database will be updated.

[0065] The present invention also provides a fully automatic log analysis and troubleshooting method based on the NLP large model, including:

[0066] Collect service status, operating environment, and log files;

[0067] Extract and generate a log summary from the log file, extract key information from the log summary, and obtain the status information of the business process; if there is an error in the feedback, the NLP large model uses the service status and operating environment as prior knowledge to perform fault analysis on the error and record the key upstream and downstream information involved in the error;

[0068] Based on the upstream and downstream key information involved in the error, find out the cause of the fault and provide fault handling actions; then execute the contingency plan according to the fault handling actions.

[0069] Among them, the service status includes the business health status and application process status; the operating environment includes the dependent service status and machine performance indicators; the log files include application logs, system logs and other log files, and the types include user operation logs, business processing logs, interface call logs and database logs.

[0070] Specifically, the NLP big model extracts and generates a log summary from the log file based on the system architecture, data structure and coding specifications as prior knowledge.

[0071] Specifically, the NLP big model extracts key information from the log summary using error codes, monitoring indicators, and monitoring metrics as prior knowledge.

[0072] Specifically, there are two trigger modes for executing the plan in the fault handling module: automatic triggering and manual confirmation triggering; if the fault execution effect is greater than or equal to the set threshold, it is automatically triggered; if the execution effect is less than the threshold, it is manually confirmed and triggered.

[0073] Execute the plan according to the fault handling action. If this process is manually confirmed and triggered or generates new execution results or feedback information, the historical fault database will be updated.

[0074] It should be noted that the method embodiment shown in this embodiment matches the content of the above-mentioned system embodiment. You can refer to the content of the above-mentioned system embodiment and will not repeat it here.

[0075] Corresponding to the aforementioned embodiment of a fully automatic log analysis and fault handling method based on a large NLP model, the present invention also provides an embodiment of a fully automatic log analysis and fault handling device based on a large NLP model.

[0076] Referring to Figure 6, an embodiment of the present invention provides a fully automatic log analysis and fault handling device based on an NLP large model, including one or more processors for implementing a fully automatic log analysis and fault handling method based on an NLP large model in the above embodiment.

[0077] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0078] An embodiment of the fully automatic log analysis and fault handling device based on the NLP large model of the present invention can be applied to any device with data processing capabilities, and the any device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located to read the corresponding computer program instructions in the non-volatile memory into the memory and run them. From the hardware level, as shown in Figure 6, it is a hardware structure diagram of any device with data processing capabilities where the fully automatic log analysis and fault handling device based on the NLP large model of the present invention is located. In addition to the processor, memory, network interface, and non-volatile memory shown in Figure 6, any device with data processing capabilities where the device in the embodiment is located can also include other hardware according to the actual function of the device with data processing capabilities, which will not be described in detail.

[0079] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0080] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present invention. A person of ordinary skill in the art can understand and implement the present invention without inventive work.

[0081] An embodiment of the present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, it implements a fully automatic log analysis and fault handling method based on an NLP large model in the above embodiment.

[0082] The computer-readable storage medium may be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or memory. The computer-readable storage medium may also be any device with data processing capabilities, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit of any device with data processing capabilities and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and may also be used to temporarily store data that has been output or is to be output.

[0083] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only.

[0084] The above embodiments are intended only to illustrate the design concepts and features of the present invention. Their purpose is to enable those skilled in the art to understand the contents of the present invention and implement them accordingly. The scope of protection of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design concepts disclosed in the present invention are within the scope of protection of the present invention.

Claims

1. A fully automated log analysis and fault handling system based on a large NLP model, characterized in that, including: a collection module, including several application monitoring collectors and several log collectors; the application monitoring collectors are used to collect service status and running environment and save them in the associated information library; the log collectors are used to collect log files; an analysis module, used to extract and generate a log summary from the log files, extract key information from the log summary, and obtain the status information of the business process; if an error is reported, the NLP large model uses the information in the knowledge base and the associated information library as prior knowledge to perform fault analysis on the error and record the upstream and downstream key information involved in the error; the knowledge base includes system architecture, error codes, monitoring metrics, data structures, business processes, and coding specifications; a fault handling module, used to find out the fault cause based on the upstream and downstream key information involved in the error and give fault handling actions; then execute the pre-plan according to the fault handling actions.

2. The system according to claim 1, wherein The specific process of extracting and generating a log summary from the log files is as follows: the NLP large model uses the system architecture, data structure, and coding specifications in the knowledge base as prior knowledge to extract and generate a log summary from the log files; The specific process of extracting key information from the log summary is as follows: the NLP large model uses the business process, error codes, and monitoring metrics in the knowledge base as prior knowledge to extract key information from the log summary and obtain the status information of the business process.

3. The system according to claim 1, characterized in that, It also includes an experience library; the experience library includes a troubleshooting library experience library and a historical fault library; The specific process of finding out the fault cause based on the upstream and downstream key information involved in the error and giving fault handling actions is as follows: find out the fault cause based on the upstream and downstream key information involved in the error and according to the troubleshooting library experience library; then query the historical fault library according to the fault cause to give fault handling actions.

4. The system according to claim 3, characterized in that In the fault handling module, there are two triggering modes for executing the pre-plan: automatic triggering and manual confirmation triggering; if the fault execution effect is greater than or equal to the set threshold, it is automatically triggered, and if the execution effect is less than the threshold, it is manually confirmed and triggered.

5. The system according to claim 4, characterized in that, When executing the pre-plan according to the fault handling actions, if this process is manually confirmed and triggered or new execution effects or feedback information are generated, the historical fault library is updated.

6. The system according to claim 1, wherein The log files collected by the log collectors are saved in the log database; the types of the log files include business processing logs, interface call logs, database operation logs, and user operation logs.

7. The system according to claim 1, characterized in that, The service status includes business health status and application process status; the running environment includes dependent service status and machine performance metrics.

8. A fully automatic log analysis and fault handling method based on an NLP large model, characterized in that, including: collect service status, running environment, and log files; extract and generate a log summary from the log files, extract key information from the log summary, and obtain the status information of the business process; if an error is reported, the NLP large model uses the knowledge base, service status, and running environment as prior knowledge to perform fault analysis on the error and record the upstream and downstream key information involved in the error; the knowledge base includes system architecture, error codes, monitoring metrics, data structures, business processes, and coding specifications; find out the fault cause based on the upstream and downstream key information involved in the error and give fault handling actions; then execute the pre-plan according to the fault handling actions.

9. An automatic log analysis and fault handling device based on an NLP large model, characterized in that, Comprising one or more processors for implementing a fully automated log analysis and fault handling method based on an NLP large model as recited in claim 8.

10. A computer-readable storage medium having a program stored thereon, characterized in that, When executed by the processor, it is used to implement a fully automated log analysis and fault handling method based on an NLP large model as recited in claim 8.

Images