Fault detection method, system, device, equipment, medium and program product

Abstract

The invention provides a fault detection method, system and device, equipment, a medium and a program product, and relates to the technical field of artificial intelligence. The method comprises: when first detection data of a detected object indicates a fault of the detected object, obtaining a fault detection data set of the detected object, the first detection data being detection data obtained in any one time frame, the fault detection data set comprising a plurality of second detection data, each piece of second detection data refers to detection data obtained after the detected object has a fault; acquiring configuration information of the detected object; according to the first detection data, the fault detection data set and the configuration information, whether the detected object has a fault is judged, and when the judgment result indicates that the detected object has the fault, a fault analysis report of the detected object is obtained; and reporting a fault analysis report to an operation and maintenance platform. By means of the method, the problems that an existing operation and maintenance team is low in response speed and high in false alarm rate due to the low automation degree are solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a fault detection method, system, device, equipment, medium and program product. Background Art

[0002] With the rapid development of information technology, the demand for system stability and reliability is increasing, which requires enterprises to pay more attention to the role of operation and maintenance teams in the process of digital transformation. In order to adapt to this change, the operation and maintenance team needs to continuously improve their skills and tools and implement more advanced management strategies to ensure that the information system can support the rapid development and business innovation of the enterprise.

[0003] The existing operation and maintenance team relies on manual intervention to confirm and process alarm information and lacks intelligent automated processing capabilities, which not only prolongs fault response time but also increases the probability of human error. Summary of the invention

[0004] The present application provides a fault detection method, system, device, equipment, medium and program product to solve the technical problems of slow response speed and high false alarm rate caused by low automation level of existing operation and maintenance teams.

[0005] In a first aspect, the present application provides a fault detection method, which is applied to a core agent of an agent platform, and the method comprises:

[0006] When the first detection data of the detected object indicates a fault of the detected object, a fault detection data set of the detected object is acquired; wherein the first detection data refers to detection data obtained in any time frame, and the fault detection data set includes a plurality of second detection data, each of which refers to detection data obtained after the detected object fails;

[0007] Acquire configuration information of the detected object;

[0008] Determine whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtain a fault analysis report of the detected object when the determination result indicates that the detected object is faulty;

[0009] Report the fault analysis report to the operation and maintenance platform.

[0010] Optionally, in the method as described above, the agent platform further includes a monitoring agent, and when the first detection data of the detected object indicates a fault of the detected object, obtaining a fault detection data set of the detected object includes:

[0011] Obtaining the fault cause analysis pushed by the monitoring agent to determine the fault of the detected object; wherein the fault cause analysis is obtained based on the first detection data;

[0012] According to the fault cause analysis, the monitoring agent is adjusted so as to collect the fault detection data set from the detected object according to the adjusted monitoring agent.

[0013] Optionally, in the method as described above, the monitoring agent includes a plurality of sub-agents, and the fault cause analysis includes fault prompt words;

[0014] Then, adjusting the monitoring agent according to the fault cause analysis includes:

[0015] Extracting the fault prompt word from the fault cause analysis;

[0016] Generate functional instructions according to the fault prompt words through a preset natural language processing model and a functional instruction library;

[0017] According to the functional instructions, at least one target agent is called from the multiple sub-agents, and the sampling method of the at least one target agent is adjusted.

[0018] Optionally, in the method as described above, the multiple sub-agents include a link agent and a log agent;

[0019] Then, calling at least one target agent from the plurality of sub-agents according to the functional instruction and adjusting the sampling mode of the at least one target agent include:

[0020] When the function instruction indicates to call the link agent, the sampling frequency of the link agent is increased until the number of the plurality of second detection data reaches a first preset number, and / or the plurality of adjacent second detection data remain stable;

[0021] When the function instruction instructs to call the log agent, the sampling range and / or sampling accuracy of the log agent is increased until the number of the plurality of second detection data reaches a second preset number.

[0022] Optionally, in the method described above, the agent platform further includes a configuration management database agent, and the step of obtaining the configuration information of the detected object includes:

[0023] According to the fault cause analysis pushed by the monitoring agent, the configuration management database agent calls the configuration information of the detected object from the configuration information set of the preset configuration management database.

[0024] Optionally, in the method as described above, judging whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtaining a fault analysis report of the detected object when the judgment result indicates that the detected object is faulty, comprises:

[0025] Inputting the first detection data, the fault detection data set and the configuration information into a preset fault tree model to obtain a first judgment result output by the fault tree model;

[0026] When the first judgment result indicates that the detected object is faulty, the fault analysis report is extracted from the fault tree model.

[0027] Optionally, in the above method, when the first judgment result does not indicate a fault in the detected object, the method further includes:

[0028] Reporting the first detection data, the fault detection data set and the configuration information to a fault detection platform so that the fault detection platform can output the fault analysis report;

[0029] The fault tree model is updated according to the fault analysis report.

[0030] Optionally, in the method described above, the agent platform further includes an alarm agent, and reporting the fault analysis report to the operation and maintenance platform includes:

[0031] The fault analysis report is pushed to the alarm agent so that the alarm agent generates an alarm prompt according to the fault analysis report and pushes the alarm prompt to the operation and maintenance platform.

[0032] In a second aspect, the present application provides a fault detection system, comprising: at least one detected device, an operation and maintenance platform, and an intelligent agent platform communicatively connected to the operation and maintenance platform;

[0033] The intelligent agent platform is used to implement the fault detection method provided in the first aspect of the present application.

[0034] Optionally, in the method as described above, the intelligent agent platform includes a core intelligent agent, and a monitoring intelligent agent, a configuration management database intelligent agent and an alarm intelligent agent that are communicatively connected to the core intelligent agent;

[0035] The monitoring agent includes a link agent and a log agent.

[0036] In a third aspect, the present application provides a fault detection device, which is applied to a core agent of an agent platform, and the device includes:

[0037] A fault detection data set acquisition module is used to acquire a fault detection data set of the detected object when the first detection data of the detected object indicates a fault of the detected object; wherein the first detection data refers to detection data obtained in any time frame, and the fault detection data set includes a plurality of second detection data, each of which refers to detection data obtained after the detected object fails;

[0038] A configuration information acquisition module, used to acquire the configuration information of the detected object;

[0039] A fault analysis report acquisition module is used to determine whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtain a fault analysis report of the detected object when the judgment result indicates that the detected object is faulty;

[0040] Fault analysis report reporting module: used to report the fault analysis report to the operation and maintenance platform.

[0041] In a fourth aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0042] The memory stores computer-executable instructions;

[0043] The processor executes the computer-executable instructions stored in the memory to implement the fault detection method provided in the first aspect of the present application.

[0044] In a fifth aspect, the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the fault detection method provided in the first aspect of the present application.

[0045] In a sixth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which implements the fault detection method provided in the first aspect of the present application when the computer program is executed by a processor.

[0046] The present application provides a fault detection method, system, device, equipment, medium and program product, the fault detection method comprising: when the first detection data of the detected object indicates the fault of the detected object, obtaining the fault detection data set of the detected object; obtaining the configuration information of the detected object; judging whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtaining the fault analysis report of the detected object when the judgment result indicates the fault of the detected object; reporting the fault analysis report to the operation and maintenance platform. Based on the above method, the following technical effects are achieved: the core intelligent agent obtains the fault analysis report according to the first detection data, the fault detection data set and the configuration information of the detected object, and reports the sorted fault analysis report to the operation and maintenance platform, the operation and maintenance platform directly handles the fault according to the fault analysis report, greatly improving the degree of automation, thereby shortening the fault response time and reducing the probability of human error; the intelligent agent platform supports dynamic expansion and configuration, and can flexibly adjust the monitoring range and alarm strategy according to actual needs. At the same time, data transmission and command interaction are carried out between each intelligent agent through an efficient communication protocol to ensure the overall performance and stability of the intelligent agent platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0049] Figure 1 Schematic diagram of the process of the fault detection method provided in the embodiment of the present application Figure 1 ;

[0050] Figure 2 Schematic diagram of the process of the fault detection method provided in the embodiment of the present application Figure 2 ;

[0051] Figure 3 Schematic diagram of the process of the fault detection method provided in the embodiment of the present application Figure 3 ;

[0052] Figure 4 A schematic diagram of the structure of a fault detection device provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0054] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0055] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0056] In the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or design. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way. In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more.

[0057] It should be noted that the "at..." in the embodiment of the present application can be the instant when a certain situation occurs, or it can be a period of time after a certain situation occurs, and the embodiment of the present application does not specifically limit this. In addition, a model training method provided in the embodiment of the present application is only used as an example, and the model training method can also include more or less content.

[0058] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0059] In order to clearly describe the technical solutions of the embodiments of the present application, some terms and technologies involved in the embodiments of the present application are briefly introduced below:

[0060] Fine-tuning: It is a technique widely used in the field of deep learning, especially in natural language processing and computer vision. Its basic concept is to adjust the model parameters by continuing to train on a small-scale task-specific dataset based on a model that has been pre-trained on a large-scale dataset to make it better suited to new tasks or datasets.

[0061] Function Calling: is a concept widely used in programming and artificial intelligence (AI) interaction. It refers to triggering certain preset functions or methods by sending specific instructions or commands to perform specific tasks.

[0062] Reasoning and Acting (ReAct): is a cutting-edge framework designed to enhance the decision-making capabilities of Large Language Models (LLMs). The ReAct mode allows large language models to alternately generate prediction paths and text actions. The prediction part helps the model to generalize and update action plans and handle exceptions; while the action part enables the model to interact with external information sources (knowledge and environment) to collect the required information. In the ReAct framework, the model updates its context window based on new observations and recalculates existing information. This mechanism enables the model to dynamically adjust its prediction and action strategies based on changes in the external environment.

[0063] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0064] The existing operation and maintenance team relies on manual intervention to confirm and process alarm information and lacks intelligent automated processing capabilities, which not only prolongs fault response time but also increases the probability of human error.

[0065] Therefore, in response to the technical problems of slow response speed and high false alarm rate caused by the low degree of automation of the existing operation and maintenance team, the research found that in order to solve this problem, ① the core intelligent agent obtains the fault detection data set of the detected object; ② obtains the configuration information of the detected object; ③ determines whether the detected object is faulty and obtains a fault analysis report when a fault occurs; ④ reports the fault analysis report.

[0066] Based on the above creative findings, the technical solution of the present application is proposed.

[0067] The following introduces the application scenarios of the fault detection method provided by the embodiment of the present invention.

[0068] The application scenarios of the fault detection method provided by the embodiment of the present invention include: scenarios where detected devices, operation and maintenance management platforms and intelligent platforms exist. Among them, the operation and maintenance platform and the intelligent platform are communicatively connected, and the intelligent platform can be communicatively connected with the detected device and / or connected to the operation and maintenance management platform through sensors. The detected device can be a server cabinet in a computer room or a firewall server. The operation and maintenance management platform refers to a comprehensive platform for supporting and managing the operation and maintenance of information systems or physical equipment. These platforms usually provide monitoring, management, alarm, troubleshooting and other functions to help operation and maintenance personnel perform their work effectively. The operation and maintenance platform can be a software solution that integrates various tools and technologies to simplify the operation and maintenance process and improve work efficiency. They support real-time monitoring of the detected equipment, aggregate data and generate reports, and provide decision support. For example, the operation and maintenance management platform can be an operation and maintenance platform that can monitor server performance, automatically identify faults and perform failover.

[0069] The embodiments of the present application are introduced below in conjunction with the drawings in the specification.

[0070] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0071] Figure 1 Schematic diagram of the process of the fault detection method provided in the embodiment of the present application Figure 1 , the fault detection method is applied to the core agent of the agent platform, and the fault detection method provided in this embodiment includes the following steps:

[0072] S101 . When first detection data of a detected object indicates a fault of the detected object, obtain a fault detection data set of the detected object.

[0073] In this embodiment, the first detection data refers to detection data obtained in any time frame, and the fault detection data set includes a plurality of second detection data, each of which refers to detection data obtained after a fault occurs in the detected object.

[0074] S102: Obtain configuration information of the detected object.

[0075] In this embodiment, a flexible configuration management function is provided, allowing users to adjust the monitoring scope and alarm strategy according to actual needs. At the same time, it supports dynamic expansion and configuration of the number and type of intelligent agents. The intelligent agents transmit data and interact with each other through efficient communication protocols to ensure the overall performance and stability of the system.

[0076] S103: judging whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtaining a fault analysis report of the detected object when the judgment result indicates that the detected object is faulty.

[0077] In this embodiment, when a fault occurs in the detected object, a fault analysis report is output, which includes the source of the fault, basic information about the fault, the fault diagnosis process, the fault diagnosis conclusion, a fault solution, etc.

[0078] S104. Report the fault analysis report to the operation and maintenance platform.

[0079] In this embodiment, the organized fault analysis report is reported to the operation and maintenance platform so that the operation and maintenance platform can handle the fault accordingly according to the fault analysis report. The report can be reported in a variety of data forms: such as strings, videos, pictures and texts; it can also be reported directly; it can also be reported through a push server.

[0080] The present application provides a fault detection method, system, device, equipment, medium and program product, the fault detection method comprising: when the first detection data of the detected object indicates that the detected object is faulty, obtaining a fault detection data set of the detected object; obtaining configuration information of the detected object; judging whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtaining a fault analysis report of the detected object when the judgment result indicates that the detected object is faulty; reporting the fault analysis report to the operation and maintenance platform. Based on the above method, the following technical effects are achieved: reporting the sorted fault analysis report to the operation and maintenance platform, the operation and maintenance platform directly handles the fault accordingly according to the fault analysis report, and by sorting out the fault analysis report, the degree of automation is greatly improved, thereby shortening the fault response time and reducing the probability of human error; the system supports dynamic expansion and configuration, and can flexibly adjust the monitoring range and alarm strategy according to actual needs. At the same time, data transmission and command interaction are carried out between each intelligent body through an efficient communication protocol to ensure the overall performance and stability of the system.

[0081] Figure 2 Schematic diagram of the process of the fault detection method provided in the embodiment of the present application Figure 2 In this embodiment Figure 1Based on the provided embodiments, the fault detection method is further explained. In a possible design, the intelligent agent platform also includes a monitoring intelligent agent and a configuration management database intelligent agent, the monitoring intelligent agent includes multiple sub-agents, and the fault cause analysis includes fault prompt words; further, the monitoring intelligent agent includes a link intelligent agent and a log intelligent agent. Figure 2 As shown, the fault detection method includes:

[0082] S201. Obtain the fault cause analysis pushed by the monitoring agent to determine the fault of the detected object.

[0083] In this embodiment, the intelligent agent platform also includes a monitoring intelligent agent, and the fault cause analysis is obtained based on the first detection data, and the first detection data refers to the detection data obtained in any time frame.

[0084] Fault cause analysis is data used to indicate the fault of the detected object, that is, alarm information. The alarm information can be collected by itself or sent by other equipment, and is based on the time frame. Whether the detected object is faulty can be determined in real time through a certain algorithm, or determined through historical data, or determined by technicians.

[0085] S202: extracting fault prompt words from the fault cause analysis.

[0086] In this embodiment, the fault cause analysis includes fault prompt words. The fault prompt words can be obtained by analyzing the alarm information using natural language processing (NLP) technology and combining it with the pre-stored knowledge base and strategy base.

[0087] S203: Generate functional instructions according to the fault prompt words through a preset natural language processing model and a functional instruction library.

[0088] In this embodiment, S201, S202 and S203 belong to the decision-making stage. In the decision-making stage, the intelligent agent platform needs to guide and determine which sub-agent to call based on the fault prompt words. Fine-tuning technology is used to optimize the understanding ability of the intelligent agent platform. By fine-tuning on a large-scale operation and maintenance data set, the intelligent agent platform can better understand the operation and maintenance related fault prompt words and accurately select the corresponding sub-agents. Specifically, a Fine-tuned NLP model is used to parse the operation and maintenance prompt words. The model is trained on a large amount of operation and maintenance related text data and can identify key operation and maintenance events and fault prompt words.

[0089] When the function instruction instructs to call the link agent, S204 is executed, that is, the next step of S204 is S206; when the function instruction instructs to call the log agent, S205 is executed. The link agent can be called alone, the log agent can be called alone, or the link agent and the log agent can be called at the same time.

[0090] S204. Increase the sampling frequency of the link agent until the number of the plurality of second detection data reaches a first preset number, and / or the plurality of adjacent second detection data remain stable.

[0091] In this embodiment, the monitoring agent includes multiple sub-agents, and the multiple sub-agents include a link agent and a log agent. The link agent focuses on monitoring network links, and helps operation and maintenance personnel understand the health status of the network by collecting status information and performance data of network devices in real time, and promptly discover and solve network faults.

[0092] Specifically, when the function instruction instructs to call the link agent, based on the sampling frequency of the link agent, multiple rounds of dynamic observation are performed on the action results and observation data of the link agent, and based on the observation results, the preset maximum number of attempts and the stable state, it is determined whether to jump out of the loop and end the current processing flow.

[0093] S205: Increase the sampling range and / or sampling accuracy of the log agent until the number of the plurality of second detection data reaches a second preset number.

[0094] In this embodiment, the log agent focuses on the collection and processing of log files, and provides strong support for troubleshooting and performance optimization by extracting and analyzing key information in the log. When the called sub-agent is a log agent, multiple rounds of dynamic analysis are performed on the action results and observation data of the log agent based on the sampling range and / or sampling accuracy of the log agent, and based on the analysis results, the preset sampling range and / or sampling accuracy, it is determined whether to jump out of the loop and end the current processing flow. Among them, the link agent and the log agent can be called on the same device and at the same time. After executing S205, execute S206.

[0095] S206. Collect a fault detection data set from the detected object according to the adjusted monitoring intelligent agent.

[0096] In this embodiment, the fault detection data set includes multiple second detection data, each of which refers to detection data obtained after the detected object fails. The fault detection data set can be collected only after the detected object becomes abnormal, or it can be collected at any time and only called after the abnormality occurs.

[0097] S207. Based on the fault cause analysis pushed by the monitoring agent, the configuration management database agent calls the configuration information of the detected object from the configuration information set of the preset configuration management database.

[0098] In this embodiment, the agent platform also includes a configuration management database agent. The configuration management database agent is closely integrated with the configuration management database, responsible for synchronizing and managing the configuration information of system resources, and providing necessary configuration data and dependency support for other agents.

[0099] S204, S205, S206 and S207 belong to the action stage. In the action stage, Function Calling technology is the core. After making a decision, the intelligent agent platform needs to call the corresponding sub-agent to implement specific automated operations, which is done by calling preset functions or application programming interfaces (APIs). Function Calling technology allows the intelligent agent platform to interact with external systems or components in a structured and controllable manner to achieve automated operation and maintenance tasks. Fine-tuning technology can also be used to optimize the behavior model of the sub-agent. For example, if a sub-agent is responsible for restarting a service, its performance in a specific environment or configuration can be fine-tuned to improve the probability and efficiency of a successful restart. In order to improve execution efficiency, the sub-agent can be called asynchronously, and the execution results can be monitored through polling or event notification mechanisms.

[0100] S208. Determine whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtain a fault analysis report of the detected object when the determination result indicates that the detected object is faulty.

[0101] In this embodiment, the intelligent agent platform collects action results through various means such as log records, API return status codes, system monitoring indicators, etc., uses the One-Class SVM algorithm to perform anomaly detection on the collected data, identifies action results that do not meet expectations, and feeds back the detection results to the intelligent agent platform in real time so that adjustments can be made in subsequent actions.

[0102] In this embodiment, the effect of S208 is similar to the effect of S103 in the previous embodiment of the present invention, and will not be described in detail here.

[0103] S209. Submit the fault analysis report to the operation and maintenance platform.

[0104] In this embodiment, the effect of S209 is similar to the effect of S104 in the previous embodiment of the present invention, and will not be repeated here.

[0105] The fault detection method provided in the embodiment of the present application achieves the following technical effects: by adjusting the sampling form such as the sampling frequency, sampling range or sampling accuracy of the sub-agent to perform multiple rounds of dynamic analysis, the accuracy of fault judgment is improved; by determining which sub-agent to call based on the fault prompt word, the targeted fault handling can be improved; by utilizing the autonomous perception capability of the agent platform, comprehensive coverage and efficient monitoring of system resources are achieved, and each agent is responsible for monitoring tasks in a specific area, and through collaborative work, all possible fault points and abnormal conditions are monitored without omissions; through unified alarm information templates and standards, the processing and analysis process of alarm information is simplified, and the alarm information is screened, classified and correlated using intelligent analysis algorithms to improve the accuracy and readability of the alarm information.

[0106] Figure 3 Schematic diagram of the process of the fault detection method provided in the embodiment of the present application Figure 3 In this embodiment Figure 1 and Figure 2 Based on the embodiments provided, the fault detection method is further explained. Figure 3 As shown, S208, including:

[0107] S301: Input first detection data, a fault detection data set and configuration information into a preset fault tree model to obtain a first judgment result output by the fault tree model.

[0108] In this embodiment, when a fault is found in the detected object, it is first determined whether there is a fault analysis report suitable for handling the current fault in the fault tree model.

[0109] Determine the content indicated by the first judgment result. When the first judgment result indicates that the detected object is faulty, execute S302; when the first judgment result does not indicate that the detected object is faulty, execute S303.

[0110] S302. Extract a fault analysis report from the fault tree model.

[0111] In this embodiment, common fault modes and solutions are discovered through association rule mining model algorithms. The root cause of the fault is inferred by combining the results of multiple rounds of analysis with the professional knowledge base, and the analysis results, processing process, action results and other information are integrated into a detailed fault analysis report. Specifically, after executing S302, S209 is executed.

[0112] When there is a fault analysis report applicable to the current fault processing in the fault tree model, the processing efficiency can be greatly improved by directly calling the fault analysis report, that is, obtaining the fault analysis report based on historical data.

[0113] S303: Report the first detection data, the fault detection data set and the configuration information to the fault detection platform, so that the fault detection platform can output a fault analysis report.

[0114] In this embodiment, when there is no fault analysis report applicable to the current fault processing in the fault tree model, the fault analysis report is obtained through the fault detection platform. The fault detection platform here can specifically be a third-party device such as an expert system and an automatic analysis platform. Specifically, after executing S303, S304 is executed.

[0115] S304. Update the fault tree model according to the fault analysis report.

[0116] In this embodiment, the fault analysis report is integrated into the fault tree model through an algorithm.

[0117] This embodiment can achieve the following technical effects: when there is a fault analysis report applicable to the current fault processing in the fault tree model, by directly calling the fault analysis report, that is, obtaining the fault analysis report based on historical data, the processing efficiency can be greatly improved; the fault analysis report is integrated into the fault tree model through an algorithm so as to be reused and improved in future operation and maintenance tasks. Specifically, after executing S304, S209 is executed.

[0118] In a possible design, the agent platform further includes an alarm agent, and S209 includes:

[0119] The fault analysis report is pushed to the alarm agent so that the alarm agent can generate alarm prompts based on the fault analysis report and push the alarm prompts to the operation and maintenance platform.

[0120] In this embodiment, the alarm agent serves as the core processing unit of the system, is responsible for receiving alarm information from various agents, performing intelligent analysis and processing, and sending alarm notifications to operation and maintenance personnel through multiple channels.

[0121] The following is a specific embodiment of calling a link agent, where the alarm type is a high temperature alarm:

[0122] The link agent is deployed in the third row of server cabinets in computer room A, and detects that the internal temperature of the third row of server cabinets in computer room A exceeds the preset threshold (normal <25°C, current 30°C) for 10 minutes.

[0123] 1) Generation and transmission of warning information

[0124] Data information: The temperature detected by the link agent is 30°C, which exceeds the preset threshold of 25°C.

[0125] Timestamp: 2024-05-10 09:45:00

[0126] Transmission method: Alarm information is automatically pushed to the integrated large model system through the API interface.

[0127] 2) Large model analysis and suggestions

[0128] Analysis process: The large model uses NLP technology to parse alarm information and conducts analysis based on the rules in the knowledge base and policy library.

[0129] Generated prompts: "Check the temperature distribution in the cabinet", "Analyze the server load and heat dissipation", "Call the configuration management database agent to obtain the configuration information of the cabinet and server"

[0130] Recommended Action: Explicitly instruct the Link Agent to perform the temperature distribution check first, followed by the Configuration Management Database Agent.

[0131] 3) Specify sub-agent actions

[0132] Link Agent Action: Increase the temperature sampling frequency from the normal once every 5 minutes to once every 1 minute.

[0133] First, the timestamps and corresponding temperature data of the top, middle and bottom areas of the cabinet are obtained through the link agent, that is, the temperature data is densely sampled, as shown in Table 1.

[0134] The obtained temperature data is then sorted out to draw a thermal map of the temperature distribution inside each area of ​​the cabinet.

[0135] It can be observed that the temperature distribution thermogram clearly shows that the top area is a high temperature point. Therefore, the temperature data can be used to conclude that the temperature in the top area of ​​the cabinet is too high.

[0136] Table 1

[0137] Timestamp Cabinet area Temperature(℃) 2024 / 5 / 10 9：45 top 35 2024 / 5 / 10 9：45 Central 26 2024 / 5 / 10 9：45 bottom 24 … … … 2024 / 5 / 10 10：00 top 34 2024 / 5 / 10 10：00 Central 26.5 2024 / 5 / 10 10：00 bottom 24.2

[0138] Configuration management database agent action: obtain key configuration information. Table 2 shows the key configuration information obtained from the configuration management database. Combining the key configuration information obtained with the temperature data in Table 1 can lay the foundation for the following analysis.

[0139] Table 2

[0140]

[0141] 4) Observe the results of the action

[0142] Link Agent Observation Results:

[0143] Data points: The highest temperature in the top area reached 35°C, while the average temperature in other areas remained below 27°C.

[0144] Heat map: It visually shows that there is an obvious high temperature area in the top area.

[0145] Configuration Management Database Observations:

[0146] Configuration details: The servers in the top area have higher configurations and higher power consumption, and the speed of cooling fans of some servers is lower than the standard value.

[0147] 5) Dynamic analysis and problem solving

[0148] Analysis process: Combining temperature data and server configuration information, the system found that the top server had insufficient cooling capacity due to high-density deployment and high power consumption, as well as insufficient cooling fan speed.

[0149] Problem location: Confirm that the heat dissipation problem of the server on the top of the cabinet is the root cause of the overall high temperature.

[0150] 6) Integrate diagnostic conclusions and solutions

[0151] Overall diagnosis conclusion: The internal temperature of the third row of server cabinets in computer room A is too high (up to 35°C). The main reason is that the heat dissipation capacity of the servers on the top of the cabinets is insufficient, which is specifically manifested in the low speed of the cooling fans of some servers and the high deployment density.

[0152] Solution suggestions:

[0153] Immediate measures:

[0154] Manually increase the speed of the top server cooling fan to the standard value or higher (such as 2500RPM).

[0155] Improvement measures:

[0156] Optimize the layout of servers in the cabinet and reduce the server density in the top area; consider adding additional cooling equipment on the top of the cabinet, such as additional cooling fans or heat sinks; regularly check and maintain the cooling equipment to ensure its normal operation; adjust the wind direction and speed of the computer room air conditioner to ensure that the top of the cabinet is more adequately cooled.

[0157] 7) Update the fault tree model

[0158] The diagnostic process, solution and implementation effect of this high temperature alarm are recorded in the fault tree model so that it can be quickly referenced and responded to when similar problems occur in the future.

[0159] The following is a specific example of calling a log agent, where the alarm type is a log exception alarm:

[0160] The log agent finds that the keyword "switch" appears frequently in the firewall log, which usually indicates that the active and standby firewalls are undergoing abnormal switching, or there are potential configuration / hardware problems.

[0161] 1) Receiving and preliminary analysis of alarm information

[0162] When the log agent generates the above alarm information, the system automatically transmits the alarm information to the integrated large model or monitoring center.

[0163] As the front-end sensing unit of the system, the intelligent agent platform is responsible for real-time collection of system resource status information and preliminary anomaly detection. Once an abnormal situation is found, an alarm is immediately triggered and relevant information is sent to the monitoring center.

[0164] As the core part of the system, the monitoring center is responsible for receiving monitoring data and alarm information sent by each intelligent agent. The monitoring center also has intelligent analysis capabilities, which can filter, classify and correlate alarm information, and provide accurate alarm views and fault location suggestions for operation and maintenance personnel.

[0165] The large model or monitoring center generates the following prompt words based on the keywords "log exception", "switch keyword", "exit firewall", etc. in the alarm information, combined with the pre-trained knowledge base and policy library: "Verify the active and standby status of the firewall", "Check the detailed information of the firewall log file", "Call the configuration management database agent to obtain the firewall configuration information" and "Analyze whether the network traffic is abnormal".

[0166] 2) Specify the corresponding sub-agent to implement specific operations

[0167] Log Agent Action: Continue to monitor and collect more detailed firewall logs, especially log snippets containing the "switch" keyword, for further analysis.

[0168] Configuration management database agent action: retrieve the configuration information of the egress firewall from the configuration management database, including the active / standby switching strategy, device model, recent maintenance records, etc.

[0169] Network monitoring agent: Analyzes the current network traffic, especially the traffic related to the egress firewall, and checks whether there is any abnormal traffic that causes excessive firewall load.

[0170] 3) Observe the results of your actions

[0171] Log agent observation results: By analyzing the logs, it was confirmed that the firewall had multiple active-standby switches in a short period of time, and there were records of the "switch" keyword before and after each switch.

[0172] Observation results of the configuration management database agent: The information obtained from the configuration management database shows that there are no obvious errors in the firewall configuration, but the hardware of the main firewall may be nearing the end of its service life, and there is no planned maintenance or upgrade in the near future.

[0173] Observation results of the network monitoring agent: Network traffic is within the normal range, and no abnormal traffic surge or attack behavior was found.

[0174] 4) Multiple rounds of dynamic analysis and problem location

[0175] Based on the observations of the log agent, configuration management database agent, and network monitoring agent, the system determined through multiple rounds of dynamic analysis that the root cause of the problem might be instability caused by the aging of the main firewall hardware, which in turn triggered an abnormal master-slave switch. The system determined that the specific problem had been located and could jump out of the loop and enter the next stage of resolution.

[0176] 5) Integrate the diagnostic process and output conclusions

[0177] The system integrates the entire fault diagnosis process and outputs the following overall diagnosis conclusions:

[0178] Problem description: The egress firewall frequently experiences abnormal master-slave switching, mainly due to instability caused by aging hardware of the primary firewall.

[0179] Solution suggestions:

[0180] Take immediate action: Temporarily migrate services to the backup firewall to ensure the continuity of network services.

[0181] Short-term measures: Arrange emergency inspection and necessary hardware replacement of the main firewall.

[0182] Long-term measures: Consider regular upgrades of firewall hardware and develop maintenance plans to prevent similar problems from happening again.

[0183] Follow-up actions: Submit the diagnosis conclusions and solution suggestions to the operation and maintenance team, who will perform specific solution steps and monitor the firewall status after the solution.

[0184] 6) Fault tree model update

[0185] The handling process, lessons learned, and solutions of this abnormal switching are recorded in the fault tree model, including the key points of log analysis, firewall maintenance practices, etc., so that they can be quickly referenced and responded to in similar situations in the future.

[0186] The embodiment of the present application also provides a fault detection system, the system comprising: at least one detected device, an operation and maintenance platform, and an intelligent agent platform communicatively connected to the operation and maintenance platform;

[0187] The intelligent agent platform is used to implement the fault detection method of the above embodiment of the present invention.

[0188] Each agent in the agent platform is responsible for monitoring tasks in a specific field, including data collection, anomaly detection, alarm triggering and other functions. The agents transmit data and interact with each other through preset communication protocols.

[0189] In a possible design, the intelligent agent platform includes a core intelligent agent, and a monitoring intelligent agent, a configuration management database intelligent agent, and an alarm intelligent agent that are communicatively connected to the core intelligent agent;

[0190] Monitoring agents include link agents and log agents.

[0191] The implementation principle and technical effect of the fault detection system provided in this embodiment are similar to those of the fault detection method in the above-mentioned embodiment, and will not be described in detail in this embodiment.

[0192] Figure 4 This is a schematic diagram of the structure of the fault detection device provided in the embodiment of the present application. Figure 4 As shown, in this embodiment, the fault detection device can be located in the electronic device. The fault detection device includes:

[0193] The fault detection data set acquisition module 401 is used to acquire a fault detection data set of the detected object when the first detection data of the detected object indicates a fault of the detected object; wherein the first detection data refers to detection data obtained in any time frame, and the fault detection data set includes a plurality of second detection data, each of which refers to detection data obtained after the detected object fails;

[0194] Configuration information acquisition module 402, used to acquire configuration information of the detected object;

[0195] The fault analysis report acquisition module 403 is used to determine whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtain a fault analysis report of the detected object when the judgment result indicates that the detected object is faulty;

[0196] The fault analysis report reporting module 404 is used to report the fault analysis report to the operation and maintenance platform.

[0197] The fault detection device provided in this embodiment can be executed Figure 1 The technical solution of the fault detection method embodiment shown in the figure has the same implementation principle and technical effect as Figure 1 The fault detection method embodiments shown are similar and will not be described in detail here.

[0198] At the same time, the fault detection device provided by the present invention further refines the fault detection device provided by the previous embodiment.

[0199] Optionally, in this embodiment, when the fault detection data set acquisition module 401 acquires the fault detection data set of the detected object when the first detection data of the detected object indicates the fault of the detected object, the intelligent agent platform further includes a monitoring intelligent agent; acquiring the fault cause analysis pushed by the monitoring intelligent agent to determine the fault of the detected object; wherein the fault cause analysis is obtained based on the first detection data;

[0200] According to the fault cause analysis, the monitoring agent is adjusted so as to collect a fault detection data set from the detected object according to the adjusted monitoring agent.

[0201] Optionally, when the fault detection data set acquisition module 401 adjusts the monitoring agent according to the fault cause analysis, the monitoring agent includes multiple sub-agents, and the fault cause analysis includes a fault prompt word;

[0202] Extract fault prompt words from fault cause analysis;

[0203] Generate functional instructions based on the fault prompt words through the preset natural language processing model and functional instruction library;

[0204] According to the functional instructions, at least one target agent is called from multiple sub-agents, and the sampling method of at least one target agent is adjusted.

[0205] Optionally, when the fault detection data set acquisition module 401 calls at least one target agent from the multiple sub-agents according to the functional instruction and adjusts the sampling mode of the at least one target agent, the multiple sub-agents include a link agent and a log agent;

[0206] When the function instruction indicates to call the link agent, the sampling frequency of the link agent is increased until the number of the plurality of second detection data reaches a first preset number, and / or the plurality of adjacent second detection data remains stable;

[0207] When the function instruction indicates to call the log agent, the sampling range and / or sampling accuracy of the log agent is increased until the number of the plurality of second detection data reaches a second preset number.

[0208] Optionally, in this embodiment, when the configuration information acquisition module 402 acquires the configuration information of the detected object, the agent platform further includes a configuration management database agent.

[0209] According to the fault cause analysis pushed by the monitoring agent, the configuration management database agent calls the configuration information of the detected object from the configuration information set of the preset configuration management database.

[0210] Optionally, in this embodiment, the fault analysis report acquisition module 403 is specifically used for:

[0211] Inputting the first detection data, the fault detection data set and the configuration information into a preset fault tree model to obtain a first judgment result output by the fault tree model;

[0212] When the first judgment result indicates that the detected object is faulty, a fault analysis report is extracted from the fault tree model.

[0213] Optionally, when the first judgment result does not indicate a fault in the detected object, the fault analysis report acquisition module 403 reports the first detection data, the fault detection data set and the configuration information to the fault detection platform, so that the fault detection platform outputs a fault analysis report;

[0214] Update the fault tree model based on the fault analysis report.

[0215] Optionally, in this embodiment, the fault analysis report reporting module 404 is specifically used for:

[0216] The intelligent agent platform also includes an alarm agent, which pushes the fault analysis report to the alarm agent so that the alarm agent can generate alarm prompts based on the fault analysis report and push the alarm prompts to the operation and maintenance platform.

[0217] The fault detection device provided in this embodiment can execute the technical solution of the above-mentioned fault detection method embodiment. Its implementation principle and technical effect are similar to those of the above-mentioned fault detection method embodiment, and will not be described in detail here.

[0218] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device is intended to be used in various electronic devices that can perform the fault detection method, such as a microcomputer, a single-chip microcomputer, and other suitable computers. The components shown herein, their connections and relationships, and their functions are only examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0219] like Figure 5 As shown, the electronic device includes: at least one processor 501 and a memory 502. The electronic device also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0220] In a specific implementation process, at least one processor 501 executes the computer execution instructions stored in the memory 502, so that at least one processor 501 executes the fault detection method executed by the electronic device side as above.

[0221] The specific implementation process of the processor 501 can refer to the above-mentioned fault detection method embodiment, and its implementation principle and technical effect are similar, which will not be repeated in this embodiment.

[0222] In the above embodiments, it should be understood that the processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor 401 may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0223] The memory 502 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage.

[0224] The bus 504 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 504 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 504 in the drawings of the present application is not limited to only one bus or one type of bus.

[0225] The above-mentioned functions implemented by the electronic device and the main control device introduce the scheme provided by the embodiment of the present invention. It can be understood that in order to implement the above-mentioned functions, the electronic device or the main control device includes a hardware structure and / or software module corresponding to the execution of each function. In combination with the units and algorithm steps of each example described in the embodiment disclosed in the embodiment of the present invention, the embodiment of the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present invention.

[0226] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above fault detection method is implemented.

[0227] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0228] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. The readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). The processor and the readable storage medium can also exist as discrete components in an electronic device or a main control device.

[0229] The memory 502 is a non-transitory computer-readable storage medium provided by the present invention. The non-transitory computer-readable storage medium of the present invention stores computer instructions, and the computer instructions are used to enable a computer to execute the fault detection method provided by the present invention.

[0230] The memory 502 is a non-transient computer-readable storage medium that can be used to store non-transient software programs, non-transient computer executable programs and modules, such as program instructions / modules corresponding to the fault detection method in the embodiment of the present invention (for example, Figure 4 The processor 501 executes various functional applications and data processing by running the non-transient software programs, instructions and modules stored in the memory 502, that is, the fault detection method in the above method embodiment is implemented.

[0231] At the same time, this embodiment also provides a computer program product, including a computer program, and when the computer program is executed by a processor, it is used to implement the fault detection method of the above embodiment.

[0232] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0233] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0234] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0235] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0236] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0237] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0238] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0239] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0240] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

[0241] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A fault detection method, characterized in that: The method is applied to the core agent of the agent platform, and the method includes: When the first detection data of the detected object indicates a fault of the detected object, a fault detection data set of the detected object is acquired; wherein the first detection data refers to detection data obtained in any time frame, and the fault detection data set includes a plurality of second detection data, each of which refers to detection data obtained after the detected object fails; Acquire configuration information of the detected object; Determine whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtain a fault analysis report of the detected object when the determination result indicates that the detected object is faulty; Report the fault analysis report to the operation and maintenance platform.

2. The fault detection method according to claim 1, characterized in that: The intelligent agent platform further includes a monitoring intelligent agent. When the first detection data of the detected object indicates a fault of the detected object, obtaining a fault detection data set of the detected object includes: Obtaining the fault cause analysis pushed by the monitoring agent to determine the fault of the detected object; wherein the fault cause analysis is obtained based on the first detection data; According to the fault cause analysis, the monitoring agent is adjusted so as to collect the fault detection data set from the detected object according to the adjusted monitoring agent.

3. The fault detection method according to claim 2, characterized in that: The monitoring agent includes a plurality of sub-agents, and the fault cause analysis includes fault prompt words; Then, adjusting the monitoring agent according to the fault cause analysis includes: Extracting the fault prompt word from the fault cause analysis; Generate functional instructions according to the fault prompt words through a preset natural language processing model and a functional instruction library; According to the functional instructions, at least one target agent is called from the multiple sub-agents, and the sampling method of the at least one target agent is adjusted.

4. The fault detection method according to claim 3, characterized in that: The multiple sub-agents include a link agent and a log agent; Then, calling at least one target agent from the plurality of sub-agents according to the functional instruction and adjusting the sampling mode of the at least one target agent include: When the function instruction indicates to call the link agent, the sampling frequency of the link agent is increased until the number of the plurality of second detection data reaches a first preset number, and / or the plurality of adjacent second detection data remain stable; When the function instruction instructs to call the log agent, the sampling range and / or sampling accuracy of the log agent is increased until the number of the plurality of second detection data reaches a second preset number.

5. The fault detection method according to claim 2-4, characterized in that: The agent platform further includes a configuration management database agent, and the step of obtaining the configuration information of the detected object includes: According to the fault cause analysis pushed by the monitoring agent, the configuration management database agent calls the configuration information of the detected object from the configuration information set of the preset configuration management database.

6. The fault detection method according to claim 1, characterized in that: The step of determining whether the detected object is faulty according to the first detection data, the fault detection data set, and the configuration information, and obtaining a fault analysis report of the detected object when the determination result indicates that the detected object is faulty, includes: Inputting the first detection data, the fault detection data set and the configuration information into a preset fault tree model to obtain a first judgment result output by the fault tree model; When the first judgment result indicates that the detected object is faulty, the fault analysis report is extracted from the fault tree model.

7. The fault detection method according to claim 6, characterized in that: When the first judgment result does not indicate a fault in the detected object, the method further includes: Reporting the first detection data, the fault detection data set and the configuration information to a fault detection platform so that the fault detection platform can output the fault analysis report; The fault tree model is updated according to the fault analysis report.

8. The fault detection method according to claim 7, characterized in that: The agent platform further includes an alarm agent, and reporting the fault analysis report to the operation and maintenance platform includes: The fault analysis report is pushed to the alarm agent so that the alarm agent generates an alarm prompt according to the fault analysis report and pushes the alarm prompt to the operation and maintenance platform.

9. A fault detection system, characterized in that: The system comprises: at least one detected device, an operation and maintenance platform, and an intelligent agent platform communicatively connected to the operation and maintenance platform; The intelligent agent platform is used to implement the fault detection method as described in any one of claims 1 to 8.

10. The fault detection system according to claim 9, characterized in that: The intelligent agent platform includes a core intelligent agent, and a monitoring intelligent agent, a configuration management database intelligent agent and an alarm intelligent agent that are communicatively connected to the core intelligent agent; The monitoring agent includes a link agent and a log agent.

11. A fault detection device, characterized in that: The device is applied to the core agent of the agent platform, and the device includes: A fault detection data set acquisition module is used to acquire a fault detection data set of the detected object when the first detection data of the detected object indicates a fault of the detected object; wherein the first detection data refers to detection data obtained in any time frame, and the fault detection data set includes a plurality of second detection data, each of which refers to detection data obtained after the detected object fails; A configuration information acquisition module, used to acquire the configuration information of the detected object; A fault analysis report acquisition module is used to determine whether the detected object is faulty according to the first detection data, the fault detection data set and the configuration information, and obtain a fault analysis report of the detected object when the judgment result indicates that the detected object is faulty; Fault analysis report reporting module: used to report the fault analysis report to the operation and maintenance platform.

12. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the fault detection method according to any one of claims 1 to 8.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the fault detection method according to any one of claims 1 to 8.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it is used to implement the fault detection method according to any one of claims 1 to 8.

Images