A real-time intelligent operation and maintenance method and an intelligent operation and maintenance system

Abstract

The application relates to a real-time intelligent operation and maintenance method and an intelligent operation and maintenance system, the method is used for the intelligent operation and maintenance system, the intelligent operation and maintenance system comprises a Kafka unit, an intelligent agent set unit and an RCA-Agent unit which are connected in sequence; the method comprises the following steps: actively reporting batch logs, so that the Kafka unit contains the batch logs; consuming the batch logs of the Kafka unit and extracting text key contents; based on the text key contents, the intelligent agent set unit generates unified context information, sends the unified context information to the RCA-Agent unit, generates a solution according to the unified context information, and stores the solution into a local knowledge base. The existing scheme can only solve surface problems and current problems, cannot prevent potential risks, and cannot make a prediction based on the overall architecture of the operation and maintenance system; the application can prevent potential risks on the basis of solving surface problems and can make a prediction based on the overall architecture of the operation and maintenance system.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance, and in particular to a real-time intelligent operation and maintenance method and an intelligent operation and maintenance system. Background Technology

[0002] With the rapid development of information technology, data assets have become one of the core assets of enterprises, and more and more enterprises are entrusting the operation and maintenance of data assets to data teams for management and mining.

[0003] Data operations personnel routinely query logs to identify anomalies and pinpoint their root causes. However, given the sheer volume of logs, current technologies can only address surface-level and immediate issues, failing to prevent potential risks or provide forecasts based on the overall architecture of the operations system. Therefore, the industry needs to design a real-time intelligent operations solution to address these technical challenges. Summary of the Invention

[0004] The technical problem to be solved by this invention is: how to design a real-time intelligent operation and maintenance technical solution that can make predictions based on the overall architecture of the operation and maintenance system.

[0005] To address the aforementioned issues, this invention proposes a real-time intelligent operation and maintenance method and an intelligent operation and maintenance system. The beneficial effects are that, on the one hand, it can prevent potential risks while solving surface problems, and on the other hand, it can make predictions based on the overall architecture of the operation and maintenance system.

[0006] In a first aspect, embodiments of the present invention propose a real-time intelligent operation and maintenance method. The method is used in an intelligent operation and maintenance system, which includes a Kafka unit, an agent collection unit, and an RCA-Agent unit connected sequentially. The real-time intelligent operation and maintenance method includes: S1, actively reporting batch logs so that the Kafka unit contains batch logs; S2, consuming the batch logs from the Kafka unit and extracting key text content; S3, based on the key text content, the agent collection unit generates unified context information and sends the unified context information to the RCA-Agent unit; S4, generating a solution based on the unified context information and storing the solution in a local knowledge base.

[0007] A further technical solution involves connecting the RCA-Agent unit of the intelligent operation and maintenance system to the information assistance unit. The real-time intelligent operation and maintenance method further includes: S5, receiving abnormal dynamic problems from external input through the information assistance unit, obtaining abnormal feedback information, and then generating an operation and maintenance analysis report. In the above solution, the abnormal dynamic problem can specifically be a surge in transaction volume, system lag, or similar issues; the specific definition of the abnormal dynamic problem is known to those skilled in the art. Further, the information assistance unit is used to understand user input, formulate a plan, and perform root cause analysis; the role of the plan is to filter out a third number of Agent intelligent agents with corresponding relationships. Further, different Plans will be generated based on different abnormal dynamic problems (i.e., based on different representations) when querying specific Agent intelligent agents.

[0008] A further technical solution is that step S1, actively reporting batch logs so that the Kafka unit contains batch logs, includes: S101, actively reporting the batch logs of a first number of Serve service units to the Kafka unit, so that the Kafka unit contains batch logs. In the above solution, different types of Serve service units are stored according to corresponding topics. This architecture can be flexibly expanded; adding or removing services only requires adding or removing topics on the Kafka unit.

[0009] A further technical solution is as follows: Step S2, consuming the batch logs of the Kafka unit and extracting key text content, includes: S102, actively consuming the batch logs of the Kafka unit in streaming form using the FLAIR framework, cleaning the information content of the batch logs in real time based on regular expression matching, and extracting key text content. In the above solution, actively consuming the batch logs of the Kafka unit in streaming form using the FLAIR framework means extracting the target from the batch logs of the Kafka unit in streaming form; the specific definition of active consumption is known to those skilled in the art.

[0010] A further technical solution is that the agent set unit includes a second number of agent agents; step S3, based on the key text content, the agent set unit generates unified context information and sends the unified context information to the RCA-Agent unit, including: S103, firstly, log information containing the key text content is taken as valid log information, then the valid log information output by the second number of agent agents within a preset time interval is summarized and unified context information is generated, and the unified context information is sent to the RCA-Agent unit. In the above solution, the agent set unit is a superior unit of the agent agents, and the second number of agent agents are all sub-units, and the second number of agent agents are independent of each other.

[0011] Furthermore, all agents are based on the LLM model, and the knowledge base is implemented using a vector database. The fault type (i.e., service alert) is used as the key, and the log input is used as the value. Based on the problem log input, the fault type is output, and both the input and output are stored in the vector database / local knowledge base through Embedding to form an accumulation of expert experience. Subsequent outputs will first search for the most similar alarm summary, i.e., the problem log, from the vector database / local knowledge base using the KNN algorithm, thereby quickly outputting the fault type (i.e., service alert). As the types of service units increase, the types of agents can be flexibly increased and dynamically arranged.

[0012] The further technical solution is that step S4, generating a solution based on unified context information and storing the solution in a local knowledge base, includes: S104, summarizing and analyzing all unified context information through the RCA-Agent unit, obtaining the solution corresponding to the unified context information through the root cause localization module, and storing the solution in key-value format in the local knowledge base.

[0013] A further technical solution is that the RCA-Agent unit includes an analysis and early warning module, a root cause localization module, and a local knowledge base, wherein both the analysis and early warning module and the root cause localization module are connected to the local knowledge base; step S5, based on the information assistance unit receiving externally input abnormal dynamic problems, obtaining abnormal feedback information, and then generating an operation and maintenance analysis report, includes: S105, based on the information assistance unit receiving externally input abnormal dynamic problems, transmitting the abnormal dynamic problems to the root cause localization module of the RCA-Agent unit for divergence, and then distributing and drilling down the abnormal dynamic problems to a second number of Agent intelligent agents through the root cause localization module; S106, according to the correspondence between the second number of Agent intelligent agents and the abnormal dynamic problems, selecting a third number of Agent intelligent agents with corresponding relationships from the second number of Agent intelligent agents, and converting the abnormal dynamic problems into abnormal feedback information; S107, the RCA-Agent unit receives the abnormal feedback information sent by the third number of Agent intelligent agents, and then the analysis and early warning module in the RCA-Agent unit analyzes the abnormal feedback information and generates an operation and maintenance analysis report. The analysis and early warning module and the root cause localization module share the same local knowledge base for accumulating expert experience.

[0014] Secondly, embodiments of the present invention propose an intelligent operation and maintenance system, which is used to execute the real-time intelligent operation and maintenance method as described in the first aspect. The functions of the real-time intelligent operation and maintenance method and the intelligent operation and maintenance system include:

[0015] First, it improves the efficiency of fault diagnosis and prevention: Through the analysis and reasoning capabilities of LLM, the root cause of a problem can be quickly located and repair suggestions can be provided; combined with the analysis of historical data, early warnings can be given for potential future problems.

[0016] Second, enhance cross-system and cross-team collaboration capabilities: The RCA-Agent unit is responsible for collecting and integrating anomaly information and link configuration data detected by each Agent; coordinating analysis tasks between different Agents to achieve a better collaboration mechanism.

[0017] Third, it enables automated operation and maintenance: Through real-time processing and analysis of massive log information, automated fault detection and repair can be achieved, reducing the burden of manual operation and maintenance and improving operation and maintenance efficiency.

[0018] Fourth, improve system reliability and availability: quickly locate and fix problems to reduce service interruption time; provide early warnings and prevent potential future problems to enhance system reliability.

[0019] Fifth, reduce operation and maintenance costs: automated operation and maintenance significantly reduces labor costs; through the analysis and optimization of historical data, resource utilization efficiency can be further optimized.

[0020] Therefore, this invention, through a big data technology framework and the coordinated work of multiple agents, can process massive amounts of log information in real time and automatically. Based on the emergence and reasoning capabilities of LLM, it can not only quickly locate current defects but also provide repair suggestions for current defects and warn of potential future problems. In addition, this invention uses the RCA-Agent unit to accurately collect anomaly information, links, and configuration information detected by other agents for root cause localization. It is also responsible for converging collaboration rounds and determining the direction of the next analysis and drill-down based on feedback from other agents, thereby realizing a cross-system and cross-team collaborative mechanism.

[0021] Data operations and maintenance personnel routinely query logs to identify anomalies and pinpoint their root causes. However, given the sheer volume of logs, current technologies can only address surface-level and immediate issues, failing to prevent potential risks or make predictions based on the overall architecture of the operations and maintenance system. Therefore, this application presents a real-time intelligent operations and maintenance method and system that offers the following advantages: firstly, it can prevent potential risks while addressing surface-level problems; secondly, it enables predictions based on the overall architecture of the operations and maintenance system. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating a real-time intelligent operation and maintenance method provided in an embodiment of the present invention.

[0025] Figure 2 This is another flowchart illustrating the real-time intelligent operation and maintenance method provided in an embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of a framework for an intelligent operation and maintenance system provided in an embodiment of the present invention.

[0027] Figure 4This is another schematic diagram of the intelligent operation and maintenance system provided in an embodiment of the present invention.

[0028] Figure 5 A block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0031] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0032] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to one or any combination of the associated listed items and all possible combinations, and includes such combinations.

[0033] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrases "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0034] Example 1

[0035] Please see Figures 1 to 2 This is a flowchart illustrating a real-time intelligent operation and maintenance method provided in an embodiment of the present invention. The present invention proposes a real-time intelligent operation and maintenance method for an intelligent operation and maintenance system, the intelligent operation and maintenance system comprising a Kafka unit, an agent collection unit, and an RCA-Agent unit connected sequentially; the real-time intelligent operation and maintenance method includes:

[0036] S1 actively reports batch logs, enabling Kafka units to contain batch logs.

[0037] S2 consumes batch logs from a Kafka unit and extracts key text content.

[0038] S3, based on the key content of the text, the agent collection unit generates unified context information and sends the unified context information to the RCA-Agent unit.

[0039] S4. Generate a solution based on the unified context information and store the solution in the local knowledge base.

[0040] In one embodiment, the RCA-Agent unit of the intelligent operation and maintenance system is connected to the information assistance unit; the real-time intelligent operation and maintenance method further includes: S5, based on the abnormal dynamic problems received by the information assistance unit from external input, obtaining abnormal feedback information, and then generating an operation and maintenance analysis report.

[0041] In one embodiment, step S1, which involves actively reporting batch logs so that the Kafka unit contains batch logs, includes: S101, actively reporting the batch logs of a first number of Service units to the Kafka unit so that the Kafka unit contains batch logs.

[0042] In one embodiment, step S2, consuming the batch logs of the Kafka unit and extracting key text content, includes: S102, actively consuming the batch logs of the Kafka unit in streaming form using the FLINK framework, cleaning the information content of the batch logs in real time based on regular expression matching, and extracting key text content.

[0043] In one embodiment, the agent set unit includes a second number of agent agents; step S3, based on the key text content, the agent set unit generates unified context information and sends the unified context information to the RCA-Agent unit, including: S103, first taking the log information containing the key text content as valid log information, then summarizing the valid log information output by the second number of agent agents within a preset time interval and generating unified context information, and sending the unified context information to the RCA-Agent unit.

[0044] In one embodiment, step S4, generating a solution based on unified context information and storing the solution in a local knowledge base, includes: S104, summarizing and analyzing all unified context information through the RCA-Agent unit, obtaining the solution corresponding to the unified context information through the root cause localization module, and storing the solution in key-value format in the local knowledge base.

[0045] In one embodiment, the RCA-Agent unit includes an analysis and early warning module, a root cause localization module, and a local knowledge base, wherein both the analysis and early warning module and the root cause localization module are connected to the local knowledge base; step S5, based on the information assistance unit receiving externally input abnormal dynamic problems, obtaining abnormal feedback information, and then generating an operation and maintenance analysis report, includes: S105, based on the information assistance unit receiving externally input abnormal dynamic problems, transmitting the abnormal dynamic problems to the root cause localization module of the RCA-Agent unit for divergence, and then distributing and drilling down the abnormal dynamic problems to a second number of Agent intelligent agents through the root cause localization module; S106, according to the correspondence between the second number of Agent intelligent agents and the abnormal dynamic problems, selecting a third number of Agent intelligent agents with corresponding relationships from the second number of Agent intelligent agents, and converting the abnormal dynamic problems into abnormal feedback information; S107, the RCA-Agent unit receives the abnormal feedback information sent by the third number of Agent intelligent agents, and then the analysis and early warning module in the RCA-Agent unit analyzes the abnormal feedback information and generates an operation and maintenance analysis report.

[0046] This invention also proposes an intelligent operation and maintenance system, see [link to relevant documentation]. Figure 3 as well as Figure 4 The intelligent operation and maintenance system is used to execute the real-time intelligent operation and maintenance method as described in any of the above embodiments. In one embodiment, the real-time intelligent operation and maintenance method specifically includes the following steps S101 to S107:

[0047] S101, actively report the batch logs of the first number of Serve service units to the Kafka unit, so that the Kafka unit contains the batch logs.

[0048] S102 uses the fly framework to actively consume batch logs from Kafka units in streaming form. Based on regular expression matching, it cleans the information content of batch logs in real time and extracts key text content.

[0049] S103, firstly, log information containing key text content is taken as valid log information, then the valid log information output by the second number of Agents within a preset time interval is summarized and a unified context information is generated, and the unified context information is sent to the RCA-Agent unit.

[0050] S104, the RCA-Agent unit summarizes and analyzes all unified context information, and the root cause localization module obtains the solution corresponding to the unified context information, and stores the solution in key-value form in the local knowledge base.

[0051] S105, based on the abnormal dynamic problem received by the information assistance unit from the external input, the abnormal dynamic problem is transmitted to the root cause localization module of the RCA-Agent unit for divergence, and then the abnormal dynamic problem is distributed and drilled down to the second number of Agent intelligent agents through the root cause localization module.

[0052] S106, based on the correspondence between the second number of Agents and the abnormal dynamic issues, select the third number of Agents that have a corresponding relationship from the second number of Agents, and transform the abnormal dynamic issues into abnormal feedback information.

[0053] S107, the RCA-Agent unit receives the abnormal feedback information sent by the third number of Agents, and then the analysis and early warning module in the RCA-Agent unit analyzes the abnormal feedback information and generates an operation and maintenance analysis report.

[0054] Those skilled in the art will understand the relevant terms used in the above embodiments. The explanations of the relevant terms in the intelligent seal recognition method and seal recognition system include:

[0055] Embedding: An important concept in the fields of machine learning and natural language processing. It refers to the transformation of discrete, high-dimensional data (such as text, images, etc.) into continuous, low-dimensional data representations.

[0056] LLM: Large Language Model.

[0057] KNN: A classic machine learning algorithm, namely K-Nearest Neighbors, which can be used to perform nearest neighbor search in vector databases.

[0058] In summary, with the development of the digital economy, platforms require increasingly more services to maintain. Data teams' operations and maintenance personnel mainly face the following challenges: First, insufficient automation: some operations and maintenance work still relies on manual operation and expert experience, lacking sufficient automation and intelligence, making human error prone to occur; Second, weak operations and maintenance data analysis capabilities: existing operations and maintenance systems cannot effectively collect and analyze large amounts of data, failing to promptly identify and prevent potential risks; Third, lack of foresight and holistic perspective: existing operations and maintenance solutions only focus on immediate problem fixing, lacking prediction of the overall system architecture and future development trends; Fourth, lack of cross-team and cross-system collaboration: operations and maintenance collaboration between different teams or systems is generally difficult, lacking effective collaboration mechanisms.

[0059] Data operations and maintenance personnel routinely query logs to identify anomalies and pinpoint their root causes. However, given the sheer volume of logs, current technologies can only address surface-level and immediate issues, failing to prevent potential risks or make predictions based on the overall architecture of the operations and maintenance system. Therefore, this application presents a real-time intelligent operations and maintenance method and system that offers the following advantages: firstly, it can prevent potential risks while addressing surface-level problems; secondly, it enables predictions based on the overall architecture of the operations and maintenance system.

[0060] Example 2

[0061] Please see Figure 5 , Figure 5 This is a block diagram of an electronic device provided by the present invention. The electronic device can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet computer, laptop computer, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster.

[0062] It includes a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0063] Memory 113 is used to store computer programs.

[0064] In one embodiment of the present invention, the processor 111, when executing the program stored in the memory 113, implements the method provided in any of the foregoing method embodiments.

[0065] It should be understood that, in the embodiments of this application, processor 111 may be a central processing unit (CPU), and processor 502 may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0066] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0067] Therefore, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method provided in any of the foregoing method embodiments.

[0068] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0069] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions, but such implementations should not be considered beyond the scope of this invention.

[0070] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is only a logical functional division, and there may be other division methods in actual implementation. For example, units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0071] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0072] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0073] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0074] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

[0075] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A real-time intelligent operation and maintenance method, characterized in that, The method is used in an intelligent operation and maintenance system, which includes a Kafka unit, an agent collection unit, and an RCA-Agent unit connected in sequence. The RCA-Agent unit of the intelligent operation and maintenance system is connected to an information assistance unit. The RCA-Agent unit includes an analysis and early warning module, a root cause localization module, and a local knowledge base. The analysis and early warning module and the root cause localization module are both connected to the local knowledge base. The real-time intelligent operation and maintenance method includes: S101, actively report the batch logs of the first number of Serve service units to the Kafka unit, so that the Kafka unit contains the batch logs; S102 uses the Flink framework to actively consume batch logs from Kafka units in streaming form. Based on regular expression matching, it cleans the information content of batch logs in real time and extracts key text content. S103, first take the log information containing key text content as valid log information, then summarize the valid log information output by the second number of Agents within a preset time interval and generate unified context information, and send the unified context information to the RCA-Agent unit. S104, the RCA-Agent unit summarizes and analyzes all unified context information, and the root cause localization module obtains the solution corresponding to the unified context information, and stores the solution in the local knowledge base in key-value form; S105, based on the abnormal dynamic problem received by the information assistance unit from the external input, the abnormal dynamic problem is transmitted to the root cause localization module of the RCA-Agent unit for divergence, and then the abnormal dynamic problem is distributed and drilled down to the second number of Agent intelligent agents through the root cause localization module. S106, Based on the correspondence between the second number of Agents and the abnormal dynamic issues, select the third number of Agents that have a corresponding relationship from the second number of Agents, and transform the abnormal dynamic issues into abnormal feedback information; S107, the RCA-Agent unit receives the abnormal feedback information sent by the third number of Agents, and then the analysis and early warning module in the RCA-Agent unit analyzes the abnormal feedback information and generates an operation and maintenance analysis report.

2. An intelligent operation and maintenance system, characterized in that, The intelligent operation and maintenance system is used to execute the real-time intelligent operation and maintenance method as described in claim 1.

Images