A method and system for cloud platform alarm scene root cause positioning based on deep learning

Abstract

The application relates to the field of artificial intelligence, in particular to a cloud platform alarm scene root cause positioning method and system based on deep learning, which comprises the following steps: obtaining cloud platform alarm information, alarm resource information, resource log information and alarm processing history information; beneficial effects are as follows: the cloud platform alarm scene root cause positioning method and system based on deep learning provided by the application can form different alarm scenes through alarm clustering according to collected cloud platform alarm information, resource information and log information, lock the range of log analysis for each alarm scene, deeply analyze the correlation of resources and the correlation of logs, identify the final fault cause, and give the description of the fault cause and key alarm information for different alarm scenes. This method can manage alarms in scenes, provide more accurate problem positioning, effectively reduce the time of operation and maintenance personnel for positioning problems, improve efficiency, and better ensure the normal operation of the cloud platform.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to a method and system for root cause localization of alarm scenarios on cloud platforms based on deep learning. Background Technology

[0002] With the development of information technology and cloud computing, and the continuous changes in business needs, the cluster size of cloud platforms and the services running on the clusters are also constantly increasing.

[0003] Meanwhile, with the widespread adoption of container technology and microservice architecture, the number of resource entities to be monitored has surged, and the uncertainty has increased significantly. Especially when used with a coordinator like Kubernetes, resource lifespans can be very short, making tracking increasingly difficult, compounded by increased environmental complexity and distribution.

[0004] When environmental problems occur, a large number of alarms often erupt in a short period of time. If the most critical problem cannot be found in time, it may cause huge losses to the business. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for root cause localization of alarm scenarios on cloud platforms based on deep learning, so as to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for root cause localization of alarm scenarios on a cloud platform based on deep learning, the method comprising the following steps:

[0007] Obtain cloud platform alarm information, alarm resource information, resource log information, and alarm processing history information, and uniformly format the above alarm-related information;

[0008] The processed data is clustered using the k-means method, and the clustering results are divided into different scenarios.

[0009] For each alarm scenario, feature extraction and preprocessing are performed on the alarm-related resources and log data, followed by word-to-quantity processing to convert them into numerical representations.

[0010] The LSTM-CNN deep neural network model is used to learn and analyze the processed vector data to obtain the anomaly description and root cause under each alarm scenario, and to recommend key alarms for the scenario based on the resources corresponding to the anomaly.

[0011] Preferably, the specific operations for clustering the processed data using the k-means method include:

[0012] The alarm time series curves of the cloud platform are collected as the training set. Cluster analysis is performed on the training set to discover common information in the training data, thereby reducing the impact of outliers and noise on data analysis.

[0013] The time series curves collected from the cloud platform are used as the training set. The curve data consists of alarm data at the time of alarm occurrence and alarm data at n time points before the alarm occurs. Therefore, the time series curve contains a total of n+1 time points.

[0014] Standardize the format of alarm data and add resource information;

[0015] Cluster analysis is performed on the training set data to analyze common information in the training data and automatically classify it;

[0016] By analyzing common information, noise and irrelevant samples are filtered out, thereby improving the data analysis effect and reducing the algorithm's running time.

[0017] Based on the clustering results, the analysis results of each cluster are processed to discover the regularity of alarm occurrences, thereby determining the alarm scenario and persisting it.

[0018] Preferably, the specific operations for feature extraction and preprocessing of alarm-related resources and log data for each alarm scenario include:

[0019] Real-time log collection is achieved through a log collection agent. The agent can be configured with two methods for log collection: configuring the path and configuring the log listening port. This corresponds to both active and passive collection methods to obtain raw log content from resources. These logs are then categorized based on their source, such as system logs, service logs, and platform logs, and ultimately stored in a log index. The log agent used is fluentd.

[0020] For persistent alarm scenarios, the alarm list is traversed to analyze the alarm-related resources. The relevant system logs, service logs, and platform logs for each alarm resource within the alarm statistics time period are obtained, and metadata information of the resources, such as resource name, host where the resource is located, and IP information, are added to form pre-analyzed raw logs.

[0021] The original logs were effectively segmented using word segmentation technology. The Chinese logs were effectively segmented using open-source word segmentation software, specifically jieba.

[0022] The logs after word segmentation are transformed into numerical vector representations using the word2vec algorithm.

[0023] The log events represented by numerical vectors are clustered using the single-pass algorithm.

[0024] LSTM-CNN is used to learn for each sample after clustering to form alarm association information. Log events with digital encoding are input into the LSTM-CNN-based neural network model for evaluation and optimization. The clustering results are used as the initial knowledge base, new logs are continuously added for learning, the knowledge base is continuously adjusted, and the knowledge base is associated with alarm scenarios.

[0025] The trained neural network model is used to evaluate whether the logs in the next time series are abnormal. Based on the abnormal logs, the alarms are traced to determine the fault points and key alarms.

[0026] Preferably, it also includes: forming a preliminary alarm scenario and knowledge base model, each alarm scenario containing a series of alarms, key alarms, root cause descriptions of key alarms, and related alarm resources and knowledge base content; training and optimizing the above model using historical data; and connecting the system to the cloud platform to perform real-time scenario root cause localization of alarms on the cloud platform.

[0027] A system for root cause localization of alarm scenarios on a cloud platform based on deep learning, the system comprising an information acquisition module, a data clustering module, a data preprocessing module, and an alarm module;

[0028] The information acquisition module acquires cloud platform alarm information, alarm resource information, resource log information, and alarm processing history information, and performs unified formatting processing on the above alarm-related information.

[0029] The data clustering module uses the k-means method to cluster the processed data and divides the clustering results into different scenarios.

[0030] The data preprocessing module performs feature extraction and preprocessing on the alarm-related resources and log data for each alarm scenario, performs word-to-quantity processing, and converts them into numerical representations.

[0031] The alarm module uses an LSTM-CNN deep neural network model to learn and analyze the processed vector data, obtain the anomaly description and root cause under each alarm scenario, and recommend key alarms for the scenario based on the resources corresponding to the anomaly.

[0032] Preferably, the data clustering module collects alarm time series curves from the cloud platform as a training set, performs cluster analysis on the training set to discover common information in the training data, thereby reducing the impact of outliers and noise on data analysis.

[0033] The time series curves collected from the cloud platform are used as the training set. The curve data consists of alarm data at the time of alarm occurrence and alarm data at n time points before the alarm occurs. Therefore, the time series curve contains a total of n+1 time points.

[0034] Standardize the format of alarm data and add resource information;

[0035] Cluster analysis is performed on the training set data to analyze common information in the training data and automatically classify it;

[0036] By analyzing common information, noise and irrelevant samples are filtered out, thereby improving the data analysis effect and reducing the algorithm's running time.

[0037] Based on the clustering results, the analysis results of each cluster are processed to discover the regularity of alarm occurrences, thereby determining the alarm scenario and persisting it.

[0038] Preferably, in the data preprocessing module, real-time log collection is achieved through a log collection agent. The agent can be configured with two log collection methods: one is a configured path, and the other is a configured log listening port. This corresponds to both active and passive collection methods to obtain the raw log content of resources. These logs are then categorized according to their source, such as system logs, service logs, and platform logs, and ultimately stored in a log index. The log agent used is fluentd.

[0039] For persistent alarm scenarios, the alarm list is traversed to analyze the alarm-related resources. The relevant system logs, service logs, and platform logs for each alarm resource within the alarm statistics time period are obtained, and metadata information of the resources, such as resource name, host where the resource is located, and IP information, are added to form pre-analyzed raw logs.

[0040] The original logs were effectively segmented using word segmentation technology. The Chinese logs were effectively segmented using open-source word segmentation software, specifically jieba.

[0041] The logs after word segmentation are transformed into numerical vector representations using the word2vec algorithm.

[0042] The log events represented by numerical vectors are clustered using the single-pass algorithm.

[0043] LSTM-CNN is used to learn for each sample after clustering to form alarm association information. Log events with digital encoding are input into the LSTM-CNN-based neural network model for evaluation and optimization. The clustering results are used as the initial knowledge base, new logs are continuously added for learning, the knowledge base is continuously adjusted, and the knowledge base is associated with alarm scenarios.

[0044] The trained neural network model is used to evaluate whether the logs in the next time series are abnormal. Based on the abnormal logs, the alarms are traced to determine the fault points and key alarms.

[0045] Preferably, the alarm module forms a preliminary alarm scenario and knowledge base model. Each alarm scenario includes a series of alarms, key alarms, root cause descriptions of key alarms, and related alarm resources and knowledge base content. The above model is trained and optimized using historical data. The system is connected to the cloud platform to perform real-time scenario root cause localization of alarms on the cloud platform.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] This invention proposes a method and system for root cause localization of cloud platform alarm scenarios based on deep learning. Based on collected cloud platform alarm information, resource information, and log information, alarms are clustered into different alarm scenarios. For each alarm scenario, the scope of log analysis is narrowed, and in-depth analysis of resource and log correlations is performed to identify the ultimate cause of the failure. A description of the cause of the failure and key alarm information are provided for different alarm scenarios. This approach enables scenario-based alarm management, provides more accurate problem localization, effectively reduces the time spent by operations and maintenance personnel in locating problems, improves efficiency, and better ensures the normal operation of the cloud platform. Attached Figure Description

[0048] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of the present invention clear and complete, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only some, not all, embodiments of the present invention, and are merely illustrative of the embodiments of the present invention. They are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] Example 1

[0051] Please see Figure 1This invention provides a technical solution: a method for root cause localization of alarm scenarios on a cloud platform based on deep learning, the method comprising the following steps:

[0052] Step 1: Collect alarm time series curves from the cloud platform as a training set. Perform cluster analysis (such as K-means clustering algorithm) on the training set to discover common information in the training data, thereby reducing the impact of outliers and noise on data analysis.

[0053] The time series curves collected from the cloud platform are used as the training set. The curve data consists of alarm data at the time of alarm occurrence and alarm data at n time points before the alarm occurs. Therefore, the time series curve contains a total of n+1 time points.

[0054] The alarm data is formatted in a standardized way, and resource information is added. The formatted data model is as follows:

[0055]

[0056] Cluster analysis is performed on the training set data (this invention uses the K-means algorithm) to analyze the common information in the training data and automatically classify it;

[0057] By analyzing common information, noise and irrelevant samples are filtered out, thereby improving the data analysis effect and reducing the algorithm's running time.

[0058] Based on the clustering results, the analysis results of each cluster are processed to discover the regularity of alarm occurrences, thereby determining the alarm scenario and persisting it.

[0059] Step 2: Preprocess the historical logs of alarm-related resources for different alarm scenarios;

[0060] Real-time log collection is achieved through a log collection agent. The agent can be configured with two log collection methods: one is a configured path (e.g., system syslog, service log path), and the other is a configured log listening port. This corresponds to both active collection and passive reception methods to obtain the raw log content of resources. These logs are then categorized according to their source, such as system logs, service logs, and platform logs, and ultimately stored in a log index. The log agent used in this invention is fluentd.

[0061] For persistent alarm scenarios, the alarm list is traversed to analyze the alarm-related resources. The relevant system logs, service logs, platform logs, etc. of each alarm resource within the alarm statistics time period are obtained, and the metadata information of the resources, such as resource name, host where the resource is located, IP, etc., is added to form pre-analyzed raw logs.

[0062] The original logs were effectively segmented using word segmentation technology. The Chinese logs were effectively segmented using open-source word segmentation software, specifically jieba.

[0063] The segmented logs are transformed into numerical vector representations using word vector conversion. This invention employs the word2vec algorithm.

[0064] Clustering is performed on the log events represented by numerical vectors using the single-pass algorithm. The general operation is as follows:

[0065] The first sample does not need to have its similarity calculated; it is directly used as the first cluster.

[0066] Sample 2 needs to have its similarity calculated with a cluster. If it is found to be similar to the first sample, it will be assigned to the same cluster; otherwise, it will be in its own cluster. The cosine similarity is chosen for the similarity calculation here.

[0067] Sample #3 needs to have its similarity calculated with each cluster. If it is found to be similar to a certain cluster, the calculation stops and the sample is assigned to that cluster; otherwise, it forms its own cluster; and so on.

[0068] Each cluster calculated can be viewed as a category. After clustering, several categories can be obtained, or they can be viewed as several log events.

[0069] LSTM-CNN is used to learn alarm association information for each clustered sample. Log events encoded with numbers are input into the LSTM-CNN-based neural network model for evaluation and optimization. The clustering results are used as the initial knowledge base, and new logs are continuously added for learning, constantly adjusting the knowledge base. The knowledge base is then associated with alarm scenarios.

[0070] The trained neural network model is used to evaluate whether the logs in the next time series are abnormal. Based on the abnormal logs, the alarms are traced to determine the fault point (such as tracing the host and IP information in the source log record of the alarm log and the log content to the corresponding platform virtual machine, and determining the specific component based on the fault information) and key alarms.

[0071] Step 3: After the above two steps, a preliminary alarm scenario and knowledge base model is formed. Each alarm scenario includes a series of alarms, key alarms, root cause descriptions of key alarms, and related alarm resources and knowledge bases.

[0072] Step four: Train and optimize the above model using historical data;

[0073] Step 5: Connect the system to the cloud platform to locate the root cause of alarms from the cloud platform in real time.

[0074] Example 2

[0075] Based on Embodiment 1, a system for a method of root cause localization of alarm scenarios in a cloud platform based on deep learning is provided. The system consists of an information acquisition module, a data clustering module, a data preprocessing module, and an alarm module.

[0076] The information acquisition module acquires cloud platform alarm information, alarm resource information, resource log information, and alarm processing history information, and performs unified formatting processing on the above alarm-related information.

[0077] The data clustering module uses the k-means method to cluster the processed data and divides the clustering results into different scenarios; it collects alarm time series curves from the cloud platform as a training set, performs cluster analysis on the training set to discover common information in the training data, thereby reducing the impact of outliers and noise on data analysis.

[0078] The time series curves collected from the cloud platform are used as the training set. The curve data consists of alarm data at the time of alarm occurrence and alarm data at n time points before the alarm occurs. Therefore, the time series curve contains a total of n+1 time points.

[0079] Standardize the format of alarm data and add resource information;

[0080] Cluster analysis is performed on the training set data to analyze common information in the training data and automatically classify it;

[0081] By analyzing common information, noise and irrelevant samples are filtered out, thereby improving the data analysis effect and reducing the algorithm's running time.

[0082] Based on the clustering results, the analysis results of each cluster are processed to discover the regularity of alarm occurrences, thereby determining the alarm scenario and persisting it.

[0083] The data preprocessing module performs feature extraction and preprocessing on the alarm-related resources and log data for each alarm scenario, performs word-to-quantity processing, and converts them into numerical representations. Real-time log collection is achieved through a log collection agent. The agent can be configured with two log collection methods: one is a configured path, and the other is a configured log listening port. It acquires the raw log content of resources through both active and passive collection methods, and categorizes these logs according to their source, such as system logs, service logs, and platform logs. Finally, the logs are stored in a log index. The log agent used is fluentd.

[0084] For persistent alarm scenarios, the alarm list is traversed to analyze the alarm-related resources. The relevant system logs, service logs, and platform logs for each alarm resource within the alarm statistics time period are obtained, and metadata information of the resources, such as resource name, host where the resource is located, and IP information, are added to form pre-analyzed raw logs.

[0085] The original logs were effectively segmented using word segmentation technology. The Chinese logs were effectively segmented using open-source word segmentation software, specifically jieba.

[0086] The logs after word segmentation are transformed into numerical vector representations using the word2vec algorithm.

[0087] The log events represented by numerical vectors are clustered using the single-pass algorithm.

[0088] LSTM-CNN is used to learn for each sample after clustering to form alarm association information. Log events with digital encoding are input into the LSTM-CNN-based neural network model for evaluation and optimization. The clustering results are used as the initial knowledge base, new logs are continuously added for learning, the knowledge base is continuously adjusted, and the knowledge base is associated with alarm scenarios.

[0089] The trained neural network model is used to evaluate whether the logs in the next time series are abnormal. Based on the abnormal logs, the alarms are traced to determine the fault points and key alarms.

[0090] The alarm module uses an LSTM-CNN deep neural network model to learn and analyze the processed vector data, deriving anomaly descriptions and root causes for each alarm scenario, and recommending key alarms for that scenario based on the resources corresponding to the anomalies; forming a preliminary alarm scenario and knowledge base model, each alarm scenario containing a series of alarms, key alarms, root cause descriptions of key alarms, and related alarm resources and knowledge base content; training and optimizing the above model using historical data; and connecting the system to the cloud platform to perform real-time scenario root cause localization for alarms on the cloud platform.

[0091] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for root cause localization of alarm scenarios on a cloud platform based on deep learning, characterized in that: The method includes the following steps: Obtain cloud platform alarm information, alarm resource information, resource log information, and alarm processing history information, and uniformly format the above alarm-related information; The processed data is clustered using the k-means method, and the clustering results are divided into different scenarios. For each alarm scenario, feature extraction and preprocessing are performed on the alarm-related resources and log data, followed by word-to-quantity processing to convert them into numerical representations. The LSTM-CNN deep neural network model is used to learn and analyze the processed vector data to obtain the anomaly description and root cause under each alarm scenario, and to recommend key alarms for the scenario based on the resources corresponding to the anomaly. The log events represented by numerical vectors are clustered using the single-pass algorithm. LSTM-CNN is used to learn for each sample after clustering to form alarm association information. Log events with digital encoding are input into the LSTM-CNN-based neural network model for evaluation and optimization. The results of clustering using the single-pass algorithm are used as the initial knowledge base. New logs are continuously added for learning, and the knowledge base is continuously adjusted and associated with alarm scenarios. The trained neural network model is used to evaluate whether the logs in the next time series are abnormal. Based on the abnormal logs, the alarms are traced to determine the fault points and key alarms. The specific steps for clustering the processed data using the k-means method include: The alarm time series curves of the cloud platform are collected as the training set. Cluster analysis is performed on the training set to discover common information in the training data, thereby reducing the impact of outliers and noise on data analysis. The time series curves collected from the cloud platform are used as the training set. The curve data consists of alarm data at the time of alarm occurrence and alarm data at n time points before the alarm occurs. Therefore, the time series curve contains a total of n + 1 time points. Standardize the format of alarm data and add resource information; Cluster analysis is performed on the training set data to analyze common information in the training data and automatically classify it; By analyzing common information, noise and irrelevant samples are filtered out, thereby improving the data analysis effect and reducing the algorithm's running time. Based on the clustering results, the analysis results of each cluster are processed to discover the regularity of alarm occurrences, thereby determining the alarm scenario and persisting it. The specific operations for feature extraction and preprocessing of alarm-related resources and log data for each alarm scenario include: Real-time log collection is achieved through a log collection agent. There are two ways to configure log collection on the agent: one is to configure the path, and the other is to configure the log listening port. The agent obtains the raw log content of the resources through both active collection and passive reception methods. These logs are then classified into system logs, service logs, and platform logs according to their source. Finally, they are stored in the log index. The log agent used is fluentd. For persistent alarm scenarios, the alarm list is traversed to analyze the alarm-related resources. The relevant system logs, service logs, and platform logs for each alarm resource within the alarm statistics time period are obtained, and metadata information of the resources is added. The metadata information includes the resource name, the host where the resource is located, and the IP information, forming the pre-analyzed raw logs. The original logs were effectively segmented using word segmentation technology. The Chinese logs were effectively segmented using open-source word segmentation software, namely jieba. The logs after word segmentation are transformed into numerical vector representations using the word2vec algorithm. It also includes: forming preliminary alarm scenarios and knowledge base models, each alarm scenario containing a series of alarms, key alarms, root cause descriptions of key alarms, and related alarm resources and knowledge base content; training and optimizing the above models using historical data; and connecting the system to the cloud platform to perform real-time scenario root cause localization of alarms on the cloud platform.

Images