Fault scene positioning and handling method, device, equipment and medium

Abstract

The invention discloses a fault scene positioning and handling method and device, equipment and a medium. The method is characterized by comprising the following steps: collecting system operation data of a multi-place deployment system, carrying out alarm detection on the system operation data, determining at least one alarm message, carrying out anomaly detection on the system operation data according to the alarm level of the alarm message, and determining the anomaly of the system operation data. Determining at least one abnormal index and abnormal label information corresponding to each abnormal index; carrying out fault positioning on the abnormal indexes according to the abnormal label information through a pre-trained fault scene positioning model, and determining a fault scene; and processing scheme recommendation is performed according to the fault scene, and a fault processing scheme corresponding to the fault scene is determined. The fault of the system can be positioned, a processing scheme is provided for the fault, emergency personnel and a system responsible person can handle the fault conveniently, and the system recovery speed is increased.

Description

Technical Field

[0001] The present invention relates to the technical field of system exception handling, and in particular to a method, device, equipment and medium for locating and handling fault scenarios. Background Art

[0002] When an abnormality exists in the system, the application layer, system layer, network layer and device layer of the system will all issue alarms. The application layer has various types of alarms including web page interruption, log anomaly detection, and performance data interruption. The system layer has processor and memory alarms, etc. Similarly, the network layer and device layer also have various types of alarms and indicators corresponding to various types of alarms at each level of the system. It is difficult for non-professionals corresponding to each level to clearly identify the abnormal information corresponding to each alarm, which makes system maintenance very difficult and unable to handle abnormalities at each level in a timely manner. Existing technologies are usually only able to identify abnormalities in the system and find it difficult to handle abnormalities in the system. Summary of the invention

[0003] The present invention provides a method, device, equipment and medium for locating and handling a fault scenario, so as to solve the technical problem that the anomaly in the system cannot be effectively handled in the prior art.

[0004] According to one aspect of the present invention, a method for locating and handling a fault scenario is provided, comprising:

[0005] Collecting system operation data of systems deployed in multiple locations, performing alarm detection on the system operation data, and determining at least one alarm information, wherein the alarm information includes an alarm type and an alarm level;

[0006] Performing anomaly detection on the system operation data according to the alarm level of the alarm information, and determining at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator;

[0007] Performing fault location on the abnormal indicator according to the abnormal label information through a pre-trained fault scenario location model to determine the fault scenario;

[0008] A processing solution is recommended based on the fault scenario, and a fault processing solution corresponding to the fault scenario is determined.

[0009] According to another aspect of the present invention, a fault scenario location and handling device is provided, comprising:

[0010] A fault alarm module, used to collect system operation data of systems deployed in multiple locations, perform alarm detection on the system operation data, and determine at least one alarm information, wherein the alarm information includes an alarm type and an alarm level;

[0011] An anomaly detection module, used to perform anomaly detection on the system operation data according to the alarm level of the alarm information, and determine at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator;

[0012] A fault scenario detection module is used to locate the fault of the abnormal indicator according to the abnormal label information through a pre-trained fault scenario location model to determine the fault scenario;

[0013] The processing module is used to recommend a processing solution according to the fault scenario and determine the fault processing solution corresponding to the fault scenario.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the fault scenario location and handling method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the fault scenario location and handling method described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention collects system operation data of systems deployed in multiple locations, performs alarm detection on the system operation data, determines at least one alarm information, performs abnormal detection on the system operation data according to the alarm level of the alarm information, determines at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator, and can effectively determine the abnormal indicators in the system through two abnormal detections, and identify the abnormal indicators of the system through abnormal label information, thereby improving the accuracy of abnormal recognition; the abnormal indicators are fault-located according to the abnormal label information through the pre-trained fault scenario location model, and the fault scenario corresponding to the abnormal label information is determined; processing solutions are recommended according to the fault scenario, and the fault processing solutions corresponding to the fault scenario are determined, and the corresponding fault scenarios are determined through the abnormal label information of the abnormal indicators, and processing solutions are recommended for the fault scenarios, which can locate the fault more intuitively. The technical problem that the prior art cannot effectively handle the abnormalities in the system is solved, the system fault detection accuracy is achieved, the processing speed of the system fault is improved, and the system recovery speed is accelerated.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a method for locating and handling a fault scenario is provided for an embodiment of the present invention;

[0023] Figure 2 A flowchart of another method for locating and handling a fault scenario is provided for an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of the structure of a fault scenario location and handling device provided by an embodiment of the present invention;

[0025] Figure 4 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1 A flowchart of a method for locating and handling a fault scenario is provided for an embodiment of the present invention. This embodiment is applicable to the situation where anomalies and faults in a system deployed in multiple locations are located and handled. The method can be executed by a fault scenario locating and handling device. The fault scenario locating and handling device can be implemented in the form of hardware and / or software. The fault scenario locating and handling device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0029] S110: Collect system operation data of systems deployed in multiple locations, perform alarm detection on the system operation data, and determine at least one alarm information.

[0030] Among them, the multi-location deployment system can be a system based on a multi-location deployment architecture, which deploys multiple complete systems in different geographical locations and connects multiple data centers, server clusters or cloud service providers through the network to provide services. For example, a bank will establish data centers in different cities, each of which has a complete banking system, including databases, application servers, etc., and ensure the consistency of data in different data centers through data replication technology; different data centers have different functions, such as disaster recovery, same-city, headquarters and other data center deployment systems.

[0031] Among them, the system operation data can be system operation indicators of different levels in the multi-location deployment system; the system operation data includes at least one system operation indicator, and the system operation indicator can be various indicator data generated during the system operation process. It should be noted that the multi-location deployment system includes the application layer, system layer, network layer and device layer; the application layer is the level of user-system interaction, which includes various application programs and services, has the function of interacting with users, and can provide users with specific functions and services; the system layer is the level of operating system and system software, and the system layer provides the basic operating environment and services for the application layer, and can manage the system's hardware resources and the system's core functions (process management, memory management, file system management, device driver); the network layer is the system's network layer, which can transmit data and information between users and systems, systems and systems, transmit data through network communication protocols, and allocate and manage network resources to ensure the normal operation of the network and provide system network services; the device layer can be the system's hardware devices, including processors, memory, storage devices, input and output devices and other devices, and the device layer provides the most basic hardware resources.

[0032] Optionally, the system operation data may be system operation indicators corresponding to each layer of the application layer, system layer, network layer and device layer. For example, the system operation indicators of the application layer may be application response information, application response time, throughput, error rate and user behavior records, application transaction volume and transaction success rate; the system operation indicators of the system layer may be the operating status of the system process; the system operation indicators of the network layer may be network bandwidth, network delay, packet loss rate and network data traffic; the system operation indicators of the device layer may be processor utilization efficiency, memory utilization efficiency, storage rate and utilization rate, hardware status and power status.

[0033] Among them, the alarm information can be a system operation indicator that triggers an alarm in the system operation data; the alarm information can be used to warn the system of abnormal system operation data; the alarm information includes an alarm type and an alarm level, the alarm type can be the indicator type corresponding to the system operation indicator that triggers the alarm, and the alarm level can be the system level corresponding to the system operation indicator that triggers the alarm. Exemplarily, in the system operation indicator of the application layer, the system operation indicator that triggers the alarm can be an application connection failure, the alarm type of the application connection failure can be: application connection message error, the alarm level is the application layer; the system operation indicator that triggers the alarm can be an application response time that is too long, the alarm type of the application connection failure can be an application response time indicator abnormality, the alarm level is the application layer; the system operation indicator that triggers the alarm can be a network connection error, the alarm type of the network connection error can be a network connection keyword abnormality, the alarm level is the network layer; the system operation indicator that triggers the alarm can be an IP (Internet Protocol, Internet Protocol) address conflict, the alarm type of the network connection error can be a network connection state abnormality, the alarm level is the network layer.

[0034] Specifically, corresponding to the multi-location deployment system based on the multi-location deployment architecture, the system operation data of the multi-location deployment system is collected, the system operation data is alarm detected, the abnormal system operation data is detected, the alarm type and abnormal level of the abnormal system operation data are determined, and at least one alarm message is determined.

[0035] S120: Perform anomaly detection on the system operation data according to the alarm level of the alarm information, and determine at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator.

[0036] The abnormal index may be a system operation index with abnormalities in the system operation data. It should be noted that when the system operation index in the system is abnormal, the abnormal system operation index is regarded as the abnormal index.

[0037] Optionally, in an embodiment of the present invention, alarm detection is performed on the collected system operation data of systems deployed in multiple locations to determine whether there is alarm information in the system operation data. When an alarm message exists, it is necessary to perform in-depth anomaly detection on the system operation data. By using the alarm level of the alarm message as a detection guide, anomaly detection is performed on the system operation data to identify all abnormal system operation indicators in the system operation data, and the abnormal system operation indicators are used as abnormal indicators.

[0038] Among them, the abnormal label information can be label information that identifies the abnormal indicator. It should be noted that the abnormal label information includes the indicator type, the detection result information and the abnormal level information. The abnormal label information has 6 digits in total, the first two digits are used to identify the indicator type of the system operation indicator corresponding to the abnormal label information, the middle two digits are used to identify the detection result information, and the last two digits are used to identify the abnormal level information; the indicator type of the system operation indicator can be the data type corresponding to the system operation indicator, for example: performance indicator attendance, log indicator type and link indicator type; the detection result information can be the abnormal classification information corresponding to the abnormal label information; the detection result information includes abnormal interruption, abnormal sudden increase and abnormal sudden decrease, and the abnormal level information can be used to indicate the abnormal hazard degree of the abnormal label information; exemplary, the abnormal level information can be urgent, high, medium and low.

[0039] Optionally, after identifying abnormal indicators in the system operation data, the data type of the system operation indicator corresponding to the abnormal indicator is used as the indicator type of the abnormal label information, the abnormal result corresponding to the abnormal indicator is identified as the detection result information corresponding to the abnormal label information, and the abnormal level information of the abnormal result is assigned to the abnormal indicator, and the abnormal label information of the abnormal indicator is constructed based on the indicator type, detection result information and abnormal level information of the abnormal indicator.

[0040] Specifically, after detecting the presence of alarm information in systems deployed in multiple locations, in-depth anomaly detection is performed on the system operation data, and by using the alarm level of the alarm message as a detection guide, at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator are determined.

[0041] S130: Using a pre-trained fault scenario location model, fault location is performed on the abnormal indicator according to the abnormal label information to determine the fault scenario.

[0042] Among them, the fault scenario location model can be pre-trained based on a neural network model; the neural network model can select a support vector machine algorithm.

[0043] The fault scenario may be a specific manifestation of a fault in a specific environment where the system is deployed in multiple locations. For example, the fault scenario may be a service interruption caused by a network failure in the network layer.

[0044] Specifically, after obtaining the abnormal label information of the abnormal indicator, the abnormal label information is input into a pre-trained fault scenario location model, and the fault scenario location model locates the fault of the abnormal indicator and determines the fault scenario corresponding to the abnormal indicator.

[0045] S140: Recommend a processing solution according to the fault scenario, and determine a fault processing solution corresponding to the fault scenario.

[0046] The fault handling solution may be an operation and maintenance solution for handling faults of abnormal indicators. The fault handling solution may be used to guide system staff to handle abnormalities in system operation data of systems deployed in multiple locations.

[0047] Optionally, the fault handling solution can restore the multi-location deployment system to an abnormality, and the fault handling solution may include four types of disposal solutions: manual, rollback, switching, and flow control. Exemplarily, the manual handling solution may be a handling solution given by a fault handling expert to handle the abnormality; the rollback solution may be when the abnormality in the system is a transaction dimension success rate indicator or a transaction dimension response time indicator, and detect whether there is change data in the latest change window in the system operation data. If so, a rollback solution is recommended, and a rollback operation is performed through the latest change number of the change data; the switching solution may be when the success rate or response time of the indicator of the external service capability of the running instance one in the system operation data of the system is abnormal or the network layer, application layer, and device layer corresponds to the fault scenario, obtain the running instance two in a normal state, switch the running instance one to the running instance two, and realize the recovery of the switching operation; the flow control solution may be when the system operation indicators in the system operation data have a sudden increase in transaction, channel, and provincial and municipal response time labels, and perform flow limiting operations. It should be noted that each disposal solution needs to be reviewed and confirmed by the system review staff of the multi-location deployment system.

[0048] Specifically, by recommending processing solutions for the fault scenarios, fault processing solutions corresponding to different fault scenarios are determined.

[0049] The technical solution of the embodiment of the present invention collects system operation data of systems deployed in multiple locations, performs alarm detection on the system operation data, determines at least one alarm information, performs abnormal detection on the system operation data according to the alarm level of the alarm information, determines at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator, and can effectively determine the abnormal indicators in the system through two abnormal detections, and identify the abnormal indicators in the system through the abnormal label information, thereby improving the accuracy of abnormal recognition; the abnormal indicators are located according to the abnormal label information through the pre-trained fault scenario location model, and the fault scenario corresponding to the abnormal label information is determined; the processing solution is recommended according to the fault scenario, and the fault processing solution corresponding to the fault scenario is determined, and the corresponding fault scenario is determined through the abnormal label information of the abnormal indicator, and the processing solution is recommended for the fault scenario, which can locate the fault more intuitively. The technical problem that the prior art cannot effectively handle the abnormalities in the system is solved, the system detection accuracy of the fault is achieved, the processing speed of the system fault is improved, and the system recovery speed is accelerated.

[0050] Figure 2 This is a flowchart of another fault scenario location and handling method provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiment is a specific scheme for detecting abnormalities in system operation data based on the alarm level. Figure 2 As shown, the method includes:

[0051] S210: Collect system operation data of systems deployed in multiple locations, perform alarm detection on the system operation data, and determine at least one alarm information.

[0052] Optionally, in another optional embodiment of the present invention, the performing alarm detection on the system operation data to determine at least one alarm information includes:

[0053] Acquire at least one abnormal alarm rule corresponding to the multi-location deployment system; perform alarm detection on the system operation data according to the abnormal alarm rule to determine at least one of the alarm information.

[0054] Among them, the abnormal alarm rules can be rules pre-set in the multi-location deployment system for alarm matching of system operation data. It should be noted that the abnormal alarm rules can be set in the application layer, system layer, network layer and device layer respectively, that is, the abnormal alarm rules include application layer abnormal alarm rules, system layer abnormal alarm rules, network layer abnormal alarm rules and device layer abnormal alarm rules; application layer abnormal alarm rules can be rules set in the application layer of the multi-location deployment system for alarm matching; system layer abnormal alarm rules can be rules set in the system layer of the multi-location deployment system for alarm matching; network layer abnormal alarm rules can be rules set in the network layer of the multi-location deployment system for alarm matching; device layer abnormal alarm rules can be rules set in the device layer of the multi-location deployment system for alarm matching.

[0055] Optionally, when matching system operation data of systems deployed in multiple locations through abnormal alarm rules, alarm matching is performed for the system operation data corresponding to the application layer, system layer, network layer and device layer using the application layer abnormal alarm rules, system layer abnormal alarm rules, network layer abnormal alarm rules and device layer abnormal alarm rules respectively to obtain alarm messages corresponding to the application layer, the system layer, the system layer and the system layer.

[0056] Specifically, when matching alarms of systems deployed in multiple locations, obtain the application layer abnormal alarm rules, system layer abnormal alarm rules, network layer abnormal alarm rules and device layer abnormal alarm rules corresponding to each system level of the systems deployed in multiple locations, and use the application layer abnormal alarm rules, system layer abnormal alarm rules, network layer abnormal alarm rules and device layer abnormal alarm rules to perform alarm detection on system operation data, and determine at least one alarm information.

[0057] S220: Perform anomaly detection on the system operation data according to the alarm level of the alarm information by using a preset anomaly detection method, and determine the detection result information corresponding to each of the system operation indicators.

[0058] Optionally, the preset anomaly detection method may be a method pre-set for performing anomaly detection on each system operation indicator. Exemplarily, the anomaly detection method may be a statistically based detection method - a baseline analysis method, a sample distance based detection method - KNN (K-Nearest Neighbors) and a clustering analysis method based on clustering, etc.

[0059] Optionally, in an embodiment of the present invention, the inspection result information corresponding to each system operation indicator is not the same. The inspection result information corresponding to the system operation indicator includes abnormal interruption, abnormal surge, abnormal drop and normal indicator. When the abnormal detection of the system operation indicator is normal, the inspection result information is that the indicator is normal. When the system operation indicator is an indicator data that increases sharply in an instant, it is considered that the abnormal detection result of the system operation identification is an abnormal surge. When the system operation indicator is an indicator data that drops sharply, it is considered that the abnormal detection result of the system operation identification is an abnormal drop. When the system operation indicator is interrupted, it is considered that the abnormal detection result of the system operation indicator is an abnormal interruption.

[0060] Specifically, anomaly detection is performed on each application layer, system layer, network layer and device layer of the system based on the alarm level of the alarm information through a preset anomaly detection method to determine the detection result information corresponding to each system operation indicator.

[0061] S230: Determine the system operation indicator whose detection result information is abnormal interruption, abnormal sudden increase or abnormal sudden decrease as an abnormal indicator, and determine abnormal label information corresponding to each abnormal indicator according to the detection result information of each abnormal indicator.

[0062] Specifically, for the inspection result information of a system operation identification, if the detection result information of a system operation indicator is an abnormal interruption, an abnormal sudden increase or an abnormal sudden decrease, then the system operation indicator is considered to be an abnormal indicator, and the abnormal label information corresponding to each abnormal indicator is determined based on the detection result information of each abnormal indicator.

[0063] Optionally, in another optional embodiment of the present invention, determining the abnormal label information corresponding to each abnormal indicator according to the detection result information of each abnormal indicator includes:

[0064] Obtain the indicator weight and indicator type corresponding to each of the system operation indicators; determine the level weight corresponding to each of the system operation indicators according to the indicator weight of each of the system operation indicators and the detection result information; assign a level to each of the abnormal indicators according to the abnormal level scores corresponding to all of the system operation indicators, and determine the abnormal level information corresponding to each of the abnormal indicators; determine the abnormal label information according to the indicator type, detection result information and abnormal level information of each of the abnormal indicators.

[0065] The indicator weight may be the weight information of the system operation indicator in the multi-location deployment system. It should be noted that different indicator weights are set for the system operation indicators of the multi-location deployment system. The importance of the system operation indicator and the degree of impact on the business determine different indicator weights. For example, in the banking system, the indicator weights of the deposit business and the loan business are set to a higher weight, while the indicator weights of the bank user points or the bank activity business are set to a lower weight.

[0066] Among them, the abnormal level score can be a weight score corresponding to different abnormal indicators. It should be noted that different weight scores are pre-set for the detection result information of the abnormal indicators, and corresponding weight scores are assigned to the abnormal situations corresponding to the inspection result information of the corresponding abnormal indicators. For example, an abnormal sudden increase or abnormal sudden decrease sets an abnormal numerical range, and then the abnormal situation corresponding to the inspection result information is quantified in the abnormal numerical range to determine the weight score of the detection result information in the abnormal numerical range.

[0067] Optionally, for a system operation indicator, a preset indicator weight for each system operation indicator is obtained, and a comprehensive score is calculated based on the weight score of the detection result information and the indicator weight of the system operation indicator to obtain an abnormality level score.

[0068] The abnormality level information may be the abnormality level of each abnormal indicator; it should be noted that the abnormality level information reflects the degree of influence of the abnormal indicator on the multi-location deployment system, and the abnormality level information includes four levels: emergency, high, medium, and low. The emergency level has a serious impact on the business of the multi-location deployment system and may cause system business interruption; the high level has a greater impact on the business of the multi-location deployment system, and emergency measures need to be taken immediately to deal with it; the medium level has a certain impact on the business of the multi-location deployment system; and the low level has a small impact on the business of the multi-location deployment system.

[0069] Optionally, after obtaining the abnormal level score corresponding to each abnormal indicator, a score range corresponding to each abnormal level information is set for the abnormal indicator based on all the abnormal level scores, and then the abnormal indicator is assigned a level according to the score range to determine the abnormal level information corresponding to each abnormal indicator.

[0070] Specifically, obtain the indicator weight and indicator type corresponding to each system operation indicator; determine the abnormal level score corresponding to each system operation indicator according to the indicator weight and detection result information of each system operation indicator; assign a level to each abnormal indicator according to the abnormal level scores corresponding to all system operation indicators, and determine the abnormal level information corresponding to each abnormal indicator; determine the abnormal label information according to the indicator type, detection result information and abnormal level information of each abnormal indicator.

[0071] S240: Perform fault location on the abnormal indicator according to the abnormal label information using a pre-trained fault scenario location model to determine the fault scenario.

[0072] S250: Recommend a processing solution according to the fault scenario, and determine a fault processing solution corresponding to the fault scenario.

[0073] Optionally, in another optional embodiment of the present invention, before locating the fault of the abnormal indicator according to the abnormal label information through the pre-trained fault scenario location model and determining the fault scenario, it also includes:

[0074] Obtaining at least one abnormal alarm rule and system training operation indicator corresponding to the multi-location deployment system;

[0075] Performing fault detection on the system training operation indicator through the abnormal alarm rule to determine at least one training alarm information; wherein the training alarm information includes a training alarm type and an alarm level;

[0076] Performing anomaly detection on the training alarm information according to the alarm level of the training alarm information, and determining at least one training indicator and abnormal label information corresponding to each of the training indicators;

[0077] The pre-built positioning model is trained by using a pre-set fault scenario knowledge base, the abnormal label information corresponding to the training indicator and the abnormal alarm rule to determine the fault scenario positioning model.

[0078] The system training operation index may be a system operation index pre-collected for training a fault scenario location model. It should be noted that the system training operation index may be a system operation index based on anomalies in the historical operation period of the multi-location deployment system.

[0079] The training alarm information may be alarm information of a fault scenario location model used for training.

[0080] The training index may be an abnormal index of a fault scenario location model used for training.

[0081] Among them, the fault scenario knowledge base can be a knowledge base of a fault scenario location model pre-set for training; the fault scenario knowledge base can be a knowledge collection method of experts deploying systems in multiple locations to collect various fault scenarios of various technology stacks under the application layer, system layer, network layer, and device layer, and build at least one fault scenario knowledge base based on the collected fault scenarios. Optionally, corresponding fault scenario knowledge bases can be set for the application layer, system layer, network layer, and device layer respectively.

[0082] The positioning model may be a model to be trained that is pre-built based on a support vector machine algorithm.

[0083] Specifically, the training process of the fault scenario localization model for the system deployed in multiple locations is as follows: by obtaining at least one abnormal alarm rule and system training operation indicator corresponding to the system deployed in multiple locations, fault detection is performed on the system training operation indicator through the abnormal alarm rule, at least one of the training alarm information is determined, and the training alarm information is detected for abnormality according to the alarm level of the training alarm information, and at least one training indicator and abnormal label information corresponding to each training indicator are determined. The pre-constructed positioning model is trained through a pre-set fault scenario knowledge base, abnormal label information corresponding to the training indicator, and abnormal alarm rules to determine the fault scenario localization model.

[0084] Optionally, in another optional embodiment of the present invention, the pre-built positioning model is trained by using a pre-set fault scenario knowledge base, abnormal label information and the abnormal alarm rule to determine the fault scenario positioning model, including:

[0085] Mapping each of the abnormal alarm rules into training label data;

[0086] Constructing an indicator label library according to the training label data and the abnormal label information corresponding to the training indicators;

[0087] Performing correlation calculation on the fault scenario knowledge base and the indicator label library to determine the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library;

[0088] If the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library meets the preset correlation threshold, it is determined as model training data;

[0089] The positioning model is trained using the model training data to determine the fault scenario positioning model.

[0090] The training label data may be label data obtained by mapping the abnormal alarm rule. It should be noted that for each abnormal alarm rule, the corresponding training label data is defined, the indicator type of the system operation indicator detected by the abnormal alarm rule is used as the indicator type of the training label data, the alarm matching of the system operation indicator detected by the abnormal alarm rule is defined as the inspection result information corresponding to the training label data, and the abnormal level information is assigned to the training label data based on the indicator weight and the detection result information of the system operation indicator, thereby constructing the training label data.

[0091] The indicator label library can be a label database constructed based on training label data and abnormal label information. At least one indicator label corresponding to each system operation indicator is stored in the indicator label library. The indicator label is composed of training label data and abnormal label information. The indicator label library can be used to train the fault scenario location model.

[0092] Among them, the correlation between the fault scenarios of each fault scenario knowledge base and the indicator labels of each indicator label library can be the correlation degree between the fault scenarios and each indicator label, that is, the correlation between the composition of the fault scenarios and the indicator labels of each system operation indicator. The higher the correlation degree between the fault scenarios and each indicator label, the higher the degree of influence of the indicator labels of the system operation indicators on the fault scenarios; the lower the correlation degree between the fault scenarios and each indicator label, the lower the degree of influence of the indicator labels of the system operation indicators on the fault scenarios.

[0093] The preset correlation threshold may be threshold information pre-set to determine the correlation between the fault scenario and each indicator label. It should be noted that if the correlation between the fault scenario and an indicator label is greater than the preset correlation threshold, it is considered that the fault scenario is associated with the indicator label; if the correlation between the fault scenario and an indicator label is less than the preset correlation threshold, it is considered that the fault scenario is not associated with the indicator label.

[0094] The model training data may be a fault scenario used to train a fault scenario location model and an indicator label corresponding to the fault scenario.

[0095] Specifically, each abnormal alarm rule is mapped to training label data, an indicator label library is constructed according to the training label data and the abnormal label information corresponding to the training indicators, the fault scenario knowledge base and the indicator label library are correlated, and the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library is determined. If the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library meets a preset correlation threshold, it is determined as model training data, and the positioning model is trained using the model training data to determine the fault scenario positioning model.

[0096] The technical solution of the embodiment of the present invention matches the system operation data with alarms through the abnormal alarm rules of each system level, effectively improves the accuracy of the alarm, and performs abnormal detection on the system operation indicators through a preset abnormal detection method to determine at least one abnormal indicator; based on the weight and scoring mechanism, the abnormal level is assigned to each abnormal indicator, which can effectively determine the degree of influence of each abnormal indicator on the system, improve the accuracy of the abnormal label information, and through two abnormal detections, the abnormal indicators in the system can be effectively determined, and the abnormal indicators of the system are identified by the abnormal label information, so as to improve the accuracy of the recognition of the abnormality; through the pre-trained fault scenario positioning model, the abnormal indicators are fault-located according to the abnormal label information, and the fault scenario corresponding to the abnormal label information is determined; according to the fault scenario, a processing solution is recommended, and the fault processing solution corresponding to the fault scenario is determined, and the corresponding fault scenario is determined by the abnormal label information of the abnormal indicator, and a processing solution is recommended for the fault scenario, which can locate the fault more intuitively. The technical problem that the prior art cannot effectively handle the abnormalities in the system is solved, the system detection accuracy of the fault is obtained, the processing speed of the system fault is improved, and the system recovery speed is accelerated.

[0097] Figure 3 A schematic diagram of the structure of a fault scene location and handling device provided by an embodiment of the present invention. Figure 3 As shown, the device includes: a fault alarm module 310, an abnormality detection module 320, a fault scenario detection module 330 and a processing module 340; wherein,

[0098] A fault alarm module 310 is used to collect system operation data of systems deployed in multiple locations, perform alarm detection on the system operation data, and determine at least one alarm information, wherein the alarm information includes an alarm type and an alarm level;

[0099] An anomaly detection module 320, configured to perform anomaly detection on the system operation data according to the alarm level of the alarm information, and determine at least one anomaly indicator and anomaly label information corresponding to each anomaly indicator;

[0100] A fault scenario detection module 330 is used to locate the fault of the abnormal indicator according to the abnormal label information through a pre-trained fault scenario location model to determine the fault scenario;

[0101] The processing module 340 is used to recommend a processing solution according to the fault scenario and determine a fault processing solution corresponding to the fault scenario.

[0102] The technical solution of the embodiment of the present invention collects system operation data of systems deployed in multiple locations, performs alarm detection on the system operation data, determines at least one alarm information, performs abnormal detection on the system operation data according to the alarm level of the alarm information, determines at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator, and can effectively determine the abnormal indicators in the system through two abnormal detections, and identify the abnormal indicators of the system through abnormal label information, thereby improving the accuracy of abnormal recognition; the abnormal indicators are fault-located according to the abnormal label information through the pre-trained fault scenario location model, and the fault scenario corresponding to the abnormal label information is determined; processing solutions are recommended according to the fault scenario, and the fault processing solutions corresponding to the fault scenario are determined, and the corresponding fault scenarios are determined through the abnormal label information of the abnormal indicators, and processing solutions are recommended for the fault scenarios, which can locate the fault more intuitively. The technical problem that the prior art cannot effectively handle the abnormalities in the system is solved, the system fault detection accuracy is achieved, the processing speed of the system fault is improved, and the system recovery speed is accelerated.

[0103] Optionally, the fault alarm module 310 is specifically used for:

[0104] Obtaining at least one abnormal alarm rule corresponding to the multi-location deployment system;

[0105] The system operation data is subjected to alarm detection according to the abnormal alarm rule to determine at least one alarm information.

[0106] The abnormal alarm rules include application layer abnormal alarm rules, system layer abnormal alarm rules, network layer abnormal alarm rules and device layer abnormal alarm rules.

[0107] The system operation data includes at least one system operation indicator;

[0108] Optionally, the anomaly detection module 320 is specifically used for:

[0109] Performing anomaly detection on the system operation data according to the alarm level of the alarm information by a preset anomaly detection method, and determining the detection result information corresponding to each of the system operation indicators; wherein the detection result information includes abnormal interruption, abnormal sudden increase, abnormal sudden decrease and normal indicators;

[0110] The system operation indicator whose detection result information is abnormal interruption, abnormal sudden increase or abnormal sudden decrease is determined as an abnormal indicator, and the abnormal label information corresponding to each abnormal indicator is determined according to the detection result information of each abnormal indicator.

[0111] Optionally, the anomaly detection module 320 is further configured to:

[0112] Obtaining the indicator weight and indicator type corresponding to each of the system operation indicators;

[0113] Determine the abnormality level score corresponding to each of the system operation indicators according to the indicator weight of each of the system operation indicators and the detection result information;

[0114] Assigning a level to each abnormal indicator according to the abnormal level scores corresponding to all the system operation indicators, and determining the abnormal level information corresponding to each abnormal indicator;

[0115] The abnormal label information is determined according to the indicator type, detection result information and abnormal level information of each abnormal indicator; wherein the abnormal label information includes the indicator type, the detection result information and the abnormal level information.

[0116] Optionally, the system further includes: a data preparation module, a training alarm module, a training detection module and a model training module; wherein,

[0117] A data preparation module, used to obtain at least one abnormal alarm rule and system training operation indicator corresponding to the multi-location deployment system;

[0118] A training alarm module, used to perform fault detection on the system training operation index through the abnormal alarm rule, and determine at least one training alarm information; wherein the training alarm information includes an alarm type and an alarm level;

[0119] A training detection module, used to perform anomaly detection on the training alarm information according to the alarm level of the training alarm information, and determine at least one training indicator and abnormal label information corresponding to each training indicator;

[0120] The model training module is used to perform model training on a pre-built positioning model through a pre-set fault scenario knowledge base, abnormal label information corresponding to the training indicators and the abnormal alarm rules to determine the fault scenario positioning model.

[0121] Optionally, the model training module is specifically used to: map each of the abnormal alarm rules into training label data;

[0122] Constructing an indicator label library according to the training label data and the abnormal label information corresponding to the training indicators;

[0123] Performing correlation calculation on the fault scenario knowledge base and the indicator label library to determine the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library;

[0124] If the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library meets the preset correlation threshold, it is determined as model training data;

[0125] The positioning model is trained using the model training data to determine the fault scenario positioning model.

[0126] The fault scenario location and handling device provided in the embodiment of the present invention can execute the fault scenario location and handling method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0127] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their modes are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0128] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0129] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer grid such as the Internet and / or various telecommunication grids.

[0130] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as fault scenario location and handling methods.

[0131] In some embodiments, the fault scenario location and handling method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the fault scenario location and handling method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the fault scenario location and handling method in any other appropriate manner (e.g., by means of firmware).

[0132] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0133] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the modes / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0134] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0135] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0136] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a grid browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication grid). Examples of communication grids include: a local area network (LAN), a wide area network (WAN), a blockchain grid, and the Internet.

[0137] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication grid. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0138] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0139] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the method steps of locating and handling fault scenarios provided in any embodiment of the present invention are implemented. The method includes:

[0140] Collecting system operation data of systems deployed in multiple locations, performing alarm detection on the system operation data, and determining at least one alarm information, wherein the alarm information includes an alarm type and an alarm level;

[0141] Performing anomaly detection on the system operation data according to the alarm level of the alarm information, and determining at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator;

[0142] Performing fault location on the abnormal indicator according to the abnormal label information through a pre-trained fault scenario location model to determine the fault scenario;

[0143] A processing solution is recommended based on the fault scenario, and a fault processing solution corresponding to the fault scenario is determined.

[0144] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0145] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0146] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0147] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of grid, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0148] It should be understood by those skilled in the art that the above modules or steps of the present invention can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a grid composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0149] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0150] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for locating and handling fault scenarios, characterized in that: include: Collecting system operation data of systems deployed in multiple locations, performing alarm detection on the system operation data, and determining at least one alarm information, wherein the alarm information includes an alarm type and an alarm level; Performing anomaly detection on the system operation data according to the alarm level of the alarm information, and determining at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator; Performing fault location on the abnormal indicator according to the abnormal label information through a pre-trained fault scenario location model to determine the fault scenario; A processing solution is recommended based on the fault scenario, and a fault processing solution corresponding to the fault scenario is determined.

2. The method according to claim 1, characterized in that The performing alarm detection on the system operation data to determine at least one alarm information includes: Obtaining at least one abnormal alarm rule corresponding to the multi-location deployment system; The system operation data is subjected to alarm detection according to the abnormal alarm rule to determine at least one alarm information.

3. The method according to claim 2, characterized in that The abnormal alarm rules include application layer abnormal alarm rules, system layer abnormal alarm rules, network layer abnormal alarm rules and device layer abnormal alarm rules.

4. The method according to claim 1, characterized in that: The system operation data includes at least one system operation indicator; The performing abnormality detection on the system operation data according to the alarm level of the alarm information to determine at least one abnormal label information includes: Performing anomaly detection on the system operation data according to the alarm level of the alarm information by a preset anomaly detection method, and determining the detection result information corresponding to each of the system operation indicators; wherein the detection result information includes abnormal interruption, abnormal sudden increase, abnormal sudden decrease and normal indicators; The system operation indicator whose detection result information is abnormal interruption, abnormal sudden increase or abnormal sudden decrease is determined as an abnormal indicator, and the abnormal label information corresponding to each abnormal indicator is determined according to the detection result information of each abnormal indicator.

5. The method according to claim 4, characterized in that The determining, according to the detection result information of each abnormal indicator, the abnormal label information corresponding to each abnormal indicator comprises: Obtaining the indicator weight and indicator type corresponding to each of the system operation indicators; Determine the abnormality level score corresponding to each of the system operation indicators according to the indicator weight of each of the system operation indicators and the detection result information; Assigning a level to each abnormal indicator according to the abnormal level scores corresponding to all the system operation indicators, and determining the abnormal level information corresponding to each abnormal indicator; The abnormal label information is determined according to the indicator type, detection result information and abnormal level information of each abnormal indicator; wherein the abnormal label information includes the indicator type, the detection result information and the abnormal level information.

6. The method according to claim 1, characterized in that Before locating the fault of the abnormal indicator according to the abnormal label information by using the pre-trained fault scenario location model and determining the fault scenario, it also includes: Obtaining at least one abnormal alarm rule and system training operation indicator corresponding to the multi-location deployment system; Performing fault detection on the system training operation indicator through the abnormal alarm rule to determine at least one training alarm information; wherein the training alarm information includes an alarm type and an alarm level; Performing anomaly detection on the training alarm information according to the alarm level of the training alarm information, and determining at least one training indicator and abnormal label information corresponding to each of the training indicators; The pre-built positioning model is trained by using a pre-set fault scenario knowledge base, the abnormal label information corresponding to the training indicator and the abnormal alarm rule to determine the fault scenario positioning model.

7. The method according to claim 6, characterized in that The method of training a pre-built positioning model by using a pre-set fault scenario knowledge base, abnormal label information, and the abnormal alarm rule to determine the fault scenario positioning model includes: Mapping each of the abnormal alarm rules into training label data; Constructing an indicator label library according to the training label data and the abnormal label information corresponding to the training indicator; Performing correlation calculation on the fault scenario knowledge base and the indicator label library to determine the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library; If the correlation between the fault scenario of each fault scenario knowledge base and the indicator label of each indicator label library meets the preset correlation threshold, it is determined as model training data; The positioning model is trained using the model training data to determine the fault scenario positioning model.

8. A fault scene location and handling device, characterized in that: include: A fault alarm module, used to collect system operation data of systems deployed in multiple locations, perform alarm detection on the system operation data, and determine at least one alarm information, wherein the alarm information includes an alarm type and an alarm level; An anomaly detection module, used to perform anomaly detection on the system operation data according to the alarm level of the alarm information, and determine at least one abnormal indicator and abnormal label information corresponding to each abnormal indicator; A fault scenario detection module is used to locate the fault of the abnormal indicator according to the abnormal label information through a pre-trained fault scenario location model to determine the fault scenario; The processing module is used to recommend a processing solution according to the fault scenario and determine the fault processing solution corresponding to the fault scenario.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the fault scenario location and handling method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the fault scenario location and handling method described in any one of claims 1 to 7 when executed.

Images