System monitoring method and device, computer equipment and storage medium

Abstract

The invention relates to a system monitoring method and device, computer equipment, a storage medium and a computer program product. The method comprises the steps of obtaining basic monitoring text data collected from a data source of a target system; performing monitoring data analysis processing on the basic monitoring text data, and combining a knowledge base and a code base of the target system to obtain potential system problems of the target system; updating the basic data acquisition strategy to obtain a real-time data acquisition strategy; collecting real-time monitoring text data through a real-time data collection strategy; problem positioning and scheme reasoning processing are carried out through a system monitoring large language model, and problem reasons and solutions of potential system problems are obtained. Through basic monitoring data analysis, semantic understanding analysis, potential system problem analysis, collection strategy adjustment, data supplement monitoring, solution reasoning and other processing, the system monitoring process can be effectively, efficiently and intelligently operated and maintained, and therefore the system exception processing efficiency is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a system monitoring method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the development of computer technology, computer system technology has emerged. The computer system consists of two major parts: hardware system and software system. Hardware refers to any mechanical, magnetic, or electronic device or component that makes up a computer. Hardware is also called hardware equipment. The hardware part consists of five parts: controller, arithmetic unit, memory, input device, and output device. Software is a general term for various programs that are designed to facilitate users and give full play to the performance of computers. The software system consists of system software, application software, and tool software. In the current computer system, due to various reasons (such as hardware failure, unreasonable program design, etc.), the system may be abnormal when the machine is running, resulting in system crashes, performance degradation, and other problems.

[0003] At present, in order to timely discover and solve these abnormal problems of computer systems, it is necessary to monitor and analyze the runtime status of computer systems on machines. At present, some monitoring tools can realize monitoring and alarm of machines and applications, but these monitoring tools have poor ability to analyze system anomalies and cannot efficiently realize system monitoring and alarm, thus affecting the efficiency of handling system anomalies. Summary of the invention

[0004] Based on this, it is necessary to provide a system monitoring method, device, computer equipment, computer-readable storage medium and computer program product that can improve the efficiency of system exception handling in response to the above technical problems.

[0005] In a first aspect, the present application provides a system monitoring method. The method comprises:

[0006] Acquire basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy;

[0007] The basic monitoring text data is analyzed and processed by a system monitoring large language model, and potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning the model parameters of a general large language model based on a fine-tuning database of the target system;

[0008] Based on the potential system problem, updating the basic data collection strategy to obtain a real-time data collection strategy;

[0009] Collecting real-time monitoring text data from the data source of the target system through the real-time data collection strategy;

[0010] Based on the potential system problem and the real-time monitoring text data, the problem location and solution reasoning processing are performed through the system monitoring large language model to obtain the cause and solution of the potential system problem.

[0011] In a second aspect, the present application also provides a system monitoring device. The device comprises:

[0012] A data acquisition module, used to acquire basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy;

[0013] A problem analysis module is used to perform monitoring data analysis and processing on the basic monitoring text data through a system monitoring large language model, and obtain potential system problems of the target system by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning model parameters of a general large language model based on a fine-tuning database of the target system;

[0014] A strategy adjustment module, used to update the basic data collection strategy based on the potential system problem to obtain a real-time data collection strategy;

[0015] A data collection module, used for collecting real-time monitoring text data from the data source of the target system through the real-time data collection strategy;

[0016] A solution reasoning module is used to locate the problem and perform solution reasoning processing based on the potential system problem and the real-time monitoring text data through the system monitoring large language model to obtain the cause and solution of the potential system problem.

[0017] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0018] Acquire basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy;

[0019] The basic monitoring text data is analyzed and processed by a system monitoring large language model, and potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning model parameters of a general large language model based on a fine-tuning database of the target system;

[0020] Based on the potential system problem, updating the basic data collection strategy to obtain a real-time data collection strategy;

[0021] Collecting real-time monitoring text data from the data source of the target system through the real-time data collection strategy;

[0022] Based on the potential system problem and the real-time monitoring text data, the problem location and solution reasoning processing are performed through the system monitoring large language model to obtain the cause and solution of the potential system problem.

[0023] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0024] Acquire basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy;

[0025] The basic monitoring text data is analyzed and processed by a system monitoring large language model, and potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning the model parameters of a general large language model based on a fine-tuning database of the target system;

[0026] Based on the potential system problem, updating the basic data collection strategy to obtain a real-time data collection strategy;

[0027] Collecting real-time monitoring text data from the data source of the target system through the real-time data collection strategy;

[0028] Based on the potential system problem and the real-time monitoring text data, the problem location and solution reasoning processing are performed through the system monitoring large language model to obtain the cause and solution of the potential system problem.

[0029] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0030] Acquire basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy;

[0031] The basic monitoring text data is analyzed and processed by a system monitoring large language model, and potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning model parameters of a general large language model based on a fine-tuning database of the target system;

[0032] Based on the potential system problem, updating the basic data collection strategy to obtain a real-time data collection strategy;

[0033] Collecting real-time monitoring text data from the data source of the target system through the real-time data collection strategy;

[0034] Based on the potential system problem and the real-time monitoring text data, the problem location and solution reasoning processing are performed through the system monitoring large language model to obtain the cause and solution of the potential system problem.

[0035] The above-mentioned system monitoring method, device, computer equipment, storage medium and computer program product obtain the basic monitoring text data collected from the data source of the target system, and the basic monitoring text data is specifically collected through the basic data collection strategy. The basic monitoring text data is analyzed and processed by the system monitoring big language model, and the potential system problems of the target system are obtained in combination with the knowledge base and code base of the target system, that is, the basic monitoring text data is analyzed and processed by the system monitoring big language model, and the potential system problems of the target system are obtained in combination with the knowledge base and code base of the target system. By intelligently analyzing the system status through the scene-adapted system monitoring big language model, the potential system problems existing in the target system can be automatically detected from multiple dimensions, thereby improving the accuracy of problem location. After identifying the potential system problems, the basic data collection strategy is updated based on the potential system problems to obtain the real-time data collection strategy; and the real-time monitoring text data is collected from the data source of the target system through the real-time data collection strategy. That is, based on potential system problems, the data collection strategy for the target system is adjusted to facilitate in-depth analysis of the potential system problems. Finally, based on the potential system problems and real-time monitoring text data, the system monitoring large language model is used to locate the problem and reason about the solution, and the cause and solution of the potential system problem are obtained. In-depth data collection is performed on the basis of discovering potential problems, thereby achieving problem location and solution reasoning, which can effectively ensure the monitoring efficiency and processing efficiency of system problems during system monitoring and operation and maintenance. This application can effectively perform efficient and intelligent operation and maintenance of the system monitoring process through basic monitoring data analysis, semantic understanding analysis, potential system problem analysis, collection strategy adjustment, data supplementation monitoring, and solution reasoning, thereby effectively improving the efficiency of handling system anomalies, improving the work efficiency of system development and operation and maintenance personnel, and ensuring system stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 An application environment diagram of a system monitoring method in an embodiment;

[0037] Figure 2 A schematic diagram of a flow chart of a system monitoring method in one embodiment;

[0038] Figure 3 A schematic diagram of basic monitoring text data input in one embodiment;

[0039] Figure 4 A schematic diagram of a text-type monitoring report output in one embodiment;

[0040] Figure 5 A system framework diagram of a system monitoring method in an embodiment;

[0041] Figure 6 is a schematic diagram of the structure of a data layer in one embodiment;

[0042] Figure 7 is a schematic diagram of the structure of the logic layer in one embodiment;

[0043] Figure 8 is a schematic diagram of the structure of the application layer in one embodiment;

[0044] Fig. 9 is a flow chart of a system monitoring method in another embodiment;

[0045] Fig.10 is a structural block diagram of a system monitoring device in one embodiment;

[0046] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] This application relates to the field of artificial intelligence (AI). Artificial intelligence is the theory, method, technology and application system of using digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that the machines have the functions of perception, reasoning and decision-making. Artificial intelligence technology is a comprehensive discipline involving a wide range of fields, including both hardware-level technology and software-level technology. Basic artificial intelligence technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, and mechatronics. Artificial intelligence software technology mainly includes several major directions such as computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning. This application specifically involves the fields of natural language processing (NLP) and machine learning (ML) in artificial intelligence.

[0049] Natural language processing is an important direction in the fields of computer science and artificial intelligence. It studies various theories and methods that can achieve effective communication between people and computers using natural language. Natural language processing is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field will involve natural language, that is, the language used by people in daily life, so it is closely related to the study of linguistics. Natural language processing technology usually includes text processing, semantic understanding, machine translation, robot question answering, knowledge graph and other technologies. Machine learning is a multi-disciplinary cross-disciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all fields of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and inductive learning.

[0050] The system monitoring method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the system server 102 communicates with the monitoring server 104 through the network. The data storage system can store the data that the monitoring server 104 needs to process. The data storage system can be integrated on the monitoring server 104, or it can be placed on the cloud or other servers. The monitoring server 104 can perform status monitoring on the system running on the system server 102 during the operation of the system server 102. Specifically, the monitoring server 104 obtains the basic monitoring text data collected from the data source of the target system, and the basic monitoring text data is collected through the basic data collection strategy; the basic monitoring text data is analyzed and processed by the system monitoring large language model, and the potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning the model parameters of the general large language model based on the fine-tuning database of the target system; based on the potential system problems, the basic data collection strategy is updated to obtain the real-time data collection strategy; the real-time monitoring text data is collected from the data source of the target system through the real-time data collection strategy; based on the potential system problems and the real-time monitoring text data, the problem location and solution reasoning are processed through the system monitoring large language model to obtain the cause and solution of the potential system problems. The system server 102 and the monitoring server 104 may be implemented as independent servers or a server cluster consisting of multiple servers.

[0051] In one embodiment, Figure 2 As shown, a system monitoring method is provided, which is applied to Figure 1 Taking the monitoring server 104 in the example as an example, the following steps are included:

[0052] Step 201 : acquiring basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy.

[0053] Among them, the target system refers to the system installed on the system server 102, and the target system can specifically be a computer system or application system installed on the system server 102. The basic data collection strategy refers to the indicators, frequency and range collected under the normal operation of the system. This strategy can usually provide enough information for preliminary analysis without affecting the performance of the system. For example: indicators such as central processing unit (CPU), memory, disk, network, service process, number of threads, etc., are sampled regularly and once every minute; the full-link log of service calls is sampled by proportional coloring, and the proportion is generally low, such as one thousandth; service code and configuration changes, full sampling, such as code changes, each change will trigger full sampling analysis; service internal performance sampling analysis, closed by default to avoid affecting service performance. Data source refers to the source of monitoring data collection, such as CPU usage, memory usage, disk, network, service configuration, operation log, business indicators, user feedback, etc. can all be used as data sources. The basic monitoring text data refers to the data collected from the data source during system operation after being converted into text form, including but not limited to data such as central processing unit usage, memory usage, disk space, network input and output, service logs, etc.

[0054] Specifically, the method of the present application mainly implements the state monitoring of the running system. In modern computer systems, due to various reasons (such as hardware failure, unreasonable program design, etc.), the system may be abnormal when running on these machines, resulting in system crashes, performance degradation and other problems. In order to discover and solve these problems in a timely manner, it is necessary to monitor and analyze the runtime state of the system. At this time, the system monitoring method of the present application can be used to monitor and analyze the system running on the system server 102, and for the target system under normal operating conditions, only the basic data collection strategy can be used to regularly collect part of the data from the data source as the basic data for system timing monitoring and analysis. In a specific embodiment, during data collection, the basic monitoring data of multiple dimensions can be collected at the data source according to the basic data collection strategy at a specific time interval, and then in each time period, the basic monitoring data of multiple dimensions collected from the data source of the target system is obtained, and it is converted into the format of text data through preprocessing, so as to obtain the basic data for system monitoring and analysis in each time period.

[0055] Step 203, the basic monitoring text data is analyzed and processed by the system monitoring big language model, and the potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system monitoring big language model is obtained by fine-tuning the model parameters of the general big language model based on the fine-tuning database of the target system.

[0056] Among them, the system monitoring large language model refers to a large language model specifically used to implement the system monitoring scenario. The large language model (LLM) refers to a deep learning language model that uses a large amount of text data training and contains hundreds of billions (or more parameters), which can generate natural language text or understand the meaning of language text, such as ChatGPT model and Bard model. Large language models can handle a variety of natural language tasks, such as text classification, question and answer, dialogue, etc., and are an important way to artificial intelligence. However, these large language models have strong language understanding capabilities, but they cannot be privately deployed, data security is not guaranteed, and the model cannot be fine-tuned for each usage scenario. Therefore, in the specific implementation, the scheme of the present application can be obtained by fine-tuning the parameters of the model for the scenario of its monitoring target system with the help of a fine-tuning database for a lightweight general large language model, so as to obtain a system monitoring large language model, thereby realizing the system monitoring processing of the target system, and the adjustment database is based on the target system's domain expertise, domain-specific terms, historical business logs, system business reference indicators, and system question and answer work order data. Therefore, the system monitoring large language model can be specialized for monitoring the target system to ensure the monitoring effect. Monitoring data analysis and processing refers to the joint analysis of the system status of the target system based on the multi-dimensional basic monitoring data in the provided basic monitoring text data, combined with the knowledge base and code base of the target system, so as to obtain accurate status monitoring results. Potential system problems refer to problems exposed by the target system during operation, such as system crashes or sudden drops in system performance that the system may face.

[0057] Specifically, the present application realizes the monitoring of the target system through a large language model. The model parameters can be fine-tuned based on the general large language model for the scenario of the target system to obtain a system monitoring large language model dedicated to the monitoring of the target system. After obtaining the basic monitoring text data related to the state of the target system, the basic monitoring text data can be input into the system monitoring large language model. The system monitoring large language model is used to perform multi-dimensional monitoring data analysis on the basic monitoring text data, thereby using the semantic understanding and logical analysis capabilities of the large language model to perform a multi-dimensional comprehensive analysis on the data collected and processed at the data layer, as well as the knowledge base and code base, so as to obtain the potential system problems of the target system and determine the potential risks that may exist in the target system. In a specific embodiment, the system monitoring large language model can extract key information from the basic monitoring text data, and then, based on the extracted key information, use the logical analysis capabilities of the large language model to search and analyze the knowledge base and code base to determine the potential system problems, thereby realizing the analysis of the target system.

[0058] Step 205: based on the potential system problem, update the basic data collection strategy to obtain the real-time data collection strategy.

[0059] Among them, the real-time data collection strategy refers to a more comprehensive data collection strategy determined after adjusting the basic data collection strategy based on the identified potential system problems. More comprehensive here specifically refers to increasing the collection frequency and scope of certain key indicators, or collecting more relevant data for in-depth analysis. For example, for log data, the proportion of log coloring sampling can be increased through the real-time data collection strategy, so as to obtain more relevant logs for subsequent analysis. You can also enable the service performance analysis tool inside the service to collect data from the server for analysis. You can also directly shorten the sampling period of monitoring data, for example, adjust the frequency of scheduled sampling of indicator data from once per minute to once every 30 seconds.

[0060] Specifically, when the target system is found to have problems through analysis of basic monitoring text data, the corresponding data collection strategy can be adjusted according to the nature and severity of the problem, so as to achieve more in-depth analysis using the large language model. For example, in a specific embodiment, the frequency and scope of collection of certain key indicators can be increased through a real-time data collection strategy, or more relevant data can be collected for in-depth analysis.

[0061] Step 207: collect real-time monitoring text data from the data source of the target system through a real-time data collection strategy.

[0062] Among them, real-time monitoring text data and basic monitoring text data are both collected from the data source of the target system. However, compared with the basic monitoring text data, the real-time monitoring text data may be more comprehensive or more targeted, and can be used for in-depth analysis of potential system problems of the target system.

[0063] Specifically, when the monitoring server 104 determines that there is a potential problem in the system server 102, the basic data collection strategy can be changed, and the real-time data collection strategy obtained by the change can be used to perform more in-depth data collection on the system server 102. The collection process can refer to the collection process of basic monitoring text data, first collect multi-dimensional monitoring data including CPU usage, memory usage, disk, network, service configuration, operation log, and business indicators, and then convert these multi-dimensional monitoring data into real-time monitoring text data in text form through data preprocessing to facilitate subsequent processing.

[0064] Step 209 , based on the potential system problems and the real-time monitoring text data, the system monitoring large language model is used to perform problem location and solution reasoning processing to obtain the cause and solution of the potential system problems.

[0065] The cause of the problem is the main cause of the potential system problem determined after analysis, such as system configuration changes or system code anomalies. The solution refers to the processing plan suitable for solving potential system problems, such as modifying system configuration, expanding system capacity services, or modifying system code, etc.

[0066] Specifically, after the potential system problems existing in the target system are determined through the system monitoring large language model, the data collection strategy can be adjusted to collect a wider range of data and obtain more relevant data for in-depth analysis for the determined potential system problems. After the data collection is complete, the reasoning ability of the large language model is used to locate the problem, and the cause of the problem obtained by the problem location is combined with the solution reasoning to generate a targeted solution, thereby effectively solving the hidden dangers existing in the target system. In a specific embodiment, the monitoring server 104 in the present application solution specifically includes three layers: the data layer, the logic layer and the application layer, and the process of collecting data and preprocessing data corresponds to the data layer. The system monitoring large language model corresponds to the logic layer content of the server 104. With the help of the semantic understanding and logical analysis capabilities of the large language model, the analysis and positioning module monitors the data collected and processed by the data layer, the knowledge base, and the code base to analyze the data, determine the potential system problems, and adjust the data collection strategy through the interaction between the logic layer and the data layer, obtain real-time monitoring text data to accurately locate the specific problem, and generate a specific solution through model reasoning. At the same time, in the process of handling problems, the logic layer also supports real-time interaction with users in natural language through the application layer of the server 104 to jointly handle problems. In addition, the application layer of the monitoring server 104 of the present application can also generate corresponding monitoring reports based on the monitoring situation of the target system, and inform the relevant personnel of the system maintenance of the actual operation situation of the target system.

[0067] The above-mentioned system monitoring method obtains basic monitoring text data collected from the data source of the target system, and the basic monitoring text data is collected through the basic data collection strategy. The basic monitoring text data is analyzed and processed by the system monitoring big language model, and the potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. That is, the basic monitoring text data is analyzed and processed by the system monitoring big language model, and the potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system status can be intelligently analyzed by the scene-adapted system monitoring big language model, which can automatically analyze the system status from multiple dimensions.

[0068] Detect potential system problems in the target system and improve the accuracy of problem location. After identifying potential system problems, update the basic data collection strategy based on the potential system problems to obtain real-time data collection strategy; and collect real-time monitoring text data from the data source of the target system through the real-time data collection strategy. That is, adjust the collection strategy for the target system data based on the potential system problems to conduct in-depth analysis of the potential system problems, and finally, based on the potential system problems and real-time monitoring text data, perform problem location and solution reasoning through the system monitoring large language model to obtain the cause and solution of the potential system problems. By conducting in-depth data collection on the basis of discovering potential problems, problem location and solution reasoning can be achieved, which can effectively ensure the monitoring efficiency and processing efficiency of system problems in the process of system monitoring and operation and maintenance. This application can effectively perform efficient and intelligent operation and maintenance of the system monitoring process through basic monitoring data analysis, semantic understanding analysis, potential system problem analysis, collection strategy adjustment, data supplement monitoring and solution reasoning, thereby effectively improving the processing efficiency of system abnormalities, improving the work efficiency of system development and operation and maintenance personnel, and ensuring system stability.

[0069] In one embodiment, step 201 includes: determining a data source connected to a target system; calling a data collection component of a performance management system through a basic data collection strategy; performing multi-dimensional collection of data from the data source based on the data collection component to obtain multi-dimensional basic monitoring data; and performing text data preprocessing on the multi-dimensional basic monitoring data to obtain basic monitoring text data for the target system.

[0070] Among them, the performance management system refers to a tool system that manages the state of the system, helps understand the system behavior, and is used to analyze performance problems. The performance management system can manage various data collection components. Therefore, the corresponding data collection components of the performance management system can be called through the basic data collection strategy to realize data collection and processing. Text data preprocessing refers to the normalization of the collected multi-dimensional basic monitoring data to meet the needs of subsequent processing, and the basic monitoring text data refers to the text data corresponding to the multi-dimensional basic monitoring data obtained after text data preprocessing. The text data preprocessing method can specifically include processing such as cleaning, sampling, aggregation, and storage. Through text data preprocessing, the collected multi-dimensional basic monitoring data can be converted into basic monitoring text data that better meets the processing standards.

[0071] Specifically, in the scheme of the present application, for the data collection process, the data can be collected by integrating the existing application performance management (Application Performance Monitor, APM) system (such as SkyWalking, Jaeger, Pinpoint), so that when a fault occurs, the problem can be quickly located and solved, while maintaining compatibility with existing monitoring tools. In the process of data collection, the basic data collection strategy corresponding to the target system can be determined first, and then the data collection component of the performance management system is called through the basic data collection strategy to collect the data formulated by the basic data collection strategy in multiple dimensions. In another embodiment, in addition to collecting data through the existing data collection tool class on the performance management system, the present application can also access various types of data collection tools developed according to data collection requirements, so as to personalize and customize various data sources and indicators. For the process of text data preprocessing, the corresponding preprocessing method can be set in advance for each basic monitoring data, such as setting one or more of the processing of cleaning, sampling, aggregation, and storage of the data, so as to effectively extract the text information in the multi-dimensional basic monitoring data, and obtain the basic monitoring text data for analysis and use in the subsequent process. In one embodiment, the multi-dimensional basic monitoring data includes system log data. At this time, the log record time and log items in the log data can be extracted through data cleaning, and then the extracted data is aggregated into a text representation to obtain the text data corresponding to the log data. Finally, the text corresponding to each basic data in the multi-dimensional basic monitoring data is aggregated in the form of a table or a structured body data to obtain basic monitoring text data that can be used for multi-dimensional analysis. In this embodiment, the multi-dimensional basic monitoring data of the target system is realized through the performance management system on the existing system, thereby realizing efficient and accurate data collection and processing, and ensuring the validity of the multi-dimensional basic monitoring data collected from the data source.

[0072] In one embodiment, step 203 includes: identifying the data type of each dimensional basic data in the multi-dimensional basic monitoring data; determining the data processing method of each dimensional basic data based on the data type; performing data processing on each dimensional basic data of the corresponding data type through the data processing method to obtain each dimensional monitoring data corresponding to each dimensional basic data; filling each dimensional monitoring data into the corresponding column of the normalized text table to obtain the basic monitoring text data for the target system, and the normalized text table is created based on the data source type contained in the target system.

[0073] Among them, data type refers to the specific data type to which the multi-dimensional basic monitoring data belongs, such as CPU usage, memory usage, disk space, network IO, service logs, user feedback, etc. can all be used as data types. Data processing method refers to the method of processing each data in the multi-dimensional basic monitoring data, which specifically includes one or more of the processing methods such as cleaning, sampling, aggregation, and storage. The normalized text table is created based on the data source type contained in the target system. Specifically, it can be pre-built tabular data based on the monitoring needs of the current target system. Then, by normalizing the corresponding columns of the text table of the processed monitoring data of each dimension, basic monitoring text data with unified specifications can be obtained.

[0074] Specifically, the scheme of the present application specifically realizes the state identification of the target system by combining basic monitoring data of different types and dimensions, and different basic monitoring data correspond to different data processing methods. Therefore, after obtaining the multi-dimensional basic monitoring data collected from the data source of the target system, in order to effectively process these basic monitoring data, the data type of each dimension of the basic data in the multi-dimensional basic monitoring data can be determined first, for example, which CPU usage data and which log data are identified. Then the data processing method of each dimension of basic data is determined for different types; through the data processing method, the basic data of each dimension of the corresponding data type is processed to obtain the monitoring data of each dimension corresponding to the basic data of each dimension. For example, for log data, the corresponding processing method is cleaning and aggregation. At this time, the log data can be cleaned first to obtain the cleaned log data, and then the cleaned log data can be directly aggregated to obtain the final aggregated data as the dimension monitoring data for subsequent processing. After obtaining the dimension monitoring data, in order to normalize these dimension monitoring data, the monitoring data of each dimension can be filled into the corresponding column of the normalized text table at this time to obtain a complete table as the final basic monitoring text data. In another embodiment, in addition to constructing a table, the normalization of text data can also be completed by constructing structured data. At this time, the variables and template formats of the structured data can be created in advance based on the data source type of the collected data, and then the monitoring data of each dimension corresponding to the basic data of each dimension is filled into the structured data to construct the final basic monitoring text data. In this application, the monitoring data collection method is flexible and can be directly integrated with the existing APM system without the need for cumbersome and refined data processing. The core is that the logic layer uses a large language model for analysis. The large language model has a language logic analysis capability similar to that of humans, thereby avoiding a large amount of refined processing of the original data. It only needs to be preliminarily processed into an easy-to-understand natural language format. In this embodiment, the basic monitoring text data is constructed by splitting, processing and filling the dimensional data, which can effectively ensure the validity of the constructed basic monitoring text data, thereby ensuring the effect of system monitoring and improving the stability of the system.

[0075] In one embodiment, step 205 includes: determining the dimensional baseline data of each dimensional monitoring data in the basic monitoring text data; inputting the basic monitoring text data and the dimensional baseline data into the system monitoring big language model; performing semantic understanding on the basic monitoring text data and the dimensional baseline data based on the system monitoring big language model, and performing retrieval processing and analysis processing in combination with the knowledge base and code base of the target system to obtain potential system problems of the target system.

[0076] Among them, dimension baseline data refers to the baseline of each dimension basic data that can be established by the large language model through the analysis of historical sampling data. The baseline is the performance indicator level of the system under normal operating conditions. By comparing real-time data with the baseline, it is easier to find abnormal situations. The baseline can also be used to evaluate the effectiveness of system optimization measures and predict future resource requirements. If the dimension basic data is not within the normal range specified by the dimension baseline data, it can be determined that the system status of the current dimension basic data may be abnormal.

[0077] Specifically, the system monitoring large language model can be combined with the dimensional baseline data of each dimensional monitoring data to identify and determine the system status. Therefore, the basic monitoring text data and the dimensional baseline data of the dimensional monitoring data determined by analysis can be input into the model together, and the actual data and indicator data can be compared through the model to analyze the system status. Thereby achieving a comprehensive semantic understanding of the dimensional baseline data, ensuring the effectiveness of the semantic understanding process, and obtaining more accurate potential system problems. In one of the embodiments, for the specific process of semantic understanding, the basic monitoring text data and the dimensional baseline data can be semantically understood based on the system monitoring large language model to obtain key information, and finally all the key information can be integrated to obtain the potential system problems of the target system. Among them, the key information can be specifically identified in combination with the basic monitoring text data and the dimensional baseline data. For example, data in the basic monitoring text data that does not conform to the dimensional baseline data can be extracted as key data. At the same time, the system monitoring large language model can perform reasoning analysis based on the identification of key information. When the application performs a multi-dimensional analysis of the target system based on monitoring data, the analysis dimensions are comprehensive and in-depth, not only covering the various performance indicators and system logs of the machine, but also going deep into the business-related code and configuration, etc., automatically analyzing the relationship between each part, and providing a full range of analysis perspectives. In one embodiment, the application can achieve more effective long-term analysis through a large language model, for example, time series analysis can be used to cooperate with other machine learning algorithms to predict trends in sampled data. This helps us to discover possible performance problems in advance, so that we can take measures to optimize them in advance. For example, if it is predicted that the memory usage rate will reach a critical value in a certain period of time in the future, we can expand or optimize the memory management strategy in advance to avoid system crashes. In this embodiment, the system monitors the large language model in combination with the dimensional baseline data to identify and monitor the anomalies in the basic monitoring text data, so as to determine the key information and potential system problems in the system, thereby ensuring the accuracy of the system monitoring process.

[0078] In one of the embodiments, step 203 includes: determining the trend change data of each dimensional monitoring data in the basic monitoring text data; inputting the trend change data of each dimensional monitoring data into the system monitoring large language model; performing trend analysis processing on the trend change data of each dimensional monitoring data based on the system monitoring large language model, and performing retrieval processing and analysis processing in combination with the knowledge base and code base of the target system to obtain potential system problems of the target system.

[0079] Among them, the trend change data refers to the data determined by analyzing the changes of the dimension monitoring data in different data collection cycles. For example, the average or median of the dimension monitoring data in the data collection cycle can be selected as the representative data of the data collection cycle, and then the trend change data of the dimension monitoring data can be obtained by analyzing the change trend of the representative data of the dimension monitoring data in different collection cycles.

[0080] Specifically, in the scheme of the present application, the system monitoring large language model will not only analyze the current data, but also timely discover the problems existing in the target system in combination with the code base and knowledge base. It is also possible to perform trend analysis on the data obtained by sampling in different data collection cycles in different dimensions. Specifically, the trend change data of the monitoring data of each dimension in the basic monitoring text data can be determined; the trend change data of the monitoring data of each dimension is then input into the system monitoring large language model; the trend change data of the monitoring data of each dimension is subjected to trend analysis processing based on the system monitoring large language model. During the analysis process, the knowledge base and code base of the target system are combined for retrieval processing and analysis processing to obtain the potential system problems of the target system. By performing trend analysis on the sampled data, the large language model can identify abnormal fluctuations and potential problems. For example, if the usage rate of a certain indicator suddenly increases or continues to grow, it may indicate a performance bottleneck or resource leakage. In this case, the large language model can generate an early warning notification so that developers can take timely measures to solve the problem.

[0081] In one embodiment, the real-time data collection strategy includes a log coloring sampling ratio adjustment strategy and a service performance analysis detection strategy. Step 207 includes: determining the log coloring ratio data corresponding to the potential system problem through the log coloring sampling ratio adjustment strategy, determining the service performance detection tool corresponding to the potential system problem through the service performance analysis detection strategy; collecting the system log data of the target system based on the log coloring ratio data, and collecting the service performance data of the target system based on the service performance detection tool; performing text data preprocessing based on the system log data and service performance data to obtain real-time monitoring text data.

[0082] Among them, log dyeing, also known as log coloring, can extract the required log data by marking specific parts of the log. For example, in the system call chain, you can mark the process of a specific requirement, so that the context information in the entire call chain is transmitted all the way, just like it was marked and dyed at the beginning. This way of marking logs is called dyed logs. The log dyeing sampling ratio adjustment strategy is a strategy for adjusting the ratio of dyed logs, and the service performance analysis detection strategy is a strategy for analyzing the performance of the service provider, such as calling the pprof performance analysis tool of the Golang service through the strategy to implement performance analysis.

[0083] Specifically, when a potential system problem is found through the analysis and processing of the monitoring data of the basic monitoring text data, the data collection strategy can be adjusted according to the nature and severity of the potential system problem. For example, the collection frequency and range of certain key indicators are increased, or more relevant data are collected for in-depth analysis. Specifically, the log dyeing sampling ratio adjustment strategy and the service performance analysis detection strategy can be included. For the log dyeing sampling ratio adjustment strategy, it can be implemented in an adaptive way by the log dyeing sampling ratio. First, the log dyeing ratio data corresponding to the potential system problem is determined by the log dyeing sampling ratio adjustment strategy, and then the system log data of the target system is collected based on the log dyeing ratio data to obtain the log data as a basic data for real-time monitoring text data. As we all know, when there is a problem with the service, the full-link dyeing log is crucial for the troubleshooting of the problem. However, since the full-link dyeing log reporting of the service is more resource-intensive, the general ratio is low, usually only one percent to one thousandth. At this time, if a fault occurs, if the dyeing ratio can be adjusted in time and dynamically through the log dyeing sampling ratio adjustment strategy, and the relevant data reporting is increased, it will be of great help to the problem troubleshooting. In one embodiment, the scheme of the present application can assist the data layer in adjusting the dyeing ratio through the system monitoring large language model. For example, when a service interface reports an error or a work order reports an abnormal function, if the exact cause cannot be analyzed based on the existing data, the full-link configuration will be automatically adjusted to increase the full-link log coloring ratio, report more log information for upstream and downstream related services, and then further find the root cause of the problem.

[0084] As for the service performance analysis detection strategy, it is associated with the service code and configuration changes. Through full sampling analysis, some code and configuration problems can be discovered in advance. However, some problems are not easy to find through static analysis, and they will only be exposed during runtime. However, if performance analysis is always turned on during runtime, a lot of resources will be wasted. Therefore, the solution of this application can realize intelligent fault detection through the interaction of system monitoring large language model and performance analysis tool. First, the runtime indicators are analyzed by the large language model. If the indicators are abnormal, for example, the service request volume does not fluctuate significantly, but the CPU and memory usage rates continue to increase, this is likely to be caused by the service itself. At this time, the large language model will enable the service performance analysis detection strategy, and automatically call the relevant service performance analysis tools through the strategy, which includes turning on the pprof performance analysis tool such as Golang service, and performing CPU analysis through CPUProfiling. The CPU usage of the monitored application CPU can be collected at a certain frequency to determine the specific location where the application spends time when actively consuming CPU cycles; memory analysis can be performed through MemoryProfiling. Stack tracking can be recorded when the application performs heap allocation, which is used to determine the current and historical memory usage, and to check memory leaks. Then, the specific reasons are further analyzed in combination with the service source code and configuration. As for the text data preprocessing of system log data and service performance data to obtain the processing process of real-time monitoring text data, here the collected data can be directly converted into text data according to the type of collected data. For example, for log data, the text data in the log can be obtained after removing the fixed format of the log. In this embodiment, the real-time monitoring of the target system is performed based on potential system problems through the log coloring sampling ratio adjustment strategy and the service performance analysis detection strategy, so as to obtain real-time monitoring text data with higher coverage and pertinence, thereby ensuring the efficiency and accuracy of subsequent problem location and solution reasoning processing.

[0085] In one embodiment, step 207 includes: based on potential system problems and real-time monitoring text data, problem location processing is performed through a system monitoring large language model to obtain the cause of the potential system problem; based on the cause of the potential system problem and real-time monitoring text data, solution reasoning processing is performed through a system monitoring large language model to obtain a solution to the potential system problem.

[0086] Among them, problem location processing refers to identifying the location of the problem in the target system based on the real-time monitoring text data and the identified potential system problems. Once the potential system problem is identified, the problem can be located through problem location processing. For example, if the potential system problem is a sudden drop in performance under high load, the system can be located by collecting real-time monitoring text data and performing problem identification processing based on the system monitoring large language model to locate the system problem as a performance drop under high load caused by the system configuration reaching a performance bottleneck.

[0087] Specifically, after obtaining the potential system problems and real-time monitoring text data, the two can be combined for analysis, and the specific location of the problem in the target system can be determined through problem location processing. After the location is completed, the system monitoring large language model can be used to perform solution reasoning processing on the basis of the problem cause and real-time monitoring text data to obtain a solution to the problem identification result. Specifically, the reasoning ability of the system monitoring large language model is utilized, combined with the problem cause of the potential system problem and the real-time monitoring text data, to generate a solution to the problem identification result, such as modifying the configuration, expanding the service, modifying the code, etc. can all be used as solutions. In addition, in a specific embodiment, in the solution of the present application, the system monitoring large language model can also realize human-computer interaction processing in the process of problem identification and solution generation. For example, after obtaining the solution, the potential system problem, the cause of the problem and the solution can be fed back to the system end of the target system. After obtaining potential system problems, causes of problems and solutions, system maintenance personnel on the system side can submit problem feedback to the server where the monitoring system is located if they want to further understand the more specific situation monitored or have questions about the monitoring results. After receiving the problem feedback on the solution from the system side, they can generate and process interactive information based on the problem feedback submitted by the system side and the solution generated by the monitoring model through the system monitoring large language model to obtain interactive information of the problem feedback; and feedback the interactive information to the system side. At this time, the interactive action can continue for multiple rounds, so as to fully answer the questions submitted by the system end users. Through the interaction of natural language, the system problems can be answered accurately and effectively. Thereby improving the convenience of the system problem solving process. In addition, after the problem is solved, the system monitoring large language model can continuously optimize the data collection strategy according to the actual effect. For example, for the solved problems, the collection frequency and range of relevant indicators can be appropriately reduced to reduce resource consumption. For example, reduce the proportion of dyeing logs, turn off performance analysis sampling, etc. At the same time, the model can also discover new problems and optimization points according to the actual operation situation, so as to achieve continuous self-optimization and feedback. In this embodiment, a solution is obtained by combining problem identification with problem reasoning, and at the same time, the problem feedback from the system end on the solution is combined to interact with the user on the system end, so that the efficiency of problem handling during the system monitoring process can be effectively guaranteed.

[0088] In one embodiment, the method also includes: obtaining system information of the general large language model and the target system, the system information including the target system's professional knowledge in the field, special terms in the field, historical business logs, system business reference indicators, and system question and answer work order data; fine-tuning the training library data of the general large language model based on the system information of the target system to obtain a fine-tuning database; iteratively training the general large language model based on the fine-tuning database to obtain a system monitoring large language model after fine-tuning of model parameters.

[0089] The training database data refers to the database where the training data used to train the general large language model is located. The language database data volume of the large language model is generally large, which can reach hundreds of billions. Fine-tuning the training database data means that the information content of the target system's system information can be increased in the language database data volume of the large language model, so that the model parameters of the large language model can be fine-tuned for the corresponding scenarios to adapt to the operation and maintenance scenarios of the target system monitoring.

[0090] Specifically, the solution of the present application needs to complete the training and fine-tuning of the system monitoring large language model before monitoring the target system. During the training process, the large language model can be repeatedly trained through the pre-built training library data. In order to adapt to the application scenario of monitoring the target system, the training library data of the general large language model can be fine-tuned based on the system information of the target system to obtain a fine-tuning database, and then the general large language model obtained after training is iteratively trained again through the database after fine-tuning to obtain the system monitoring large language model after fine-tuning the model parameters. In a specific embodiment, although the large language model represented by ChatGPT has strong capabilities in natural language understanding and logical analysis, it cannot adapt well to the use scenario due to its high cost of use, inability to be privately deployed, and data security issues. This application selects some open source, low resource consumption and privately deployable large language models.

[0091] In a specific embodiment, this application uses a low-parameter version of ChatGLM, ChatGLM-6B, as an example to implement system monitoring with a large language model. ChatGLM-6B is an open source, bilingual Chinese and English dialogue language model based on the general language model (GLM) architecture with 6.2 billion parameters. By adopting model quantization technology, users can deploy it locally on consumer-grade graphics cards (only 6GB of video memory is required at the INT4 quantization level). ChatGLM-6B uses technology similar to ChatGPT. In the bilingual training of Chinese and English with about 1T identifiers, it is supplemented by supervised fine-tuning, feedback self-help, human feedback reinforcement learning and other technologies, so that the 6.2 billion parameter ChatGLM-6B can analyze problems well and conduct smooth conversations. In addition, it also supports an efficient parameter fine-tuning method based on P-Tuning v2, and only 7GB of video memory is required at the INT4 quantization level to start fine-tuning.

[0092] In addition, in one embodiment, the test effect of system monitoring achieved by ChatGLM-6B can be referred to Figure 3 and Figure 4 As shown, Figure 3 The model input includes text data of system abnormal conditions and related system source code data, while the output of the system monitoring large language model can refer to Figure 4 As shown, from the test results, the ChatGLM-6B model performs well in language understanding and logical analysis. It can not only analyze the causes of the problem, but also locate the specific code that may have problems, and give targeted optimization suggestions. And this process can be completed in a very short time, which greatly saves the time of troubleshooting and solving problems. In addition, in other embodiments, the present application can also support other large language models, such as Vicuna-13B, BELLE-7B2M, etc., which also have excellent natural language understanding and analysis capabilities, and can meet the needs of system monitoring.

[0093] This solution supports personalized fine-tuning for different enterprises and application scenarios, and can flexibly adapt to various scenario requirements. Each scenario can use its own professional data to fine-tune the model and achieve efficient application of professional scenarios at a very low cost. For example, business systems in industries such as finance, e-commerce, and games. Although these systems are implemented by a large amount of computer software and hardware, the business and related knowledge information of each industry are usually different. Since the corpus usually does not have the professional knowledge within the enterprise during the initial training of the large language model, it is particularly important to use fine-tuning to allow the large language model to deeply understand the relevant business and professional knowledge. The fine-tuning stage of this application is specifically based on the professional knowledge of the field to which the target system belongs, the special terms in the field, the historical business logs, the system business reference indicators, and the system question and answer work order data and domain knowledge precipitation, etc., and the fine-tuning database is established to achieve it. For example, taking a fine-tuning training of a model using work order data as an example, the general steps are as follows: First, in the data preparation stage, by connecting to the work order system to which the target system belongs, collect the after-sales question and answer work order data set; then through pre-processing: the work order questions and the corresponding reply content are classified and screened, and processed into high-quality training data required for model fine-tuning. Finally, in the model training, the pre-processed data can be used to train the system monitoring large language model in the training process, and the training is adjusted by modifying parameters such as the soft prompt word length and the training learning rate, so as to finally achieve the best effect. In this embodiment, the scenario adaptation processing of the general large language model is achieved by fine-tuning the database, which can effectively ensure the accuracy of the system monitoring large language model for the target system monitoring.

[0094] In one embodiment, the method also includes: generating system monitoring information of the target system based on potential system problems, causes of the problems and solutions; determining a message notification channel corresponding to the target system; generating a system monitoring report in a corresponding format based on the system monitoring information and the message notification channel; and feeding back the system monitoring report in a corresponding format through the message notification channel.

[0095] Among them, the target system's corresponding message notification channels include phone, SMS, instant messaging software, and email, and different message notification channels correspond to different system monitoring reports, such as plain text, HTML, PDF, etc. Therefore, before conducting message notification, you can first determine the message notification channel corresponding to the target system, and then generate the corresponding system monitoring report for the message notification channel to ensure the timeliness of the message notification.

[0096] Specifically, all system information including potential system problems, causes of problems and solutions can be summarized through system monitoring information, and then reported to the system end by forming a system monitoring report, so that the problems and solutions faced by the target system can be immediately notified to the system maintenance staff of the target system. At the same time, different message notification channels can be set according to the needs of the target system, and then in the notification process, a system monitoring report of a corresponding format is generated based on the system monitoring information and the message notification channel; and the system monitoring report of a corresponding format is fed back through the message notification channel. In one embodiment, the notification process of the system monitoring report in the present application can be implemented through the application layer of the monitoring system, which is responsible for pushing the analysis and positioning results and recommended solutions of the logic layer to the system end of the target system in various forms, so as to ensure that the system maintenance staff of the system end can timely understand the changes of the target system and perform maintenance processing. In this embodiment, the monitoring status report for the target system is realized by generating a system monitoring report, so as to effectively ensure the visibility of system problems during the system monitoring process and improve the system monitoring effect.

[0097] In one embodiment, the method also includes: obtaining system problems for the target system on the system side; searching for multi-dimensional basic monitoring data of the target system based on the system problems; generating problem-solving information corresponding to the system problems based on the multi-dimensional basic monitoring data; and feeding back the problem-solving information.

[0098] Specifically, in addition to being able to interact with the system side for the results of system monitoring during the system monitoring process, the solution of the present application also provides the function of real-time interaction with users and collaboratively solving system problems. First, users can submit system problems to the server side equipped with the system monitoring method of the present application through various channels. For example, direct voice input can be performed. At this time, the server side can obtain the system problems of the target system by performing voice recognition processing on the voice input, and then answer them to achieve human-computer interaction. In addition, users can also input interactive content through text. The text interaction process also supports multiple input methods, such as keyboard input, clipboard paste, etc., and can process texts in different formats (such as plain text, Markdown, etc.). Then, for specific interactive processing, it is implemented based on the logical layer of the system. According to the system problems input by Hu, the multi-dimensional basic monitoring data of the target system can be found in the logical layer; the analysis and positioning results and suggested solutions are obtained, and finally the problem-solving information corresponding to the system problems is generated based on the multi-dimensional basic monitoring data; and the problem-solving information is fed back. This process supports multiple rounds of dialogue. When applied, problems and needs can be gradually clarified in the process of interaction with users. Finally, for the output of question answering information, multiple channels are also supported, such as text display, voice playback, etc., and the appropriate output format can be selected according to the user's device and preferences. In one of the embodiments, the solution of the present application can also be applied to the field of system development. For example, system anomalies caused by certain codes uploaded by R&D personnel or certain content configurations modified by operators can be discovered in real time. Even when the logic and configuration of the code base are changed, problems can be discovered in advance and assisted in solving through real-time question and answer prompts. In this embodiment, by obtaining system problems for the target system on the system side, real-time interactive processing with system side users can be achieved. Problems encountered during system operation can be solved through interaction with the system side, thereby improving the effectiveness of system status monitoring and ensuring the effective operation of the system.

[0099] The present application also provides an application scenario, and the application scenario applies the above-mentioned system monitoring method. Specifically, the application of the system monitoring method in the application scenario is as follows:

[0100] When the user wants to monitor the application system currently running on the computer, in order to ensure the efficiency and accuracy of the monitoring, the system monitoring method of the present application can be used to assist in the system monitoring process. First, the user can submit the information related to the application system to be monitored to the server equipped with the system monitoring method of the present application, and then the server fine-tunes the training library data of the large language model based on the general large language model and the information related to the application system to obtain a fine-tuning database; iteratively train the general large language model based on the fine-tuning database to obtain a system monitoring large language model after the model parameters are fine-tuned, and the system monitoring large language model can be used to monitor the application system.

[0101] The system architecture diagram of the monitoring system installed on the server can be referred to Figure 5 As shown, it specifically includes three layers: data layer, logic layer and application layer. The structure of the data layer can refer to Figure 6 As shown, it collects various data during the operation of the application system through the data collection module, including but not limited to CPU usage, memory usage, disk space, network IO, service logs, etc. After the collection is completed, the data is processed by the preprocessing module to make the data more standardized and more suitable for large language model analysis. When collecting and processing data, the existing APM system can be used for collection, or it can be combined with various self-developed indicator collection tools for collection. Finally, the preprocessing module is used to clean, sample, aggregate, store and other processing of the data, making the data more standardized and more suitable for large language model analysis, thereby improving the accuracy and speed of analysis.

[0102] The structure of the logical layer can refer to Figure 7As shown in the figure, the data source of the logic layer includes the preprocessed data obtained from the previous processing, as well as the code base, knowledge base and fine-tuning database of the application system. The large language model is the core of the logic layer. The module of the large language model includes an open source, low resource consumption and privately deployable large language model, such as ChatGLM, Vicuna-13B, BELLE-7B2M, etc. These models have similar capabilities to ChatGPT in natural language understanding and logical analysis, and support personalized fine-tuning. The large language model provides core technical support for the analysis and positioning module and the solution module. It provides strong support for the natural language processing functions of data analysis, problem location, solution generation and human-computer interaction. The analysis and positioning module and the solution module need to perform corresponding processing based on the large language model. After preprocessing the data collected from the application system data source, the preprocessed data of the data layer is input into the large language model. The analysis and positioning module can use the semantic understanding ability of the large language model to conduct in-depth analysis of the input data and extract potential system problems. Then, based on the potential system problems, the data layer is called to collect data. Specifically, based on the potential system problems, the basic data collection strategy can be updated to obtain the real-time data collection strategy, such as the log coloring sampling ratio adjustment strategy and the service performance analysis detection strategy. Then, the log coloring ratio data corresponding to the potential system problem is determined through the log coloring sampling ratio adjustment strategy, and the service performance detection tool corresponding to the potential system problem is determined through the service performance analysis detection strategy; the system log data of the target system is collected based on the log coloring ratio data, and the service performance data of the target system is collected based on the service performance detection tool; text data is preprocessed based on the system log data and service performance data to obtain real-time monitoring text data. Based on the potential system problems and real-time monitoring text data, the system monitoring large language model is used to locate the problem and obtain the cause of the potential system problem; based on the cause of the potential system problem and the real-time monitoring text data, the system monitoring large language model is used to reason about the solution and obtain the solution to the potential system problem, that is, the reasoning ability of the large language model is used to combine the results of problem identification to generate targeted solutions. In addition, in the process of handling problems, the solution module also supports real-time interaction with users in natural language through the application layer to jointly handle problems. The server can feedback potential system problems, causes of problems, and solutions to the system end of the target system; and receive problem feedback from the system end for solutions; based on problem feedback and solutions, the system monitors the large language model to generate and process interactive information, obtain interactive information of problem feedback, and feedback interactive information to the system end. In this way, interaction with the system end is realized.

[0103] Finally, Figure 8As shown in the application layer, the application layer mainly includes the report module and the human-computer interaction module. The report module includes submodules such as notification channel management, report generation and report sending. The notification channel management submodule is responsible for managing different notification channels, such as phone, SMS, instant messaging software, email, etc. It needs to support the functions of adding, deleting and modifying notification channels so that users can choose the appropriate notification method according to their needs. The report generation submodule is responsible for generating reports based on the analysis and positioning results and recommended solutions of the logic layer. The report should contain content such as problem description, cause analysis, solution, etc., and generate corresponding report formats according to different notification channels. The report sending submodule is responsible for sending the generated report to the concerned person through the notification channel selected by the user. It needs to work with the notification channel management submodule to ensure that the report can be successfully sent. The human-computer interaction module includes submodules such as text input interface, speech recognition interface, interaction processing, and interaction output. The text input interface module is responsible for receiving questions and needs entered by users through text. It needs to support multiple input methods, such as keyboard input, clipboard paste, etc., and be able to process texts in different formats. The speech recognition interface submodule is responsible for receiving questions and needs entered by users through voice. It needs to integrate speech recognition technology to convert the user's speech into text for subsequent processing. The interaction processing submodule is responsible for processing the questions and needs entered by the user, interacting with the logic layer, obtaining analysis and positioning results and recommended solutions. It needs to support multiple rounds of dialogue so that the questions and needs can be gradually clarified during the interaction with the user.

[0104] The interactive output submodule is responsible for presenting the results of the interactive processing to the user in the form of text or voice. It needs to support multiple output methods, such as text display, voice playback, etc., and be able to select the appropriate output format according to the user's device and preferences. Through the above system, real-time monitoring of the application system can be effectively achieved. Among them, the intelligent analysis mechanism based on the large language model can automatically detect and analyze the causes of system abnormalities from multiple dimensions, and improve the accuracy of problem location. At the same time, it can analyze and locate specific program codes, configuration changes, etc., provide targeted suggestions for development and operation and maintenance personnel, and improve the efficiency of problem solving. Through interactive processing at the application layer, real-time natural language interaction with development and operation and maintenance personnel can be achieved, further reducing their workload and improving operation and maintenance efficiency. This application helps to discover and solve system abnormalities in a timely manner, thereby improving the stability of the system. At the same time, this application has the characteristics of easy implementation, easy deployment, low cost, safe and controllable, which reduces the difficulty of implementation and maintenance. In addition, it can be flexibly expanded as needed, not only can it adapt to a variety of data collection tools, but also can adapt to a variety of large language models. At the same time, fine-tuning the model can adapt to different scenarios of various enterprises.

[0105] In one embodiment, the complete process of the system monitoring method of the present application can be referred to Fig. 9As shown, including:

[0106] Step 902, determine the data source connected to the target system. Step 904, call the data collection component of the performance management system through the basic data collection strategy. Step 906, perform multi-dimensional data collection on the data source based on the data collection component to obtain multi-dimensional basic monitoring data. Step 908, identify the data type of each dimension of the basic data in the multi-dimensional basic monitoring data. Step 910, determine the data processing method of each dimension of the basic data based on the data type. Step 912, perform data processing on the basic data of each dimension of the corresponding data type through the data processing method to obtain the monitoring data of each dimension corresponding to the basic data of each dimension. Step 914, fill the monitoring data of each dimension into the corresponding column of the normalized text table to obtain the basic monitoring text data for the target system. Step 916, determine the dimensional baseline data of each dimensional monitoring data in the basic monitoring text data. Step 918, input the basic monitoring text data and the dimensional baseline data into the system monitoring large language model. Step 920: Based on the system monitoring big language model, semantic understanding is performed on the basic monitoring text data and dimension baseline data, and retrieval and analysis are performed in combination with the knowledge base and code base of the target system to obtain potential system problems of the target system. Step 922: Based on the potential system problems, the basic data collection strategy is updated to obtain the real-time data collection strategy. Step 924: Real-time monitoring text data is collected from the data source of the target system through the real-time data collection strategy. Step 926: Based on the potential system problems and the real-time monitoring text data, the system monitoring big language model is used to perform problem location processing to obtain the cause of the potential system problems. Step 928: Based on the cause of the potential system problems and the real-time monitoring text data, the system monitoring big language model is used to perform solution reasoning processing to obtain the solution to the potential system problems.

[0107] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0108] Based on the same inventive concept, the embodiment of the present application also provides a system monitoring device for implementing the system monitoring method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more system monitoring device embodiments provided below can refer to the limitations on the system monitoring method above, and will not be repeated here.

[0109] In one embodiment, Fig.10 As shown, a system monitoring device is provided, comprising:

[0110] The data acquisition module 1001 is used to acquire basic monitoring text data collected from the data source of the target system. The basic monitoring text data is collected using a basic data collection strategy.

[0111] The problem analysis module 1003 is used to perform monitoring data analysis and processing on the basic monitoring text data through the system monitoring large language model, and obtain potential system problems of the target system by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning the model parameters of the general large language model based on the fine-tuning database of the target system.

[0112] The strategy adjustment module 1005 is used to update the basic data collection strategy based on potential system problems to obtain a real-time data collection strategy.

[0113] The data collection module 1007 is used to collect real-time monitoring text data from the data source of the target system through a real-time data collection strategy.

[0114] Solution reasoning module 1009 is used to locate problems and perform solution reasoning based on potential system problems and real-time monitoring text data through the system monitoring large language model to obtain the cause and solution of the potential system problem.

[0115] In one embodiment, the data acquisition module 1001 is specifically used to: determine the data source connected to the target system; call the data acquisition component of the performance management system through the basic data acquisition strategy; perform multi-dimensional data acquisition on the data source based on the data acquisition component to obtain multi-dimensional basic monitoring data; perform text data preprocessing on the multi-dimensional basic monitoring data to obtain basic monitoring text data for the target system.

[0116] In one embodiment, the data acquisition module 1001 is also used to: identify the data type of each dimensional basic data in the multi-dimensional basic monitoring data; determine the data processing method of each dimensional basic data based on the data type; perform data processing on the basic data of each dimension of the corresponding data type through the data processing method to obtain the monitoring data of each dimension corresponding to the basic data of each dimension; fill the monitoring data of each dimension into the corresponding column of the normalized text table to obtain the basic monitoring text data for the target system, and the normalized text table is created based on the data source type contained in the target system.

[0117] In one embodiment, the problem analysis module 1003 is specifically used to: determine the dimensional baseline data of each dimensional monitoring data in the basic monitoring text data; input the basic monitoring text data and the dimensional baseline data into the system monitoring big language model; perform semantic understanding of the basic monitoring text data and the dimensional baseline data based on the system monitoring big language model, and perform retrieval processing and analysis processing in combination with the knowledge base and code base of the target system to obtain potential system problems of the target system.

[0118] In one embodiment, the problem analysis module 1005 is also used to: determine the trend change data of the monitoring data of each dimension in the basic monitoring text data; input the trend change data of the monitoring data of each dimension into the system monitoring large language model; perform trend analysis on the trend change data of the monitoring data of each dimension based on the system monitoring large language model, and perform retrieval processing and analysis processing in combination with the knowledge base and code base of the target system to obtain potential system problems of the target system.

[0119] In one embodiment, the real-time data collection strategy includes a log coloring sampling ratio adjustment strategy and a service performance analysis detection strategy. The data collection module 1007 is specifically used to: determine the log coloring ratio data corresponding to the potential system problem through the log coloring sampling ratio adjustment strategy, determine the service performance detection tool corresponding to the potential system problem through the service performance analysis detection strategy; collect the system log data of the target system based on the log coloring ratio data, and collect the service performance data of the target system based on the service performance detection tool; perform text data preprocessing based on the system log data and service performance data to obtain real-time monitoring text data.

[0120] In one embodiment, the solution reasoning module 1009 is specifically used to: based on potential system problems and real-time monitoring text data, perform problem location processing through the system monitoring large language model to obtain the cause of the potential system problem; based on the cause of the potential system problem and real-time monitoring text data, perform solution reasoning processing through the system monitoring large language model to obtain a solution to the potential system problem.

[0121] In one embodiment, it also includes a solution interaction module, which is used to: feedback potential system problems, causes of problems and solutions to the system end of the target system; receive problem feedback from the system end regarding the solution; based on the problem feedback and the solution, generate and process interactive information through the system monitoring large language model to obtain interactive information of the problem feedback; and feed back the interactive information to the system end.

[0122] In one embodiment, a model training module is also included, which is used to: obtain the general large language model and system information of the target system, the system information including the target system's professional knowledge in the field, special terms in the field, historical business logs, system business reference indicators, and system question and answer work order data; fine-tune the training library data of the general large language model based on the system information of the target system to obtain a fine-tuning database; iteratively train the general large language model based on the fine-tuning database to obtain a system monitoring large language model after fine-tuning of model parameters.

[0123] In one embodiment, it also includes a report generation module, which is used to: generate system monitoring information of the target system based on potential system problems, causes of the problems and solutions; determine the message notification channel corresponding to the target system; generate a system monitoring report in a corresponding format based on the system monitoring information and the message notification channel; and feedback the system monitoring report in a corresponding format through the message notification channel.

[0124] In one embodiment, it also includes a human-computer interaction module, which is used to: obtain system problems for the target system on the system side; search for multi-dimensional basic monitoring data of the target system based on the system problems; generate problem-solving information corresponding to the system problems based on the multi-dimensional basic monitoring data; and feedback the problem-solving information.

[0125] Each module in the above system monitoring device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0126] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.11As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store system monitoring data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a system monitoring method is implemented.

[0127] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0128] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0129] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0130] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0131] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A system monitoring method, characterized in that: The method comprises: Acquire basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy; The basic monitoring text data is analyzed and processed by a system monitoring large language model, and potential system problems of the target system are obtained by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning the model parameters of a general large language model based on a fine-tuning database of the target system; Based on the potential system problem, updating the basic data collection strategy to obtain a real-time data collection strategy; Collecting real-time monitoring text data from the data source of the target system through the real-time data collection strategy; Based on the potential system problem and the real-time monitoring text data, the problem location and solution reasoning processing are performed through the system monitoring large language model to obtain the cause and solution of the potential system problem.

2. The method according to claim 1, characterized in that The obtaining of basic monitoring text data collected from the data source of the target system includes: Determine a data source connected to the target system; Call the data collection component of the performance management system through the basic data collection strategy; Based on the data collection component, the data of the data source is collected in multiple dimensions to obtain multi-dimensional basic monitoring data; The multi-dimensional basic monitoring data is subjected to text data preprocessing to obtain basic monitoring text data for the target system.

3. The method according to claim 1, characterized in that: The performing text data preprocessing on the multi-dimensional basic monitoring data to obtain basic monitoring text data for the target system includes: Identify the data type of each dimension of basic data in the multi-dimensional basic monitoring data; Determine a data processing method for the basic data of each dimension based on the data type; Through the data processing method, the basic data of each dimension of the corresponding data type is processed to obtain the monitoring data of each dimension corresponding to the basic data of each dimension; The monitoring data of each dimension is filled into the corresponding column of the normalized text table to obtain the basic monitoring text data for the target system. The normalized text table is created based on the data source type included in the target system.

4. The method according to claim 1, characterized in that: The monitoring data analysis and processing of the basic monitoring text data by the system monitoring large language model is combined with the knowledge base and code base of the target system to obtain the potential system problems of the target system, including: Determine dimensional baseline data of each dimensional monitoring data in the basic monitoring text data; Inputting the basic monitoring text data and the dimension baseline data into the system monitoring large language model; Based on the system monitoring large language model, semantic understanding is performed on the basic monitoring text data and the dimensional baseline data, and retrieval processing and analysis processing are performed in combination with the knowledge base and code base of the target system to obtain potential system problems of the target system.

5. The method according to claim 1, characterized in that The monitoring data analysis and processing of the basic monitoring text data by the system monitoring large language model is combined with the knowledge base and code base of the target system to obtain the potential system problems of the target system, including: Determine trend change data of monitoring data of each dimension in the basic monitoring text data; Inputting the trend change data of the monitoring data of each dimension into the system monitoring large language model; Based on the system monitoring large language model, trend analysis is performed on the trend change data of the monitoring data of each dimension, and retrieval and analysis are performed in combination with the knowledge base and code base of the target system to obtain potential system problems of the target system.

6. The method according to claim 1, characterized in that The real-time data collection strategy includes a log coloring sampling ratio adjustment strategy and a service performance analysis detection strategy; The collecting of real-time monitoring text data from the data source of the target system by the real-time data collection strategy includes: Determine the log coloring ratio data corresponding to the potential system problem through the log coloring sampling ratio adjustment strategy, and determine the service performance detection tool corresponding to the potential system problem through the service performance analysis detection strategy; Collecting system log data of the target system based on the log coloring ratio data, and collecting service performance data of the target system based on the service performance detection tool; Text data preprocessing is performed based on the system log data and the service performance data to obtain real-time monitoring text data.

7. The method according to claim 1, characterized in that Based on the potential system problem and the real-time monitoring text data, the problem location and solution reasoning processing are performed through the system monitoring large language model to obtain the cause and solution of the potential system problem, including: Based on the potential system problem and the real-time monitoring text data, problem location processing is performed through the system monitoring large language model to obtain the cause of the potential system problem; Based on the cause of the potential system problem and the real-time monitoring text data, solution reasoning processing is performed through the system monitoring large language model to obtain a solution to the potential system problem.

8. The method according to claim 7, characterized in that The method further comprises: Feedback the potential system problem, the cause of the problem and the solution to the system end of the target system; Receiving problem feedback from the system end regarding the solution; Based on the problem feedback and the solution, the system monitors the large language model to generate interactive information to obtain interactive information of the problem feedback; The interaction information is fed back to the system end.

9. The method according to claim 1, characterized in that: The method further comprises: Acquire the universal large language model and system information of the target system, wherein the system information includes the domain expertise, domain-specific terms, historical business logs, system business reference indicators, and system question and answer work order data of the target system; Fine-tune the training library data of the universal large language model based on the system information of the target system to obtain a fine-tuning database; The general large language model is iteratively trained based on the fine-tuning database to obtain a system monitoring large language model after model parameters are fine-tuned.

10. The method according to claim 1, characterized in that The method further comprises: generating system monitoring information of the target system based on the potential system problem, the cause of the problem and the solution; Determine a message notification channel corresponding to the target system; Generate a system monitoring report in a corresponding format based on the system monitoring information and the message notification channel; The system monitoring report in a corresponding format is fed back through the message notification channel.

11. The method according to any one of claims 1 to 10, characterized in that: The method further comprises: Obtaining system problems of the system end for the target system; Searching for multi-dimensional basic monitoring data of the target system based on the system problem; Generate question answering information corresponding to the system problem based on the multi-dimensional basic monitoring data; Feedback the information to answer the question.

12. A system monitoring device, characterized in that: The device comprises: A data acquisition module, used to acquire basic monitoring text data collected from a data source of a target system, wherein the basic monitoring text data is collected using a basic data collection strategy; A problem analysis module is used to perform monitoring data analysis and processing on the basic monitoring text data through a system monitoring large language model, and obtain potential system problems of the target system by combining the knowledge base and code base of the target system. The system monitoring large language model is obtained by fine-tuning model parameters of a general large language model based on a fine-tuning database of the target system; A strategy adjustment module, used to update the basic data collection strategy based on the potential system problem to obtain a real-time data collection strategy; A data collection module, used for collecting real-time monitoring text data from the data source of the target system through the real-time data collection strategy; A solution reasoning module is used to locate the problem and perform solution reasoning processing based on the potential system problem and the real-time monitoring text data through the system monitoring large language model to obtain the cause and solution of the potential system problem.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images