Analytical question and answer method and device for operation and maintenance logs based on large language model

Abstract

The invention discloses an operation and maintenance log analysis question and answer method and device based on a large language model. The method is characterized by comprising the following steps: responding to a log question dialogue of a user through a pre-trained log processing large model, and determining a log analysis demand and a log query statement corresponding to the log analysis demand according to the log question dialogue; performing distributed semantic search in a preset log database according to the log query statement, and determining target log information; and generating a log answer of the log question dialogue through the log processing large model according to the target log information and the log analysis demand. By means of the log processing large model, the natural language can be understood and generated, key information can be extracted from log data, questions can be answered in the form of the natural language, large-scale and complex operation and maintenance log data can be automatically processed, analyzed and explained, and therefore the log monitoring efficiency and the operation and maintenance decision accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of log management, and in particular to a method and device for analyzing and answering questions of operation and maintenance logs based on a large language model. Background Art

[0002] With the rapid development of information technology, enterprises are increasingly dependent on information systems. The normal operation of the system is crucial to ensuring business continuity and improving work efficiency. With the continuous expansion of system scale and the increasing complexity of business needs, the amount of system log data is huge and the format is diverse. Due to the complexity and magnitude of log data, traditional log analysis methods are difficult to perform log analysis on massive log data and cannot support the operation and maintenance of information systems. In addition, the operating status and performance indicators of information systems are constantly changing. Traditional log analysis methods are too inefficient and cannot respond quickly to various emergencies. Although existing technologies can be applied to log analysis and system operation and maintenance through artificial intelligence technology, they are unable to analyze log data sufficiently and cannot provide efficient suggestions for the operation and maintenance of information systems. Summary of the invention

[0003] The present invention provides a method and device for analyzing and answering questions of operation and maintenance logs based on a large language model, so as to solve the technical problem that the log information cannot be analyzed quickly and efficiently in the prior art.

[0004] According to one aspect of the present invention, a method for analyzing and answering questions of operation and maintenance logs based on a large language model is provided, comprising:

[0005] Responding to the user's log question dialogue through a pre-trained log processing large model, and determining the log analysis requirements and the log query statements corresponding to the log analysis requirements according to the log question dialogue;

[0006] Performing a distributed semantic search in a preset log database according to the log query statement to determine target log information;

[0007] The log processing macromodel generates a log answer to the log question dialogue according to the target log information and the log analysis requirements.

[0008] According to another aspect of the present invention, there is provided a device for analyzing and answering questions of operation and maintenance logs based on a large language model, comprising:

[0009] A question-and-answer module, used to respond to a user's log question dialogue through a pre-trained log processing large model, and determine a log analysis requirement and a log query statement corresponding to the log analysis requirement according to the log question dialogue;

[0010] A log search module, used to perform a distributed semantic search in a preset log database according to the log query statement to determine the target log information;

[0011] The answering module is used to generate a log answer to the log question dialogue according to the target log information and the log analysis requirements through the log processing big model.

[0012] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the analysis and question-answering method of operation and maintenance logs based on a large language model as described in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the analysis and question-answering method for operation and maintenance logs based on a large language model as described in any embodiment of the present invention when executed.

[0017] The technical solution of the embodiment of the present invention responds to the user's log question dialogue through a pre-trained log processing large model, determines the log analysis requirements and the log query statement corresponding to the log analysis requirements according to the log question dialogue, and can automatically analyze the user's log operation and maintenance requirements through the log processing large model, effectively improving the efficiency and quality of log analysis; according to the log query statement, a distributed semantic search is performed in a preset log database to determine the target log information, and the log query statement can automatically extract logs from the log database, thereby improving the efficiency of log information acquisition and log analysis; the log processing large model generates the log answer of the log question dialogue according to the target log information and the log analysis requirements, and the log processing large model can perform data analysis on the target log information, improve the accuracy and intelligence of log analysis, and improve the efficiency of log information processing. The technical problem that the log information cannot be analyzed quickly and efficiently in the prior art is solved. The log processing large model can understand and generate natural language, extract key information from log data, and answer questions in the form of natural language, and can automatically process, analyze and interpret large-scale and complex operation and maintenance log data, thereby improving the monitoring efficiency of the log and the accuracy of operation and maintenance decisions.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A flowchart of a method for analyzing and answering questions of operation and maintenance logs based on a large language model is provided for an embodiment of the present invention;

[0021] Figure 2 A flowchart of another method for analyzing and answering questions of operation and maintenance logs based on a large language model provided by an embodiment of the present invention;

[0022] Figure 3 A flowchart of another method for analyzing and answering questions of operation and maintenance logs based on a large language model provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of the structure of a large language model-based operation and maintenance log analysis and question-answering device provided in an embodiment of the present invention;

[0024] Figure 5 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Figure 1 A flowchart of a method for analyzing and answering operation and maintenance logs based on a large language model is provided for an embodiment of the present invention. This embodiment is applicable to the situation where log analysis is performed on operation and maintenance logs. The method can be executed by an analysis and answering device for operation and maintenance logs based on a large language model. The analysis and answering device for operation and maintenance logs based on a large language model can be implemented in the form of hardware and / or software. The analysis and answering device for operation and maintenance logs based on a large language model can be configured in an electronic device.

[0028] like Figure 1 As shown, the method includes:

[0029] S110. Respond to the user's log question dialogue through a pre-trained log processing large model, and determine the log analysis requirements and the log query statements corresponding to the log analysis requirements according to the log question dialogue.

[0030] Among them, the log processing large model can be a large language model pre-trained for in-depth analysis of operation and maintenance logs. When training the log processing large model, it is trained through a large amount of unlabeled text and log information related to the log. It can understand the user's questions about the log information, analyze the log information, and answer the user's questions.

[0031] Among them, the log question dialogue can be a log analysis dialogue input by the user to the log processing big model; the log analysis requirement can be a log analysis requirement sent by the user to the log processing big model. It should be noted that when the user needs to perform operation and maintenance analysis on the log information, he / she enters the log question dialogue corresponding to the operation and maintenance analysis requirement in the language input box provided by the log processing big model, and puts forward the analysis requirement for the log information. Exemplarily, the log question dialogue can be "Compare the deposit log information of the day before yesterday and yesterday", and the log analysis requirement can be the similarities and differences between the deposit log information of the day before yesterday and yesterday.

[0032] Optionally, when the user communicates with the log processing model, the user can communicate with the log processing model multiple times and input the conversation content multiple times. The log language model will reply to the conversation content input by the user each time and give corresponding conversation replies.

[0033] The log query statement may be a query statement for querying log information. It should be noted that when the log language model receives a log question dialogue from a user, it can analyze the user's demand for log information in the log question dialogue through semantic recognition, obtain the log analysis demand, and then automatically combine the log query statement to meet the user's log analysis demand.

[0034] Specifically, the pre-trained log processing big model can provide a language input box to the user. The user inputs the log question dialogue in the language input box and inputs the log question dialogue into the log processing big model. The log processing big model responds to the user's log question dialogue, performs semantic analysis on the log question dialogue, and determines the log analysis requirements of the log question dialogue and the log query statements corresponding to the log analysis requirements.

[0035] S120: Perform a distributed semantic search in a preset log database according to the log query statement to determine target log information.

[0036] The log database may be a database pre-set to store various log information. It should be noted that the log database may be pre-created, and the log database can receive various types of log information in real time and store the log information.

[0037] Optionally, in an embodiment of the present invention, the log database may adopt a distributed database, allowing multiple servers to work together. Each server may run multiple Elasticsearch instances. After the log processing large model determines the log query statement, the log query statement is sent to the distributed database, and a distributed semantic search is performed in the distributed database through the log query statement to obtain the query result in the distributed database.

[0038] The target log information may be a query result obtained by querying a log database through a log query statement.

[0039] Specifically, the log query statement is sent to the distributed database, and a distributed semantic search is performed in the distributed database through the log query statement to obtain the target log information.

[0040] S130: Generate a log answer to the log question dialogue according to the target log information and the log analysis requirements through the log processing macro model.

[0041] The log answer may be the answer information output by the log processing model. It should be noted that the log answer is the answer information output by the log processing model. When the log processing model displays the log answer, it also displays the log analysis results of the target log information and the target log information, and displays the queried log information and log analysis results to the user, so as to ensure the integrity of the output log answer.

[0042] Optionally, after the target log information is queried in the log database, the log database returns the queried target log information to the log processing big model. The log processing big model receives the target log information, and the log processing big model analyzes the target log information according to the log analysis requirements of the target question dialogue, determines the log analysis result, and combines the target log information and the log analysis result into a log answer for display.

[0043] The technical solution of the embodiment of the present invention responds to the user's log question dialogue through a pre-trained log processing large model, determines the log analysis requirements and the log query statement corresponding to the log analysis requirements according to the log question dialogue, and can automatically analyze the user's log operation and maintenance requirements through the log processing large model, effectively improving the efficiency and quality of log analysis; according to the log query statement, a distributed semantic search is performed in a preset log database to determine the target log information, and the log query statement can automatically extract logs from the log database, thereby improving the efficiency of log information acquisition and log analysis; the log processing large model generates the log answer of the log question dialogue according to the target log information and the log analysis requirements, and the log processing large model can perform data analysis on the target log information, improve the accuracy and intelligence of log analysis, and improve the efficiency of log information processing. The technical problem that the log information cannot be analyzed quickly and efficiently in the prior art is solved. The log processing large model can understand and generate natural language, extract key information from log data, and answer questions in the form of natural language, and can automatically process, analyze and interpret large-scale and complex operation and maintenance log data, thereby improving the monitoring efficiency of the log and the accuracy of operation and maintenance decisions.

[0044] Figure 2 This is a flowchart of another method for analyzing and answering questions in operation and maintenance logs based on a large language model provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiment is the specific process of updating the performance of the log processing large model based on the user's log search record. Figure 2 As shown, the method includes:

[0045] S210. Respond to the user's log question dialogue through the pre-trained log processing large model, and determine the log analysis requirements and the log query statements corresponding to the log analysis requirements according to the log question dialogue.

[0046] S220: Perform a distributed semantic search in a preset log database according to the log query statement to determine target log information.

[0047] S230: Collect log search records from the log database.

[0048] The log search record may be a record of the log information being searched recorded in the log database; the search time of each searched log information is recorded in the log search record, and the search frequency or number of searches for each searched log information within a certain period of time can be counted through the log search record.

[0049] Specifically, data is collected in a log database to obtain log search records of the log database.

[0050] S240: Update the log processing model according to the log information corresponding to the log search record.

[0051] Optionally, searching the log search records of log information in the log database can determine the trend of log analysis within a certain period of time, and then obtaining the log information corresponding to the log search records to retrain the log processing model to improve the log processing model's ability to process log information.

[0052] Optionally, in another optional embodiment of the present invention, the log processing large model is updated according to the log information corresponding to the log search record.

[0053] The number of log searches corresponding to the log information is queried in the log search record, and the log information of interest is determined according to the number of log searches; log monitoring information corresponding to a preset distributed messaging system is obtained; the log monitoring information is updated according to the log information of interest, and updated log monitoring information is determined; and the log processing model is updated according to the updated log monitoring information and the log information corresponding to the log search record.

[0054] The number of log searches may be the number of times each log information in the log database is searched. It should be noted that, in order to improve the timeliness of information, when determining the number of log searches for log information in the log search record, when querying the log search record, log search records within a certain time range are selected to perform a statistical query of the number of log searches to determine the number of log searches corresponding to each log information.

[0055] The log information of interest may be the log information with a higher search count. It should be noted that after obtaining the log search count of the log information, the log search counts are arranged from large to small, and the log information with a higher ranking is used as the log information of interest. Exemplarily, the log information of interest may be the top 10 log information.

[0056] The log monitoring information may be log information in the log database that needs to be monitored. The distributed message system may be a pre-set distributed message queue, through which the log information stored in the log database in real time can be monitored, and the log information matching the log monitoring information can be collected from the log information stored in the log database in real time.

[0057] Specifically, the log search times corresponding to each log information is queried in the log search record, and the top log information is selected as the log information of interest by arranging the log search times. The log monitoring information corresponding to the distributed messaging system is obtained, and the log information of interest is updated to the log monitoring information. The updated log monitoring information is determined, and the log processing model is updated according to the updated log monitoring information and the log information corresponding to the log search record.

[0058] Optionally, in another optional embodiment of the present invention, the log processing model is updated according to the updated log monitoring information and the log information corresponding to the log search record.

[0059] Performing log matching on the log database through the updated log monitoring information to determine the target upload log;

[0060] The target upload log is sent to a distributed messaging system; the target upload log is subscribed to in the distributed messaging system through the log processing big model, and the log processing big model is updated according to the target upload log.

[0061] Among them, the target upload log can be the log information generated by the data source connected to the log database in real time and successfully matched with the log monitoring information. It should be noted that the log database is connected to at least one data source. After the data source generates log information, it sends the log information to the log database for storage. The distributed messaging system establishes a connection with the log database, and can monitor and match the log information sent by the data source connected to the log database in real time, and monitor the log data. When the log information sent by the connected data source successfully matches the updated log monitoring information, the successfully matched log information is collected as the target upload log, and the target upload log is uploaded to the distributed messaging system.

[0062] Optionally, the distributed messaging system creates a corresponding topic for the updated log monitoring information, which is used to receive the target upload log uploaded by the log database, and creates a consumer program for the log processing large model. The log processing large model subscribes to the topic corresponding to the target upload log through the consumer program, and the log processing large model obtains the target upload log through the distributed messaging system. Among them, the distributed consumer system can be a messaging system based on Apache Kafka. By providing persistent storage for log data through Kafka, log data can be monitored and processed in real time.

[0063] Specifically, the log database is log-matched through the updated log monitoring information, the target upload log in the log database that matches the log monitoring information is determined, the target upload log is sent to the distributed messaging system, the log processing big model subscribes to the target upload log in the distributed messaging system, the distributed messaging system sends the target upload log to the log processing big model, and the log processing big model is updated through the target upload log. The performance of the log processing big model can be updated according to real-time log data, which effectively improves the performance of the log processing big model.

[0064] Optionally, in another optional embodiment of the present invention, updating the log processing large model according to the target upload log includes:

[0065] Perform log cleaning and keyword extraction on the target upload log to determine processing log information; perform feature extraction on the processing log information through natural language processing and machine learning algorithms to determine log training vectors; and update the log processing large model through the log training vectors.

[0066] Among them, the processing log information can be the log information obtained by preprocessing the target upload log. Optionally, there is certain irrelevant information in the target upload log, and the target upload log may have different log formats. It is necessary to clean the target upload log to remove irrelevant information and duplicate information from the log information; and parse the log format to extract the valid information in the target upload log, extract the key fields of the valid information in the target upload log, obtain the key log fields, and obtain the processing log information corresponding to the target upload log.

[0067] Optionally, after obtaining the processed log information, natural language processing is performed on the processed log information, and text segmentation and named entity recognition are performed on the processed log information to obtain each valid word in the processed log information and the part-of-speech tag corresponding to each word, and at least one word of the processed log information is obtained. The word of the processed log information is subjected to feature extraction through a machine learning algorithm to obtain a log training vector. Among them, the log training vector can be a vector feature used to update the model of the log processing large model, the log training vector can be a feature vector of the processed log information, and the log training vector can be a word vector. The present invention does not limit the machine learning algorithm. Exemplarily, the machine learning algorithm can use a recurrent neural network and a topic model of deep learning.

[0068] Optionally, after obtaining the log training vector, the log training vector is input into the log processing model, and the log processing model optimizes the model parameters of the log processing model by an online learning method to obtain an optimized log processing model.

[0069] Specifically, the target uploaded log is cleaned and keywords are extracted to determine the processing log information; the feature extraction of the processed log information is performed through natural language processing and machine learning algorithms to determine the log training vector; the log processing large model is updated through the log training vector.

[0070] S250: Generate a log answer to the log question dialogue according to the target log information and the log analysis requirements through the log processing macro model.

[0071] The technical solution of the embodiment of the present invention sets a distributed message system between the log database and the log processing big model, monitors the real-time log information of the log database in real time through the distributed message system, and performs model performance training on the log processing big model by extracting real-time log information, thereby effectively improving the performance of the model, improving the accuracy and intelligence of the model, effectively reducing the dependence of log operation and maintenance on professional and technical personnel, and simplifying the analysis process of log operation and maintenance.

[0072] Figure 3 This is a flowchart of another method for analyzing and answering questions in operation and maintenance logs based on a large language model provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiment is the specific process of providing operation and maintenance analysis results and decision support to log operation and maintenance personnel. Figure 3 As shown, the method includes:

[0073] S310. Respond to the user's log question dialogue through the pre-trained log processing large model, and determine the log analysis requirements and the log query statements corresponding to the log analysis requirements according to the log question dialogue.

[0074] S320: Perform a distributed semantic search in a preset log database according to the log query statement to determine target log information.

[0075] S330: If it is detected that the user has selected a decision support option in the log processing big model, the log processing big model generates the log answer according to the decision support option, the log analysis requirement and the target log information.

[0076] Among them, the decision support option can be an optional control pre-integrated in the log processing big model, and each decision support option corresponds to a decision support; exemplary, the decision support can include providing performance optimization suggestions, troubleshooting guidance and security reinforcement measures. Optionally, in an embodiment of the present invention, the log processing big model also provides at least one decision support option, and the decision support option can be integrated in the log processing big model. When the user inputs the log question submission dialogue to the log processing big model, the user can select at least one decision support option, and the log processing big model will provide decision support for the user according to the decision support option selected by the user. In the present invention, if the log processing big model detects that the user has not selected a decision support option after inputting the log question submission dialogue, the log processing big model will automatically generate a dialogue to ask the user whether the decision support option is needed, and provide at least one decision support option, and the user can select at least one decision support option through dialogue or selection.

[0077] Optionally, if the log processing big model detects that the user did not select a decision support option after entering the dialog for submitting a log question, the log processing big model will automatically generate a dialog to ask the user whether he needs a decision support option. If the user chooses not to select any decision support option, the log processing big model will automatically match a decision support option based on the target log information to provide decision support to the user.

[0078] Specifically, the daily processing large model obtains the target log information sent back, detects the decision support options selected by the user, determines the decision support required by the user, generates log answers based on the decision support options, log analysis requirements and target log information, and displays the log answers.

[0079] Optionally, in another optional embodiment of the present invention, the log answer includes log analysis results and decision suggestions;

[0080] The log processing big model generates the log answer according to the decision support option, the log analysis requirement and the target log information, including:

[0081] Performing log analysis according to the target log information and the log analysis requirements through the log processing big model, and determining the log analysis result of the log question dialogue;

[0082] The log processing large model uses a preset data mining algorithm to perform decision analysis based on the log analysis results and the decision support options to determine the decision recommendation.

[0083] Among them, the log analysis result can be the result of the log processing large model analyzing the target log information. Optionally, when displaying the log analysis result, the log processing large model simultaneously displays the target log information corresponding to the log analysis result, and calls the visualization library pre-integrated in the log processing large model to generate dynamic and cross-cloud visualization effects of the log analysis results and target log information through the visualization library. Exemplarily, the visualization library can be SVG (Scalable Vector Graphics) and CSS (Cascading Style Sheets).

[0084] The preset data mining algorithm may be an algorithm pre-set for decision analysis based on target log information and decision support options. Exemplarily, the preset data mining algorithm may be association rule mining, cluster analysis, classification algorithm, or sequence pattern mining.

[0085] Among them, the decision suggestion can be the suggestion information output by the log processing large model for optimizing the target log information. It should be noted that the decision suggestion is associated with the decision support option selected by the user, and different decision suggestions are generated for different decision support options. For example, when the decision support option is a performance optimization suggestion, the decision suggestion can be an optimization system process; when the decision support option is a troubleshooting guide, the decision suggestion can be a method to solve the fault. Optionally, the target log information is converted into a data format suitable for processing by a data mining algorithm, the target of the data analysis is determined according to the decision support option selected by the user, and the data mining algorithm is used to perform operations based on the data characteristics and goals of the target log information, and the results of the operation are observed, and the patterns and laws of the data are analyzed and parsed, and decision suggestions corresponding to the decision support options are proposed.

[0086] Optionally, when providing decision support for target log information, the log processing model introduces log analysis results, queries historical log information of the target log information as the data basis for decision analysis, and uses it as reference data for data mining algorithms to propose decision recommendations corresponding to decision support options.

[0087] Specifically, the log processing model analyzes the target log information according to the user's log analysis requirements to obtain the log analysis results of the log question dialogue. The log processing model uses a preset data mining algorithm to perform decision analysis based on the log analysis results and decision support options to determine decision recommendations. The log processing model combines the log analysis results, target log information, and decision recommendations into log answers and displays the log answers. Exemplarily, when displaying the log answers, the target log information obtained by the query is displayed in turn, and then the analysis results corresponding to the target log information are displayed, and finally the decision recommendations are displayed.

[0088] The technical solution of the embodiment of the present invention sets decision support options in the log processing large model. When answering user questions, it provides decision suggestions to users based on the decision support options and log analysis results. This can effectively improve the flexibility of the model, improve the intelligence of the model, and effectively provide forward-looking decision support for staff.

[0089] Figure 4 A schematic diagram of the structure of a large language model-based operation and maintenance log analysis and question-answering device provided by an embodiment of the present invention. Figure 4 As shown, the device includes: a question-answering module 410, a log search module 420 and a solution module 430; wherein,

[0090] A question-and-answer module 410 is used to respond to a user's log question dialogue through a pre-trained log processing large model, and determine a log analysis requirement and a log query statement corresponding to the log analysis requirement according to the log question dialogue;

[0091] The log search module 420 is used to perform a distributed semantic search in a preset log database according to the log query statement to determine the target log information;

[0092] The answer module 430 is used to generate a log answer to the log question dialogue according to the target log information and the log analysis requirements through the log processing macro model.

[0093] The technical solution of the embodiment of the present invention responds to the user's log question dialogue through a pre-trained log processing large model, determines the log analysis requirements and the log query statement corresponding to the log analysis requirements according to the log question dialogue, and can automatically analyze the user's log operation and maintenance requirements through the log processing large model, effectively improving the efficiency and quality of log analysis; according to the log query statement, a distributed semantic search is performed in a preset log database to determine the target log information, and the log query statement can automatically extract logs from the log database, thereby improving the efficiency of log information acquisition and log analysis; the log processing large model generates the log answer of the log question dialogue according to the target log information and the log analysis requirements, and the log processing large model can perform data analysis on the target log information, improve the accuracy and intelligence of log analysis, and improve the efficiency of log information processing. The technical problem that the log information cannot be analyzed quickly and efficiently in the prior art is solved. The log processing large model can understand and generate natural language, extract key information from log data, and answer questions in the form of natural language, and can automatically process, analyze and interpret large-scale and complex operation and maintenance log data, thereby improving the monitoring efficiency of the log and the accuracy of operation and maintenance decisions.

[0094] Optionally, the system further includes a large model performance optimization module;

[0095] The large model performance optimization module is used to collect log search records from the log database; and update the log processing large model according to the log information corresponding to the log search records.

[0096] Optionally, the large model performance optimization module is specifically used for:

[0097] Querying the log search times corresponding to the log information in the log search record, and determining the log information of interest according to the log search times;

[0098] Get the log monitoring information corresponding to the preset distributed messaging system;

[0099] Update the log monitoring information according to the log information of interest, and determine the updated log monitoring information;

[0100] The log processing large model is updated according to the updated log monitoring information and the log information corresponding to the log search record.

[0101] Optionally, the large model performance optimization module is further used to:

[0102] Performing log matching on the log database through the updated log monitoring information to determine the target upload log;

[0103] Sending the target upload log to a distributed messaging system;

[0104] The target upload log is subscribed to in the distributed message system through the log processing big model, and the log processing big model is updated according to the target upload log.

[0105] Optionally, the large model performance optimization module is further used to:

[0106] Perform log cleaning and keyword extraction on the target upload log to determine the processing log information;

[0107] Extract features from the processing log information using natural language processing and machine learning algorithms to determine a log training vector;

[0108] The log processing large model is updated through the log training vector.

[0109] Optionally, the answer module is specifically used for:

[0110] If it is detected that the user selects a decision support option in the log processing big model, the log processing big model generates the log answer according to the decision support option, the log analysis requirement and the target log information.

[0111] The log answer includes log analysis results and decision suggestions;

[0112] Optionally, the answer module is further used for:

[0113] Performing log analysis according to the target log information and the log analysis requirements through the log processing big model, and determining the log analysis result of the log question dialogue;

[0114] The log processing large model uses a preset data mining algorithm to perform decision analysis based on the log analysis results and the decision support options to determine the decision recommendation.

[0115] The analysis and question-answering device for operation and maintenance logs based on a large language model provided in an embodiment of the present invention can execute the analysis and question-answering method for operation and maintenance logs based on a large language model provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0116] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their modes are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0117] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0118] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer grid such as the Internet and / or various telecommunication grids.

[0119] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the analysis and question-answering method of the operation and maintenance log based on the large language model.

[0120] In some embodiments, the analysis and question-answering method of the operation and maintenance log based on the large language model can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the analysis and question-answering method of the operation and maintenance log based on the large language model described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the analysis and question-answering method of the operation and maintenance log based on the large language model by any other appropriate means (for example, by means of firmware).

[0121] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0122] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the modes / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0123] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0124] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0125] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a grid browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication grid). Examples of communication grids include: a local area network (LAN), a wide area network (WAN), a blockchain grid, and the Internet.

[0126] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication grid. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0127] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0128] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps of the method for analyzing and answering operation and maintenance logs based on a large language model as provided in any embodiment of the present invention are implemented. The method includes:

[0129] Responding to the user's log question dialogue through a pre-trained log processing large model, and determining the log analysis requirements and the log query statements corresponding to the log analysis requirements according to the log question dialogue;

[0130] Performing a distributed semantic search in a preset log database according to the log query statement to determine target log information;

[0131] The log processing macromodel generates a log answer to the log question dialogue according to the target log information and the log analysis requirements.

[0132] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0133] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0134] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0135] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of grid, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0136] It should be understood by those skilled in the art that the above modules or steps of the present invention can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a grid composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0137] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0138] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for analyzing and answering operation and maintenance logs based on a large language model, characterized in that: include: Responding to the user's log question dialogue through a pre-trained log processing large model, and determining the log analysis requirements and the log query statements corresponding to the log analysis requirements according to the log question dialogue; Performing a distributed semantic search in a preset log database according to the log query statement to determine target log information; The log processing macromodel generates a log answer to the log question dialogue according to the target log information and the log analysis requirements.

2. The method according to claim 1, characterized in that After performing a distributed semantic search in a preset log database according to the log query statement to determine the target log information, the method further includes: Collecting log search records of the log database; The log processing large model is updated according to the log information corresponding to the log search record.

3. The method according to claim 2, characterized in that The updating of the log processing model according to the log information corresponding to the log search record includes: Querying the log search times corresponding to the log information in the log search record, and determining the log information of interest according to the log search times; Get the log monitoring information corresponding to the preset distributed messaging system; Update the log monitoring information according to the log information of interest, and determine the updated log monitoring information; The log processing large model is updated according to the updated log monitoring information and the log information corresponding to the log search record.

4. The method according to claim 3, characterized in that The updating of the log processing large model according to the updated log monitoring information and the log information corresponding to the log search record includes: Performing log matching on the log database through the updated log monitoring information to determine the target upload log; Sending the target upload log to a distributed messaging system; The target upload log is subscribed to in the distributed message system through the log processing big model, and the log processing big model is updated according to the target upload log.

5. The method according to claim 4, characterized in that The updating of the log processing large model according to the target upload log includes: Perform log cleaning and keyword extraction on the target upload log to determine the processing log information; Extract features from the processing log information using natural language processing and machine learning algorithms to determine a log training vector; The log processing large model is updated through the log training vector.

6. The method according to claim 1, characterized in that The step of generating a log answer to the log question dialogue according to the target log information and the log analysis requirement by the log processing macro model includes: If it is detected that the user selects a decision support option in the log processing big model, the log processing big model generates the log answer according to the decision support option, the log analysis requirement and the target log information.

7. The method according to claim 6, characterized in that in, The log answer includes log analysis results and decision suggestions; The log processing big model generates the log answer according to the decision support option, the log analysis requirement and the target log information, including: Performing log analysis according to the target log information and the log analysis requirements through the log processing big model, and determining the log analysis result of the log question dialogue; The log processing large model uses a preset data mining algorithm to perform decision analysis based on the log analysis results and the decision support options to determine the decision recommendation.

8. A question-answering device for analyzing operation and maintenance logs based on a large language model, characterized in that: include: A question-and-answer module, used to respond to a user's log question dialogue through a pre-trained log processing large model, and determine a log analysis requirement and a log query statement corresponding to the log analysis requirement according to the log question dialogue; A log search module, used to perform a distributed semantic search in a preset log database according to the log query statement to determine the target log information; The answering module is used to generate a log answer to the log question dialogue according to the target log information and the log analysis requirements through the log processing big model.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the analysis and question-answering method of operation and maintenance logs based on a large language model as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the analysis and question-answering method for operation and maintenance logs based on a large language model as described in any one of claims 1 to 7 when executed.

Images