IT system fault diagnosis method and system based on large language model

Abstract

The invention discloses an IT system fault diagnosis method and system based on a large language model, and the method comprises the steps: carrying out the vectorization of a troubleshooting guide TSG through the LLM technology, generating a corresponding TSG vector, and defining an automatic troubleshooting process according to the TSG; according to the received alarm event information, determining an associated IT component and an occurring alarm event by using an IT topological graph; performing vectorization on the alarm event by using an LLM technology to generate an alarm event vector, performing similarity comparison with a TSG vector, and determining a TSG of a similar fault; and executing an automatic troubleshooting process of similar fault TSG, determining a fault root cause according to the obtained diagnosis information, and generating a fault diagnosis report by using an LLM technology. Through the technical scheme of the invention, the fault root cause can be accurately and quickly positioned, automatic fault diagnosis is realized, and the fault handling efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of system error detection, and in particular to an IT system fault diagnosis method based on a large language model and an IT system fault diagnosis system based on a large language model. Background Art

[0002] Distributed microservice application architecture and cloud-native technology have made the IT architecture very large, and its composition and operating logic extremely complex, greatly increasing the difficulty of diagnosis and analysis when failures occur.

[0003] First, there are many links in the IT system where failures may occur, from the underlying network system to the server, database, middleware, and application program, and failures may propagate. Second, the user access path of the distributed architecture is relatively long, and problems may occur in any link. Failures in the production environment are difficult to locate through simulation debugging in the test environment due to differences in deployment architecture and configuration, data volume, concurrency, data sensitivity, and contingency.

[0004] Current IT systems generally deploy multiple monitoring systems to continuously monitor the monitoring indicator data, call chain data, and log data at all levels of the IT system. They use static or dynamic indicator thresholds and AI machine learning algorithms to judge abnormal system behavior and generate alarm events. Combined with the topological relationship between IT system components, they can identify the root cause events from the many alarm events generated in the time window before and after the system abnormality time point. Find the preset troubleshooting plan based on the root cause event, manually troubleshoot the cause of the business access abnormality and restore the system.

[0005] Distributed IT systems are large in scale and the relationships between IT system components are complex. Limited by monitoring technology, fault detection can only be performed independently in the three dimensions of indicator data, logs, and call chains, and omissions or misjudgments may occur. IT topology that assists fault location analysis Figure 1 Generally, they can only go to the IT system component layer, so in many cases they can only determine a fault type and approximate fault range. Frontline operation and maintenance engineers then look for appropriate troubleshooting guides in many troubleshooting guides and troubleshoot according to the guides. If the root cause event is not accurately determined, or the fault range is too large, or the troubleshooting guide is not clearly described, the troubleshooting efficiency will be reduced, or even the root cause of the fault cannot be located. Summary of the invention

[0006] In response to the above problems, the present invention provides an IT system fault diagnosis method and system based on a large language model, which utilizes prior knowledge to construct a troubleshooting guide TSG and its automated troubleshooting process, and determines similar fault TSGs by similarity matching the alarm event information with the TSG vector using the LLM technology. The root cause of the fault is obtained and a fault diagnosis report is generated by obtaining the diagnostic information obtained by executing the corresponding automated troubleshooting process. The method and system can make full use of multiple modal alarm event information and prior knowledge of the fault library, accurately and quickly locate the root cause of the fault, and present the diagnostic information of the troubleshooting process in a way that is easy for front-line operation and maintenance personnel to understand, thereby realizing automated fault diagnosis and improving fault handling efficiency.

[0007] To achieve the above object, the present invention provides an IT system fault diagnosis method based on a large language model, comprising:

[0008] Use the large language model (LLM) technology to vectorize the troubleshooting guide TSG, generate corresponding TSG vectors and store them in the TSG vector library, and define an automated troubleshooting process based on the TSG.

[0009] Determine, based on the received alarm event information, the associated IT components using the IT topology map, and determine the alarm events occurring on the IT components;

[0010] Vectorizing the alarm event by using LLM technology to generate an alarm event vector, and performing a similarity comparison between the alarm event vector and the TSG vector in the TSG vector library to determine a similar fault TSG;

[0011] Automatically execute the automated troubleshooting process corresponding to the TSG of the similar fault, determine the root cause of the fault according to the obtained diagnostic information, and generate a fault diagnosis report using LLM technology.

[0012] In the above technical solution, preferably, the use of the large language model LLM technology to vectorize the troubleshooting guide TSG to generate a corresponding TSG vector includes:

[0013] Using LLM technology to generate a corresponding vector representation for each troubleshooting guide as the TSG vector of the corresponding troubleshooting guide;

[0014] When the text length of the troubleshooting guide is less than the preset value, the content of the troubleshooting guide is directly input into the LLM to generate the corresponding vector;

[0015] When the text length of the troubleshooting guide is greater than or equal to a preset value, the troubleshooting guide is segmented according to chapters or fixed lengths, a summary is generated for each segment, and the summaries are merged and vectorized.

[0016] In the above technical solution, preferably, the process of determining the associated IT components using the IT topology map according to the received alarm event information and determining the alarm events occurring on the IT components includes:

[0017] According to the alarm event information received by the system, extract the alarm time, alarm level, alarm category, IT resource generating the alarm, alarm details and corresponding indicators and values;

[0018] If the system receives a business system indicator alarm or a business system log alarm event, all infrastructure IT components that the business system depends on are retrieved from the IT topology map, where the IT components include databases, middleware, operating systems, storage, networks, and cloud environments;

[0019] An alarm event of the IT component within a preset time window before and after the business alarm event occurs is determined.

[0020] In the above technical solution, preferably, the alarm event vector is compared with the TSG vector in the TSG vector library for similarity to determine a similar fault TSG, and the specific process includes:

[0021] Using the alarm event vector and the TSG vectors in the TSG vector library to perform similarity comparison respectively;

[0022] Sort the TSG vectors in the TSG vector library from high to low according to similarity;

[0023] A preset number of TSG vectors with the highest similarity are selected as similar fault TSGs corresponding to the alarm event vector.

[0024] In the above technical solution, preferably, the automated troubleshooting process corresponding to the similar fault TSG is automatically executed, the root cause of the fault is determined according to the obtained diagnostic information, and a fault diagnosis report is generated using the LLM technology. The specific process includes:

[0025] According to the automated troubleshooting process corresponding to the TSG of similar faults, use automation technology to automatically execute;

[0026] The obtained diagnostic information is used as context and input into LLM through a preset prompt template, and the language synthesis capability of LLM technology is used to generate fault root cause analysis and diagnostic reports.

[0027] The present invention further proposes an IT system fault diagnosis system based on a large language model, which applies the IT system fault diagnosis method based on a large language model disclosed in any one of the above technical solutions, including:

[0028] The TSG vectorization module is used to vectorize the troubleshooting guide TSG using the large language model (LLM) technology, generate corresponding TSG vectors and store them in the TSG vector library, and define an automated troubleshooting process based on the TSG.

[0029] An alarm event determination module, configured to determine, based on the received alarm event information, the associated IT components using the IT topology map, and determine the alarm events occurring on the IT components;

[0030] A similar fault determination module is used to vectorize the alarm event by using the LLM technology to generate an alarm event vector, and compare the alarm event vector with the TSG vector in the TSG vector library for similarity to determine a similar fault TSG;

[0031] The automatic troubleshooting analysis module is used to automatically execute the automatic troubleshooting process corresponding to the similar fault TSG, determine the root cause of the fault according to the obtained diagnostic information, and generate a fault diagnosis report using LLM technology.

[0032] In the above technical solution, preferably, the TSG vectorization module is specifically used for:

[0033] Using LLM technology to generate a corresponding vector representation for each troubleshooting guide as the TSG vector of the corresponding troubleshooting guide;

[0034] When the text length of the troubleshooting guide is less than the preset value, the content of the troubleshooting guide is directly input into the LLM to generate the corresponding vector;

[0035] When the text length of the troubleshooting guide is greater than or equal to a preset value, the troubleshooting guide is segmented according to chapters or fixed lengths, a summary is generated for each segment, and the summaries are merged and vectorized.

[0036] In the above technical solution, preferably, the alarm event determination module is specifically used to:

[0037] According to the alarm event information received by the system, extract the alarm time, alarm level, alarm category, IT resource generating the alarm, alarm details and corresponding indicators and values;

[0038] If the system receives a business system indicator alarm or a business system log alarm event, all infrastructure IT components that the business system depends on are retrieved from the IT topology map, where the IT components include databases, middleware, operating systems, storage, networks, and cloud environments;

[0039] An alarm event of the IT component within a preset time window before and after the business alarm event occurs is determined.

[0040] In the above technical solution, preferably, the similar fault determination module is specifically used to:

[0041] Using the alarm event vector and the TSG vectors in the TSG vector library to perform similarity comparison respectively;

[0042] Sort the TSG vectors in the TSG vector library from high to low according to similarity;

[0043] A preset number of TSG vectors with the highest similarity are selected as similar fault TSGs corresponding to the alarm event vector.

[0044] In the above technical solution, preferably, the automatic troubleshooting analysis module is specifically used for:

[0045] According to the automated troubleshooting process corresponding to the TSG of similar faults, use automation technology to automatically execute;

[0046] The obtained diagnostic information is used as context and input into LLM through a preset prompt template, and the language synthesis capability of LLM technology is used to generate fault root cause analysis and diagnostic reports.

[0047] Compared with the prior art, the beneficial effects of the present invention are: utilizing prior knowledge to construct a troubleshooting guide TSG and its automated troubleshooting process, determining similar fault TSGs after similarity matching of alarm event information with TSG vectors using LLM technology, obtaining the root cause of the fault and generating a fault diagnosis report through the diagnostic information obtained by executing the corresponding automated troubleshooting process, making full use of multiple modal alarm event information and prior knowledge of the fault library, accurately and quickly locating the root cause of the fault, and presenting the diagnostic information of the troubleshooting process in a way that is easy for front-line operation and maintenance personnel to understand, thereby realizing automated fault diagnosis and improving fault handling efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flowchart of an IT system fault diagnosis method based on a large language model disclosed in an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of an automated troubleshooting process disclosed in an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of modules of an IT system fault diagnosis system based on a large language model disclosed in an embodiment of the present invention.

[0051] In the figure, the corresponding relationship between each component and the reference numeral is as follows:

[0052] 1. TSG vectorization module, 2. Alarm event determination module, 3. Similar fault determination module, 4. Automatic troubleshooting analysis module. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0055] like Figure 1 As shown, a method for diagnosing faults in an IT system based on a large language model according to the present invention includes:

[0056] Use the large language model (LLM) technology to vectorize the troubleshooting guide TSG, generate the corresponding TSG vectors and store them in the TSG vector library, and define the automated troubleshooting process based on the TSG.

[0057] According to the received alarm event information, the IT topology map is used to determine the associated IT components, and the alarm events occurring on the IT components are determined;

[0058] Use LLM technology to vectorize alarm events to generate alarm event vectors, and compare the alarm event vectors with TSG vectors in the TSG vector library to determine similar fault TSGs;

[0059] Execute the automated troubleshooting process of TSG for similar faults, determine the root cause of the fault based on the obtained diagnostic information, and generate a fault diagnosis report using LLM technology.

[0060] In this implementation, prior knowledge is used to construct a troubleshooting guide TSG and its automated troubleshooting process. The alarm event information is matched with the TSG vector by similarity using the LLM technology to determine the similar fault TSG. The diagnostic information obtained by executing the corresponding automated troubleshooting process is used to obtain the root cause of the fault and generate a fault diagnosis report. This implementation can make full use of multiple modal alarm event information and prior knowledge of the fault library, accurately and quickly locate the root cause of the fault, and present the diagnostic information of the troubleshooting process in a way that is easy for front-line operation and maintenance personnel to understand, thereby realizing automated fault diagnosis and improving fault handling efficiency.

[0061] Specifically, the troubleshooting guide of the known fault is vectorized and stored in the troubleshooting guide TSG vector library after being understood by LLM, and the corresponding automated troubleshooting process is designed according to the troubleshooting guide to realize automated fault diagnosis.

[0062] LLM technology uses its powerful natural language understanding capabilities to organize alarm events and related information at all levels of the IT system where an abnormality occurs into a context. After input into LLM for understanding, summarization, and vectorization, it is compared with the TSG vectors in the TSG vector library for similarity to find one or more similar faults.

[0063] Utilize automation technology to automatically execute the automated troubleshooting process of TSG for similar faults, obtain diagnostic information, determine the real root cause of the fault, and use the powerful language integration capabilities of LLM to output the root cause and diagnostic report that is easy for frontline operation and maintenance personnel to understand.

[0064] Among them, the Trouble-Shooting Guide TSG, or Trouble-Shooting Guide, provides a description of the fault, troubleshooting steps, emergency plans, and other information for a specific fault in a certain application system or IT resource (database, middleware, server, storage, network equipment, virtualization environment, container environment), providing front-line engineers with a guide to locating and troubleshooting faults, which can greatly reduce troubleshooting time.

[0065] The troubleshooting guide document includes the following elements:

[0066] (1) Title. Description: This guide is for a certain type of fault.

[0067] (2) Scope. Describe the scope of application of the guideline, including which application systems and types of IT resources it corresponds to.

[0068] (3) Fault description: Describe the main symptoms of the fault.

[0069] (4) Troubleshooting steps. Specific execution steps, including commands and input and output for information collection, and judgment basis.

[0070] (5) Emergency recovery plan. Describe the steps and commands to restore the system as quickly as possible, such as restarting system services.

[0071] (6) Fundamental solution: Describe the fundamental solution to the problem, such as modifying the configuration, fixing program bugs, adjusting the architecture, etc.

[0072] The same fault can have multiple troubleshooting guide documents, each describing the fault and troubleshooting information caused by different reasons. Taking the troubleshooting guide for missed scheduling in the bank's batch scheduling system as an example, the specific form of the troubleshooting guide document is explained as follows:

[0073]

[0074]

[0075] In the above implementation, preferably, the troubleshooting guide TSG is vectorized using a large language model LLM technology (such as embedding models such as test2vec, bge, and m3e) to generate a corresponding TSG vector. The specific process includes:

[0076] LLM technology is used to convert each troubleshooting guide described in text into vector data represented by high-dimensional digital representation, that is, to generate a corresponding vector representation as the TSG vector of the corresponding troubleshooting guide;

[0077] When the text length of the troubleshooting guide is less than a preset value (e.g., less than 512 characters, or less than the maximum context length of the model used), the content of the troubleshooting guide is directly input into the LLM to generate the corresponding vector;

[0078] When the text length of the troubleshooting guide is greater than or equal to the preset value (for example, it exceeds the maximum context length of the model used), the troubleshooting guide is divided into several parts (chunks) according to chapters or fixed lengths, and a corresponding summary is generated for each divided chunk. After the summaries of each chunk are merged, the merged summary is used to generate the vector corresponding to the troubleshooting document.

[0079] In the above implementation, preferably, according to the received alarm event information, the IT topology map is used to determine the associated IT components, and the alarm events occurring on the IT components are determined. The specific process includes:

[0080] Based on the alarm event information received by the system, extract the alarm time, alarm level, alarm category, IT resource that generated the alarm, alarm details, and corresponding indicators and values;

[0081] If the system receives a business system indicator alarm or a business system log alarm event, it retrieves all the infrastructure IT components that the business system depends on from the IT topology map, where the IT components include databases, middleware, operating systems, storage, and cloud environments;

[0082] Identify alarm events of IT components within a preset time window before and after a business alarm event occurs.

[0083] In the above implementation, preferably, the alarm event vector is compared with the TSG vector in the TSG vector library for similarity to determine a similar fault TSG. The specific process includes:

[0084] Use the alarm event vector and the TSG vector in the TSG vector library to perform similarity comparison;

[0085] Sort the TSG vectors in the TSG vector library from high to low according to similarity;

[0086] The first preset number of TSG vectors with the highest similarity are selected as similar fault TSGs corresponding to the alarm event vector.

[0087] During the implementation process, front-line operation and maintenance engineers can select one or more of the top-ranked faults and execute the automated troubleshooting process in their troubleshooting guide.

[0088] In the above implementation, preferably, an automated troubleshooting process of TSG with similar faults is executed, the root cause of the fault is determined according to the obtained diagnostic information, and a fault diagnosis report is generated using LLM technology. The specific process includes:

[0089] Use automation technology to automatically execute the automated troubleshooting process corresponding to the TSG of similar faults;

[0090] The obtained diagnostic information is used as context and input into LLM through a preset prompt template, and the language synthesis capability of LLM technology is used to generate fault root cause analysis and diagnostic reports.

[0091] During the implementation process, fault diagnosis information is collected and input into LLM together with the root cause of the fault, so that it can output the root cause analysis and diagnosis report.

[0092] like Figure 2 As shown in the figure, during the implementation process, taking the missed scheduling of the bank batch scheduling system as an example, an automated troubleshooting process is defined for each troubleshooting guide. When the alarm event matches the troubleshooting guide, the system automatically executes the automated troubleshooting process, performs fault diagnosis reasoning, and outputs the diagnostic information of the entire troubleshooting process to find the root cause of the fault.

[0093] After the above automated troubleshooting process is executed, the following diagnostic information will be output:

[0094]

[0095]

[0096] Use the above diagnostic information as context and input it to LLM through the following prompt template.

[0097]

[0098] Taking the missed scheduling of the above-mentioned bank batch scheduling system as an example, after entering the diagnostic information into LLM, the following diagnostic report and root cause analysis are generated.

[0099]

[0100]

[0101]

[0102] like Figure 3 As shown, the present invention further proposes an IT system fault diagnosis system based on a large language model, applying the IT system fault diagnosis method based on a large language model disclosed in any one of the above embodiments, including:

[0103] TSG vectorization module 1 is used to vectorize the troubleshooting guide TSG using the large language model LLM technology, generate corresponding TSG vectors and store them in the TSG vector library, and automate the troubleshooting process according to the TSG definition;

[0104] The alarm event determination module 2 is used to determine the associated IT components using the IT topology map according to the received alarm event information, and determine the alarm events occurring on the IT components;

[0105] A similar fault determination module 3 is used to vectorize the alarm event using the LLM technology to generate an alarm event vector, and compare the alarm event vector with the TSG vector in the TSG vector library to determine the similar fault TSG;

[0106] The automatic troubleshooting analysis module 4 is used to execute the automatic troubleshooting process of similar fault TSG, determine the root cause of the fault according to the obtained diagnostic information, and generate a fault diagnosis report using LLM technology.

[0107] In the above implementation, preferably, the TSG vectorization module 1 is specifically used for:

[0108] Using LLM technology to generate a corresponding vector representation for each troubleshooting guide as the TSG vector of the corresponding troubleshooting guide;

[0109] When the text length of the troubleshooting guide is less than the preset value, the content of the troubleshooting guide is directly input into the LLM to generate the corresponding vector;

[0110] When the text length of the troubleshooting guide is greater than or equal to a preset value, the troubleshooting guide is segmented according to chapters or fixed lengths, a summary is generated for each segment, and the summaries are merged and vectorized.

[0111] In the above implementation, preferably, the alarm event determination module 2 is specifically used to:

[0112] Based on the alarm event information received by the system, extract the alarm time, alarm level, alarm category, IT resource that generated the alarm, alarm details, and corresponding indicators and values;

[0113] If the system receives a business system indicator alarm or a business system log alarm event, it retrieves all the infrastructure IT components that the business system depends on from the IT topology map, where the IT components include databases, middleware, operating systems, storage, and cloud environments;

[0114] Identify alarm events of IT components within a preset time window before and after a business alarm event occurs.

[0115] In the above implementation, preferably, the similar fault determination module 3 is specifically used for:

[0116] Use the alarm event vector and the TSG vector in the TSG vector library to perform similarity comparison;

[0117] Sort the TSG vectors in the TSG vector library from high to low according to similarity;

[0118] The first preset number of TSG vectors with the highest similarity are selected as similar fault TSGs corresponding to the alarm event vector.

[0119] In the above implementation, preferably, the automatic troubleshooting analysis module 4 is specifically used for:

[0120] Use automation technology to automatically execute the automated troubleshooting process corresponding to the TSG of similar faults;

[0121] The obtained diagnostic information is used as context and input into LLM through a preset prompt template, and the language synthesis capability of LLM technology is used to generate fault root cause analysis and diagnostic reports.

[0122] According to the IT system fault diagnosis system based on a large language model disclosed in the above-mentioned implementation mode, the functions to be implemented by each module thereof correspond to the respective steps of the IT system fault diagnosis method based on a large language model disclosed in the above-mentioned implementation mode. During the implementation process, operations are performed with reference to the above-mentioned implementation mode, which will not be repeated here.

[0123] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for IT system fault diagnosis based on a large language model, characterized in that: include: Use the large language model (LLM) technology to vectorize the troubleshooting guide TSG, generate corresponding TSG vectors and store them in the TSG vector library, and define an automated troubleshooting process based on the TSG. Determine, based on the received alarm event information, the associated IT components using the IT topology map, and determine the alarm events occurring on the IT components; Vectorizing the alarm event by using LLM technology to generate an alarm event vector, and performing a similarity comparison between the alarm event vector and the TSG vector in the TSG vector library to determine a similar fault TSG; Execute the automated troubleshooting process of the TSG for similar faults, determine the root cause of the fault based on the obtained diagnostic information, and generate a fault diagnosis report using LLM technology.

2. The IT system fault diagnosis method based on a large language model according to claim 1, characterized in that: The troubleshooting guide TSG is vectorized by using the large language model (LLM) technology to generate a corresponding TSG vector. The specific process includes: Using LLM technology to generate a corresponding vector representation for each troubleshooting guide as the TSG vector of the corresponding troubleshooting guide; When the text length of the troubleshooting guide is less than the preset value, the content of the troubleshooting guide is directly input into the LLM to generate the corresponding vector; When the text length of the troubleshooting guide is greater than or equal to a preset value, the troubleshooting guide is segmented according to chapters or fixed lengths, a summary is generated for each segment, and the summaries are merged and vectorized.

3. The IT system fault diagnosis method based on a large language model according to claim 1, characterized in that: The process of determining the associated IT components using the IT topology map according to the received alarm event information and determining the alarm events occurring on the IT components specifically includes: According to the alarm event information received by the system, extract the alarm time, alarm level, alarm category, IT resource generating the alarm, alarm details and corresponding indicators and values; If the system receives a business system indicator alarm or a business system log alarm event, all infrastructure IT components that the business system depends on are retrieved from the IT topology map, where the IT components include databases, middleware, operating systems, storage, networks, and cloud environments; Determine an alarm event of the IT component within a preset time window before and after the business alarm event occurs.

4. The IT system fault diagnosis method based on a large language model according to claim 1, characterized in that: The process of comparing the alarm event vector with the TSG vector in the TSG vector library to determine a similar fault TSG includes: Using the alarm event vector and the TSG vectors in the TSG vector library to perform similarity comparison respectively; Sort the TSG vectors in the TSG vector library from high to low according to similarity; A preset number of TSG vectors with the highest similarity are selected as similar fault TSGs corresponding to the alarm event vector.

5. The IT system fault diagnosis method based on a large language model according to claim 1, characterized in that: The automated troubleshooting process of executing the TSG of the similar fault is used to determine the root cause of the fault according to the obtained diagnostic information, and generate a fault diagnosis report by using the LLM technology. The specific process includes: According to the automated troubleshooting process corresponding to the TSG of similar faults, use automation technology to automatically execute; The obtained diagnostic information is used as context and input into LLM through a preset prompt template, and the language synthesis capability of LLM technology is used to generate fault root cause analysis and diagnostic reports.

6. An IT system fault diagnosis system based on a large language model, characterized in that: The method for diagnosing faults in an IT system based on a large language model as claimed in any one of claims 1 to 5 comprises: The TSG vectorization module is used to vectorize the troubleshooting guide TSG using the large language model (LLM) technology, generate corresponding TSG vectors and store them in the TSG vector library, and define an automated troubleshooting process based on the TSG. An alarm event determination module, configured to determine, based on the received alarm event information, the associated IT components using the IT topology map, and determine the alarm events occurring on the IT components; A similar fault determination module is used to vectorize the alarm event by using the LLM technology to generate an alarm event vector, and compare the alarm event vector with the TSG vector in the TSG vector library for similarity to determine a similar fault TSG; The automatic troubleshooting analysis module is used to execute the automatic troubleshooting process of the TSG with similar faults, determine the root cause of the fault according to the obtained diagnostic information, and generate a fault diagnosis report using LLM technology.

7. The IT system fault diagnosis system based on a large language model according to claim 6, characterized in that: The TSG vectorization module is specifically used for: Using LLM technology to generate a corresponding vector representation for each troubleshooting guide as the TSG vector of the corresponding troubleshooting guide; When the text length of the troubleshooting guide is less than the preset value, the content of the troubleshooting guide is directly input into the LLM to generate the corresponding vector; When the text length of the troubleshooting guide is greater than or equal to a preset value, the troubleshooting guide is segmented according to chapters or fixed lengths, a summary is generated for each segment, and the summaries are merged and vectorized.

8. The IT system fault diagnosis system based on a large language model according to claim 6, characterized in that: The alarm event determination module is specifically used for: According to the alarm event information received by the system, extract the alarm time, alarm level, alarm category, IT resource generating the alarm, alarm details and corresponding indicators and values; If the system receives a business system indicator alarm or a business system log alarm event, all infrastructure IT components that the business system depends on are retrieved from the IT topology map, where the IT components include databases, middleware, operating systems, storage, networks, and cloud environments; An alarm event of the IT component within a preset time window before and after the alarm event occurs is determined.

9. The IT system fault diagnosis system based on a large language model according to claim 6, characterized in that: The similar fault determination module is specifically used for: Using the alarm event vector and the TSG vectors in the TSG vector library to perform similarity comparison respectively; Sort the TSG vectors in the TSG vector library from high to low according to similarity; A preset number of TSG vectors with the highest similarity are selected as similar fault TSGs corresponding to the alarm event vector.

10. The IT system fault diagnosis system based on a large language model according to claim 6, characterized in that: The automatic troubleshooting analysis module is specifically used for: According to the automated troubleshooting process corresponding to the TSG of similar faults, use automation technology to automatically execute; The obtained diagnostic information is used as context and input into LLM through a preset prompt template, and the language synthesis capability of LLM technology is used to generate fault root cause analysis and diagnostic reports.

Images