Operation and maintenance system and method for analyzing Kubernetes deployment micro-service based on large language model

Abstract

The invention relates to an operation and maintenance system and method for analyzing Kubernetes deployment micro-services based on a large language model. The system comprises a link log acquisition module, a data processing module, a large language model analysis module and an interactive output module. The link log acquisition module is used for acquiring link information and log information of a micro service in k8s, and storing a data result into an ElasticSearch database; the data processing module is used for carrying out cleaning and filtering, format conversion and labeling on data in the ElasticSearch database; the large language model analysis module is used for finely adjusting a large language model to update a knowledge base and create prompt words; the interactive output module is used for outputting the early warning result of the large language model analysis module and giving a corresponding alarm according to the early warning result; according to the method, the operation and maintenance complexity is low, the capability of better understanding the operation condition of the system can be achieved, possible problems can be found and reasoned in time, and early warning can be conducted in time.

Description

Technical Field

[0001] The present invention belongs to the field of computer operation and maintenance technology, and specifically relates to an operation and maintenance system and method thereof based on large language model analysis of Kubernetes deployed microservices. Background Art

[0002] In the current era of rapid development of software technology, the emergence of Kubernetes (K8s for short) has simplified the complexity and repetitive work of traditional operation and maintenance. Servers that previously required more than a dozen people to manage may now only require one person, making operation and maintenance work more efficient. The emergence of K8s has greatly changed the landscape of the cloud computing industry and pushed container technology to a new level.

[0003] At present, K8s has become the de facto standard in the field of container orchestration and management, and has been used more and more widely. Whether in public cloud, private cloud, or hybrid cloud environment, K8s has a wide range of applicable scenarios and can help enterprises build distributed applications and services more easily and improve the reliability and elasticity of applications. Although K8s has significant advantages in container orchestration and cloud-native application deployment, it also has some recognized challenges and shortcomings. K8s operation and maintenance is highly complex. The cluster itself is a distributed system, and the stability and security of the entire system need to be continuously monitored and managed; application log viewing is cumbersome. Although a query interface is provided, each application must be viewed separately in the container, which is very time-consuming and labor-intensive, and errors in the application cannot be discovered and alerted in time; the user experience is not good, and the user interface of K8s is not very friendly, and it needs to be operated through the command line or API. Summary of the invention

[0004] In order to solve the problem that the existing K8s operation and maintenance is highly complex and errors in the system cannot be discovered in time, the present invention provides an operation and maintenance system and method for analyzing Kubernetes deployed microservices based on a large language model. The operation and maintenance complexity is low, and the ability to better understand the system operation status can be better discovered and inferred in time that possible problems may occur, and timely warnings can be issued.

[0005] The technical solution of the present invention is as follows:

[0006] An operation and maintenance system for analyzing Kubernetes-deployed microservices based on a large language model, the system comprising a link log acquisition module, a data processing module, a large language model analysis module, and an interactive output module;

[0007] The link log acquisition module is used to configure the skywalking platform for monitoring and the logstash engine for acquiring log information in the Kubernetes microservice, collect the link information and log information of the microservice in k8s through the skywalking platform and the logstash engine respectively, and store the data results in the ElasticSearch database;

[0008] The data processing module is used to clean, filter and format the data in the ElasticSearch database, obtain the error data information of the link and the error data information in the log, perform data processing to obtain data records, and annotate the data records to generate sample data;

[0009] The large language model analysis module is used to fine-tune the large language model based on sample data to update the knowledge base, create prompt words, and send the prompt words to the large language model for learning, so that the large language model can output warning results and analyze and reason about the input questions. The learned large language model analyzes and reasoned about the input questions and then obtains warning results;

[0010] The interactive output module is used to output the warning results of the large language model analysis module and issue corresponding alarms based on the warning results.

[0011] Furthermore, the data cleaning, filtering and format conversion method includes: the link information and log information are cleaned and filtered mainly to extract error and abnormal data, normal link information and log records do not need to be extracted, and empty data, dirty data and duplicate data in the same time period are eliminated, and useless fields are eliminated, and only fields used for analysis are retained.

[0012] Furthermore, the data records are labeled to generate sample data, specifically: the error data information of the link and the error data information in the log are labeled, and the risk level of the error data information is labeled, wherein the risk level includes high, medium and low, and the error data information with the risk level is the sample data.

[0013] Furthermore, the prompt words include link prompt words and log prompt words. The link prompt words include response time, success rate and risk level of expected output, and the log prompt words include frequency of error occurrence, error type and risk level of expected output.

[0014] Furthermore, the sending of the prompt words to the large language model specifically includes: calling the backend interface of the large language model to pass the link information, log information and the prompt words to the large language model.

[0015] Furthermore, the large language model analyzes and infers the input questions, and its specific process includes front-end question-answering interaction and back-end interface interaction. The front-end inputs questions through a web page, and the large language model analyzes and processes them. The back-end interface obtains link information and log information through task scheduling and cooperates with prompt words to analyze the operating status of the current monitored object.

[0016] Furthermore, the warning result includes a risk level, which is divided into low, medium and high. When the large language model analyzes that the risk level of the warning result is not low, the warning interface is called, and the content that needs to be warned is received through the warning interface. Through the preset warning template, the relevant personnel are notified to send the alarm information.

[0017] Furthermore, the fine-tuning in the large language analysis module updates the knowledge base, specifically by feeding back the labeled link and log error data to the knowledge base of the large language model, and further training the large language model through the fine-tuning model, and after fine-tuning, saving the fine-tuned large language model and saving the fine-tuned model weights.

[0018] An operation and maintenance method for analyzing Kubernetes deployed microservices based on a large language model, the method comprising the following steps:

[0019] Step 1: Collect the link information and log information of microservices in k8s through the skywalking platform and logstash engine respectively, and store the data results in the ElasticSearch database;

[0020] Step 2: regularly obtain data from the ElasticSearch database, clean and filter the data, and convert the format of the data to obtain error data information of the link and error data information in the log, process the data to obtain data records, and annotate the data records to generate sample data;

[0021] Step 3: Fine-tune and update the large language model using labeled sample data, so that the knowledge base of the large language model has the data and ability to judge abnormalities;

[0022] Step 4: The background task scheduling monitors and obtains the link information and log information of all microservices, and sends them to the large language model through prompt words. The large language model analyzes the operating status of the current system through the prompt words.

[0023] Step 5: The large language model performs analysis and reasoning to obtain warning results, and issues corresponding alarms based on the warning results.

[0024] Compared with the prior art, the present invention has the following beneficial effects:

[0025] (1) The present invention can build a method for obtaining links and logs based on the microservice business architecture of K8s, and then fine-tune the large language model by building samples of links and logs through data analysis, update the large language model knowledge base, and combine the capabilities of the large language model to monitor and warn system operation and maintenance.

[0026] (2) The present invention provides a method for obtaining the link and log collection summary of K8s microservices, realizing unified viewing, reducing the operational complexity of operation and maintenance, and being able to further reduce the investment of operation and maintenance personnel, reduce costs, and improve the stability and utilization efficiency of the system.

[0027] (3) The present invention uses a large language model to analyze and infer business operation status, reducing the cost of manual investment in service review and K8s learning.

[0028] (4) The present invention improves the friendliness of human-computer interaction, and the operation status of the system can be understood through a question-and-answer method. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 is a flow chart of the method of the present invention;

[0030] Figure 2 It is a structural block diagram of the system of the present invention;

[0031] Figure 3 This is a complete flow chart of an embodiment of the present invention;

[0032] Figure 4 Schematic diagram of the large language model analysis process in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0034] See also Figure 2 , an operation and maintenance system for Kubernetes-deployed microservices based on large language model analysis, the system includes a link log acquisition module, a data processing module, a large language model analysis module, and an interactive output module;

[0035] The link log acquisition module is used to configure the skywalking platform for monitoring and the logstash engine for acquiring log information in the Kubernetes microservice, collect the link information and log information of the microservice in k8s through the skywalking platform and the logstash engine respectively, and store the data results in the ElasticSearch database;

[0036] The data processing module is used to clean, filter and format the data in the ElasticSearch database, obtain the error data information of the link and the error data information in the log, perform data processing to obtain data records, and annotate the data records to generate sample data;

[0037] The large language model analysis module is used to fine-tune the large language model based on sample data to update the knowledge base, create prompt words, and send the prompt words to the large language model for learning, so that the large language model can output warning results and analyze and reason about the input questions. The learned large language model analyzes and reasoned about the input questions and then obtains warning results;

[0038] The interactive output module is used to output the warning results of the large language model analysis module and issue corresponding alarms based on the warning results.

[0039] The link information includes the link request and all returned data information.

[0040] The present invention will be further described below in conjunction with a specific embodiment:

[0041] See also Figure 3 , step S1, configure the probe container of the skywalking platform in k8s for the service that needs to be monitored to obtain link information. The link information includes all the link interface information of the service for external interaction. At the same time, the logstash engine needs to be configured to obtain log information.

[0042] In step S1, all the link interface information and log information of the service's external interactions are obtained, which also includes: unifying the log formats of the front-end and back-end. The web front-end Nginx log needs to be configured with the output format of: $remote_addr-$remote_user[$year-$month-$day$hour:$minute:$second]"$request"$status$body_bytes_sent"$http_referer""$http_user_agent".

[0043] The backend configuration output log format is: %date{yyyy-MM-ddHH:mm:ss.SSS}%p[%t](%file:%line\\)-%m%ex{full}%n, where date is the date, p is the log level, file is the file name, ex is the abnormal information, n is the line break, m is the output information, and t is the thread name. Unifying the format is convenient for obtaining and filtering log information;

[0044] By configuring the output parameters of the skywalking platform and the logstash engine, the data is saved in the ElasticSearch database. Link information and log information are saved with different index names. To read data from the ElasticSearch database, you need to obtain it through the index name. The skywalking platform obtains it according to the default index name. The logstash engine is set in the configuration document, such as "k8s-logX".

[0045] The SkyWalking platform uses the probe Agent: responsible for collecting link information from services and sending it to the backend service of the SkyWalking platform. It collects Tracing and Metrics data and formats the data into a format suitable for SkyWalking. The probe is installed on the container where the microservice is located to facilitate data acquisition.

[0046] Skywalking platform backend service: receives data sent by the probe, uses the analysis engine in the memory to perform data integration operations, and then stores the data on the corresponding storage medium.

[0047] The SkyWalking platform stores link data in the Elasticsearch database through configuration.

[0048] Step S2: Clean, filter and convert the link information and log information in the ElasticSearch database, mainly extract error and abnormal data, mark the error data information of the link and the error data information in the log, and mark the risk level of the error data information. The risk level includes high, medium and low. The error data information with the risk level is the sample data;

[0049] The error data information of the link and the error data information in the log are marked, and the risk level of the error data information is marked. The risk level includes high, medium and low. The error data information with the risk level is the sample data.

[0050] like Figure 4 As shown in the figure, the scheduled task of the data analysis module obtains the data in ElasticSearch for cleaning, filtering and format conversion, and only extracts the error data information of the link and the error data information in the log. Normal link information and log records do not need to be extracted. At the same time, empty data, dirty data and repeated data in the same period are eliminated, and useless fields are eliminated. Only fields used for analysis are retained, such as: service name, time, error code, status code, content, response time, throughput and other information. For example, the error data information of the link in the abcrond service is as follows:

[0051] Service: abcrond

[0052] Component: HttpClient

[0053] Peer node:powdeed:80

[0054] Address (url): http: / / powdeed / api / sykData

[0055] Request method (http.method): GET log

[0056] Time: 2024-07-25 01:00:15

[0057] Event:error

[0058] Error type: java.net.SocketTimeoutException

[0059] Error message: Read timed out

[0060] Stack:

[0061] java.net.SocketTimeoutException:Read timed out

[0062] at java.net.SocketInputStream.socketRead0(Native Method)

[0063] at

[0064] java.net.SocketInputStream.socketRead(SocketInputStream ......

[0066] It can be seen that this is an interface timeout error. The data analysis module is used to filter and retain the main information such as service name, interface address, time, error message, error type, etc., and a risk level can be set for the record, which is medium risk.

[0067] Log acquisition, for example:

[0068] _index: k8s-logX-2024-07-24

[0069] log_status:ERROR

[0070] logdata: The fifth call to the map engine interface failed: syntax errorjson: <title id＝"title"> Access blocked!< / title> ......"

[0071] message:2024-07-2500:37:36.366ERROR[schedule-pool-18]

[0072] (GpsUtils.java:97) - The 5th call to the map engine interface failed: syntaxerror, pos 1, json: <! DOCTYPE html> <html

[0073] style="height:100%;width:100%">.....

[0074] msgMd:{\"message\":\"2024-07-25

[0075] 00:37:36.366ERROR[schedule-pool-18](GpsUtils.java:97)-The fifth call to the map engine interface failed: syntax error, pos 1, json:

[0076] <!DOCTYPE...}

[0077] @timestamp:Jul 25,2024@00:37:37.090

[0078] @version.keyword:1

[0079] current_thread:schedule-pool-18

[0080] current_thread.keyword:schedule-pool-18

[0081] environment_id:d776ac8324d14c45846c43a6761ac691

[0082] environment_id.keyword:d776ac8324d14c45846c43a6761ac691

[0083] host:powdeed-4585c9c78c-ffwqa

[0084] host.keyword:powdeed-4585c9c78c-ffwqa

[0085] java_class:GpsUtils.java

[0086] log_status.keyword:ERROR

[0087] path: / usr / local / powdeed / log / powdeed.log ......

[0089] Filter the logs to extract data with log_status as ERROR, and retain the main index, log_status, message, timestamp, log_status.keyword, and path fields. Configure the relevant risk level according to the content of the error report. This conditional record can be set to high risk. In addition to processing a single record, the scheduled task counts the error statistics and log statistics of all links within the time every five minutes, and marks the high, medium, and low risk levels of the status for the overall statistical information of the five minutes. For example, if there are 100 link information within 5 minutes, the service name, average response time, success rate, throughput, exception count and other indicator data of the link are used, and the risk level is marked for the header statistical results; for log statistics, statistics are performed according to error code, error type, error content, and number of error occurrences, and the statistical results are marked with risk registration.

[0090] Step S3: The large language model analysis module fine-tunes and updates the knowledge base, creates prompt words, and inputs questions to the large language model analysis module, which analyzes and infers the input questions.

[0091] Fine-tuning and updating the knowledge base means feeding back the labeled link and log error data to the knowledge base of the large language model as described in step S3, including the fine-tuning model, and using these data to further train the model. Fine-tuning is the most direct method, which involves further training the pre-trained model with a new data set. In this way, the large language model can learn new features or adjust existing weights to meet the requirements of new tasks. After fine-tuning, save the large language model and save the fine-tuned model weights. Construct sample data from the two dimensions of link information and log information, and complete the knowledge base upgrade and model version iteration of the large language model through steps such as loading the pre-trained model, fine-tuning the configuration, fine-tuning the model, evaluation and testing, and updating and deploying.

[0092] Purpose of fine-tuning: Large language models have undergone large-scale unsupervised pre-training and have extensive language understanding and generation capabilities. However, they may not perform well in specific tasks or specific fields. Fine-tuning can help the model better understand knowledge in specific fields. For certain specific tasks, such as question answering, text classification, summarization, etc., fine-tuning can allow the model to achieve higher accuracy and better performance indicators. Fine-tuning can also help control the output style and content of the model. In some cases, large language models may generate inaccurate, harmful, or biased content. Through targeted fine-tuning, the occurrence of these problems can be reduced.

[0093] The fine-tuning methods of large language models are basically similar. They are technologies that large model developers need to master, that is, public knowledge technologies. Different large language model frameworks may have slight differences.

[0094] There is nothing unique about this large model fine-tuning, and since it is not the focus of this patent, it is not described in detail here.

[0095] The prompt words include link prompt words and log prompt words. The link prompt words include response time, success rate and risk level of expected output. The log prompt words include frequency of error occurrence, error type and risk level of expected output.

[0096] In order to better analyze the relationship between links, logs and risks through the big language model, we need to use prompt words to let the big language model learn and output the desired results. This can be regarded as an instruction or guide to guide the model to generate a response with a specific text result.

[0097] For link prompt words, it is necessary to define what is a low, medium, or high risk level. This is usually determined based on thresholds of key performance indicators (KPIs) such as response time and success rate. For example:

[0098] Low risk: response time is less than 100 milliseconds and success rate is higher than 90%.

[0099] Medium risk: Response time between 100 and 1000 milliseconds, success rate between 80% and 90%.

[0100] High risk: Response time greater than 1000 milliseconds and success rate less than 80%.

[0101] Low-risk reminder: “Service A calls Service B with a response time of 50 milliseconds and a success rate of 99.5%.”

[0102] Desired output: Low risk.

[0103] Medium-risk prompt words: "Service C calls service D, the response time is 300 milliseconds, and the success rate is 82%."

[0104] Expected output: Medium risk

[0105] High-risk hint words: "Service E calls service F with a response time of 1100 milliseconds and a success rate of 75%."

[0106] Expected Output: High risk.

[0107] For log prompt words, it is necessary to define what is low, medium, and high risk level. This is usually determined based on the frequency of errors, error types, and impact scope. For example:

[0108] Low risk: A single error type occurs rarely and does not affect major business processes.

[0109] Medium risk: The same error type occurs frequently, which may affect some business functions.

[0110] High risk: Errors are diverse and occur frequently, seriously affecting business processes or causing system unavailability.

[0111] Low-risk prompt words: "The log shows that NullPointerException occurred twice." Expected output: low risk.

[0112] Medium risk prompt: "The log shows that DatabaseConnectionError occurred 10 times." Expected output: Medium risk.

[0113] High-risk reminder: "The log shows.

[0114] OutOfMemoryError and NetworkFailureException occurred 20 times and 15 times respectively. Expected output: High risk.

[0115] The large language model is used to analyze the data risk level and make inferences and predictions.

[0116] The warning result includes a risk level, which is divided into low, medium and high. When the large language model analyzes that the risk level of the warning result is not low, the warning interface is called, and the content that needs to be warned is received through the warning interface. Through the preset warning template, the relevant personnel are notified to send the alarm information.

[0117] For example, if "Log status: ERROR; Log content: Invalid login user" appears in the log, the knowledge base of the large language model already has similar invalid user login data that is labeled as low risk, so the record will be judged as low risk.

[0118] For example, in the dimension of statistical logs, "Index name: k8s-logX-72070, Error code: 400, Error type: ERROR, Error content: xxxx, Number of error occurrences: 300" appears. The error occurs 300 times within 5 minutes, which is significantly higher than the previous normal number of errors. The large language model determines that it is a high risk and needs to output an early warning.

[0119] Step S4, interactive output, the large language model analyzes and infers the input questions, including front-end question-answering interaction and back-end interface interaction. The front-end inputs questions through the web page, and the large language model analyzes and processes them. The back-end interface obtains link information and log information through task scheduling and analyzes the operating status of the current monitored object with prompt words. When the large language model needs to output an alarm, the alarm is sent to the alarm module, and the alarm module determines the alarm content, selects the alarm template, and sends it to relevant personnel through email, SMS or enterprise WeChat for alarm prompts.

[0120] The variable values ​​in the warning content are pre-defined. The warning content analyzed by the large model is disassembled and associated with the corresponding variable values, and finally the warning content is assembled and inserted into the corresponding template. The warning template formulates the output alarm display format according to the business usage, including but not limited to the following templates:

[0121] (1) Log alarm template:

[0122] Service name: {{serviceCode}}|Container: {{container}}|Warning message: {{message}}|Risk level {{level}}

[0123] (2) Link alarm template:

[0124] Service name: {{serviceCode}}|Container: {{container}}|Interface address: {{url}}|Time: {{time}}|Content: {{message}}|Risk level {{level}}

[0125] (3) Comprehensive business alarm template:

[0126] Business name: {{bsGroup}}|Business status: {{bsHealth}}|Number of abnormal interfaces: {{errImpl}}, number of abnormal logs: {{errLog}}|Alarm time: {{startTime}}|Risk level {{level}}

[0127] See also Figure 1 , an operation and maintenance method for Kubernetes deployed microservices based on large language model analysis, the method comprising the following steps:

[0128] Step 1: Collect the link information and log information of microservices in k8s through the skywalking platform and logstash engine respectively, and store the data results in the ElasticSearch database;

[0129] Step 2: regularly obtain data from the ElasticSearch database, clean and filter the data, and convert the format of the data to obtain error data information of the link and error data information in the log, process the data to obtain data records, and annotate the data records to generate sample data;

[0130] Step 3: Fine-tune and update the large language model using labeled sample data, so that the knowledge base of the large language model has the data and ability to judge abnormalities;

[0131] Step 4: The background task scheduling monitors and obtains the link information and log information of all microservices, and sends them to the large language model through prompt words. The large language model analyzes the operating status of the current system through the prompt words.

[0132] Step 5: The large language model performs analysis and reasoning to obtain warning results, and issues corresponding alarms based on the warning results.

[0133] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model, characterized in that: The system includes a link log acquisition module, a data processing module, a large language model analysis module, and an interactive output module; The link log acquisition module is used to configure the skywalking platform for monitoring and the logstash engine for acquiring log information in the Kubernetes microservice, collect the link information and log information of the microservice in k8s through the skywalking platform and the logstash engine respectively, and store the data results in the ElasticSearch database; The data processing module is used to clean, filter and format the data in the ElasticSearch database, obtain the error data information of the link and the error data information in the log, perform data processing to obtain data records, and annotate the data records to generate sample data; The large language model analysis module is used to fine-tune the large language model based on sample data to update the knowledge base, create prompt words, and send the prompt words to the large language model for learning, so that the large language model can output warning results and analyze and reason about the input questions. The learned large language model analyzes and reasoned about the input questions and then obtains warning results; The interactive output module is used to output the warning results of the large language model analysis module and issue corresponding alarms based on the warning results.

2. According to claim 1, an operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model is characterized in that: The data cleaning, filtering and format conversion method includes: the link information and log information are cleaned and filtered mainly to extract error and abnormal data, normal link information and log records do not need to be extracted, and empty data, dirty data and repeated data in the same time period are eliminated, and useless fields are eliminated, and only fields used for analysis are retained.

3. According to claim 1, an operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model is characterized in that: The method of marking data records to generate sample data is specifically: marking the error data information of the link and the error data information in the log, marking the risk level of the error data information, wherein the risk level includes high, medium and low, and the error data information with the risk level is the sample data.

4. According to claim 1, an operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model is characterized in that: The prompt words include link prompt words and log prompt words. The link prompt words include response time, success rate and risk level of expected output. The log prompt words include frequency of error occurrence, error type and risk level of expected output.

5. According to claim 1, an operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model, characterized in that: The sending of the prompt words to the large language model specifically includes: calling the backend interface of the large language model to transmit the link information, log information and the prompt words to the large language model.

6. According to claim 1, an operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model, characterized in that: The large language model analyzes and infers the input questions. The specific process includes front-end question-answering interaction and back-end interface interaction. The front-end inputs questions through a web page, and the large language model analyzes and processes them. The back-end interface obtains link information and log information through task scheduling and cooperates with prompt words to analyze the operating status of the current monitored object.

7. According to claim 1, an operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model, characterized in that: The warning result includes a risk level, which is divided into low, medium and high. When the large language model analyzes that the risk level of the warning result is not low, the warning interface is called, and the content that needs to be warned is received through the warning interface. Through the preset warning template, the relevant personnel are notified to send the alarm information.

8. According to claim 1, an operation and maintenance system for analyzing Kubernetes deployed microservices based on a large language model, characterized in that: The fine-tuning and updating of the knowledge base in the large language analysis module is specifically performed by feeding back the labeled link and log error data to the knowledge base of the large language model, and further training the large language model through the fine-tuning model. After fine-tuning, the fine-tuned large language model is saved, and the fine-tuned model weights are saved.

9. An operation and maintenance method for analyzing Kubernetes deployed microservices based on a large language model, characterized in that: The method comprises the following steps: Step 1: Collect the link information and log information of microservices in k8s through the skywalking platform and logstash engine respectively, and store the data results in the ElasticSearch database; Step 2: regularly obtain data from the ElasticSearch database, clean and filter the data, and convert the format of the data to obtain error data information of the link and error data information in the log, process the data to obtain data records, and annotate the data records to generate sample data; Step 3: Fine-tune and update the large language model using labeled sample data, so that the knowledge base of the large language model has the data and ability to judge abnormalities; Step 4: The background task scheduling monitors and obtains the link information and log information of all microservices, and sends them to the large language model through prompt words. The large language model analyzes the operating status of the current system through the prompt words. Step 5: The large language model performs analysis and reasoning to obtain warning results, and issues corresponding alarms based on the warning results.

Images