Abnormality analysis method, electronic device, storage medium and program product

Abstract

The embodiment of the invention provides an exception analysis method, electronic equipment, a storage medium and a program product, and relates to the field of large language models.The method comprises the steps that in response to an exception of a target monitoring task, target exception information of the target monitoring task within the exception occurrence time range is obtained, and obtaining target exception analysis data matched with the target exception information from a preset knowledge base, and obtaining exception analysis result data determined by the large language model according to the target exception analysis data and the target exception information. Wherein the preset knowledge base comprises exception analysis data of a plurality of monitoring tasks in at least one task chain. According to the technical scheme, anomaly analysis can be accurately and efficiently achieved, and the requirement of a large-scale time sequence calculation task for real-time performance is met.

Description

Technical Field

[0001] The present application relates to the field of large language models and data processing technology, and in particular to an anomaly analysis method, an electronic device, a computer-readable storage medium, and a computer program product, which can be applied to the field of large-scale time series computing technology. Background Art

[0002] With the rapid development of technologies such as computers and big data, the scale of some computing tasks is also growing rapidly. For example, the scale of computing tasks based on time series data produced by cloud network devices is growing rapidly. However, during the execution of computing tasks, various abnormal situations are often encountered, which seriously affects the stable operation of computing tasks. Therefore, in order to ensure the stable operation of computing tasks, it is usually necessary to analyze and handle abnormal situations of computing tasks in a timely manner.

[0003] For large-scale time series computing tasks, due to the large scale of the computing tasks and the high real-time requirements, how to quickly and accurately analyze the abnormal situations that occur in the computing tasks has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present application provide an abnormality analysis method, an electronic device, a computer-readable storage medium, and a computer program product to alleviate or solve one or more technical problems existing in the prior art.

[0005] In a first aspect, an embodiment of the present application provides an exception analysis method, the method comprising: in response to an exception occurring in a target monitoring task, obtaining target exception information of the target monitoring task within the time range of the exception occurrence; obtaining target exception analysis data matching the target exception information from a preset knowledge base; wherein the preset knowledge base includes exception analysis data of multiple monitoring tasks in at least one task chain; and obtaining exception analysis result data determined by a large language model based on the target exception analysis data and the target exception information.

[0006] In a second aspect, an embodiment of the present application provides an exception analysis system, the system comprising a monitoring device, an exception handling device and a large language model analysis device; the monitoring device is used to monitor each monitoring task in a task chain to be monitored, and when an exception is detected in a target monitoring task, an alarm indication is sent to the exception handling device; wherein the alarm indication is used to indicate that an exception has occurred in the target monitoring task; the exception handling device is used to obtain target exception information of the target monitoring task within the time range of the exception occurrence in response to the alarm indication; the large language model analysis device is used to obtain target exception analysis data matching the target exception information from a preset knowledge base, and obtain exception analysis result data determined by a large language model based on the target exception analysis data and the target exception information; wherein the preset knowledge base includes exception analysis data of multiple monitoring tasks in at least one task chain.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory, and the processor implements any method described in the first aspect of the embodiment of the present application when executing the computer program.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method described in any one of the first aspects of the embodiments of the present application is implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method described in any one of the first aspects of the embodiments of the present application when executed by a processor.

[0010] According to the technical solution of the embodiment of the present application, when an abnormality occurs in a target monitoring task, an abnormality analysis of the target monitoring task is performed through a large language model based on the target abnormality information of the target monitoring task and the target abnormality analysis data matching the target abnormality information. Since the large language model has powerful semantic understanding and reasoning capabilities, it can improve the accuracy of the abnormality analysis results of the target monitoring task; further, by performing abnormality analysis on the target monitoring task through a large language model, the analysis efficiency can be improved, thereby meeting the timeliness requirements of large-scale time series computing tasks.

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments according to the present application and should not be regarded as limiting the scope of the present application.

[0013] Figure 1 A schematic diagram of an application scenario of the abnormality analysis method provided in an embodiment of the present application is shown; Figure 2 One of the flowchart diagrams of the abnormality analysis method provided in the embodiment of the present application is shown; Figure 3 The second flowchart of the abnormality analysis method provided in the embodiment of the present application is shown; Figure 4 A block diagram of an exception handling system provided by an embodiment of the present application is shown; Figure 5 The third flowchart of the abnormality analysis method provided in the embodiment of the present application is shown; Figure 6 A block diagram of an electronic device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0014] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the concept or scope of the present application. Therefore, the drawings and descriptions are considered to be exemplary in nature and not restrictive.

[0015] To facilitate understanding of the technical solutions of the embodiments of the present application, the following describes the related technologies of the embodiments of the present application. The following related technologies can be combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0016] The following terms will be used in the following text: Large Language Model (LLM): Large model for short, is a large machine learning model used in the field of Natural Language Processing (NLP) to understand or generate human language. LLM uses deep learning technology and is trained on very large text data sets, so that it can capture the complex patterns and diversity of natural language.

[0017] Retrieval Augmented Generation (RAG) framework: A natural language processing model framework that integrates retrieval and generation mechanisms. By introducing an information retrieval module, RAG enhances the knowledge base of LLM. LLM no longer relies solely on the knowledge learned during its pre-training, but can also dynamically retrieve the latest and most relevant information from external databases.

[0018] Requests Per Second (PRS): Indicates the number of requests that the server can process per second, and is one of the indicators to measure the processing capacity of the server.

[0019] Failover times: indicates the number of failovers. Failover refers to the process in which, when a component or service fails in a computer system, the system automatically switches to a backup component or service to ensure normal operation.

[0020] Fetch delay: refers to the time difference from requesting data to actually receiving the data in a computing network.

[0021] Emitdelay: usually refers to the time difference between the generation and actual sending of data in a service flow.

[0022] Among them, transmission delay and service delay are usually used to measure the delay in the data flow process, which is particularly important for real-time applications such as large-scale time series computing tasks.

[0023] Watermark Delay: refers to a technical parameter for data flow control in computer networks or distributed systems. Its main function is to ensure the stability and reliability of data flow and prevent data loss or duplication caused by too fast transmission speed.

[0024] In the process of computing task execution, in order to ensure the stable operation of computing tasks, it is usually necessary to timely analyze and handle abnormal situations of computing tasks. Especially in some large-scale time series computing tasks, due to the high real-time requirements, it is even more necessary to timely and accurately analyze abnormal situations that occur in computing tasks.

[0025] In the related art, the abnormal analysis of computing tasks is usually performed based on the error log of the computing tasks. During implementation, the mapping relationship between various error logs and corresponding abnormal analysis can be pre-set. When an abnormality occurs in a computing task, the abnormal analysis information of the computing task is obtained by matching the error log of the computing task with the above mapping relationship. However, for large-scale time series computing tasks, the computing task scale is very large, and the efficiency of matching by mapping relationship is low, which may not meet the real-time requirements of large-scale time series computing tasks; in addition, for error logs that do not exist in the mapping relationship, the corresponding abnormal analysis information cannot be obtained, and manual intervention is required, which further reduces the efficiency of abnormal analysis in the case of abnormal computing tasks.

[0026] In view of this, the embodiments of the present application provide an exception analysis method and system, which can accurately and efficiently analyze the exception of computing tasks by introducing a large language model to analyze the exception of computing tasks that have abnormalities, thereby meeting the real-time requirements of large-scale time series computing tasks. In order to facilitate the understanding of the embodiments of the present application, the application scenario of the exception analysis method provided in the embodiments of the present application is first briefly described. Figure 1 The following is a schematic diagram showing an application scenario of the abnormality analysis method provided in the embodiment of the present application. Figure 1 As shown, the application scenario includes an exception analysis system 110 and a computing cluster 120 for executing each monitoring task in the task chain, and the computing cluster includes a management node 122 and at least one computing node 121. Among them, the exception analysis system 110 includes a monitoring device 401, an exception handling device 402 and a large language model analysis device 403. The computing node 121 and the management node 122 can be computing devices such as servers, virtual machines or containers.

[0027] Among them, the above-mentioned monitoring device 401, exception handling device 402 and large language model analysis device 403 can be deployed on the same subject or multiple subjects, and the subject can be an application, service, instance, software-based functional module, virtual machine, container or cloud server, etc., or a hardware device or hardware chip with data processing function, etc. Exemplarily, each device can be deployed on a local computing device or a cloud computing platform that provides computing power, storage and network resources, and the specific application architecture can be built according to service requirements.

[0028] In an application example, each computing node 121 in the computing cluster 120 reports the monitoring index information of the corresponding monitoring task to the management node 122 at a preset time interval during the execution of each monitoring task in the task chain. The management node 122 reports the monitoring index information reported by each computing node to the monitoring device 401 in the abnormality analysis system 110. After receiving the monitoring index information, the monitoring device 401 determines whether the corresponding monitoring task is abnormal according to the monitoring index information. When it is determined that any monitoring task is abnormal, it sends an alarm indication to the abnormality handling device 402. In response to the alarm indication sent by the monitoring device 401, the abnormality handling device 402 obtains the target abnormality information of the abnormal monitoring task, and sends the target abnormality information to the large language model analysis device 403. After receiving the target abnormality information, the large language model analysis device 403 first obtains the target abnormality analysis data matching the target abnormality information from the preset knowledge base, calls the large language model, and uses the large language model to perform reasoning based on the target abnormality information and the target abnormality analysis data to obtain the abnormality analysis result data corresponding to the monitoring task.

[0029] In some other application scenarios, the computing nodes in the computing cluster may also directly report the monitoring indicator information of the corresponding monitoring task to the monitoring device 401 in the abnormality analysis system 110 .

[0030] It should be noted that the above application scenarios or application examples provided in the embodiments of the present application are for ease of understanding, and the embodiments of the present application do not specifically limit the application of the technical solution. In addition, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0031] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0032] Figure 2 The method flow chart of the abnormality analysis method provided by the embodiment of the present application is shown as follows: Figure 2 As shown, the method may include step S201, step S202 and step S203.

[0033] Step S201: In response to an exception occurring in a target monitoring task, target exception information of the target monitoring task within a time range of the exception occurrence is obtained.

[0034] Step S202: acquiring target anomaly analysis data matching the target anomaly information from a preset knowledge base; wherein the preset knowledge base includes anomaly analysis data of multiple monitoring tasks in at least one task chain.

[0035] Step S203: obtaining abnormality analysis result data determined by the large language model according to the target abnormality analysis data and the target abnormality information.

[0036] The above-mentioned abnormal analysis result data includes abnormal cause data and / or abnormal solution data.

[0037] Among them, the target monitoring task is a monitoring task in which an abnormality occurs in the target task chain. Usually, a task chain includes multiple monitoring tasks, and a computing node executes one or more monitoring tasks. In an embodiment of the present application, abnormal monitoring of monitoring tasks is achieved by monitoring the monitoring indicator information corresponding to each monitoring task. Exemplarily, the above-mentioned monitoring indicator information may include the indicator values ​​of one or more monitoring indicators. When the indicator value of any monitoring indicator is abnormal, it is determined that the monitoring task is abnormal.

[0038] In one embodiment, the target abnormal information may include abnormal work information and abnormal indicator information, and the abnormal work information may include at least one of the following information: abnormal log information of the target monitoring task, task status information of the target monitoring task, and resource information allocated to the target monitoring task. Exemplarily, the task status information is used to characterize the execution status of the target monitoring task, which may be in execution or stopped. The resource information may be processor (Central Processing Unit, CPU) resources or memory resources. The abnormal indicator information includes at least indicator information of the monitoring indicator where the abnormality occurs, and may also include indicator information of other monitoring indicators corresponding to the target monitoring task.

[0039] In addition, the above target abnormality information may also include upstream and downstream task information of the target monitoring task in the task chain to be monitored.

[0040] In step S201, the target abnormality information of the target monitoring task is obtained, which can be obtained from the computing node used to execute the target monitoring task, or from the management node of the computing cluster used to execute the target task chain. In specific implementation, it can be selected from the computing node or the management node to obtain the target abnormality information according to the actual deployment of the computing cluster.

[0041] The abnormal analysis data of each monitoring task included in the preset knowledge base may be historical abnormal information of each monitoring task, corresponding historical abnormal analysis result data, monitoring indicator information, and the like.

[0042] In the above step S202, target anomaly analysis data matching the target anomaly information can be obtained from the preset knowledge base by RAG retrieval. Usually, the preset knowledge base is a vector database, and the historical anomaly information of each monitoring task and the corresponding feature vectors of the historical anomaly analysis result data are stored in the preset knowledge base. Therefore, when obtaining the target anomaly analysis data matching the target anomaly information from the preset knowledge base, it is possible to first determine the anomaly feature vector corresponding to the target anomaly information, match the anomaly feature vector with each feature vector in the preset knowledge base, and obtain a target feature vector matching the anomaly feature vector, which can include a feature vector corresponding to the historical anomaly information matching the target feature vector and a feature vector corresponding to the historical anomaly analysis result data. Generate text information corresponding to the target feature vector as the target anomaly analysis data.

[0043] For example, in the embodiment of the present application, the above target feature vector can be converted into text information based on a vector-to-document algorithm. For example, a vector-to-document algorithm such as an autoregressive model, a natural language generation method, or a transformer model can be used. When implementing the solution, a corresponding algorithm can be selected according to actual needs to convert the vector into text information.

[0044] After obtaining the target abnormality analysis data corresponding to the target monitoring task, the large language model is called, and the abnormality analysis result data of the target monitoring task is obtained by inferring the target abnormality analysis data and the target abnormality information through the large language model. In one embodiment, the abnormality cause of the abnormality of the target monitoring task can be analyzed by the large language model, and correspondingly, the abnormality analysis result data obtained from the large language model is the abnormality cause data; the abnormality solution of the abnormality of the target monitoring task can also be analyzed by the large language model, and correspondingly, the abnormality analysis result data obtained from the large language model is the abnormality solution; the abnormality cause and abnormality solution of the abnormality of the target monitoring task can also be analyzed by the large language model at the same time, and correspondingly, the abnormality analysis result data obtained from the large language model includes the abnormality cause data and the abnormality solution.

[0045] In an embodiment of the present application, when an abnormality occurs in a target monitoring task, an abnormality analysis of the target monitoring task is performed through a large language model based on the target abnormality information of the target monitoring task and the target abnormality analysis data matching the target abnormality information. Since the large language model has powerful semantic understanding and reasoning capabilities, it can improve the accuracy of the abnormality analysis results of the target monitoring task; in addition, by performing abnormality analysis on the target monitoring task through a large language model, the analysis efficiency can be improved, thereby meeting the timeliness requirements of large-scale time series computing tasks.

[0046] In the embodiment of the present application, each monitoring task in the task chain can be monitored by corresponding monitoring indicators to determine whether there are abnormal monitoring tasks in the task chain. Therefore, in one embodiment, it can be determined whether there are abnormal monitoring tasks in the task chain through the following process: obtaining the monitoring indicator information corresponding to each monitoring task in the task chain to be monitored; matching each monitoring indicator information with the preset abnormal judgment rule respectively; if there is abnormal monitoring indicator information matching the preset abnormal judgment rule, it is determined that the target monitoring task corresponding to the abnormal monitoring indicator information is abnormal.

[0047] Among them, the abnormal analysis system can obtain the original data related to the monitoring indicators from the computing cluster used to execute the task chain, and calculate the index value of the corresponding monitoring indicator based on the obtained original data as the monitoring indicator information. Alternatively, after obtaining the original data related to each monitoring indicator, the management node or computing node of the computing cluster calculates the index value of the corresponding monitoring indicator based on the original data, and reports the index value to the abnormal analysis system. Exemplarily, the abnormal analysis system can obtain the above-mentioned original data or monitoring indicator information from the computing node of each monitoring task, and can also obtain the above-mentioned original data or monitoring indicator information from the management node of the computing cluster used to execute the task chain.

[0048] In one implementation, the computing node or management node may periodically report data to the abnormal analysis system. For example, data may be reported every 15 seconds. Of course, the specific value of the period for the computing node or management node to report data may be set according to actual scenario requirements, and the present application embodiment does not limit this.

[0049] Among them, the above-mentioned monitoring indicator information may include the indicator value of at least one monitoring indicator. Correspondingly, the above-mentioned preset abnormality judgment rule may include at least one abnormality judgment sub-rule, and one abnormality judgment sub-rule corresponds to one monitoring indicator. For example, in one embodiment, the above-mentioned monitoring indicator information includes monitoring indicator 1, monitoring indicator 2 and monitoring indicator 3, and correspondingly, the preset abnormality judgment rule includes abnormality judgment sub-rule 1, abnormality judgment sub-rule 2 and abnormality judgment sub-rule 3, wherein abnormality judgment sub-rule 1 is used to judge whether monitoring indicator 1 is abnormal, abnormality judgment sub-rule 2 is used to judge whether monitoring indicator 2 is abnormal, and abnormality judgment sub-rule 3 is used to judge whether monitoring indicator 3 is abnormal.

[0050] In one embodiment, for any monitoring task, if any monitoring indicator in the monitoring indicator information corresponding to the monitoring task matches the corresponding abnormality judgment sub-rule, that is, any monitoring indicator is abnormal, it is determined that the monitoring task is abnormal.

[0051] In an embodiment of the present application, the above-mentioned monitoring indicators may include at least one of the following indicators: the RPS corresponding to the execution of the monitoring task, the data delay during the execution of the monitoring task, the service delay corresponding to the monitoring task during the execution process, and the number of failovers occurring within a preset time length during the execution of the monitoring task.

[0052] For the RPS indicator, if the RPS increases sharply, it means that a large amount of data flows to the monitoring task, which may cause the memory corresponding to the monitoring task to overflow, thereby causing the monitoring task to have insufficient resources. Therefore, for RPS, the corresponding abnormal judgment sub-rule may be whether the RPS is greater than or equal to the preset threshold. When the monitoring task is monitored abnormally, if the RPS corresponding to the monitoring task is greater than or equal to the preset threshold, it is considered that the RPS indicator is abnormal, and then the monitoring task is determined to be abnormal. For real-time computing tasks, it has high requirements for real-time performance. If the data and / or service delay time is long, the real-time performance of the monitoring task cannot be guaranteed. Therefore, for the monitoring indicator of data delay, the corresponding abnormal judgment sub-rule may be whether the data delay is greater than or equal to the first target time length. When the monitoring task is monitored abnormally, if the data delay corresponding to the monitoring task is greater than or equal to the first target time length, it is determined that the data delay during the execution of the monitoring task is long, that is, the monitoring task is abnormal. Similarly, for the service delay indicator, the corresponding abnormal judgment sub-rule may be whether the service delay is greater than or equal to the second target time length. When performing abnormal monitoring on a monitoring task, if the service delay corresponding to the monitoring task is greater than or equal to the second target time length, it is determined that the service time during the execution of the monitoring task is long, that is, the monitoring task is abnormal. For the number of failovers, if the number of failovers within a certain time length reaches the target number, it is considered that the monitoring task is not running stably. Therefore, for the monitoring indicator of the number of failovers, the corresponding abnormal judgment sub-rule can be whether the number of failovers occurring within the third time length exceeds the target number. When performing abnormal monitoring on a monitoring task, if the number of failovers occurring during the execution of the monitoring task within the third target time length exceeds the target number, it is considered that the monitoring task is abnormal.

[0053] It should be noted that the above only exemplarily lists several possible monitoring indicators and their corresponding abnormal judgment sub-rules. When implementing the scheme, more or fewer monitoring indicators can be set according to actual needs. For example, in one embodiment, whether the data reported by the computing node or the management node is received within a certain length of time can also be used as a monitoring indicator, and accordingly, the indicator value corresponding to the monitoring indicator is yes or no. If the data reported by the computing node or the management node has not been received within a certain length of time, it is considered that the monitoring task is abnormal. Alternatively, in some embodiments, the watermark delay value corresponding to the monitoring task can also be used as a monitoring indicator. When the watermark delay value is a negative value, it means that the data corresponding to the monitoring task is missing. In this case, the monitoring task can also be considered to be abnormal.

[0054] If the target monitoring task in the task chain is determined to be abnormal through the above method, the above Figure 2 The method provided in the illustrated embodiment analyzes the abnormal situation of the target monitoring task and obtains corresponding analysis result data.

[0055] In one embodiment, the preset knowledge base also includes topological relationship information of multiple monitoring tasks in the task chain; accordingly, the step 202 obtains target anomaly analysis data matching the target anomaly information from the preset knowledge base, including: determining the upstream and downstream task information of the target monitoring task based on the topological relationship information, and obtaining historical anomaly information matching the target anomaly information and corresponding historical anomaly analysis result data from the preset knowledge base; wherein the target anomaly analysis data includes historical anomaly information, corresponding historical anomaly analysis result data and upstream and downstream task information.

[0056] Among them, the above-mentioned topological relationship information represents the upstream and downstream relationships between multiple monitoring tasks in the task chain. By way of example, the above-mentioned topological relationship information can be represented in the form of a topological diagram or in the form of a text description. During implementation, the specific representation form of the topological relationship information can be selected according to actual needs, and the embodiments of the present application are not limited to this.

[0057] In one embodiment, the topological relationship information includes identification information of each monitoring task, and the upstream and downstream tasks corresponding to the target monitoring task can be matched from the topological relationship information based on the identification information of the target monitoring task. Exemplarily, the upstream and downstream tasks corresponding to the target monitoring task can be matched by RAG retrieval.

[0058] Among them, the above-mentioned historical anomaly analysis result data may include historical anomaly cause data and / or historical anomaly solutions. If the anomaly cause of the target monitoring task is inferred only based on the large language model, the above-mentioned historical anomaly analysis result data may only include the historical anomaly cause data. If the anomaly solution of the target monitoring task is also required to be inferred based on the large language model, the above-mentioned historical anomaly analysis result data also needs to include the historical anomaly solution. During implementation, the data content of the above-mentioned historical anomaly analysis result data can be set according to actual needs.

[0059] In an embodiment of the present application, the preset knowledge base also includes topological relationship information of multiple monitoring tasks in the task chain. In this way, the upstream and downstream task information of the target monitoring task can be obtained from the preset knowledge base, so that when the large language model performs an exception analysis on the target monitoring task, the upstream and downstream task information of the target monitoring task in the task chain is taken into account, that is, the upstream and downstream dependencies of the target monitoring task are taken into account, thereby further improving the accuracy of the exception analysis results.

[0060] In one embodiment, in the above step S203, obtaining the abnormality analysis result data determined by the large language model based on the target abnormality analysis data and the target abnormality information may include: filling the target abnormality analysis data and the target abnormality information into a preset prompt word template to obtain the target prompt word; inputting the above target prompt word into the large language model, and obtaining the abnormality analysis result data generated by the large language model based on the target prompt word.

[0061] Usually when using a large language model for reasoning, it is necessary to construct prompt words. The constructed prompt words are used to indicate the relevant knowledge documents based on which the large language model performs reasoning, the status information of the task to be reasoned, and the reasoning content that needs to be output. After the prompt words are constructed, the constructed prompt words are input into the large language model, and the large language model performs reasoning according to the instructions of the prompt words. In an embodiment of the present application, the target prompt words are constructed according to the target abnormality analysis data and the target abnormality information according to the preset prompt word template. The above-mentioned target abnormality analysis data is used as the relevant knowledge document for reasoning by the large language model, and the target abnormality information is used as the task status information of the current reasoning task performed by the large language model. In addition, the preset prompt word template is also provided with information such as the data content and format of the abnormality analysis result data that the large language model needs to output.

[0062] The above-mentioned abnormality analysis data includes historical abnormality information matching the target abnormality information, corresponding historical abnormality analysis result data, and upstream and downstream task information of the target monitoring task.

[0063] In an embodiment of the present application, by constructing a target prompt word based on the target abnormality analysis data and the target abnormality information, the large language model can perform reasoning according to the instructions of the target prompt word, thereby realizing the analysis of the abnormality corresponding to the target monitoring task through the large language model; and because the above-mentioned target abnormality analysis data contains historical abnormality information, corresponding historical abnormality analysis result data and upstream and downstream task information, therefore, when the large language model performs abnormality analysis of the target monitoring task, it not only considers the historical abnormality related information, but also considers the upstream and downstream dependencies of the target monitoring task in the task chain, thereby improving the accuracy of abnormality analysis of the target monitoring task.

[0064] In one embodiment, the above-mentioned abnormal analysis result data includes abnormal cause data and abnormal solution. That is, the abnormal solution corresponding to the target monitoring task can be directly obtained through the large language model, which significantly improves the accuracy of the generated abnormal solution, reduces manual dependence, realizes the automatic generation of abnormal solutions, improves the fault response speed of the monitoring task, meets the real-time requirements of the time series computing task of large-scale distributed deployment, and improves the stability of the task.

[0065] After obtaining the exception solution of the target monitoring task, the exception analysis method provided in the embodiment of the present application can also generate instructions corresponding to the exception solution and send them to the computing cluster for execution. Therefore, after obtaining the exception analysis result data determined by the large language model based on the target exception analysis data and the target exception information, the method provided in the embodiment of the present application can also include: generating a management request instruction corresponding to the exception solution; sending a management request instruction to the management node corresponding to at least one computing node; wherein the management request instruction is used to request the management node to implement the exception solution, and the above-mentioned at least one computing node is used to execute multiple monitoring tasks in the target task chain, and the target task chain is the task chain where the target monitoring task is located.

[0066] Each monitoring task in the task chain can be executed by a computing cluster, which includes a management node and at least one computing node, the management node is used to coordinate and manage each computing node in the computing cluster, and at least one computing node in the computing cluster is used to execute each monitoring task in the task chain. Therefore, in an embodiment of the present application, the management request instruction is sent to the management node in the computing cluster used to execute the target monitoring task, and the corresponding computing nodes in the computing cluster are coordinated and managed by the management node, so as to implement the exception solution, that is, to solve the abnormal situation corresponding to the target monitoring task.

[0067] In an embodiment of the present application, after obtaining the exception solution corresponding to the target monitoring task from the large language model, the exception analysis system can also generate a management request instruction corresponding to the exception solution, and send the management request instruction to the management node of the computing cluster. The management node implements the exception solution according to the management request instruction. That is, through the embodiment of the present application, the automatic processing of monitoring task exceptions is realized without the need for human intervention, which further improves the fault response speed of the monitoring task, meets the real-time requirements of large-scale time series tasks, and ensures the stable operation and output of large-scale time series tasks.

[0068] For the exceptions of the target monitoring task caused by different reasons, the corresponding exception solutions are also different. For example, the exception corresponding to the target monitoring task may be caused by dirty data in the data docking, insufficient resources allocated to the target monitoring task, or a computing cluster failure, etc. For the exception caused by dirty data in the data, the corresponding exception solution may be to skip the dirty data in the data queue; for the exception caused by insufficient resources allocated to the target monitoring task, the corresponding exception solution may be to adjust the resource configuration information of the target monitoring task; for the exception caused by a computing cluster failure, the corresponding exception solution may be to migrate the task chain to which the target monitoring task belongs to other computing clusters, etc.

[0069] In one embodiment, if the above-mentioned exception solution is to skip the consumption site corresponding to the dirty data in the target data queue, wherein the target data queue is the data queue required to execute the target monitoring task; accordingly, for this type of exception solution, the above-mentioned management request instruction corresponding to the exception solution may include: determining the starting consumption site in the target data queue, and generating a management request instruction; wherein the starting consumption site is located after the consumption site corresponding to the dirty data, and the management request instruction is used to request the management node to schedule the target data queue to re-consume data from the above-mentioned starting consumption site.

[0070] A data queue may include multiple data, each of which corresponds to a consumption site, which is used to characterize the position of the data in the data queue. The process of a computing node or a management node using data in a data queue can be called data consumption. In the case of an abnormal target monitoring task caused by dirty data in the target data queue, the dirty data can be skipped and any data after the dirty data in the target data queue can be consumed. That is, the starting consumption site in the target data queue is re-determined, and the management node is instructed to re-consume data from the starting consumption site. A management request instruction is generated based on the starting consumption site, wherein the management request instruction carries at least the starting consumption site, and the generated management request instruction is sent to the management node in the computing cluster, so that the management node performs data scheduling from the starting consumption site according to the instruction of the management request instruction.

[0071] Exemplarily, when implementing the solution, the management node may directly schedule data from the above-mentioned starting consumption point according to the instruction of the management request instruction, so that the computing node performs the target monitoring task according to the data scheduled by it. Alternatively, in some embodiments, after receiving the above-mentioned management request instruction, the management node sends the starting consumption point carried in the management request instruction to the corresponding computing node, so that the computing node consumes data from the starting consumption point.

[0072] In one embodiment, if the exception of the target monitoring task is caused by insufficient resources allocated to the target monitoring task, the corresponding exception solution is to adjust the resource configuration information of the target monitoring task. For this case, the generated management request instruction is used to request the management node to adjust the resource configuration information of the target monitoring task.

[0073] The resources mentioned above may be one or more of CPU resources, memory resources, disk resources, and other parallel resources.

[0074] Exemplarily, the anomaly analysis system can redetermine the amount of resources allocated to the target monitoring task, and generate the above-mentioned management request instruction based on the redetermined amount of resources, wherein the generated management request instruction carries the reconfigured resource amount information so that the management node allocates resources to the target monitoring task according to the amount of resources indicated by the management request instruction.

[0075] In one embodiment, the abnormal cause of the target monitoring task exception may also be a computing cluster failure. In this case, the corresponding abnormal solution is to migrate the target task chain to other computing clusters; the above-mentioned management request instruction corresponding to the abnormal solution may include: determining the target computing cluster for executing the target task chain; generating a management request instruction; wherein, the management request instruction is used to request the management node to migrate the target task chain to the above-mentioned target computing cluster.

[0076] The target computing cluster can be determined based on the network environment of each computing cluster, the region to which it belongs, and other dimensional information. After the target computing cluster is determined, the task deployment information of each monitoring task in the target task chain in the target computing cluster is determined based on the task information of each monitoring task included in the target task chain, and a corresponding management request instruction is generated based on the task deployment information and the target computing cluster to request the management node to migrate and deploy the target task chain to the target computing cluster according to the task deployment information.

[0077] In one embodiment, when the management node receives the above-mentioned management request instruction, it determines the target computing cluster based on the management request instruction, and sends the task deployment information carried by the management request instruction to the management node in the target computing cluster, so that the management node in the target computing cluster deploys the tasks included in the target task chain in the target computing cluster according to the task deployment information.

[0078] In an embodiment of the present application, after executing the above-mentioned exception solution, the target monitoring task may return to normal, or the target monitoring task may not be able to return to normal because the exception solution is ineffective for the exception of the target monitoring task. In the case that the target monitoring task cannot return to normal, timely manual intervention is required to resolve the exception. Therefore, in order to facilitate confirmation of whether the target monitoring task has returned to normal, in an embodiment of the present application, after sending the above-mentioned management request instruction to the management node corresponding to at least one computing node, the method provided in the embodiment of the present application may also include: obtaining the current indicator information corresponding to the target monitoring task; if it is determined that the target monitoring task has not returned to normal based on the current indicator information and the preset exception judgment rules, then sending an alarm message for the target monitoring task.

[0079] In one implementation, the current indicator information at least includes abnormal indicator information of an abnormality detected in a target monitoring task, and may also include other monitoring indicator information of the target monitoring task.

[0080] Among them, the information content of the above-mentioned current indicator information, the rule content of the preset abnormal judgment rule, and the process of matching the current indicator information with the preset abnormal judgment rule can refer to the above-mentioned description of monitoring each monitoring task in the task chain, which will not be repeated here.

[0081] In one implementation, if the current indicator information matches the preset abnormality judgment rule, it is determined that the target monitoring task is still in an abnormal state, that is, the target monitoring task has not returned to normal. If the current indicator information does not match the preset abnormality judgment rule, it is determined that the target monitoring task is not currently in an abnormal state, that is, the target monitoring task has returned to normal.

[0082] If it is determined that the target monitoring task has not returned to normal, the alarm information of the target monitoring task can be sent to the target device, for example, the alarm information can be sent to the target device in the form of a text message, or voice communication is performed with the target device to send the alarm information to the target device in the form of voice. The above-mentioned target device can be an electronic device used by an on-duty engineer or a designated person.

[0083] In an embodiment of the present application, after executing the exception solution, by continuing to monitor the target monitoring task, it is possible to promptly confirm whether the target monitoring task has returned to normal, so that the exception tasks that cannot be resolved by the above-mentioned exception solution can be resolved in a timely manner through manual intervention, thereby ensuring the stable operation of the task chain.

[0084] In the implementation of this application, in order to continuously improve the accuracy of the reasoning results of the large language model, after verifying whether the target monitoring task has returned to normal, regardless of whether the target monitoring task has returned to normal, the relevant information of the current abnormal analysis of the target monitoring task can also be added to the preset knowledge base for the large language model to perform abnormal analysis of subsequent monitoring tasks. Therefore, after matching the current indicator information with the preset abnormal judgment rules to determine whether the target monitoring task has returned to normal, the method provided by the embodiment of the present application can also include: adding the above-mentioned target abnormal information, abnormal analysis result data, and result information of whether the target monitoring task has returned to normal to the preset knowledge base.

[0085] Among them, when the target abnormality information, abnormal analysis result data and the result information of whether the target monitoring task has returned to normal are added to the preset knowledge base, a feature vector corresponding to the target abnormality information, abnormal analysis result data and the result information of whether the target monitoring task has returned to normal can be generated and added to the preset knowledge base.

[0086] In one embodiment, before adding the target exception information to the preset knowledge base, the target exception information may also be preprocessed, for example, data cleaning of the target exception information, classification according to a specified format, etc., to obtain data values ​​corresponding to each key field in the target exception information.

[0087] In an embodiment of the present application, each time an exception solution inferred by a large language model is executed, the result information of whether the target monitoring task has returned to normal after the execution of the exception solution, the exception analysis result information, and the target exception information corresponding to the target monitoring task are added to a preset knowledge base, which is used for the large language model to perform exception analysis on subsequent monitoring tasks, that is, as a basis for subsequent reasoning by the large language model, thereby improving the accuracy of reasoning by the large language model.

[0088] In a specific implementation, an operation and maintenance report can also be generated regularly. The operation and maintenance report is used to record the time when the monitoring task exception occurs, the cause of the exception, the corresponding exception solution, whether the monitoring task returns to normal after executing the exception solution, and other information, and the generated operation and maintenance report is sent to relevant personnel.

[0089] Figure 3 A flowchart of a feasible embodiment of the abnormality analysis method provided in the embodiment of the present application is shown as follows: Figure 3 As shown, the method comprises the following steps: Step S301: During the execution of each monitoring task in the task chain, monitoring indicator information corresponding to each monitoring task is periodically obtained.

[0090] Step S302: Detect whether each monitoring task has an abnormality based on the monitoring indicator information; if an abnormal target monitoring task is detected, execute step S303; otherwise, continue to execute step S301.

[0091] Step S303: Obtain target abnormality information corresponding to the target monitoring task.

[0092] Step S304: Acquire target anomaly analysis data matching the target anomaly information in a preset knowledge base.

[0093] Step S305: Fill the above target abnormality information and target abnormality analysis data into a preset prompt word template to obtain a target prompt word.

[0094] Step S306: input the target prompt word into the large language model, and obtain abnormality analysis result data generated by the large language model based on the target prompt word; wherein the abnormality analysis result data includes abnormality cause data and abnormality solution.

[0095] Step S307: Generate a management request instruction corresponding to the exception solution.

[0096] Step S308: Send the above management request instruction to the management node corresponding to at least one computing node; wherein the management request instruction is used to request the management node to implement the exception solution.

[0097] Step S309: Obtain current indicator information corresponding to the target monitoring task.

[0098] Step S310: Match the above current indicator information with the preset abnormal judgment rules to determine whether the target monitoring task has returned to normal; if so, execute step S312; otherwise, execute step S311, and execute step S312 after executing step S311.

[0099] Step S311: Send an alarm message regarding abnormalities in the target monitoring task.

[0100] Step S312: Add the target abnormality information, abnormality analysis result data and result information of whether the target monitoring task has returned to normal corresponding to the target monitoring task to the preset knowledge base.

[0101] Corresponding to the application scenario and method of the method improved by the embodiment of the present application, the embodiment of the present application also provides an abnormality analysis system, such as Figure 4 As shown, the exception analysis system includes a monitoring device 401, an exception handling device 402 and a large language model analysis device 403.

[0102] Among them, the above-mentioned monitoring device 401 is used to monitor each monitoring task in the monitored task chain, and when an abnormality is detected in the target monitoring task, an alarm indication is sent to the above-mentioned exception handling device; wherein the above-mentioned alarm indication is used to indicate that an abnormality has occurred in the above-mentioned target monitoring task; the above-mentioned exception handling device 402 is used to respond to the above-mentioned alarm indication and obtain the target abnormality information of the above-mentioned target monitoring task within the time range of the abnormality occurrence; the above-mentioned large language model analysis device 403 is used to obtain target abnormality analysis data matching the above-mentioned target abnormality information from a preset knowledge base, and obtain the abnormality analysis result data determined by the large language model based on the above-mentioned target abnormality analysis data and the above-mentioned target abnormality information; wherein the above-mentioned preset knowledge base includes abnormality analysis data of multiple monitoring tasks in at least one task chain.

[0103] In one implementation, the large language model analysis device 403 may be specifically expressed as a large language model analysis engine.

[0104] It should be noted that, in the embodiment of the present application, the above-mentioned monitoring device 401, exception handling device 402 and large language model analysis device 403 can be deployed on the same subject or multiple subjects, which can be an application, service, instance, software-based functional module, virtual machine, container or cloud server, etc., or a hardware device or hardware chip with data processing function, etc. Exemplarily, each device can be deployed on a local computing device or a cloud computing platform that provides computing power, storage and network resources, and the specific application architecture can be built according to service requirements.

[0105] In one embodiment, the large language model analysis device 403 is specifically used to: fill the target abnormality analysis data and the target abnormality information into a preset prompt word template to obtain a target prompt word; input the target prompt word into the large language model, and obtain the abnormality analysis result data generated by the large language model based on the target prompt word.

[0106] In one embodiment, the above-mentioned exception handling device 402 is also used to: generate a management request instruction corresponding to the above-mentioned exception solution; send the above-mentioned management request instruction to the management node corresponding to at least one computing node; wherein the above-mentioned management request instruction is used to request the above-mentioned management node to implement the above-mentioned exception solution, and the above-mentioned at least one computing node is used to execute multiple monitoring tasks in the target task chain, and the above-mentioned target task chain is the task chain where the above-mentioned target monitoring task is located.

[0107] In one embodiment, the above-mentioned abnormal solution is to adjust the resource configuration information of the above-mentioned target monitoring task, and the above-mentioned management request instruction is used to request the above-mentioned management node to adjust the resource configuration information of the above-mentioned target monitoring task.

[0108] In one embodiment, the above-mentioned exception solution is to migrate the above-mentioned target task chain to other computing clusters; the above-mentioned exception handling device 402 is specifically used to: determine the target computing cluster used to execute the above-mentioned target task chain; generate the above-mentioned management request instruction; wherein the above-mentioned management request instruction is used to request the above-mentioned management node to migrate the above-mentioned target task chain to the above-mentioned target computing cluster.

[0109] In one embodiment, the above-mentioned exception solution is to skip the consumption site corresponding to the dirty data in the target data queue, and the above-mentioned target data queue is the data queue required to execute the above-mentioned target monitoring task; the above-mentioned exception handling device 402 is specifically used to: determine the starting consumption site in the above-mentioned target data queue; wherein the above-mentioned starting consumption site is located after the consumption site corresponding to the above-mentioned dirty data; generate the above-mentioned management request instruction; wherein the above-mentioned management request instruction is used to request the above-mentioned management node to schedule the target data queue to re-consume data from the above-mentioned starting consumption site.

[0110] In one embodiment, the above-mentioned monitoring device 401 is also used to: obtain current indicator information corresponding to the above-mentioned target monitoring task; the above-mentioned exception handling device 402 is also used to: if the monitoring device 401 determines that the above-mentioned target monitoring task has not returned to normal based on the current indicator information and the preset exception judgment rules, send an alarm message for the above-mentioned target monitoring task.

[0111] In one embodiment, the above-mentioned exception handling device 402 is also used for: adding the above-mentioned target exception information, the above-mentioned exception analysis result data and the result information of whether the above-mentioned target monitoring task has returned to normal to the above-mentioned preset knowledge base.

[0112] Figure 5 A schematic diagram of the process of an abnormality analysis method applied to the abnormality analysis system is shown, as shown in Figure 5 As shown, the monitoring device 401 performs abnormal monitoring on each monitoring task in the task chain. When the target monitoring task is detected to be abnormal, an alarm indication of the abnormality of the target monitoring task is sent to the abnormality handling device 402. In response to the alarm indication, the abnormality handling device 402 obtains the target abnormality information corresponding to the target monitoring task, and sends the target abnormality information to the large language model analysis device 403. The large prediction model analysis device 403 obtains the abnormal cause data and abnormality solution corresponding to the target monitoring task based on the target abnormality information, and feeds back the abnormality solution to the abnormality handling device 402. The abnormality handling device 402 generates a corresponding management request instruction based on the abnormality solution and sends it to the management node of the computing cluster. Thereafter, the monitoring device 401 collects the current indicator information of the target monitoring task to determine whether the target monitoring task has returned to normal. When the target monitoring task has not returned to normal, the abnormality handling device 402 sends an alarm message to the target device. In addition, regardless of whether the target monitoring device has returned to normal, the exception handling device 402 adds the target exception information, exception solution and whether the result information has returned to normal corresponding to the target monitoring task to the preset knowledge base, which is used for the large language model to perform exception analysis on subsequent monitoring tasks, thereby achieving continuous iterative optimization of the reasoning capability of the large language model.

[0113] The abnormality analysis system provided in the embodiment of the present application can implement all the contents in the above method embodiment. Therefore, the specific implementation process of the functions corresponding to each device in the abnormality analysis system can refer to the above method embodiment and will not be repeated here.

[0114] Corresponding to the application scenario and method of the method provided in the embodiment of the present application, the embodiment of the present application also provides an exception analysis device, which includes: a first acquisition module, used to obtain target exception information of the target monitoring task within the scope of the exception occurrence event in response to an exception occurring in the target monitoring task; a second acquisition module, used to obtain target exception analysis data matching the target exception information from a preset knowledge base; wherein the preset knowledge base includes exception analysis data of multiple monitoring tasks in at least one task chain; and a third acquisition module, used to obtain exception analysis result data determined by a large language model based on the target exception analysis data and the target exception information.

[0115] In one embodiment, the above-mentioned preset knowledge base also includes topological relationship information of multiple monitoring tasks in the above-mentioned task chain; the above-mentioned second acquisition module is specifically used to: determine the upstream and downstream task information of the target monitoring task based on the topological relationship information, and obtain historical abnormality information and corresponding historical abnormality analysis result data matching the target abnormality information from the preset knowledge base; wherein, the target abnormality analysis data includes historical abnormality information, corresponding historical abnormality analysis result data and upstream and downstream task information.

[0116] In one embodiment, the third acquisition module is specifically used to: fill the target anomaly analysis data and target anomaly information into a preset prompt word template to obtain a target prompt word; input the target prompt word into a large language model, and obtain the anomaly analysis result data generated by the large language model based on the target prompt word.

[0117] In one embodiment, the above-mentioned abnormal analysis result data includes abnormal cause data and abnormal solution data.

[0118] In one embodiment, the device provided by the embodiment of the present application also includes: a generation module, used to generate a management request instruction corresponding to the above-mentioned exception solution; a first sending module, used to send the above-mentioned management request instruction to the management node corresponding to at least one computing node; wherein, the management request instruction is used to request the management node to implement the above-mentioned exception solution, and at least one computing node is used to execute multiple monitoring tasks in the target task chain, and the target task chain is the task chain where the target monitoring task is located.

[0119] In one implementation, the above-mentioned exception solution is to adjust the resource configuration information of the target monitoring task, and the management request instruction is used to request the management node to adjust the resource configuration information of the target monitoring task.

[0120] In one embodiment, the above-mentioned exception solution is to migrate the target task chain to other computing clusters; the above-mentioned generation module is specifically used to: determine the target computing cluster for executing the target task chain; generate a management request instruction; wherein the management request instruction is used to request the management node to migrate the target task chain to the target computing cluster.

[0121] In one embodiment, the above-mentioned exception solution is to skip the consumption site corresponding to the dirty data in the target data queue, and the target data queue is the data queue required to execute the target monitoring task; the above-mentioned generation module is specifically used to: determine the starting consumption site in the target data queue; wherein the starting consumption site is located after the consumption site corresponding to the above-mentioned dirty data; generate the management request instruction; wherein the management request instruction is used to request the management node to schedule the target data queue to re-consume data from the starting consumption site.

[0122] In one embodiment, the device provided in the embodiment of the present application also includes: a fourth acquisition module, used to obtain current indicator information corresponding to the target monitoring task; a second sending module, used to send alarm information for the target monitoring task if it is determined that the target monitoring task has not returned to normal based on the current indicator information and preset abnormality judgment rules.

[0123] In one embodiment, the device provided in the embodiment of the present application also includes: an adding module, which is used to add target abnormality information, abnormality analysis result data and result information of whether the target monitoring task has returned to normal to a preset knowledge base.

[0124] The functions of each module in each device in the embodiments of the present application can be found in the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0125] Figure 6 FIG. 1 is a block diagram of an electronic device used to implement an embodiment of the present application. Figure 6 As shown, the electronic device includes: a memory 601 and a processor 602, and the memory 601 stores a computer program that can be run on the processor 602. When the processor 602 executes the computer program, the method in the above embodiment is implemented. The number of the memory 601 and the processor 602 can be one or more. In a specific implementation, the electronic device may also include a communication interface 603 for communicating with external devices and performing data exchange transmission.

[0126] In specific implementation, if the memory 601, the processor 602 and the communication interface 603 are implemented independently, the memory 601, the processor 602 and the communication interface 603 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0127] Optionally, in a specific implementation, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can communicate with each other through an internal interface.

[0128] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present application when the program is executed by a processor.

[0129] An embodiment of the present application provides a computer program product, including a computer program, which implements the method provided in the embodiment of the present application when executed by a processor.

[0130] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present application.

[0131] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0132] It should be understood that the processor may be a CPU, or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the Advanced RISC Machines (ARM) architecture.

[0133] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting description, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DR RAM).

[0134] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0135] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0136] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0137] Any process or method described in the flow chart or otherwise described herein can be understood as a module, fragment or portion of a code representing one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0138] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0139] It should be understood that the various parts of the present application can be implemented with hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented with software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0140] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0141] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope recorded in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An abnormality analysis method, comprising: In response to an abnormality occurring in a target monitoring task, obtaining target abnormality information of the target monitoring task within a time range of the abnormality occurrence; Acquire target anomaly analysis data matching the target anomaly information from a preset knowledge base; wherein the preset knowledge base includes anomaly analysis data of multiple monitoring tasks in at least one task chain; Acquire abnormality analysis result data determined by the large language model according to the target abnormality analysis data and the target abnormality information.

2. The method according to claim 1, wherein: The preset knowledge base also includes topological relationship information of multiple monitoring tasks in the task chain; The step of acquiring target anomaly analysis data matching the target anomaly information from a preset knowledge base includes: Determine the upstream and downstream task information of the target monitoring task according to the topological relationship information, and obtain historical abnormality information and corresponding historical abnormality analysis result data matching the target abnormality information from the preset knowledge base; wherein the target abnormality analysis data includes the historical abnormality information, the corresponding historical abnormality analysis result data and the upstream and downstream task information.

3. The method according to claim 1 or 2, wherein: Acquiring abnormality analysis result data determined by the large language model according to the target abnormality analysis data and the target abnormality information, including: Filling the target abnormality analysis data and the target abnormality information into a preset prompt word template to obtain a target prompt word; The target prompt word is input into the large language model, and the abnormality analysis result data generated by the large language model based on the target prompt word is obtained.

4. The method according to claim 1, wherein: The abnormality analysis result data includes abnormality cause data and / or abnormality solution.

5. The method according to claim 4, wherein: The abnormality analysis result data includes an abnormality solution, and after obtaining the abnormality analysis result data determined by the large language model according to the target abnormality analysis data and the target abnormality information, it also includes: Generate a management request instruction corresponding to the exception solution; Send the management request instruction to the management node corresponding to at least one computing node; wherein the management request instruction is used to request the management node to implement the exception solution, and the at least one computing node is used to execute multiple monitoring tasks in the target task chain, and the target task chain is the task chain where the target monitoring task is located.

6. The method according to claim 5, wherein: The abnormal solution is to adjust the resource configuration information of the target monitoring task, and the management request instruction is used to request the management node to adjust the resource configuration information of the target monitoring task.

7. The method according to claim 5, wherein: The abnormal solution is to migrate the target task chain to another computing cluster; Generating a management request instruction corresponding to the exception solution includes: determining a target computing cluster for executing the target task chain; Generate the management request instruction; wherein the management request instruction is used to request the management node to migrate the target task chain to the target computing cluster.

8. The method according to claim 5, wherein: The abnormal solution is to skip the consumption site corresponding to the dirty data in the target data queue, and the target data queue is the data queue required to execute the target monitoring task; Generating a management request instruction corresponding to the exception solution includes: Determine a starting consumption position in the target data queue; wherein the starting consumption position is located after the consumption position corresponding to the dirty data; Generate the management request instruction; wherein the management request instruction is used to request the management node to schedule the target data queue to re-consume data from the starting consumption location.

9. The method according to any one of claims 5 to 8, wherein: After sending the management request instruction to the management node corresponding to the at least one computing node, the method further includes: Obtaining current indicator information corresponding to the target monitoring task; If it is determined that the target monitoring task has not returned to normal based on the current indicator information and the preset abnormality judgment rule, an alarm message for the target monitoring task is sent.

10. The method according to claim 9, wherein: After matching the current indicator information with the preset abnormality judgment rule to determine whether the target monitoring task has returned to normal, the method further includes: The target abnormality information, the abnormality analysis result data and the result information of whether the target monitoring task returns to normal are added to the preset knowledge base.

11. An abnormality analysis system, wherein: The system includes a monitoring device, an exception handling device and a large language model analysis device; The monitoring device is used to: monitor each monitoring task in the task chain to be monitored, and when an abnormality is detected in the target monitoring task, send an alarm indication to the abnormality handling device; wherein the alarm indication is used to indicate that the target monitoring task is abnormal; The exception handling device is used to: in response to the alarm indication, obtain target exception information of the target monitoring task within the time range of the exception occurrence; The large language model analysis device is used to: obtain target abnormality analysis data matching the target abnormality information from a preset knowledge base, and obtain abnormality analysis result data determined by the large language model based on the target abnormality analysis data and the target abnormality information; wherein the preset knowledge base includes abnormality analysis data of multiple monitoring tasks in at least one task chain.

12. An electronic device comprising a memory, a processor and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 10 when executing the computer program.

13. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

14. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 10.

Images