Method and device for generating diagnosis results, storage medium, electronic device and computer program product

Abstract

An embodiment of the present application provides a method and device for generating diagnostic results, a storage medium, an electronic device and a computer program product. The method includes: inputting a first fault log during the operation of a server into a first diagnostic agent used to diagnose a first fault event corresponding to a first component in the server, and determining based on the first diagnostic agent whether the first fault log contains a second fault event corresponding to other components in the server except the first component; when it is determined that the first fault log contains the second fault event, establishing a communication relationship between the second diagnostic agents corresponding to the other components based on the first diagnostic agent, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; receiving multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generating a target diagnostic result based on the multiple diagnostic results.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and more specifically, to a method and device for generating a diagnosis result, a storage medium, an electronic device, and a computer program product. Background Art

[0002] Server fault diagnosis is a crucial task. During the operation of the server, there are corresponding log records for various abnormal events and operation data. In the related technology, by detecting and analyzing the massive logs generated during the operation, various abnormal events in the server operation process are identified, and then the corresponding fault diagnosis is completed according to the abnormal events, server fault diagnosis is realized, and the fault problem is solved based on the diagnosis results. However, the types of server faults are complex and diverse, and there is a high degree of dependence between different components. Fault diagnosis and root cause analysis are very complicated; and with the expansion of the scale of server clusters and the acceleration of iterative updates of server components, the occurrence of abnormal events has become more difficult to capture. The traditional manual rule-based diagnosis method is highly dependent on the professional knowledge of the staff. The rule system formed by the knowledge of the staff cannot effectively cover all types of faults. In addition, after the model is replaced and the components are updated, new faults may not be effectively identified by experience and rules in a short time. The diagnostic tools in the related technology generally build rule systems based on experience, or combine traditional machine learning model algorithms for fault classification, which are often only applicable to specific scenarios. If the hardware of the faulty server changes due to technological innovation or the configuration of the server, it is necessary to redesign the rules and retrain the algorithm model to adapt to the changes in the server.

[0003] A server fault diagnosis method is provided in the related art, which specifically includes: connecting to at least one server; before the operating system of the server is started, notifying the server to modify the configuration of multiple serial ports on the server to transmit the log data of the modified serial port to the first virtual serial port on the server; transmitting the log data received by the first virtual serial port to the local second virtual serial port via the serial super peripheral connection channel (Serial Over LAN Channel, referred to as SOL) channel; reading the log data of the second virtual serial port to determine the type of fault. Through the technical solution of the present application, the time cost of fault diagnosis can be saved and the human resource consumption of fault diagnosis can be reduced. That is, the server fault diagnosis method in the related art can save the time cost of fault diagnosis and reduce the human resource consumption of fault diagnosis. However, the server fault diagnosis method in the related art has the problem of poor scene understanding ability, that is, once the fault scene changes, the corresponding scene parameters need to be changed and the fault diagnosis model needs to be retrained.

[0004] Therefore, the problem that when the fault scenario corresponding to the server changes, the fault diagnosis model in the related technology needs to change the corresponding scenario parameters and retrain the fault diagnosis model has not been effectively solved. Summary of the invention

[0005] The embodiments of the present application provide a method and device for generating diagnostic results, a storage medium, an electronic device, and a computer program product, so as to at least solve the problem in the related art that when the fault scenario corresponding to the server changes, the corresponding scenario parameters need to be changed and the fault diagnosis model needs to be retrained.

[0006] According to an embodiment of the present application, a method for generating a diagnostic result is provided, comprising: inputting a first fault log during the operation of a server into a first diagnostic agent, and determining based on the first diagnostic agent whether the first fault log contains a second fault event corresponding to other components, wherein the first diagnostic agent is used to diagnose a first fault event corresponding to a first component in the server, and the other components include: components other than the first component among multiple components in the server; in the case where it is determined based on the first diagnostic agent that the first fault log contains the second fault event, establishing a communication relationship between the first diagnostic agent and a second diagnostic agent corresponding to the other component based on the first diagnostic agent, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; receiving multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generating a target diagnostic result based on the multiple diagnostic results.

[0007] In an exemplary embodiment, before inputting a first fault log during the operation of the server into a first diagnostic agent, the method further includes: obtaining a second fault log during the operation of the server; standardizing the second fault log based on a log preprocessing agent to generate a third fault log; determining whether there is missing data in the third fault log; and when it is determined that there is missing data in the third fault log, filling in the missing data based on the log preprocessing agent to generate the first fault log.

[0008] In an exemplary embodiment, the second fault log is standardized based on a log preprocessing agent to generate a third fault log, including: determining an execution topic list corresponding to the third fault log to be generated, and determining a first prompt word corresponding to each execution topic in the execution topic list, wherein each execution topic is used to indicate the basic characteristics of each third fault event contained in the second fault log; based on the first prompt word and the log preprocessing agent, the second fault log is standardized under the execution topic list to generate the third fault log, wherein each row of the third fault log is used to indicate each third fault event, and each column of the third fault log is used to indicate the log data of each third fault event under each execution topic.

[0009] In an exemplary embodiment, the second fault log is standardized under the execution topic list based on the first prompt word and the log preprocessing agent, including: determining the target log data of each third fault event under each execution topic in the second fault log; determining whether the log format corresponding to the target log data is the standard log format; when it is determined that the log formats corresponding to the target log data are all the standard log formats, determining the correspondence between the target log data and each execution topic based on the first prompt word and the log preprocessing agent to standardize the second fault log; when it is determined that the log format corresponding to the target log data is not the standard log format, converting the target log data into log data in the standard log format, and determining the correspondence between the converted target log data and each execution topic to standardize the second fault log.

[0010] In an exemplary embodiment, filling the missing data based on the log preprocessing agent to generate the first fault log includes: determining the first row of the missing data in the third fault log based on the log preprocessing agent, and determining the first column of the missing data in the third fault log based on the log preprocessing agent, so as to determine the first position of the missing data in the third fault log according to the first row and the first column; determining the first execution subject corresponding to the first column, wherein the execution subject list includes: the first execution subject; determining the missing data according to the first execution subject, and filling the missing data in the first position to generate the first fault log.

[0011] In an exemplary embodiment, determining the missing data according to the first execution subject includes: in a case where it is determined that the first execution subject is a timestamp, determining whether a second line of log and a third line of log exist in the third fault log, wherein the second line of log is a line of log before the missing data, and the third line of log is a line of log after the missing data; in a case where it is determined that the second line of log and the third line of log exist in the third fault log, respectively determining first log data corresponding to the first execution subject in the second line of log and second log data corresponding to the first execution subject in the third line of log; determining a first timestamp corresponding to a fault event corresponding to the second line of log and a second timestamp corresponding to the fault event corresponding to the third line of log according to the first log data and the second log data; and determining the missing data according to the time interval between the first timestamp and the second timestamp.

[0012] In an exemplary embodiment, the missing data is determined based on the time interval between the first timestamp and the second timestamp, including: when it is determined that the time interval is greater than a preset time interval, determining third log data that already exists in the first row; determining in the third fault log log log data whose first similarity with the third log data is greater than a first similarity threshold, and determining a fourth row corresponding to the log data whose first similarity is greater than the first similarity threshold; determining a third timestamp contained in the log data corresponding to the fourth row; and determining the log data corresponding to the third timestamp as the missing data.

[0013] In an exemplary embodiment, the missing data is determined based on the time interval between the first timestamp and the second timestamp, including: when it is determined that the time interval is less than or equal to a preset time interval, determining the middle moment corresponding to the first timestamp and the second timestamp, and determining a fourth timestamp corresponding to the middle moment; and determining the log data corresponding to the fourth timestamp as the missing data.

[0014] In an exemplary embodiment, determining the missing data based on the first execution subject also includes: in a case where the first execution subject is determined to be the second execution subject among other execution subjects, determining fourth log data already existing in the first row, wherein the other execution subjects are execution subjects other than timestamps in the execution subject list; determining log data in the third fault log whose second similarity with the fourth log data is greater than a second similarity threshold, and determining the fifth row corresponding to the log data whose second similarity is greater than the second similarity threshold; determining fifth log data corresponding to the second execution subject contained in the log data corresponding to the fifth row; and determining the fifth log data as the missing data.

[0015] In an exemplary embodiment, before receiving multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, the method also includes: sending the first fault log to an unknown diagnostic agent based on the first diagnostic agent or the second diagnostic agent, wherein the unknown diagnostic agent has a communication relationship with the first diagnostic agent and a communication relationship with the second diagnostic agent, and the unknown diagnostic agent is used to diagnose unknown fault events in the server; determining an unknown diagnostic result corresponding to the first fault log based on the unknown diagnostic agent, and receiving the unknown diagnostic result sent by the unknown diagnostic agent.

[0016] In an exemplary embodiment, a target diagnostic result is generated based on the multiple diagnostic results, including: determining a diagnostic result set based on the multiple diagnostic results and the unknown diagnostic result; determining the fault occurrence time of each fault event corresponding to each diagnostic result in the diagnostic result set; and determining each line number of log data corresponding to each component included in the first fault log; determining the diagnostic result priority corresponding to each diagnostic result in the diagnostic result set based on each line number, and generating the target diagnostic result based on the fault occurrence time or the diagnostic result priority.

[0017] In an exemplary embodiment, determining the diagnostic result priority corresponding to each diagnostic result in the diagnostic result set according to each number of rows includes: determining the number of occurrences of failure events of each component according to each number of rows; and determining the total number of rows of log data contained in the first fault log; determining the average failure probability of each component according to the number of occurrences of failure events of each component and the total number of rows; determining the failure weight corresponding to each component according to the average failure probability and the number of occurrences of failure events of each component; determining the priority corresponding to each component according to the failure weight, and determining the diagnostic result priority according to the priority corresponding to each component.

[0018] In an exemplary embodiment, the target diagnostic result is generated according to the fault occurrence time or the diagnostic result priority, including: determining the number of diagnostic results included in the diagnostic result set; when it is determined that the number of diagnostic results is greater than or equal to a preset number, selecting the preset number of diagnostic results according to the diagnostic result priority, and generating the target diagnostic result based on the preset number of diagnostic results; when it is determined that the number of diagnostic results is less than the preset number, outputting each diagnostic result in the diagnostic result set in sequence according to the fault occurrence time to generate the target diagnostic result.

[0019] In an exemplary embodiment, after generating a target diagnostic result based on the multiple diagnostic results, the method further includes: obtaining a manual feedback work order corresponding to the server, wherein the manual feedback work order is used to indicate the diagnostic result of the fault event corresponding to each component in the server that is manually fed back; obtaining sixth log data corresponding to the second diagnostic result in the manual feedback work order in the first fault log; determining a third diagnostic result corresponding to the sixth log data in the target diagnostic result; comparing the second diagnostic result with the three diagnostic results to determine a comparison result; and verifying the diagnostic agent corresponding to the target diagnostic result based on the comparison result.

[0020] In an exemplary embodiment, the diagnostic agent corresponding to the target diagnostic result is verified based on the comparison result, including: when the comparison result indicates that the second diagnostic result is consistent with the third diagnostic result, determining that the verification of the diagnostic agent corresponding to the target diagnostic result is successful; when the comparison result indicates that the second diagnostic result is inconsistent with the third diagnostic result, determining that the verification of the diagnostic agent corresponding to the third diagnostic result is a failure.

[0021] In an exemplary embodiment, after verifying the diagnostic agent corresponding to the target diagnostic result according to the comparison result, the method further includes: in a case where it is determined that the diagnostic agent corresponding to the third diagnostic result has failed verification, determining the diagnostic agent corresponding to the third diagnostic result, and determining a second prompt word corresponding to the second diagnostic result; based on the second prompt word, feeding back the second diagnostic result to the diagnostic agent corresponding to the third diagnostic result, and training the diagnostic agent corresponding to the third diagnostic result based on the second diagnostic result, so that the diagnostic result of the diagnostic agent corresponding to the third diagnostic result based on the first fault log input is the second diagnostic result.

[0022] According to another embodiment of the present application, a device for generating a diagnosis result is provided, comprising: an input module, used to input a first fault log during the operation of a server into a first diagnostic agent, and determine based on the first diagnostic agent whether the first fault log contains a second fault event corresponding to other components, wherein the first diagnostic agent is used to diagnose a first fault event corresponding to a first component in the server, and the other components include: components other than the first component among multiple components in the server; an establishment module, used to establish, based on the first diagnostic agent, a communication relationship between the first diagnostic agent and a second diagnostic agent corresponding to the other component, when it is determined based on the first diagnostic agent that the first fault log contains the second fault event, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; a receiving module, used to receive multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generate a target diagnostic result based on the multiple diagnostic results.

[0023] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps in the above method embodiment when running.

[0024] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in the above method embodiment.

[0025] According to another embodiment of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiment are implemented.

[0026] Through the method for generating the diagnostic result of the present application, the first fault log in the process of server operation is input into the first diagnostic agent used to diagnose the first fault event corresponding to the first component in the server, and the first diagnostic agent is used to determine whether the first fault log contains the second fault event corresponding to other components in the server except the first component; in the case where the first diagnostic agent determines that the first fault log contains the second fault event, the first diagnostic agent is used to establish a communication relationship between the first diagnostic agent and the second diagnostic agent used to diagnose the fault event of other components, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; receive multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generate the target diagnostic result according to the multiple diagnostic results. That is to say, the embodiment of the present application sets up multiple diagnostic agents, each diagnostic agent is used to diagnose the fault event of a component in the server, and a communication relationship can be established between the multiple diagnostic agents. In the case where the first diagnostic agent determines that the first fault log also contains the fault event that the second diagnostic agent can diagnose, the first fault log can be directly sent to the second diagnostic agent according to the communication relationship between the first diagnostic agent and the second diagnostic agent. According to the optional embodiment of the present application, the problem that the fault diagnosis model in the related art needs to change the corresponding scenario parameters and retrain the fault diagnosis model when the fault scenario corresponding to the server changes can be solved. Furthermore, the fault events corresponding to the various components of the server can be diagnosed without changing the corresponding scenario parameters or retraining the fault diagnosis model, thereby improving the fault diagnosis efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a hardware structure block diagram of a computer terminal of a method for generating a diagnosis result according to an embodiment of the present application;

[0028] Figure 2 is a flow chart of a method for generating a diagnosis result according to an embodiment of the present application;

[0029] Figure 3 It is a flow chart of a processing method for server cluster fault diagnosis in the related art;

[0030] Figure 4 It is a flow chart of a server fault diagnosis method in the related art;

[0031] Figure 5 It is an overall block diagram corresponding to a server fault diagnosis device according to an optional embodiment of the present application;

[0032] Figure 6 is a data preprocessing flow chart according to an optional embodiment of the present application;

[0033] Figure 7 is a business structure diagram of collaborative decision-making among multiple diagnostic agents according to an optional embodiment of the present application;

[0034] Figure 8 It is a structural block diagram of a device for generating diagnostic results according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0037] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a computer terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a computer terminal for a method for generating a diagnosis result according to an embodiment of the present application. Figure 1 As shown, the computer terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 402 (the processor 402 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 404 for storing data, wherein the above-mentioned computer terminal may also include a transmission device 406 for communication functions and an input and output device 408. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0038] The memory 404 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for determining the interactive state in the embodiment of the present application. The processor 402 executes various functional applications and data processing by running the computer program stored in the memory 404, that is, to implement the above method. The memory 404 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 404 may further include a memory remotely arranged relative to the processor 402, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0039] The transmission device 406 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of a computer terminal. In one example, the transmission device 406 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 406 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0040] Figure 2 is a flowchart of a method for generating a diagnosis result according to an embodiment of the present application, which can be applied to Figure 1 In a computer terminal, such as Figure 2 As shown, the process includes the following steps:

[0041] Step S202, inputting a first fault log during the operation of the server into a first diagnostic agent, and determining whether the first fault log contains a second fault event corresponding to other components based on the first diagnostic agent, wherein the first diagnostic agent is used to diagnose a first fault event corresponding to a first component in the server, and the other components include: components other than the first component among multiple components in the server;

[0042] Optionally, before determining whether the first fault log contains a second fault event corresponding to another component based on the first diagnostic agent, the method further includes:

[0043] Based on the first diagnostic agent, it is determined whether a first fault event occurs in the first component.

[0044] Step S204, when it is determined based on the first diagnostic agent that the first fault log contains the second fault event, a communication relationship is established between the first diagnostic agent and a second diagnostic agent corresponding to the other component based on the first diagnostic agent, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship;

[0045] For example: the first diagnostic agent is used to diagnose the fault events corresponding to the power supply in the server. When the first diagnostic agent diagnoses that the first fault log also includes the fault events corresponding to the network card and the mainboard, a communication relationship between the first diagnostic agent and the agent corresponding to the network card, and a communication relationship between the first diagnostic agent and the agent corresponding to the mainboard can be established. The first fault log is sent to the agent corresponding to the network card through the communication relationship between the first diagnostic agent and the agent corresponding to the network card, and the first fault log is sent to the agent corresponding to the mainboard through the communication relationship between the first diagnostic agent and the agent corresponding to the mainboard.

[0046] Step S206, receiving multiple diagnosis results sent by the first diagnosis agent and the second diagnosis agent, and generating a target diagnosis result according to the multiple diagnosis results.

[0047] Through the method for generating the diagnostic result of the present application, the first fault log in the process of server operation is input into the first diagnostic agent used to diagnose the first fault event corresponding to the first component in the server, and the first diagnostic agent is used to determine whether the first fault log contains the second fault event corresponding to other components in the server except the first component; in the case where the first diagnostic agent determines that the first fault log contains the second fault event, the first diagnostic agent is used to establish a communication relationship between the first diagnostic agent and the second diagnostic agent used to diagnose the fault event of other components, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; receive multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generate the target diagnostic result according to the multiple diagnostic results. That is to say, the embodiment of the present application sets up multiple diagnostic agents, each diagnostic agent is used to diagnose the fault event of a component in the server, and a communication relationship can be established between the multiple diagnostic agents. In the case where the first diagnostic agent determines that the first fault log also contains the fault event that the second diagnostic agent can diagnose, the first fault log can be directly sent to the second diagnostic agent according to the communication relationship between the first diagnostic agent and the second diagnostic agent. According to the optional embodiment of the present application, the problem that the fault diagnosis model in the related art needs to change the corresponding scenario parameters and retrain the fault diagnosis model when the fault scenario corresponding to the server changes can be solved. Furthermore, the fault events corresponding to the various components of the server can be diagnosed without changing the corresponding scenario parameters or retraining the fault diagnosis model, thereby improving the fault diagnosis efficiency.

[0048] Optionally, before inputting the first fault log during the operation of the server into the first diagnostic agent in the above step S202, the method also includes: obtaining a second fault log during the operation of the server; standardizing the second fault log based on a log preprocessing agent to generate a third fault log; determining whether there is missing data in the third fault log; and when it is determined that there is missing data in the third fault log, filling in the missing data based on the log preprocessing agent to generate the first fault log.

[0049] It is understandable that the acquired fault logs during the operation of the server may contain multiple forms, and the multiple forms of fault logs need to be standardized, that is, the process of standardization processing of the embodiment of the present application. In the process of standardization processing, it can be determined whether there is missing fault data in the fault log. If it is determined that there is a missing fault log, the missing fault log needs to be filled.

[0050] Specifically: (1) based on the log preprocessing agent, the second fault log is standardized to generate a third fault log, that is, the process of standardizing the second fault log includes: determining the execution topic list corresponding to the third fault log to be generated, and determining the first prompt word corresponding to each execution topic in the execution topic list, wherein each execution topic is used to indicate the basic characteristics of each third fault event contained in the second fault log; based on the first prompt word and the log preprocessing agent, the second fault log is standardized under the execution topic list to generate the third fault log, wherein each row of the third fault log is used to indicate each third fault event, and each column of the third fault log is used to indicate the log data of each third fault event under each execution topic.

[0051] It can be understood that the execution topic list corresponding to the third fault log is determined, wherein the execution topics in the execution topic list may include: timestamp, component name, component location characteristics, fault category characteristics and other execution topics, that is, the second fault log is standardized according to the execution topics in the above execution topic list.

[0052] According to the above process of standardizing the second fault log, the log processing efficiency can be improved.

[0053] Among them, based on the first prompt word and the log preprocessing agent, the second fault log is subjected to standardized processing under the execution topic list, including: based on the first prompt word and the log preprocessing agent, the second fault log is subjected to standardized processing under the execution topic list, including: determining the target log data of each third fault event under each execution topic in the second fault log; determining whether the log format corresponding to the target log data is the standard log format; when it is determined that the log formats corresponding to the target log data are all the standard log formats, determining the correspondence between the target log data and each execution topic based on the first prompt word and the log preprocessing agent to perform standardized processing on the second fault log; when it is determined that the log format corresponding to the target log data is not the standard log format, converting the target log data into log data in the standard log format, and determining the correspondence between the converted target log data and each execution topic to perform standardized processing on the second fault log. Determine whether the log format corresponding to the target log data is a standard log format; when it is determined that the log formats corresponding to the target log data are all the standard log formats, determine the correspondence between the target log data and each execution topic based on the first prompt word and the log preprocessing agent to perform standardized processing on the second fault log; when it is determined that the log format corresponding to the target log data is not the standard log format, convert the target log data into log data in the standard log format, and determine the correspondence between the converted target log data and each execution topic to perform standardized processing on the second fault log.

[0054] It can be understood that the process of performing standardized processing on the second fault log under the subject list includes: determining the target log data of each fault event under each execution subject, for example: determining the log data corresponding to the timestamp of fault event 1, the log data corresponding to the component name of the fault event, etc. Determine whether each target log data is in a standard log format, for example: the format of the log data corresponding to the timestamp of the standard log format is: year / month / day / hour / minute / second, and the format of the log data corresponding to the timestamp of fault event 1 in the second fault log is: second / minute / hour / day / month / year. That is, it can be determined that there is non-standard format log data in the second fault log, and the non-standard format log data needs to be standardized.

[0055] (2) In the process of standardizing the second fault log, it can be determined whether there is missing data in the second fault log. If there is missing data, the missing data needs to be filled. Specifically:

[0056] Filling the missing data based on the log preprocessing agent to generate the first fault log includes: determining the first row of the missing data in the third fault log based on the log preprocessing agent, and determining the first column of the missing data in the third fault log based on the log preprocessing agent, so as to determine the first position of the missing data in the third fault log according to the first row and the first column; determining the first execution subject corresponding to the first column, wherein the execution subject list includes: the first execution subject; determining the missing data according to the first execution subject, and filling the missing data in the first position to generate the first fault log.

[0057] It is understandable that in the process of filling missing data, firstly, the first row of the missing data in the fault log needs to be determined, and secondly, the first column of the missing data in the fault log needs to be determined. The specific position of the missing data in the fault log can be determined based on the first row and the first column.

[0058] Since each column of the standardized fault log is used to indicate the log data of each execution topic corresponding to each fault event, after determining the column corresponding to the missing data, the first execution topic corresponding to the missing data can be determined, and then the missing data can be filled according to the first execution topic.

[0059] It can be understood that, through the above technical solution, missing data can be effectively filled in, thereby improving the integrity and availability of the fault log.

[0060] Wherein, determining the missing data according to the first execution subject includes: in the case where it is determined that the first execution subject is a timestamp, determining whether there is a second line of log and a third line of log in the third fault log, wherein the second line of log is a line of log before the missing data, and the third line of log is a line of log after the missing data; in the case where it is determined that the second line of log and the third line of log exist in the third fault log, respectively determining the first log data corresponding to the first execution subject in the second line of log and the second log data corresponding to the first execution subject in the third line of log; determining a first timestamp corresponding to a fault event corresponding to the second line of log and a second timestamp corresponding to the fault event corresponding to the third line of log according to the first log data and the second log data; determining the missing data according to the time interval between the first timestamp and the second timestamp.

[0061] It can be understood that when the missing data is determined to be a timestamp, since the fault logs are arranged in chronological order, the previous line of log and the next line of log of the missing data can be determined, and then the first timestamp corresponding to the previous line of log and the second timestamp corresponding to the next line of log can be determined, and the missing data can be determined based on the time interval between the first timestamp and the second timestamp.

[0062] Specifically, the missing data is determined based on the time interval between the first timestamp and the second timestamp, including: when it is determined that the time interval is greater than a preset time interval, determining the third log data already existing in the first row; determining in the third fault log log log data whose first similarity with the third log data is greater than a first similarity threshold, and determining a fourth row corresponding to the log data whose first similarity is greater than the first similarity threshold; determining the third timestamp contained in the log data corresponding to the fourth row; and determining the log data corresponding to the third timestamp as the missing data.

[0063] Determining the missing data based on the time interval between the first timestamp and the second timestamp also includes: when it is determined that the time interval is less than or equal to a preset time interval, determining the intermediate moment corresponding to the first timestamp and the second timestamp, and determining a fourth timestamp corresponding to the intermediate moment; and determining the log data corresponding to the fourth timestamp as the missing data.

[0064] That is, determining missing data based on time intervals can include two situations:

[0065] (1) When it is determined that the time interval is greater than the preset time interval, it is necessary to determine the similarity between the log data in the first row and the log data in all rows in the third fault log, determine the third timestamp in the fourth row of log with the highest similarity, and determine the third timestamp as missing data;

[0066] (2) When it is determined that the time interval is less than or equal to the preset time interval, it is only necessary to determine the fourth timestamp corresponding to the middle moment between the first timestamp and the second timestamp, and determine the log data corresponding to the fourth timestamp as missing data.

[0067] The preset time interval may be 5 minutes.

[0068] Through the above technical solution, the log time interval can be ensured to remain stable, making the log data more continuous and complete. By filling in missing timestamps, data loss or duplication can be avoided, improving data accuracy and availability.

[0069] Among them, the missing data may also be other data besides the timestamp, that is, determining the missing data according to the first execution subject, also includes: when determining that the first execution subject is the second execution subject among other execution subjects, determining the fourth log data already existing in the first row, wherein the other execution subject is the execution subject except the timestamp in the execution subject list; determining in the third fault log the log data whose second similarity with the fourth log data is greater than the second similarity threshold, and determining the fifth row corresponding to the log data whose second similarity is greater than the second similarity threshold; determining the fifth log data corresponding to the second execution subject contained in the log data corresponding to the fifth row; and determining the fifth log data as the missing data.

[0070] It is understandable that the above-mentioned other execution topics may be: component names, component location characteristics, etc.

[0071] When the first execution subject is determined to be the second execution subject among other execution subjects, it is necessary to determine the fourth log data in the first row, and then determine the fifth row of log data in the third fault log whose similarity with the fourth fault log is greater than the second similarity threshold, and determine the log data in the fifth row of log data that is in the same column as the missing data as the missing data.

[0072] Optionally, before receiving the multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent in the above step S206, the method also includes: sending the first fault log to an unknown diagnostic agent based on the first diagnostic agent or the second diagnostic agent, wherein the unknown diagnostic agent has a communication relationship with the first diagnostic agent and a communication relationship with the second diagnostic agent, and the unknown diagnostic agent is used to diagnose unknown fault events in the server; determining the unknown diagnostic result corresponding to the first fault log based on the unknown diagnostic agent, and receiving the unknown diagnostic result sent by the unknown diagnostic agent.

[0073] According to the above technical solution, after the first fault log is diagnosed by multiple diagnostic agents, it is also necessary to send the first fault log to an unknown diagnostic agent to determine whether the first diagnostic log includes unknown faults that cannot be diagnosed by multiple diagnostic agents, thereby improving the diagnostic accuracy and the unknown fault diagnosis rate.

[0074] Among them, generating a target diagnostic result based on the multiple diagnostic results includes: determining a diagnostic result set based on the multiple diagnostic results and the unknown diagnostic result; determining the fault occurrence time of each fault event corresponding to each diagnostic result in the diagnostic result set; and determining each line number of log data corresponding to each component included in the first fault log; determining the diagnostic result priority corresponding to each diagnostic result in the diagnostic result set according to each line number, and generating the target diagnostic result according to the fault occurrence time or the diagnostic result priority.

[0075] Wherein, determining the diagnostic result priority corresponding to each diagnostic result in the diagnostic result set according to each number of rows includes: determining the number of occurrences of the failure event of each component according to each number of rows; and determining the total number of rows of log data contained in the first fault log; determining the average failure probability of each component according to the number of occurrences of the failure event of each component and the total number of rows; determining the failure weight corresponding to each component according to the average failure probability and the number of occurrences of the failure event of each component; determining the priority corresponding to each component according to the failure weight, and determining the diagnostic result priority according to the priority corresponding to each component.

[0076] Among them, generating the target diagnostic result according to the fault occurrence time or the diagnostic result priority includes: determining the number of diagnostic results included in the diagnostic result set; when it is determined that the number of diagnostic results is greater than or equal to a preset number, selecting the preset number of diagnostic results according to the diagnostic result priority, and generating the target diagnostic result based on the preset number of diagnostic results; when it is determined that the number of diagnostic results is less than the preset number, outputting each diagnostic result in the diagnostic result set in sequence according to the fault occurrence time to generate the target diagnostic result.

[0077] It is understandable that, when receiving each diagnostic result output by each diagnostic agent, each diagnostic result needs to be integrated. Specifically, the number of occurrences of the failure time of each component can be determined, and the total number of rows of each component in the first fault log can be determined; and then the average failure probability of each component can be determined based on the number of times and the total number of rows. The failure weight corresponding to each component can be determined based on the average failure probability, and then the priority of each component can be determined. Since each component corresponds to a diagnostic agent, the priority of each diagnostic agent can be determined by determining the priority of the component.

[0078] For example: when the preset number is 5, determine how many diagnostic results are received. When it is determined that only 3 diagnostic results are received, the diagnostic results are output in sequence according to the fault occurrence time corresponding to each component to determine the target diagnostic result. When it is determined that 7 diagnostic results are received, the diagnostic results corresponding to the diagnostic agents with the top 5 priorities can be selected, and these 5 diagnostic agents can output the diagnostic results in sequence according to the fault occurrence time corresponding to the component to determine the target diagnostic result.

[0079] It can be appreciated that by outputting the diagnostic results in weight and time order, the most important or urgent faults can be handled first to minimize system downtime and impact.

[0080] Optionally, after generating the target diagnostic result based on the multiple diagnostic results in the above step S206, the method also includes: obtaining a manual feedback work order corresponding to the server, wherein the manual feedback work order is used to indicate the diagnostic result of the fault event corresponding to each component in the server that is manually fed back; obtaining sixth log data corresponding to the second diagnostic result in the manual feedback work order in the first fault log; determining a third diagnostic result corresponding to the sixth log data in the target diagnostic result; comparing the second diagnostic result with the three diagnostic results to determine a comparison result; and verifying the diagnostic agent corresponding to the target diagnostic result based on the comparison result.

[0081] Wherein, the diagnostic agent corresponding to the target diagnostic result is verified according to the comparison result, including: when the comparison result indicates that the second diagnostic result is consistent with the third diagnostic result, determining that the verification of the diagnostic agent corresponding to the target diagnostic result is successful; when the comparison result indicates that the second diagnostic result is inconsistent with the third diagnostic result, determining that the verification of the diagnostic agent corresponding to the third diagnostic result is a failure.

[0082] Among them, after verifying the diagnostic agent corresponding to the target diagnostic result according to the comparison result, the method also includes: in the case where it is determined that the diagnostic agent corresponding to the third diagnostic result has failed to be verified, determining the diagnostic agent corresponding to the third diagnostic result, and determining the second prompt word corresponding to the second diagnostic result; based on the second prompt word, feeding back the second diagnostic result to the diagnostic agent corresponding to the third diagnostic result, and training the diagnostic agent corresponding to the third diagnostic result based on the second diagnostic result, so that the diagnostic result of the diagnostic agent corresponding to the third diagnostic result based on the first fault log input is the second diagnostic result.

[0083] It is understandable that it is also possible to determine whether each diagnostic agent has passed the verification. If it is determined that the diagnostic agent has passed the verification, each diagnostic result can be directly output; if it is determined that the diagnostic agent has not passed the verification, it is necessary to train the diagnostic agent based on the correct diagnostic results.

[0084] It is understandable that before the diagnostic agent is applied, the diagnostic agent can be trained, specifically:

[0085] The diagnostic results corresponding to 100 servers can be output, and the fault results of the manual feedback corresponding to these 100 servers can be determined, and then the two results can be compared to determine the number of times the two results are consistent and inconsistent. According to the number of consistent and inconsistent times, it can be determined whether the diagnostic agent has been trained.

[0086] In order to better understand the process of the above-mentioned method for generating the diagnosis result, the implementation process of the above-mentioned method for generating the diagnosis result is described below in combination with an optional embodiment, but it is not used to limit the technical solution of the embodiment of the present application.

[0087] Before explaining the implementation process of the above diagnostic result generation method, you first need to understand the following terms:

[0088] 1. Large language model (LLM): It is an AI model based on deep learning technology, which is specially used to process and generate natural language. They understand and generate human-like language by learning from large amounts of text data. The training of these models usually requires huge computing resources and massive amounts of data.

[0089] The key points about the large language model include:

[0090] (1) Deep neural network architecture: Large language models are usually based on deep neural network architecture, which can effectively capture complex patterns and long-range dependencies in language.

[0091] (2) Large-scale data training: These models are trained on large amounts of text data, including books, articles, website content, etc. This enables them to understand a wide range of language phenomena and knowledge.

[0092] (3) Wide application: Large language models can be used for a variety of natural language processing tasks, such as text generation, translation, question-answering systems, sentiment analysis, summary generation, etc.

[0093] (2) Artificial Intelligence Agent (AI Agent): It is a software entity that can make decisions freely, perceive its environment, and take actions to achieve specific goals or tasks. The agent can receive input information and generate corresponding output information according to the preset logical algorithm based on the input information.

[0094] In the server cluster fault diagnosis scenario application, different agents can perform different tasks. Some agents can extract key information and features, some agents can be used to perform reasoning, and some agents can be used to identify log content, etc. The characteristics of the agent include:

[0095] On the one hand, the prompt words and constraints based on which the intelligent agent is constructed can be used to automatically standardize and extract features of large-scale data, which can be used to diagnose server cluster faults. On the other hand, the intelligent agent can customize the logic algorithm according to the specific server operation and maintenance scenarios and requirements. Different intelligent agents can have different logic algorithms for fault diagnosis tasks, and the focus of fault diagnosis is also different, so as to provide a more accurate fault diagnosis process. On the other hand, the intelligent agent that can perform unknown fault diagnosis can enhance the perception ability of unknown faults.

[0096] With the rapid development of cutting-edge technologies such as big data, cloud computing, and the fifth generation mobile communication technology (5G), the amount of data has increased dramatically. In order to provide computing power, data, and various application services, large server clusters are increasingly deployed in data centers around the world to provide users, enterprises, and others with the ultimate experience of computing power and applications. However, the stable operation of the server is a core element related to data security and computing power stability. In the server cluster, hard disk failure and memory failure account for about 80% of all hardware failures, and other types of failures account for the remaining 20%. Server failures may cause problems such as task delays and service delays. In severe cases, it may cause equipment downtime, business interruption, and even system crashes and data loss risks. Therefore, the stability and reliability of the server are very important. When a server failure occurs, timely and accurate diagnosis and positioning, as well as timely and effective perception of unknown failures, are the key to ensuring the stable operation of the server.

[0097] Two server fault diagnosis solutions are provided in the related art, specifically:

[0098] 1) Figure 3 The present invention is a flowchart of a processing method for server cluster fault diagnosis in the related art, and the process includes:

[0099] Step S311, collecting information from multiple registers of the server related to the fault, wherein if at least one of the multiple registers cannot complete information collection, it is determined that the automatic diagnosis fails;

[0100] Step S312, after completing the information collection of the plurality of registers, analyzing the collected register information to obtain a first fault analysis result, wherein when the first fault analysis result indicates that the faulty component of the server cannot be determined or indicates that there are multiple faulty components in the server, it is determined that the automatic diagnosis has failed;

[0101] Step S313, when it is determined based on the first fault analysis result that there is only one faulty component of the server, determining that the automatic diagnosis is successful;

[0102] Step S314: if the automatic diagnosis is successful, fault diagnosis information is generated in the real-time operation information output by the server, and the fault diagnosis information includes clear fault component information corresponding to the fault component.

[0103] That is to say, a processing method for server cluster fault diagnosis in the related technology sorts out the fault types that cause the failure of automatic diagnosis, and reports the faults that cannot be automatically diagnosed due to incomplete information or multiple component errors in real time through diagnosis failure information and enters the automatic processing process, thereby making the automatic diagnosis failure fault processing faster and more efficient. In addition, the processing method distinguishes and counts the automatic diagnosis results based on the keywords contained in the diagnosis failure information in the historical operation information, improves the feasibility of data statistics, and connects to the server supplier through the online system to provide real-time feedback and recording of data, which is conducive to the improvement and optimization of the automatic diagnosis capabilities of subsequent versions of the server.

[0104] Through the above-mentioned embodiments, when the automatic / semi-automatic diagnostic tool of the server fails, the diagnostic failure information is added to the information output by the server, and the failure information can effectively record the keywords of the diagnostic failure, and the diagnostic failure keywords can indicate a catastrophic failure. The diagnostic failure information can be screened out through the diagnostic failure keywords in the diagnostic failure information to determine the fault category. However, when the above-mentioned embodiments have the problem of incomplete information and multi-component fault problems leading to fault diagnosis failure, it is necessary to manually or by setting rules to enter the diagnostic failure information, which affects the efficiency of fault diagnosis and cannot effectively diagnose unidentified faults.

[0105] 2) Figure 4 It is a flow chart of a server fault diagnosis method in the related art, and the process includes:

[0106] Step S102, connecting to at least one server;

[0107] Step S104, before the operating system of the server is started, notifying the server to modify the configuration of multiple serial ports on the server, so as to transmit the log data of the modified serial ports to the first virtual serial port on the server;

[0108] Step S106, transmitting the log data received by the first virtual serial port to the local second virtual serial port via the SOL channel;

[0109] Step S108, reading the log data of the second virtual serial port to determine the fault type.

[0110] Through the above embodiments, the time cost of fault diagnosis can be saved and the human resource consumption of fault diagnosis can be reduced. However, the above embodiments have the problem of poor scene understanding ability, inability to use diagnostic knowledge, and need to change corresponding parameters and retrain the model once the scene changes; and lack of inference ability.

[0111] In response to the problems in the above technical solutions, the optional embodiments of the present application propose a server fault diagnosis method and device, which can not only accurately diagnose known server fault categories, but also effectively diagnose unknown faults, and based on the emergence capability of the big model, it can generate a diagnostic report according to the fault log description.

[0112] Figure 5 is an overall block diagram corresponding to a server fault diagnosis device according to an optional embodiment of the present application, such as Figure 5 As shown:

[0113] The server fault diagnosis device includes: a log collection module, a data preprocessing module, a fault diagnosis module, a mutual feedback & manual feedback module and a result output module. Among them:

[0114] 1) Log collection module: A large number of logs are generated during the operation of the server cluster. The fault log collection module collects the log information generated during the operation of the server through in-band and out-of-band methods and stores the logs.

[0115] 2) Data preprocessing module: The logs collected by the Baseboard Management Controller (BMC) include: System Event Log (SEL log), Interface Definition Language Log (IDL log), audit log, black box log, etc. Due to differences in the collection methods and collected components, the logs are presented in various forms. For example, the SEL log format is: timestamp|component name|specific component location|fault category|fault status, for example: {2024-04-01:13:34:00|SystemACPI (used to indicate a component name)|Power State ACPI_PWR (used to indicate a specific component location)|S4 / S5 soft-off (used to indicate a fault category)|Asserted (used to indicate a fault status)}. However, the IDL log format is {2024-04-01T1334:00.426591+08:00 ProductSN InspurDiagnose:InspurDiagnose--|2024-04-01T13:34:00+08:00|ACPISTATUS|Assert|Info|22FF0600|ACPI_PWR S5 / G2 - soft-off| (an example used to indicate an IDL log format)}. For server clusters, the model changes and hardware configuration differences lead to the diversity of collected logs, and the cluster generates massive logs every moment. For massive, multi-category, and widely different logs, it is necessary to use an automated method to pre-process and standardize them, and then perform subsequent diagnosis in a large model. On the one hand, the use of automated methods for preprocessing and standardization can improve the efficiency of log processing. For server clusters with thousands or even tens of thousands of nodes, manual and traditional log processing takes too long. On the other hand, traditional log processing requires setting various rules and considering various log situations, such as missing logs, irregular dates, various types of server IDs (identifications), and various rule settings to constrain log content to the same specifications.

[0116] Therefore, we build a data preprocessing agent, and use the emergence ability of the big model, the ability to process massive data, and the ability to constrain various types of data to achieve standardized processing of special characters in logs, missing logs, various date differences, and other issues. On the other hand, the built agent can accurately fill in the missing information (fault category, time of fault occurrence, etc.) through the reasoning ability of the big model and the content of the context. The main process is as follows Figure 6As shown, it includes: defining data preprocessing actions, defining execution topics, forming an execution topic list, action execution and other actions. The specific implementation process is:

[0117] The planning execution agent issues execution commands and defines specific topics in the execution topic list, including: timestamp standardization, component name standardization, component location feature standardization, fault category feature standardization, missing information filling and other topics. For each topic, define specific prompt word information, for example: for timestamp standardization: {In the input log data, the first column is the timestamp information, please convert it into the standard time format, the format is 'year-month-day hour: minute: second' (for example: 2024-06-01 12:20:20)}, other standardized prompt words are similar. In order to improve work efficiency, all execution topic lists are processed in the feature flow mode when the action is executed, that is, the log information under each server ID is passed in, and these logs are standardized under all topic lists. Among them, the feature flow mode refers to: passing in all logs under a server ID, which is a text file. The specific examples are as follows: line 1 log content, line 2 log content, ..., line n log content.

[0118] These n logs form a feature stream when they are processed. For example, timestamps, component names, etc. are processed directly in the corresponding columns, and all logs are processed directly.

[0119] During the processing, if missing data is encountered, it can be filled according to the data flow context. For the execution subject of missing data filling, the context association is involved, and the specific execution logic is constructed including:

[0120] 1) Record the missing log line and cache the log information of this line: log 缺失 , skip the timestamp standardization, component name standardization, component location feature standardization, and fault category feature standardization processes of this line, and perform subsequent log standardization processing on other lines in the log file according to the execution topic. For example, the fault category information of {'A correctable error of PCIEDevice, the status of correctable error is "Stack3 / P-Stack"' (used to indicate a fault category information)} is standardized to {"correctable error" (used to indicate a standardized fault category information)} through retrieval query, forming the original log information, that is, logs 原始 =LLM(logs BMC , Prompt 标准化 ).

[0121] Among them, Prompt 标准化Some examples of use in real applications are:

[0122] {"You are an expert in log processing. Please standardize each log by timestamp standardization, component name standardization, component location feature standardization, and fault category feature standardization. If some fields in the log are missing, please fill them with 'None' temporarily for further processing. Please perform the standardization operation step by step:

[0123] For timestamps, please standardize them into the format of 'year-month-day-hour:minute:second' (e.g. 2024-06-01-12:20:20);

[0124] Please standardize the component names to the specific English names of the central processing unit (CPU), graphics processing unit (GPU), memory, hard disk, redundant array of independent disks card (RAID card), motherboard, power supply, fan, network card, adapter card, host bus adapter card (HBA) card in the log;

[0125] For component locations, please try to simplify them into corresponding field names according to your understanding of intelligent operation and maintenance;

[0126] For the fault category characteristics, please try to constrain them to the summary of the fault. For example: A correctable error of PCIE Device, the status of correctable error is "Stack3 / P-Stack"' (used to indicate the log data corresponding to the fault category characteristics) is summarized as correctable error"} (used to indicate the summary of the fault).

[0127] Among them, Prompt 标准化 In some practical applications, the usage process is to standardize the log information obtained by BMC. LLM() is the reasoning process of the large model. BMC Indicates the server logs collected by BMC, logs 原始 It represents the intermediate state log for further processing after being standardized.

[0128] 2) For cached rows, according to the missing columns, the timestamp, component feature name, component location feature, and fault category are standardized through the prompt word, and the missing values ​​are filled through the emergent reasoning ability of the large model. The specific method used for missing value filling is:

[0129] (1) Identify the missing locations in the log, which may be timestamps, component feature names, component location features, fault categories, etc.

[0130] (2) Construct missing value filling instructions in the agent for different missing positions.

[0131] For missing timestamps, if there are logs generated before and after this log, and the time interval between the logs is less than 5 minutes, the instruction is constructed to take the middle moment of the two timestamps and fill the missing timestamp. If the time interval is greater than 5 minutes, the timestamp filling format needs to be given in combination with the context information. The feature name, component location feature, and fault category information of the missing timestamp are calculated for similarity with the string array consisting of the previous and next component feature names, component location features, and fault category information, and the timestamp of the most similar log is filled into the log with missing timestamp.

[0132] If the feature name, component location feature, or fault category information is missing, it is necessary to perform a matching search in the adjacent logs. When a server component fails, the adjacent logs will generally repeat the corresponding fault information. Due to the transitive nature of the fault, other types of faults may appear in the adjacent logs. Therefore, take the 5 logs before and after the missing fault information (if the number of before and after > 5). If the number of before and after is less than 5, take all the logs and complete the reasoning of the missing information through agent modeling. The result of the obtained log preprocessing is represented as logs 填充 :logs 填充 =LLM(logs 原始 , Prompt 预处理 ).

[0133] Based on logs 填充 Further acquire the features required for fault diagnosis through prompt words (Prompt 预处理 ) constraints realize the extraction of features in the form of “timestamp: component feature name: fault category information” and obtain the log corpus information required by the diagnostic agent.

[0134] (3) Generating a response is to return the processed log data in the form of ID.txt (a text file format) for subsequent judgment and processing, and to feed back the task execution end response to the planning execution agent for further use.

[0135] 3) Fault diagnosis module: Since the server consists of various components, using the same prompt words to construct a single diagnostic agent is prone to produce incorrect diagnostic results and terminate the diagnosis prematurely.

[0136] Therefore, combined with the inherent characteristics of the server, specific diagnostic agents such as CPU, GPU, memory, hard disk, RAID card, motherboard, power supply, fan, network card, adapter card, HBA card, etc. are constructed. In order to realize the ability to diagnose unknown faults, unknown category agents are constructed at the same time. With the help of the emergence ability of large models, unknown faults can be identified and diagnosed. The multiple agents constructed form a diagnostic module. The planning & execution agent realizes the collaborative diagnosis between different diagnostic agents, accurately analyzes the correlation between different faults, realizes the effective diagnosis of faults, and realizes the diagnosis of single component and multiple component faults of the server by setting the output. When the diagnostic module performs specific diagnostic tasks, different diagnostic agents make decisions on log judgments. Since the fault category of the server log diagnosis results is one or several of the many fault problems most of the time, collaborative decision-making between diagnostic agents is required. Figure 7 is a business structure diagram of collaborative decision-making among multiple diagnostic agents according to an optional embodiment of the present application, such as Figure 7 As shown in the figure: after obtaining the execution command of the planning execution agent, the diagnostic agents 1 to N respectively perform specific diagnoses and form diagnostic results 1 to N; during the diagnostic execution process, when the agent diagnoses the fault of other components, it will collaborate with the corresponding fault diagnosis agent in a collaborative manner to further judge the log and obtain the diagnostic results; after all agents form the diagnostic results, the collaborative agent merges the diagnostic results 1 to N, and further submits the results to the large language model for analysis to form a collaborative diagnostic result that meets the requirements of the diagnostic result language.

[0137] Specifically: The planning execution agent is used to issue fault diagnosis instructions. After issuing the instructions, the diagnostic agents 1 to N diagnose the logs after standardization and missing filling, and form diagnostic results. When the diagnostic results are formed, it is required to retain the specific information of the log based on the diagnosis results, including the time and the specific log line corresponding to the fault judgment. The format constraint is "time, specific line of fault log: diagnosed as [fault category] fault". Since each agent diagnoses a specific fault, the reasoning function of the large model may enable the agent to make inferences during diagnosis. If other faults are inferred, it will directly communicate with the corresponding fault diagnosis agent, and other agents will further judge the fault. While retaining the original fault diagnosis results, the agent communicating with it further judges the log to determine whether this type of fault occurs. Since the inferred other faults may not be one, there may be multiple agents communicating with it. At the same time, the unknown fault agent also needs to judge the log to determine whether there are faults other than the specific fault diagnosis agent.

[0138] The collaborative agent aggregates the diagnostic results of different agents on the one hand, and prioritizes the faults according to the time sequence and prior knowledge on the other hand. The time sequence is sorted according to the time in the diagnostic results of each agent. The prior knowledge construction process includes: counting the total number of all servers S and the total number of log lines T after standardization. According to expert knowledge, the total number of log lines corresponding to each component is counted: S1, S2, S3, ..., S m . S i It is represented as the total number of logs containing a single component i in all logs. The average number of failures of each component during the log collection interval is calculated as: , m is the total failure of all servers.

[0139] in, is the floor sign, so each F i All are integers. The average failure probability of a component is calculated as: .

[0140] Prior knowledge is converted into weight calculation, and the weight calculation formula is: .

[0141] F i The factorial of . i Sort from largest to smallest. If multiple faults occur, they will be sorted according to the weight P i The top 5 fault information is output. If the total number of diagnosed faults does not exceed 3, the fault information is directly output in chronological order.

[0142] 4) Mutual feedback & manual feedback module. After the diagnosis results are formed in the above fault diagnosis module, the diagnosis results are verified in the mutual feedback module to form feedback. The specific steps include:

[0143] (1) For logs used for diagnosis, define a mutual feedback agent and define the prompt word Prompt as: "As an intelligent operation and maintenance expert, please determine the specific category of the log fault based on the content of the log. Some log faults are one type, while others contain multiple types. Please analyze and infer them step by step in chronological reverse order."

[0144] (2) The standardized historical fault logs, as well as the manual feedback work orders, maintenance records, replacement parts labels, etc. of the fault logs, are matched with the server identifiers to which the corresponding logs belong, and the log features and corresponding labels are stored.

[0145] (3) The mutual feedback agent is used to extract the logs with labels in the middle logs, that is, to find the corresponding specific log lines according to the fault characteristics, as the comparison result of the diagnostic feedback information of the diagnostic agent.

[0146] (4) Compare the log features and diagnostic results in the fault diagnosis agent with the results in step (3). If they are consistent, the diagnostic results of the diagnostic agent meet the accuracy requirements. If they are inconsistent, the planning & execution agent is responsible for feeding back the labels to the corresponding diagnostic agent, using a prompt such as "The previous diagnosis was incorrect. According to the feedback from the agent, the diagnostic result is [actual diagnostic result]. Please make a new diagnosis based on this result."

[0147] 5) In the planning and execution agent, define a plan for iterative execution of 3) and 4), and count the number of log diagnosis of each batch (for example, a batch contains logs of 100 server identifiers). After the above two steps, the number of times the agent's diagnosis results are the same or different from the mutual feedback agent's retrieval results is recorded as Cnt 一致 , Cnt 不一致 If Cn t一致 / (Cnt 一致 +Cnt 不一致 )>0.85, then stop iterating and execute loops 3) and 4).

[0148] 6) After step 5), the results of the fault diagnosis agent are output, and based on the emergence capability of the large model, diagnostic results and reports are formed for specific results.

[0149] Through the above optional embodiments, the overall solution framework and implementation details of server cluster fault diagnosis based on AI agent are proposed, and an effective collaborative agent fault diagnosis framework is constructed. At the same time, a mutual feedback method is proposed for the collaborative agent fault diagnosis feedback mechanism to avoid the illusion of large models, improve the diagnosis accuracy and unknown fault diagnosis rate.

[0150] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0151] In the present embodiment, a device for generating a diagnostic result is also provided, and the device is used to implement the above-mentioned embodiment and the preferred implementation mode, and the description thereof will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceived.

[0152] Figure 8 is a structural block diagram of a device for generating diagnostic results according to an embodiment of the present application, such as Figure 8 As shown, the device comprises:

[0153] An input module 82 is used to input a first fault log in the operation process of the server into a first diagnostic agent, and determine whether the first fault log contains a second fault event corresponding to other components based on the first diagnostic agent, wherein the first diagnostic agent is used to diagnose the first fault event corresponding to the first component in the server, and the other component includes: components other than the first component among the multiple components in the server;

[0154] Establishing module 84, used for establishing a communication relationship between the first diagnostic agent and the second diagnostic agent corresponding to the other component based on the first diagnostic agent, when it is determined based on the first diagnostic agent that the first fault log contains the second fault event, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship;

[0155] The receiving module 86 is used to receive multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generate a target diagnostic result according to the multiple diagnostic results.

[0156] Through the diagnostic result generating device of the present application, the first fault log in the process of server operation is input into the first diagnostic agent used to diagnose the first fault event corresponding to the first component in the server, and the first diagnostic agent is used to determine whether the first fault log contains the second fault event corresponding to other components in the server except the first component; in the case where the first diagnostic agent determines that the first fault log contains the second fault event, the first diagnostic agent is used to establish a communication relationship between the first diagnostic agent and the second diagnostic agent used to diagnose the fault event of other components, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; receive multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generate the target diagnostic result according to the multiple diagnostic results. That is to say, the embodiment of the present application sets up multiple diagnostic agents, each diagnostic agent is used to diagnose the fault event of a component in the server, and a communication relationship can be established between the multiple diagnostic agents. In the case where the first diagnostic agent determines that the first fault log also contains the fault event that the second diagnostic agent can diagnose, the first fault log can be directly sent to the second diagnostic agent according to the communication relationship between the first diagnostic agent and the second diagnostic agent. According to the optional embodiment of the present application, the problem that the fault diagnosis model in the related art needs to change the corresponding scenario parameters and retrain the fault diagnosis model when the fault scenario corresponding to the server changes can be solved. Furthermore, the fault events corresponding to the various components of the server can be diagnosed without changing the corresponding scenario parameters or retraining the fault diagnosis model, thereby improving the fault diagnosis efficiency.

[0157] In an exemplary embodiment, the input module 82 is also used to obtain a second fault log of the server during operation; standardize the second fault log based on a log preprocessing agent to generate a third fault log; determine whether there is missing data in the third fault log; and when it is determined that there is missing data in the third fault log, fill in the missing data based on the log preprocessing agent to generate the first fault log.

[0158] In an exemplary embodiment, the input module 82 is also used to determine an execution topic list corresponding to the third fault log to be generated, and to determine a first prompt word corresponding to each execution topic in the execution topic list, wherein each execution topic is used to indicate the basic characteristics of each third fault event contained in the second fault log; based on the first prompt word and the log preprocessing agent, the second fault log is standardized under the execution topic list to generate the third fault log, wherein each row of the third fault log is used to indicate each third fault event, and each column of the third fault log is used to indicate the log data of each third fault event under each execution topic.

[0159] In an exemplary embodiment, the input module 82 is also used to determine the target log data of each third fault event under each execution topic in the second fault log; determine whether the log format corresponding to the target log data is a standard log format; when it is determined that the log formats corresponding to the target log data are all the standard log formats, determine the correspondence between the target log data and each execution topic based on the first prompt word and the log preprocessing agent to perform standardized processing on the second fault log; when it is determined that the log format corresponding to the target log data is not the standard log format, convert the target log data into log data in the standard log format, and determine the correspondence between the converted target log data and each execution topic to perform standardized processing on the second fault log.

[0160] In an exemplary embodiment, the input module 82 is also used to determine the first row of the missing data in the third fault log based on the log preprocessing agent, and determine the first column of the missing data in the third fault log based on the log preprocessing agent, so as to determine the first position of the missing data in the third fault log according to the first row and the first column; determine the first execution subject corresponding to the first column, wherein the execution subject list includes: the first execution subject; determine the missing data according to the first execution subject, and fill the missing data in the first position to generate the first fault log.

[0161] In an exemplary embodiment, the input module 82 is also used to determine whether there are a second line of log and a third line of log in the third fault log when it is determined that the first execution subject is a timestamp, wherein the second line of log is the previous line of log of the missing data, and the third line of log is the subsequent line of log of the missing data; when it is determined that the second line of log and the third line of log exist in the third fault log, respectively determine the first log data corresponding to the first execution subject in the second line of log and the second log data corresponding to the first execution subject in the third line of log; determine the first timestamp corresponding to the fault event corresponding to the second line of log and the second timestamp corresponding to the fault event corresponding to the third line of log based on the first log data and the second log data; determine the missing data based on the time interval between the first timestamp and the second timestamp.

[0162] In an exemplary embodiment, the input module 82 is also used to determine the third log data already existing in the first row when it is determined that the time interval is greater than a preset time interval; determine the log data in the third fault log whose first similarity with the third log data is greater than a first similarity threshold, and determine the fourth row corresponding to the log data whose first similarity is greater than the first similarity threshold; determine the third timestamp contained in the log data corresponding to the fourth row; and determine the log data corresponding to the third timestamp as the missing data.

[0163] In an exemplary embodiment, the input module 82 is also used to determine the intermediate moment corresponding to the first timestamp and the second timestamp when it is determined that the time interval is less than or equal to a preset time interval, and determine a fourth timestamp corresponding to the intermediate moment; and determine the log data corresponding to the fourth timestamp as the missing data.

[0164] In an exemplary embodiment, the input module 82 is also used to determine the fourth log data already existing in the first row when it is determined that the first execution subject is the second execution subject among other execution subjects, wherein the other execution subjects are execution subjects other than timestamps in the execution subject list; determine log data in the third fault log whose second similarity with the fourth log data is greater than a second similarity threshold, and determine the fifth row corresponding to the log data whose second similarity is greater than the second similarity threshold; determine the fifth log data corresponding to the second execution subject contained in the log data corresponding to the fifth row; and determine the fifth log data as the missing data.

[0165] In an exemplary embodiment, the receiving module 86 is also used to send the first fault log to an unknown diagnostic agent based on the first diagnostic agent or the second diagnostic agent, wherein the unknown diagnostic agent has a communication relationship with the first diagnostic agent and a communication relationship with the second diagnostic agent, and the unknown diagnostic agent is used to diagnose unknown fault events in the server; determine the unknown diagnostic result corresponding to the first fault log based on the unknown diagnostic agent, and receive the unknown diagnostic result sent by the unknown diagnostic agent.

[0166] In an exemplary embodiment, the receiving module 86 is also used to determine a diagnostic result set based on the multiple diagnostic results and the unknown diagnostic result; determine the fault occurrence time of each fault event corresponding to each diagnostic result in the diagnostic result set; and determine each line number of log data corresponding to each component contained in the first fault log; determine the diagnostic result priority corresponding to each diagnostic result in the diagnostic result set based on each line number, and generate the target diagnostic result based on the fault occurrence time or the diagnostic result priority.

[0167] In an exemplary embodiment, the receiving module 86 is further used to determine the number of occurrences of the failure event of each component according to the number of each line; and to determine the total number of lines of log data contained in the first fault log; determine the average failure probability of each component according to the number of occurrences of the failure event of each component and the total number of lines; determine the failure weight corresponding to each component according to the average failure probability and the number of occurrences of the failure event of each component; determine the priority corresponding to each component according to the failure weight, and determine the priority of the diagnosis result according to the priority corresponding to each component.

[0168] In an exemplary embodiment, the receiving module 86 is also used to determine the number of diagnostic results included in the diagnostic result set; when it is determined that the number of diagnostic results is greater than or equal to a preset number, the preset number of diagnostic results are selected according to the diagnostic result priority, and the target diagnostic result is generated based on the preset number of diagnostic results; when it is determined that the number of diagnostic results is less than the preset number, each diagnostic result in the diagnostic result set is output in sequence according to the fault occurrence time to generate the target diagnostic result.

[0169] In an exemplary embodiment, the receiving module 86 is also used to obtain a manual feedback work order corresponding to the server, wherein the manual feedback work order is used to indicate the diagnosis result of the fault event corresponding to each component in the server that is manually fed back; obtain the sixth log data corresponding to the second diagnosis result in the manual feedback work order in the first fault log; determine the third diagnosis result corresponding to the sixth log data in the target diagnosis result; compare the second diagnosis result with the three diagnosis results to determine the comparison result; and verify the diagnostic agent corresponding to the target diagnosis result according to the comparison result.

[0170] In an exemplary embodiment, the receiving module 86 is also used to determine that the verification of the diagnostic agent corresponding to the target diagnostic result is successful when the comparison result indicates that the second diagnostic result is consistent with the third diagnostic result; and to determine that the verification of the diagnostic agent corresponding to the third diagnostic result is unsuccessful when the comparison result indicates that the second diagnostic result is inconsistent with the third diagnostic result.

[0171] In an exemplary embodiment, the receiving module 86 is also used to determine the diagnostic agent corresponding to the third diagnostic result and determine the second prompt word corresponding to the second diagnostic result when it is determined that the diagnostic agent corresponding to the third diagnostic result has failed verification; feedback the second diagnostic result to the diagnostic agent corresponding to the third diagnostic result based on the second prompt word, and train the diagnostic agent corresponding to the third diagnostic result based on the second diagnostic result so that the diagnostic result of the diagnostic agent corresponding to the third diagnostic result based on the first fault log input is the second diagnostic result.

[0172] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps in the above method embodiment when running.

[0173] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0174] Optionally, in this embodiment, the storage medium may be configured to store program codes for executing the following steps:

[0175] S1, inputting a first fault log during the operation of the server into a first diagnostic agent, and determining whether the first fault log contains a second fault event corresponding to other components based on the first diagnostic agent, wherein the first diagnostic agent is used to diagnose the first fault event corresponding to a first component in the server, and the other components include: components other than the first component among multiple components in the server;

[0176] S2, when it is determined based on the first diagnostic agent that the first fault log contains the second fault event, establishing a communication relationship between the first diagnostic agent and a second diagnostic agent corresponding to the other component based on the first diagnostic agent, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship;

[0177] S3, receiving multiple diagnosis results sent by the first diagnosis agent and the second diagnosis agent, and generating a target diagnosis result according to the multiple diagnosis results.

[0178] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in the above method embodiment.

[0179] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0180] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0181] S1, inputting a first fault log during the operation of the server into a first diagnostic agent, and determining whether the first fault log contains a second fault event corresponding to other components based on the first diagnostic agent, wherein the first diagnostic agent is used to diagnose the first fault event corresponding to a first component in the server, and the other components include: components other than the first component among multiple components in the server;

[0182] S2, when it is determined based on the first diagnostic agent that the first fault log contains the second fault event, establishing a communication relationship between the first diagnostic agent and a second diagnostic agent corresponding to the other component based on the first diagnostic agent, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship;

[0183] S3, receiving multiple diagnosis results sent by the first diagnosis agent and the second diagnosis agent, and generating a target diagnosis result according to the multiple diagnosis results.

[0184] An embodiment of the present application further provides a computer program product, including a computer program, which is implemented to perform the steps in the above method embodiment when executed by a processor.

[0185] Optionally, in this embodiment, the computer program product may be executed by a processor to perform the following steps:

[0186] S1, inputting a first fault log during the operation of the server into a first diagnostic agent, and determining whether the first fault log contains a second fault event corresponding to other components based on the first diagnostic agent, wherein the first diagnostic agent is used to diagnose the first fault event corresponding to a first component in the server, and the other components include: components other than the first component among multiple components in the server;

[0187] S2, when it is determined based on the first diagnostic agent that the first fault log contains the second fault event, establishing a communication relationship between the first diagnostic agent and a second diagnostic agent corresponding to the other component based on the first diagnostic agent, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship;

[0188] S3, receiving multiple diagnosis results sent by the first diagnosis agent and the second diagnosis agent, and generating a target diagnosis result according to the multiple diagnosis results.

[0189] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0190] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0191] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for generating a diagnosis result, characterized in that: include: Inputting a first fault log during the operation of the server into a first diagnostic agent, and determining whether the first fault log contains a second fault event corresponding to other components based on the first diagnostic agent, wherein the first diagnostic agent is used to diagnose the first fault event corresponding to a first component in the server, and the other components include: components other than the first component among the multiple components in the server; In the case where it is determined based on the first diagnostic agent that the first fault log contains the second fault event, a communication relationship is established between the first diagnostic agent and a second diagnostic agent corresponding to the other component based on the first diagnostic agent, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; Receive multiple diagnosis results sent by the first diagnosis agent and the second diagnosis agent, and generate a target diagnosis result according to the multiple diagnosis results.

2. The method according to claim 1, characterized in that Before inputting the first fault log in the process of server operation into the first diagnostic agent, the method further includes: Obtaining a second fault log of the server during operation; Based on the log preprocessing agent, the second fault log is subjected to standardization processing to generate a third fault log; Determining whether there is missing data in the third fault log; When it is determined that the missing data exists in the third fault log, the missing data is filled in based on the log preprocessing agent to generate the first fault log.

3. The method according to claim 2, characterized in that The second fault log is subjected to standardization processing based on a log preprocessing agent to generate a third fault log, including: Determine an execution topic list corresponding to the third fault log to be generated, and determine a first prompt word corresponding to each execution topic in the execution topic list, wherein each execution topic is used to indicate a basic feature of each third fault event included in the second fault log; Based on the first prompt word and the log preprocessing agent, the second fault log is standardized under the execution topic list to generate the third fault log, wherein each row of the third fault log is used to indicate each third fault event, and each column of the third fault log is used to indicate the log data of each third fault event under each execution topic.

4. The method according to claim 3, characterized in that Based on the first prompt word and the log preprocessing agent, the second fault log is subjected to standardized processing under the execution topic list, including: Determining target log data of each third fault event under each execution subject in the second fault log; Determine whether the log format corresponding to the target log data is a standard log format; In the case where it is determined that the log formats corresponding to the target log data are all the standard log formats, determining the correspondence between the target log data and each execution topic based on the first prompt word and the log preprocessing agent, so as to perform standardized processing on the second fault log; When it is determined that the log format corresponding to the target log data is not the standard log format, the target log data is converted into log data in the standard log format, and the correspondence between the converted target log data and each execution subject is determined to perform standardized processing on the second fault log.

5. The method according to claim 3, characterized in that: Filling the missing data based on the log preprocessing agent to generate the first fault log includes: Determine a first row of the missing data in the third fault log based on the log preprocessing agent, and determine a first column of the missing data in the third fault log based on the log preprocessing agent, so as to determine a first position of the missing data in the third fault log according to the first row and the first column; Determine a first execution subject corresponding to the first column, wherein the execution subject list includes: the first execution subject; The missing data is determined according to the first execution topic, and the missing data is filled in the first position to generate the first fault log.

6. The method according to claim 5, characterized in that Determining the missing data according to the first execution topic includes: In the case where it is determined that the first execution subject is a timestamp, determining whether there is a second line of log and a third line of log in the third fault log, wherein the second line of log is a line of log before the missing data, and the third line of log is a line of log after the missing data; When it is determined that the second line of log and the third line of log exist in the third fault log, first log data corresponding to the first execution subject in the second line of log and second log data corresponding to the first execution subject in the third line of log are respectively determined; Determine, according to the first log data and the second log data, a first timestamp corresponding to the fault event corresponding to the second line of log and a second timestamp corresponding to the fault event corresponding to the third line of log; The missing data is determined according to a time interval between the first timestamp and the second timestamp.

7. The method according to claim 6, characterized in that Determining the missing data according to the time interval between the first timestamp and the second timestamp includes: In the case where it is determined that the time interval is greater than the preset time interval, determining the third log data that already exists in the first row; Determine in the third fault log the log data whose first similarity with the third log data is greater than a first similarity threshold, and determine a fourth row corresponding to the log data whose first similarity is greater than the first similarity threshold; Determine a third timestamp included in the log data corresponding to the fourth line; The log data corresponding to the third timestamp is determined as the missing data.

8. The method according to claim 6, characterized in that Determining the missing data according to the time interval between the first timestamp and the second timestamp includes: In the case where it is determined that the time interval is less than or equal to the preset time interval, determining an intermediate moment corresponding to the first timestamp and the second timestamp, and determining a fourth timestamp corresponding to the intermediate moment; The log data corresponding to the fourth timestamp is determined as the missing data.

9. The method according to claim 5, characterized in that Determining the missing data according to the first execution topic further includes: In the case where it is determined that the first execution subject is the second execution subject among other execution subjects, determining fourth log data already existing in the first row, wherein the other execution subjects are execution subjects in the execution subject list except the timestamp; Determine in the third fault log the log data whose second similarity with the fourth log data is greater than a second similarity threshold, and determine a fifth row corresponding to the log data whose second similarity is greater than the second similarity threshold; Determine fifth log data corresponding to the second execution topic contained in the log data corresponding to the fifth row; The fifth log data is determined as the missing data.

10. The method according to claim 1, characterized in that Before receiving the plurality of diagnosis results sent by the first diagnosis agent and the second diagnosis agent, the method further comprises: Sending the first fault log to an unknown diagnostic agent based on the first diagnostic agent or the second diagnostic agent, wherein the unknown diagnostic agent has a communication relationship with the first diagnostic agent and a communication relationship with the second diagnostic agent, and the unknown diagnostic agent is used to diagnose unknown fault events in the server; Based on the unknown diagnostic agent, an unknown diagnostic result corresponding to the first fault log is determined, and the unknown diagnostic result sent by the unknown diagnostic agent is received.

11. The method according to claim 10, characterized in that Generating a target diagnosis result according to the multiple diagnosis results includes: Determine a diagnosis result set according to the multiple diagnosis results and the unknown diagnosis result; Determining the fault occurrence time of each fault event corresponding to each diagnosis result in the diagnosis result set; and Determine the number of each line of log data corresponding to each component included in the first fault log; The diagnostic result priority corresponding to each diagnostic result in the diagnostic result set is determined according to each row number, and the target diagnostic result is generated according to the fault occurrence time or the diagnostic result priority.

12. The method according to claim 11, characterized in that Determining the diagnosis result priority corresponding to each diagnosis result in the diagnosis result set according to each row number includes: Determine the number of occurrences of the failure event of each component according to each row number; and, Determining the total number of rows of log data contained in the first fault log; Determine the average failure probability of each component according to the number of occurrences of the failure event of each component and the total number of rows; Determine a failure weight corresponding to each component according to the average failure probability and the number of occurrences of failure events of each component; The priority level corresponding to each component is determined according to the fault weight, and the priority level of the diagnosis result is determined according to the priority level corresponding to each component.

13. The method according to claim 11, characterized in that Generating the target diagnosis result according to the fault occurrence time or the diagnosis result priority includes: Determining the number of diagnosis results included in the diagnosis result set; In the case where it is determined that the number of the diagnosis results is greater than or equal to a preset number, selecting the preset number of diagnosis results according to the diagnosis result priority, and generating the target diagnosis result according to the preset number of diagnosis results; When it is determined that the number of the diagnosis results is less than the preset number, each diagnosis result in the diagnosis result set is output in sequence according to the fault occurrence time to generate the target diagnosis result.

14. The method according to claim 1, characterized in that After generating a target diagnosis result according to the multiple diagnosis results, the method further includes: Obtaining a manual feedback work order corresponding to the server, wherein the manual feedback work order is used to indicate a diagnosis result of a fault event corresponding to each component in the server that is manually fed back; Acquire sixth log data corresponding to the second diagnosis result in the manual feedback work order in the first fault log; Determining a third diagnostic result corresponding to the sixth log data in the target diagnostic result; Comparing the second diagnostic result with the third diagnostic result to determine a comparison result; The diagnostic agent corresponding to the target diagnostic result is verified according to the comparison result.

15. The method according to claim 14, characterized in that Verifying the diagnostic agent corresponding to the target diagnostic result according to the comparison result includes: When the comparison result indicates that the second diagnosis result is consistent with the third diagnosis result, determining that the diagnosis agent corresponding to the target diagnosis result is successfully verified; When the comparison result indicates that the second diagnostic result is inconsistent with the third diagnostic result, it is determined that the diagnostic agent corresponding to the third diagnostic result has failed verification.

16. The method according to claim 15, characterized in that After verifying the diagnostic agent corresponding to the target diagnostic result according to the comparison result, the method further includes: In the case where it is determined that the diagnostic agent corresponding to the third diagnostic result fails to be verified, determining the diagnostic agent corresponding to the third diagnostic result, and determining the second prompt word corresponding to the second diagnostic result; The second diagnostic result is fed back to the diagnostic agent corresponding to the third diagnostic result based on the second prompt word, and the diagnostic agent corresponding to the third diagnostic result is trained based on the second diagnostic result, so that the diagnostic result of the diagnostic agent corresponding to the third diagnostic result based on the first fault log input is the second diagnostic result.

17. A device for generating a diagnosis result, characterized in that: include: An input module, used to input a first fault log during the operation of the server into a first diagnostic agent, and determine whether the first fault log contains a second fault event corresponding to other components based on the first diagnostic agent, wherein the first diagnostic agent is used to diagnose the first fault event corresponding to a first component in the server, and the other components include: components other than the first component among multiple components in the server; an establishing module, for establishing a communication relationship between the first diagnostic agent and a second diagnostic agent corresponding to the other component based on the first diagnostic agent, when it is determined based on the first diagnostic agent that the first fault log contains the second fault event, so that the first diagnostic agent sends the first fault log to the second diagnostic agent according to the communication relationship; The receiving module is used to receive multiple diagnostic results sent by the first diagnostic agent and the second diagnostic agent, and generate a target diagnostic result according to the multiple diagnostic results.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method according to any one of claims 1 to 16 when executed by a processor.

19. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 16 are implemented.

20. A computer program product comprising a computer program, characterized in that The computer program is used by a processor to execute the steps of the method described in any one of claims 1 to 16.

Images