System failure diagnosis method, device, storage medium, and program product
By processing log data after system failure and analyzing action learning models, the system can automatically determine target processing actions and causes of failures, solving the problems of high manpower consumption and low efficiency in existing technologies, and achieving efficient system failure diagnosis.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA CONSTRUCTION BANK
- Filing Date
- 2022-09-22
- Publication Date
- 2026-06-09
AI Technical Summary
In existing technologies, system fault diagnosis consumes a lot of manpower and time, resulting in slow troubleshooting and low efficiency.
By acquiring log data generated after a system failure, and using action learning models to determine the target processing actions and the final cause of the failure, we can provide professional problem analysis results and solutions, thereby improving the efficiency of problem investigation.
It enables automated and intelligent identification of fault causes and solutions without user intervention, improving fault diagnosis efficiency and making it suitable for fault diagnosis of complex systems.
Smart Images
Figure CN115495364B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a system fault diagnosis method, device, storage medium, and program product. Background Technology
[0002] Computer systems can perform many functions, such as file transfer systems, which can be used for internal file transfer within an enterprise and can serve many users to meet their different file transfer needs. However, due to the complexity of the system and the environment, various failures are inevitable.
[0003] In related technologies, system fault description information is generated by the user terminal and sent to the expert terminal. The expert analyzes the system fault based on the system fault description information, determines the cause and solution of the system fault, and returns the cause and solution to the user terminal through the expert terminal so that the system problem can be effectively resolved.
[0004] However, in the process of realizing this application, the inventors discovered that the prior art has at least the following problems: the above methods consume a lot of manpower and time, resulting in slow troubleshooting and low efficiency. Summary of the Invention
[0005] This application provides a system fault diagnosis method, device, storage medium, and program product to improve the efficiency of problem diagnosis.
[0006] In a first aspect, embodiments of this application provide a system fault diagnosis method, including:
[0007] Obtain the first log data generated after a system failure;
[0008] Based on the first log data, a first preset number of processing actions are determined; different processing actions correspond to different fault causes; the processing actions are operations performed to eliminate the corresponding fault causes.
[0009] The first preset number of processing actions are input into the action learning model to obtain the target processing action and the corresponding final fault cause; the target processing action is the operation that, among the first preset number of processing actions, results in the highest degree of system recovery after execution.
[0010] In one possible design, determining a first preset number of fault causes based on the first log data includes:
[0011] Based on the first log data, determine a first preset number of fault causes;
[0012] Based on the correspondence between fault causes and handling actions, determine the handling actions corresponding to the first preset number of fault causes.
[0013] In one possible design, determining a first preset number of fault causes based on the first log data includes:
[0014] The first log data is input into the log analysis model to obtain a first preset number of fault causes.
[0015] In one possible design, the method further includes:
[0016] Obtain the second log data generated after a system failure;
[0017] The second log data is processed and categorized to obtain log data in a preset format;
[0018] The log data in the preset format is determined as the training data for the log analysis model, and the log analysis model is trained based on the training data.
[0019] In one possible design, the method further includes:
[0020] Obtain third-party log data generated after a system failure;
[0021] A second preset number of actions to be learned are determined based on the third log data; different actions to be learned correspond to different fault causes; the actions to be learned are operations performed to eliminate the corresponding fault causes;
[0022] Select a first action from the second preset number of actions to be learned, and determine the first action as the target action;
[0023] Obtain the target log data after the system executes the target action;
[0024] Based on the target log data, a score corresponding to the target action is determined; the score is related to the degree to which the system has returned to normal.
[0025] Input the score corresponding to the target action into the model to be trained to obtain the second action; determine the second action as the target action, and return to the step of obtaining the target log data after the system runs the target action;
[0026] The training of the model to be trained is completed based on the score gradient ascent strategy to obtain the action learning model.
[0027] In one possible design, the method further includes:
[0028] Based on the target log data, a third preset number of actions to be learned are determined;
[0029] The step of inputting the score corresponding to the target action into the model to be trained to obtain the second action includes:
[0030] The score corresponding to the target action is input into the model to be trained to obtain the second action from the third preset number of actions to be learned.
[0031] In one possible design, the action learning model is a deep neural network model.
[0032] Secondly, embodiments of this application provide a system fault diagnosis device, comprising:
[0033] The acquisition module is used to acquire the first log data generated after a system failure.
[0034] The processing module is used to determine a first preset number of processing actions based on the first log data; different processing actions correspond to different fault causes; the processing actions are operations performed to eliminate the corresponding fault causes.
[0035] The processing module is further configured to input the first preset number of processing actions into the action learning model to obtain the target processing action and the corresponding final fault cause; the target processing action is the operation that, among the first preset number of processing actions, achieves the highest degree of system recovery after execution.
[0036] Thirdly, embodiments of this application provide a system fault diagnosis device, including: at least one processor and a memory;
[0037] The memory stores computer-executed instructions;
[0038] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the method described in the first aspect above and various possible designs of the first aspect.
[0039] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the method described in the first aspect and various possible designs of the first aspect.
[0040] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect and various possible designs of the first aspect.
[0041] This embodiment provides a system fault diagnosis method, device, storage medium, and program product. The method includes acquiring first log data generated after a system fault occurs; determining a first preset number of processing actions based on the first log data; different processing actions correspond to different fault causes; each processing action is an operation performed to eliminate the corresponding fault cause; inputting the first preset number of processing actions into an action learning model to obtain a target processing action and its corresponding final fault cause; the target processing action is the operation among the first preset number of processing actions that results in the highest degree of system recovery after execution. The method provided in this embodiment processes the log data after a system fault occurs to obtain multiple sets of processing actions that address different faults with higher probabilities. Then, through an action learning model, a target processing action and its corresponding final fault cause are determined from these multiple sets of processing actions. This provides users with professional problem analysis results and solution paths, improving the efficiency of problem troubleshooting. Furthermore, this process requires no user intervention to obtain the final fault cause, demonstrating a high degree of automation and intelligence. Attached Figure Description
[0042] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0043] Figure 1 This is a schematic diagram illustrating an application scenario of the system fault diagnosis method provided in the embodiments of this application;
[0044] Figure 2 A flowchart illustrating the system fault diagnosis method provided in the embodiments of this application. Figure 1 ;
[0045] Figure 3 This is a schematic diagram of the Transformer architecture provided in the embodiments of this application;
[0046] Figure 4 A schematic diagram of the architecture of the action learning model provided in the embodiments of this application;
[0047] Figure 5 This is a schematic diagram of the system fault diagnosis device provided in the embodiments of this application;
[0048] Figure 6 This is a structural block diagram of the system fault diagnosis device provided in the embodiments of this application. Detailed Implementation
[0049] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0050] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0051] Computer systems, such as file transfer systems, can be used for internal file transfers within an enterprise, serving many users and meeting their diverse file transfer needs. For example, such systems can be used to transfer release installation packages, large log files, and system-generated report data. However, due to the complexity of the system and the environment, various failures are inevitable, such as database connection problems, network outages, and issues with the remote node.
[0052] In related technologies, system fault description information is generated by the user terminal and sent to the expert terminal. The expert then analyzes the system fault based on this description, derives the cause and solution, and returns these findings to the user terminal to effectively resolve the system problem. However, this method is labor-intensive and time-consuming, resulting in slow troubleshooting and low efficiency.
[0053] To address the aforementioned technical problems, the inventors of this application have discovered that by processing log data after a system failure, multiple sets of handling actions can be obtained to address different faults with higher probabilities. Then, through an action learning model, the target handling action and the corresponding final fault cause can be determined from these multiple sets of actions. This provides users with professional problem analysis results and solution paths, improving the efficiency of problem diagnosis. Furthermore, this process requires no user intervention to obtain the final fault cause, demonstrating a high degree of automation and intelligence. Based on this, embodiments of this application provide a system fault diagnosis method that can improve the efficiency of problem diagnosis.
[0054] In addition, compared to simply providing multiple possible causes of failure and requiring users to try various causes to determine the final cause of failure, the system fault diagnosis method provided in this embodiment does not require users to keep trying, which is convenient and quick, and therefore more suitable for fault diagnosis of more complex systems.
[0055] Figure 1 This is a schematic diagram illustrating an application scenario of the system fault diagnosis method provided in the embodiments of this application. For example... Figure 1 As shown, user terminal 101 is communicatively connected to server 102. User terminal 101 is used to receive a user-input start request for the system fault diagnosis system and send the start request to server 102; server 102 responds to the start request by monitoring the system status of user terminal 101, and based on the first log data generated after the system fault occurs, determines the target processing action and the corresponding final fault cause through an action learning model, and returns the target processing action and the corresponding final fault cause to user terminal 101.
[0056] In the specific implementation process, user terminal 101 can receive a system fault diagnosis system startup request input by the user and send the startup request to server 102. Server 102 responds to the startup request, starts the system fault diagnosis system, and monitors the system status of user terminal 101. Specifically, it can obtain the first log data generated after the system fault occurs; determine a first preset number of processing actions based on the first log data; different processing actions correspond to different fault causes; the processing actions are operations performed to eliminate the corresponding fault causes; input the first preset number of processing actions into an action learning model to obtain the target processing action and the corresponding final fault cause; the target processing action is the operation among the first preset number of processing actions that results in the highest degree of system recovery after execution. The system fault diagnosis method provided in this embodiment processes the log data after the system fault occurs to obtain multiple sets of processing actions that deal with different faults with a high probability. Then, through the action learning model, the target processing action and the corresponding final fault cause can be determined from the multiple sets of processing actions, providing users with professional problem analysis results and solution paths, improving the efficiency of problem investigation. Moreover, this process does not require any user operation to obtain the final fault cause, and it is highly automated and more intelligent.
[0057] It should be noted that, Figure 1 The schematic diagram shown is merely an example. The system fault diagnosis method and scenario described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of the system and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.
[0058] The technical solutions of this application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.
[0059] Figure 2 A flowchart illustrating the system fault diagnosis method provided in the embodiments of this application. Figure 1 .like Figure 2 As shown, the method includes:
[0060] 201. Obtain the first log data generated after a system failure.
[0061] The execution entity in this embodiment can be a terminal or a server, for example. Figure 1 The server shown.
[0062] In this embodiment, the log data generated after a system failure may include different types of logs such as database status logs and network status logs.
[0063] 202. Based on the first log data, determine a first preset number of processing actions; different processing actions correspond to different fault causes; the processing action is an operation performed to eliminate the corresponding fault cause.
[0064] Specifically, based on the first log data generated after a system failure, multiple causes of failure can be analyzed. Based on the probability of occurrence, these causes can be sorted and the Top N (N can be a positive integer) causes of failure can be selected. Then, for each of the Top N causes of failure, a corresponding processing action can be given. That is, the first preset number can be N. It should be noted that the processing action corresponding to each cause of failure can be a single action or a set of actions. The specific action can be determined according to the actual situation. This embodiment does not limit this.
[0065] In some embodiments, determining a first preset number of fault causes based on the first log data may include: determining a first preset number of fault causes based on the first log data; and determining the processing actions corresponding to the first preset number of fault causes based on the correspondence between fault causes and processing actions.
[0066] In this embodiment, there are multiple ways to determine the first preset number of fault causes based on the first log data.
[0067] In one feasible approach, a knowledge graph relating log data to fault causes can be constructed. Based on this knowledge graph, a first preset number of fault causes corresponding to the first log data can be determined. This approach is fast and efficient.
[0068] In another possible implementation, the first log data can be input into a log analysis model to obtain a first preset number of fault causes. This method has broad coverage and high effectiveness.
[0069] Specifically, the training process of the log analysis model may include: acquiring second log data generated after a system failure; processing and classifying the second log data to obtain log data in a preset format; determining the log data in the preset format as the training data for the log analysis model, and training the log analysis model based on the training data.
[0070] For example, the log analysis model in this embodiment can adopt the following approach: Figure 3 The simplified Transformer architecture shown, where Nx represents the number of repetitions, is more streamlined than the BERT architecture, improving training and runtime efficiency. The multi-layer Transformer structure abandons traditional Recurrent Neural Networks (RNNs) and Convolutional Neural Networks (CNNs), using an attention mechanism to convert the distance between two words at any position into 1, effectively solving the long-term dependency problem in Natural Language Processing (NLP). The log analysis model in this embodiment can include two stages: pre-training and fine-tuning. In the pre-training stage, the model is trained on unlabeled data. In the fine-tuning stage, the BERT model is first initialized with the pre-trained model parameters, and then all parameters are trained using downstream labeled data.
[0071] Specifically, the training data for the log analysis model can be entirely based on log data, completing the first stage of unsupervised training of the Transformer. After completing the first stage of unsupervised training, the general NLP model in the second step of Fine-Tune is fine-tuned to obtain the log analysis model.
[0072] 203. Input the first preset number of processing actions into the action learning model to obtain the target processing action and the corresponding final fault cause; the target processing action is the operation that makes the system recover to the highest degree after execution among the first preset number of processing actions.
[0073] Specifically, after obtaining the first preset number of processing actions, the first preset number of processing actions can be input into a pre-trained action learning model. Through the analysis and processing of the action learning model, the target processing action with the highest probability of resolving the fault can be determined from the first preset number of processing actions, as well as the final fault cause corresponding to the target processing action. Of course, the probability corresponding to the result can also be included.
[0074] In some embodiments, the action learning model is a deep neural network model. Deep reinforcement learning is a combination of deep learning and reinforcement learning. It utilizes the perceptual capabilities of deep learning to solve the modeling problem of policy and value functions, and then uses the backpropagation algorithm to optimize the objective function; simultaneously, it utilizes the decision-making capabilities of reinforcement learning to define the problem and optimize the objective. Deep reinforcement learning possesses, to a certain extent, general intelligence for solving complex problems and has achieved success in many fields. For example, the action learning model can adopt, as shown in... Figure 4 The architecture shown includes an agent and an environment. The agent consists of a dynamic neural network (DNN) with parameters θ. The agent acquires the state s of the environment and adopts a policy π. θ (s, a) generates an action a and applies a to the environment, which generates a reward r based on the action a, as well as a new state s.
[0075] In some embodiments, the training process of the above-mentioned action learning model may include: acquiring third log data generated after a system failure; determining a second preset number of actions to be learned based on the third log data; different actions to be learned correspond to different causes of failure; the actions to be learned are operations performed to eliminate the corresponding causes of failure; selecting a first action from the second preset number of actions to be learned, and determining the first action as the target action; acquiring target log data after the system runs the target action; determining the score corresponding to the target action based on the target log data; the score is related to the degree to which the system recovers to normal; inputting the score corresponding to the target action into the model to be trained to obtain a second action; determining the second action as the target action, and returning to the step of acquiring the target log data after the system runs the target action; and training the model to be trained based on a score gradient ascent strategy to obtain the action learning model.
[0076] In some embodiments, based on the above training process, it may further include: determining a third preset number of actions to be learned based on the target log data; correspondingly, the step of inputting the score corresponding to the target action into the model to be trained to obtain the second action includes: inputting the score corresponding to the target action into the model to be trained to obtain the second action from the third preset number of actions to be learned.
[0077] For example, the environment can be set up first, such as Figure 4As shown, reinforcement learning requires an "environment." The input to the environment is all the system logs after the current action, and the output of the environment is the reward obtained. Secondly, a deep neural network is built; a regular deep neural network will suffice. Thirdly, actions can be defined. For a specific system, such as the current file transfer system, the actions that can be performed are limited. For example, loading a configuration file, reading the database address and password, and using a database connection program to connect to the database can be defined as action 1. Similarly, action 2, action 3, and so on. Next, reward scores can be set. The system rewards 100 points for ultimately solving the problem or all functions functioning normally; otherwise, the reward is 1 (based on the judgment network, there is a probability of an output greater than 0.5, which rewards 1) or 0 (meaningless actions).
[0078] After completing the above preparations, model training can begin. The specific training process involves the following steps: First, randomly initialize and run an action to obtain logs. Second, input the logs into the environment to obtain a score and the next action. Third, after the environment executes the next action, obtain logs again. Fourth, repeat steps two and three, employing a reward score gradient ascent strategy, until the reward score can no longer increase.
[0079] The system fault diagnosis method provided in this embodiment processes the log data after a system fault occurs to obtain multiple sets of processing actions to deal with different faults with high probability. Then, through an action learning model, the target processing action and the corresponding final fault cause are determined from the multiple sets of processing actions. This provides users with professional problem analysis results and solution paths, improving the efficiency of problem investigation. Moreover, this process does not require any user operation to obtain the final fault cause, and it is highly automated and more intelligent.
[0080] Figure 5 This is a schematic diagram of the system fault diagnosis device provided in an embodiment of this application. Figure 5 As shown, the fault diagnosis device 50 of the system includes: an acquisition module 501 and a processing module 502.
[0081] The acquisition module 501 is used to acquire the first log data generated after a system failure.
[0082] The processing module 502 is used to determine a first preset number of processing actions based on the first log data; different processing actions correspond to different fault causes; the processing actions are operations performed to eliminate the corresponding fault causes.
[0083] The processing module 502 is further configured to input the first preset number of processing actions into the action learning model to obtain the target processing action and the corresponding final fault cause; the target processing action is the operation that, among the first preset number of processing actions, achieves the highest degree of system recovery after execution.
[0084] The system fault diagnosis device provided in this application embodiment processes the log data after a system fault occurs to obtain multiple sets of processing actions to deal with different faults with a high probability. Then, through the action learning model, the target processing action and the corresponding final fault cause are determined from the multiple sets of processing actions, providing users with professional problem analysis results and solution paths, improving the efficiency of problem investigation. Moreover, this process can obtain the final fault cause without any user operation, with a high degree of automation and greater intelligence.
[0085] The system fault diagnosis device provided in this application embodiment can be used to execute the above method embodiment. Its implementation principle and technical effect are similar, and will not be repeated here.
[0086] Figure 6 This is a structural block diagram of a system fault diagnosis device provided in an embodiment of this application. The device may be a computer, server, etc.
[0087] Device 60 may include one or more of the following components: processing component 601, memory 602, power supply component 603, multimedia component 604, audio component 605, input / output (I / O) interface 606, sensor component 607, and communication component 608.
[0088] Processing component 601 typically controls the overall operation of device 60, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 601 may include one or more processors 609 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 601 may include one or more modules to facilitate interaction between processing component 601 and other components. For example, processing component 601 may include a multimedia module to facilitate interaction between multimedia component 604 and processing component 601.
[0089] Memory 602 is configured to store various types of data to support operation on device 60. Examples of such data include instructions for any application or method operating on device 60, contact data, phonebook data, messages, pictures, videos, etc. Memory 602 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.
[0090] Power supply component 603 provides power to the various components of device 60. Power supply component 603 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to device 60.
[0091] Multimedia component 604 includes a screen that provides an output interface between the device 60 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 604 includes a front-facing camera and / or a rear-facing camera. When the device 60 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.
[0092] Audio component 605 is configured to output and / or input audio signals. For example, audio component 605 includes a microphone (MIC) configured to receive external audio signals when device 60 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 602 or transmitted via communication component 608. In some embodiments, audio component 605 also includes a speaker for outputting audio signals.
[0093] I / O interface 606 provides an interface between processing component 601 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.
[0094] Sensor assembly 607 includes one or more sensors for providing state assessments of various aspects of device 60. For example, sensor assembly 607 can detect the on / off state of device 60, the relative positioning of components such as the display and keypad of device 60, changes in the position of device 60 or a component of device 60, the presence or absence of user contact with device 60, the orientation or acceleration / deceleration of device 60, and temperature changes of device 60. Sensor assembly 607 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 607 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 607 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.
[0095] Communication component 608 is configured to facilitate wired or wireless communication between device 60 and other devices. Device 60 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 608 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 608 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
[0096] In an exemplary embodiment, device 60 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.
[0097] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 602 including instructions, which can be executed by a processor 609 of the device 60 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.
[0098] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.
[0099] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.
[0100] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.
[0101] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements the system fault diagnosis method executed by the above-mentioned system fault diagnosis device.
[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.
Claims
1. A system fault diagnosis method, characterized in that, include: Obtain the first log data generated after a system failure; Based on the first log data, determine a first preset number of processing actions; Different processing actions correspond to different fault causes; the processing action is the operation performed to eliminate the corresponding fault cause; Input the first preset number of processing actions into the action learning model to obtain the target processing action and the corresponding final fault cause; The target processing action is the operation that, among the first preset number of processing actions, results in the highest degree of system recovery after execution. The method further includes: Obtain third-party log data generated after a system failure; A second preset number of actions to be learned are determined based on the third log data; different actions to be learned correspond to different fault causes; the actions to be learned are operations performed to eliminate the corresponding fault causes; Select a first action from the second preset number of actions to be learned, and determine the first action as the target action; Obtain the target log data after the system executes the target action; Based on the target log data, a score corresponding to the target action is determined; the score is related to the degree to which the system has returned to normal. Input the score corresponding to the target action into the model to be trained to obtain the second action; determine the second action as the target action, and return to the step of obtaining the target log data after the system runs the target action; The training of the model to be trained is completed based on the score gradient ascent strategy to obtain the action learning model.
2. The method according to claim 1, characterized in that, The step of determining a first preset number of fault causes based on the first log data includes: Based on the first log data, determine a first preset number of fault causes; Based on the correspondence between fault causes and handling actions, determine the handling actions corresponding to the first preset number of fault causes.
3. The method according to claim 2, characterized in that, The step of determining a first preset number of fault causes based on the first log data includes: The first log data is input into the log analysis model to obtain a first preset number of fault causes.
4. The method according to claim 3, characterized in that, The method further includes: Obtain the second log data generated after a system failure; The second log data is processed and categorized to obtain log data in a preset format; The log data in the preset format is determined as the training data for the log analysis model, and the log analysis model is trained based on the training data.
5. The method according to claim 4, characterized in that, The method further includes: Based on the target log data, a third preset number of actions to be learned are determined; The step of inputting the score corresponding to the target action into the model to be trained to obtain the second action includes: The score corresponding to the target action is input into the model to be trained to obtain the second action among the third preset number of actions to be learned.
6. The method according to any one of claims 1-5, characterized in that, The action learning model is a deep neural network model.
7. A system fault diagnosis device, characterized in that, include: The acquisition module is used to acquire the first log data generated after a system failure. The processing module is used to determine a first preset number of processing actions based on the first log data; different processing actions correspond to different fault causes; the processing actions are operations performed to eliminate the corresponding fault causes. The processing module is further configured to input the first preset number of processing actions into the action learning model to obtain the target processing action and the corresponding final fault cause; the target processing action is the operation that, among the first preset number of processing actions, enables the system to recover to the highest degree after execution. The processing module is further configured to: Obtain third-party log data generated after a system failure; A second preset number of actions to be learned are determined based on the third log data; different actions to be learned correspond to different fault causes; the actions to be learned are operations performed to eliminate the corresponding fault causes; Select a first action from the second preset number of actions to be learned, and determine the first action as the target action; Obtain the target log data after the system executes the target action; Based on the target log data, a score corresponding to the target action is determined; the score is related to the degree to which the system has returned to normal. Input the score corresponding to the target action into the model to be trained to obtain the second action; determine the second action as the target action, and return to the step of obtaining the target log data after the system runs the target action; The training of the model to be trained is completed based on the score gradient ascent strategy to obtain the action learning model.
8. A system fault diagnosis device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the system fault diagnosis method as described in any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by the processor, implement the system fault diagnosis method as described in any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the system fault diagnosis method according to any one of claims 1 to 6.