Event fault root positioning method and device

Abstract

The invention discloses an event fault source positioning method and device which can be used in the technical field of artificial intelligence, and the method comprises the steps: obtaining a to-be-processed fault event in a bank business handling process; determining a first-level event fault source matched with the to-be-processed fault event according to a check mode associated with each first-level event fault source in the first-level event fault source list; the check mode associated with the first-level event fault source is used for verifying whether the corresponding first-level event fault source occurs or not; determining a secondary event fault source list subordinate to the primary event fault source according to the primary event fault source matched with the to-be-processed fault event; when the secondary event fault source matched with the to-be-processed fault event exists in the secondary event fault source list, the secondary event fault source matched with the to-be-processed fault event is sent to the user; according to the invention, the event fault source can be quickly positioned, the event fault source positioning accuracy is improved, and the treatment efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method and device for locating the root cause of an event fault. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] With the continuous updating of new technologies and the rapid demand for new requirements, large multi-module software systems need to keep up with technological changes, policy updates, market changes, etc., resulting in frequent incidents. The multi-layer linkage of the architecture, the distribution of applications, the fragmentation of data, and the frequent iteration of versions lead to long waiting times for event location and repair, and most of the temporary alternative measures are closed transactions or rollback versions.

[0004] In summary, there is an urgent need for a method for locating the root cause of an event fault to solve the above problems. Summary of the invention

[0005] An embodiment of the present invention provides a method for locating the root cause of an event fault, which is used to improve the accuracy and efficiency of locating the root cause of an event fault. The method includes:

[0006] Obtain pending fault events during banking business processing;

[0007] According to the inspection method associated with each first-level event fault root source in the first-level event fault root source list, determine the first-level event fault root source matching the fault event to be processed; the inspection method associated with the first-level event fault root source is used to verify whether the corresponding first-level event fault root source occurs;

[0008] According to the primary event fault root source that matches the fault event to be processed, a list of secondary event fault root sources under the primary event fault root source is determined;

[0009] When there is a secondary event fault root source matching the to-be-processed fault event in the secondary event fault root source list, the secondary event fault root source matching the to-be-processed fault event is sent to the user;

[0010] After receiving the fault management instruction from the user, the corresponding management plan information is retrieved according to the fault root cause of the secondary event matching the fault event to be processed; the management plan information includes a management script; and the management script is executed;

[0011] When there is no primary event fault root cause matching the fault event to be processed, determine the event description corresponding to the fault event to be processed;

[0012] Determine the similarity between the fault event to be processed and each historical event according to the event description corresponding to the fault event to be processed;

[0013] Determine the governance plan information corresponding to the historical event with the highest similarity; and execute the governance script contained in the governance plan information corresponding to the historical event with the highest similarity.

[0014] The embodiment of the present invention further provides a device for locating the root cause of an event fault, which is used to improve the accuracy and efficiency of locating the root cause of an event fault. The device includes:

[0015] A matching module is used to obtain pending fault events in the process of handling banking business; according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list, determine the first-level event fault root source that matches the pending fault event; the inspection method associated with the first-level event fault root source is used to verify whether the corresponding first-level event fault root source occurs; according to the first-level event fault root source that matches the pending fault event, determine the second-level event fault root source list under the first-level event fault root source; when there is a second-level event fault root source that matches the pending fault event in the second-level event fault root source list, send the second-level event fault root source that matches the pending fault event to the user;

[0016] A governance module is used to retrieve corresponding governance plan information according to the fault root cause of the secondary event matching the fault event to be processed after receiving the fault governance instruction from the user; the governance plan information includes a governance script; the governance script is executed; when there is no fault root cause of the primary event matching the fault event to be processed, the event description corresponding to the fault event to be processed is determined; according to the event description corresponding to the fault event to be processed, the similarity between the fault event to be processed and each historical event is determined; the governance plan information corresponding to the historical event with the highest similarity is determined; and the governance script contained in the governance plan information corresponding to the historical event with the highest similarity is executed.

[0017] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned event fault root cause locating method when executing the computer program.

[0018] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for locating the root cause of an event fault is implemented.

[0019] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method for locating the root cause of an event fault is implemented.

[0020] In the embodiment of the present invention, a pending fault event in the process of handling banking business is obtained; a first-level event fault root source matching the pending fault event is determined according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list; the inspection method associated with the first-level event fault root source is used to verify whether the corresponding first-level event fault root source occurs; according to the first-level event fault root source matching the pending fault event, a list of second-level event fault root sources under the first-level event fault root source is determined; when there is a second-level event fault root source matching the pending fault event in the second-level event fault root source list, the second-level event fault root source matching the pending fault event is checked. The event fault source is sent to the user; after receiving the user's fault management instruction, the corresponding management plan information is retrieved according to the secondary event fault source that matches the fault event to be processed; the management plan information includes a management script; the management script is executed; when there is no primary event fault source that matches the fault event to be processed, the event description corresponding to the fault event to be processed is determined; according to the event description corresponding to the fault event to be processed, the similarity between the fault event to be processed and each historical event is determined; the management plan information corresponding to the historical event with the highest similarity is determined; and the management script contained in the management plan information corresponding to the historical event with the highest similarity is executed. Compared with the prior art, after determining the primary event fault source that matches the fault event to be processed according to the inspection method associated with each primary event fault source in the primary event fault source list, the fault event to be processed continues to be matched with the secondary event fault source, so as to realize rapid location of the event fault source, improve the accuracy of event fault source location, and provide a management plan to improve management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0022] Figure 1 A schematic diagram of the process of locating the root cause of an event fault provided by the present invention;

[0023] Figure 2 A schematic diagram of the process of locating the root cause of an event fault provided by the present invention;

[0024] Figure 3 A schematic diagram of the process of locating the root cause of an event fault provided by the present invention;

[0025] Figure 4 A schematic diagram of the process of locating the root cause of an event fault provided by the present invention;

[0026] Figure 5 This is a schematic diagram of the structure of the device for locating the root cause of an event fault provided by the present invention. DETAILED DESCRIPTION

[0027] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0028] Figure 1 A flowchart corresponding to a method for locating the root cause of an event fault provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes:

[0029] Step 101, obtaining pending fault events in the process of handling banking business.

[0030] Step 102 : determining a first-level event fault root source matching the to-be-processed fault event according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list.

[0031] It should be noted that the inspection method associated with the primary event fault root cause is used to verify whether the corresponding primary event fault root cause occurs.

[0032] For example, based on the pending fault event, retrieve the list of first-level event fault root causes, poll the first-level event root sources q1, q2...qn, check the matching degree, for example q1 is "daily cut failure", through the check method "sql statement" associated with q1, query the database to know that the current date is T-1 (should be T), and conclude that the daily cut has failed, and q1 checks the first-level event fault root cause matching.

[0033] If the date obtained by the database is indeed T when checking the date of q1, the q1 check fails, and it can be inferred that the pending fault event is not caused by q1, and the match fails. Repeat until the traversal of qi(1~n) is completed.

[0034] Step 103: Determine a list of secondary event fault root sources under the primary event fault root source according to the primary event fault root source that matches the fault event to be processed.

[0035] Step 104 : When there is a secondary event fault root source matching the to-be-processed fault event in the secondary event fault root source list, the secondary event fault root source matching the to-be-processed fault event is sent to the user.

[0036] For example, poll the secondary event fault root source list to check the matching degree. If the check of q1 passes, then match the secondary root source list q1-1, q1-2, q1-i...q1-n corresponding to q1. The secondary root source list can be empty, which means that q1 is the superficial root source and the deepest root source. If all secondary root sources are traversed and none of them match, it means that the superficial cause is known, but the specific deepest cause is unknown, and manual intervention is required. For example, if q1 is "date unsuccessful" and q1-1 is "batch not completed", it is necessary to check whether q1-1 is satisfied. Through the "check script" associated with q1-1, the database is linked to query and it is found that the batch execution status is true, there is an unfinished batch, and the check result of q1-1 is passed.

[0037] For another example, if q1 is "communication area error, cardtype type does not match", and q1-1 is "downstream communication area transformation", then when checking whether q1-1 matches, a more complex check script is required, including the following steps: 1. Pull the error service from the log; 2. Pull the downstream service from the production call rule library; 3. Retrieve the soft demand to confirm whether the downstream service has a transformation step; 4. If the matching soft demand has been transformed, then the q1-1 check is matched and passed. If the matching soft demand does not search for the transformation requirement, then the q1-1 check is not matched and passed. Here, the semantic similarity of the soft demand is required to reach 80% to mark the check as passed.

[0038] The matching q1-1 check results are recorded and returned to the front end when the root cause of the problem is found.

[0039] Step 105: after receiving the fault management instruction from the user, the corresponding management solution information is retrieved according to the fault root cause of the secondary event matching the fault event to be processed.

[0040] It should be noted that the governance plan information includes the governance script; execution of the governance script;

[0041] Step 106: When there is no primary event fault root cause matching the fault event to be processed, determine an event description corresponding to the fault event to be processed.

[0042] Step 107: Determine the similarity between the fault event to be processed and each historical event according to the event description corresponding to the fault event to be processed.

[0043] Step 108, determining the governance solution information corresponding to the historical event with the highest similarity; and executing the governance script contained in the governance solution information corresponding to the historical event with the highest similarity.

[0044] The above scheme, after determining the first-level event fault root source that matches the fault event to be processed according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list, continues to match the fault event to be processed with the second-level event fault root source, so as to quickly locate the event fault root source, improve the accuracy of event fault root source location, and provide a governance plan at the same time, thereby improving governance efficiency.

[0045] In an embodiment of the present invention, the event description includes event name, event ID, event level, occurrence time, resolution time, event phenomenon, application modules involved, impact scope, first-level event fault root cause, second-level event fault root cause, first-level inspection script, second-level inspection script, second-level governance plan, second-level governance script, first-level governance plan, first-level governance script, etc.

[0046] Among them, the resolution time, root cause of the event, inspection script, governance plan, and governance script are blank when entered in the early stage, and will be further supplemented by the user after confirmation.

[0047] In a possible implementation, the checking method confirms whether the event fault root cause is satisfied by defining SQL statements, log retrieval, and environment screening, and then returns a Y / N indication when determining whether the event fault root cause matches successfully or not.

[0048] The governance scripts included in the governance plan information are used to execute database, container, and network applications and changes through the shell to eliminate the root cause of the event failure. When the primary event failure root cause and the secondary failure event root cause are matched, the secondary governance plan and secondary governance script will be output first. When the primary event failure root cause is matched but the secondary event failure root cause is not matched, the primary governance plan information and primary governance script will be output.

[0049] After obtaining pending fault events in the process of handling banking business, the embodiment of the present invention generates a list of primary event fault root causes and displays it on the front end.

[0050] In the embodiment of the present invention, the event analysis system of the system is divided into a front-end management system and a back-end retrieval system. The front-end management system receives the user's standardized event description, performs conventional text segmentation, intent recognition, and similar word replacement, and transmits the optimized event description to the back-end retrieval system to generate the event root cause.

[0051] The background retrieval system mainly includes the following components: S01, S02, S03, S04, and S05.

[0052] S01: Pull the event library to form an event rule library.

[0053] The event library contains event name, event ID, event level, occurrence time, resolution time, event phenomenon, application modules involved, impact range, primary event root cause, secondary event root cause, primary inspection script, secondary inspection script, primary governance plan, primary governance script, secondary governance plan, and secondary governance script. On this basis, we summarize and supplement to form an "event rule library", including events, primary event root cause times, and secondary event root cause times.

[0054] S02: Pull business data to form a business rule library.

[0055] The enterprise sorts out the business architecture and divides it into product model, process model and entity model. The product model describes the service conditions and processing rules, the process model includes standardized processing logic, and the entity model includes the rules on how the enterprise stores. Describe the business rules of the software product. For example, the user needs to provide ID card, mobile phone number, address and other elements to open a card at the branch. After the teller successfully reviews the materials, the information is entered and the card is opened, and the card is provided to the user.

[0056] By storing relevant product models, process models, and entity models in the database, the business processes and business rule requirements for normal and abnormal transactions can be provided.

[0057] S03: Pull the change records to form a change rule library.

[0058] Changes are adjustments to the system environment or business rules in the production environment. They are generally not reflected in software requirements or business rules and need to be recorded and analyzed independently. System environments include disaster recovery switching, database migration, network changes, container replicas, CPU, and memory expansion or reduction.

[0059] The change rule library generally includes: date, module, background, execution content, and business impact.

[0060] S04: Pull software requirement records to form a software requirement rule library.

[0061] Software requirements record the increments of each version change, and record version changes in time series. By analyzing the sequence transformation, we can provide first-hand information for the occurrence of events. Software requirements transformation records include overall overview (description of transformation background), logical processing (transformation implementation process), system menu and entry (involved transaction columns), technical and business checkpoints (involved verification points).

[0062] Among them, based on the software requirement records, causal reasoning is formed based on SCM, and the soft requirement rule base is recorded.

[0063] S05: Pull the full-link production log library to form a module call rule library.

[0064] For the logic storage between production and operation services, the module call rule library generally includes the following information: timestamp, globally unique tracking ID, module ID, parent module ID, request / return message.

[0065] According to the tracking ID and timestamp, a call chain of service A-->service B-->service C can be formed. This helps locate the call relationship between module services and ultimately locate the deepest source of events.

[0066] S06: Pull the code base and table structure to form a code rule base.

[0067] In order to achieve the correspondence between the code base and semantics, it is necessary to analyze the code and comments line by line to form a code rule base.

[0068] In step 102 of the embodiment of the present invention, according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list, the first-level event fault root source matching the fault event to be processed is determined. The step flow is as follows: Figure 2 As shown, the details are as follows:

[0069] Step 201, sort multiple first-level event fault root sources according to the number of occurrences of each first-level event fault root source in the first-level event fault root source list, and sort the event root sources from high to low according to the number of occurrences 100, 20...1, and check the qi matching degree according to the sorting.

[0070] Step 202 : Match the fault event to be processed with each primary event fault root cause in sequence according to the sorting result until a match is successful, thereby obtaining a primary event fault root cause that matches the fault event to be processed.

[0071] In the embodiment of the present invention, when the inspection is performed using the inspection method associated with the current level 1 event fault root cause and the inspection passes, it is determined that the current level 1 event fault root cause matches the to-be-processed fault event successfully.

[0072] After determining the list of secondary event fault root sources under the primary event fault root source according to the primary event fault root source matching the fault event to be processed, the steps of the embodiment of the present invention are as follows: Figure 3 As shown, the details are as follows:

[0073] Step 301: When the list of fault root causes of secondary events is empty, the fault root causes of primary events matching the fault events to be processed are sent to the user.

[0074] Step 302: after receiving the fault management instruction from the user, the corresponding management solution information is retrieved according to the fault root cause of the first-level event matching the fault event to be processed, and the management script contained in the management solution information is executed.

[0075] In the embodiment of the present invention, the system automatically saves the event snapshot, which includes the event description and the recommended event root cause. After a certain hour or day, the operation and maintenance personnel find out that the event is indeed caused by the recommended event root cause, and then return to the system to retrieve the event snapshot according to the date and keyword.

[0076] In a possible implementation, the user clicks "Generate Event Governance Plan" in the snapshot, and the system retrieves the governance plan and governance script based on the event root cause in the snapshot and outputs them to the front desk for reference by the operation and maintenance personnel.

[0077] In the embodiment of the present invention, the specific governance plan is described in Chinese, including but not limited to executing SQL statements, rolling back container versions, expanding container CPU and memory, expanding the number of replicas, closing programs, etc.

[0078] Users can query and edit the governance script by clicking "Script Edit". The script is a historical script of historical events. After the user associates the application database environment, container registration environment, and network environment for automatic correction, click "Submit" to take effect in the production environment.

[0079] In step 107 of the embodiment of the present invention, the similarity between the fault event to be processed and each historical event is determined according to the event description corresponding to the fault event to be processed. The steps are as follows: Figure 4 As shown, the details are as follows:

[0080] Step 401 : Using a word2vec model, determine an event description vector of the fault event to be processed according to an event description corresponding to the fault event to be processed.

[0081] Step 402: Determine the similarity between the fault event to be processed and each historical event according to the event description vector of the fault event to be processed.

[0082] For the newly input event a, extract the event description, use word2vec to get the event description vector, and use the following similarity calculation formula r<a,b> Calculate the similarity between a and other historical event questions.

[0083] For example:

[0084] r<a,b> =cov(a,b)

[0085] In the embodiment of the present invention, the smaller the r value is, the higher the similarity is. By comparing the r values, the best matching historical event can be found.

[0086] In the above solution, when the event description is matched but the root cause of the event failure is not matched, word2vec is used to match the root cause of the historical event, find the best matching historical event, and take its secondary governance plan to display the event governance plan and governance script.

[0087] In the embodiment of the present invention, the user can supplement the input of the event source, governance plan and governance script, and the information is transmitted back to the event rule library for continuous storage.

[0088] The event snapshot is divided into the status of filed and closed according to the completeness of the information. Among them, according to the secondary event fault root cause search corresponding to the fault event to be processed, the snapshot is initialized to the "filed" status, and the snapshot is updated to the "closed" status after the event information is supplemented.

[0089] For "filed" events, we will continue to send alarm emails to users, so that they can track and handle them in a timely manner and close them as "filed" as soon as possible.

[0090] The complexity of "filed" events will be calculated based on the time of case closure, related modules involved, event level, and manual scoring, and will be used as higher-complexity events for learning and production transformation.

[0091] The present invention also provides an interface mapping device, as described in the following embodiments. Figure 5 As shown, the device comprises:

[0092] Matching module 501 is used to obtain pending fault events in the process of handling banking business; determine the first-level event fault root source matching the pending fault event according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list; the inspection method associated with the first-level event fault root source is used to verify whether the corresponding first-level event fault root source occurs; determine the second-level event fault root source list under the first-level event fault root source according to the first-level event fault root source matching the pending fault event; when there is a second-level event fault root source matching the pending fault event in the second-level event fault root source list, send the second-level event fault root source matching the pending fault event to the user;

[0093] The governance module 502 is used to retrieve the corresponding governance plan information according to the secondary event fault root source matching the fault event to be processed after receiving the user's fault governance instruction; the governance plan information includes a governance script; execute the governance script; when there is no primary event fault root source matching the fault event to be processed, determine the event description corresponding to the fault event to be processed; determine the similarity between the fault event to be processed and each historical event according to the event description corresponding to the fault event to be processed; determine the governance plan information corresponding to the historical event with the highest similarity; and execute the governance script contained in the governance plan information corresponding to the historical event with the highest similarity.

[0094] In the embodiment of the present invention, the matching module 501 is specifically used for:

[0095] Sort multiple first-level event fault root sources according to the number of occurrences of each first-level event fault root source in the first-level event fault root source list;

[0096] According to the sorting result, the fault event to be processed is matched with each first-level event fault root cause in sequence until a match is successful, and the first-level event fault root cause matching the fault event to be processed is obtained.

[0097] In the embodiment of the present invention, the matching module 501 is specifically used for:

[0098] When the inspection is performed using the inspection method associated with the current first-level event fault root cause and the inspection passes, it is determined that the current first-level event fault root cause successfully matches the to-be-processed fault event.

[0099] In the embodiment of the present invention, the matching module 501 is further used for:

[0100] After determining a list of secondary event fault root sources under the primary event fault root source according to the primary event fault root source that matches the fault event to be processed, when the list of secondary event fault root sources is empty, sending the primary event fault root source that matches the fault event to be processed to the user;

[0101] After receiving the fault management instruction from the user, the corresponding management plan information is retrieved according to the fault root cause of the first-level event matching the fault event to be processed, and the management script contained in the management plan information is executed.

[0102] In the embodiment of the present invention, the governance module 502 is specifically used for:

[0103] The word2vec model is used to determine the event description vector of the fault event to be processed according to the event description corresponding to the fault event to be processed;

[0104] The similarity between the fault event to be processed and each historical event is determined according to the event description vector of the fault event to be processed.

[0105] Since the principle of the device for solving the problem is similar to that of the event fault root cause locating method, the implementation of the device can refer to the implementation of the event fault root cause locating method, and the repeated parts will not be repeated.

[0106] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned event fault root cause locating method when executing the computer program.

[0107] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for locating the root cause of an event fault is implemented.

[0108] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method for locating the root cause of an event fault is implemented.

[0109] In the embodiment of the present invention, a pending fault event in the process of handling banking business is obtained; a first-level event fault root source matching the pending fault event is determined according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list; the inspection method associated with the first-level event fault root source is used to verify whether the corresponding first-level event fault root source occurs; according to the first-level event fault root source matching the pending fault event, a list of second-level event fault root sources under the first-level event fault root source is determined; when there is a second-level event fault root source matching the pending fault event in the second-level event fault root source list, the second-level event fault root source matching the pending fault event is checked. The event fault source is sent to the user; after receiving the user's fault management instruction, the corresponding management plan information is retrieved according to the secondary event fault source that matches the fault event to be processed; the management plan information includes a management script; the management script is executed; when there is no primary event fault source that matches the fault event to be processed, the event description corresponding to the fault event to be processed is determined; according to the event description corresponding to the fault event to be processed, the similarity between the fault event to be processed and each historical event is determined; the management plan information corresponding to the historical event with the highest similarity is determined; and the management script contained in the management plan information corresponding to the historical event with the highest similarity is executed. Compared with the prior art, after determining the primary event fault source that matches the fault event to be processed according to the inspection method associated with each primary event fault source in the primary event fault source list, the fault event to be processed continues to be matched with the secondary event fault source, so as to realize rapid location of the event fault source, improve the accuracy of event fault source location, and provide a management plan to improve management efficiency.

[0110] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0112] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0113] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0114] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for locating the root cause of an event fault, characterized in that: include: Obtain pending fault events during banking business processing; According to the inspection method associated with each first-level event fault root source in the first-level event fault root source list, determine the first-level event fault root source matching the fault event to be processed; the inspection method associated with the first-level event fault root source is used to verify whether the corresponding first-level event fault root source occurs; According to the primary event fault root source that matches the fault event to be processed, a list of secondary event fault root sources under the primary event fault root source is determined; When there is a secondary event fault root source matching the to-be-processed fault event in the secondary event fault root source list, the secondary event fault root source matching the to-be-processed fault event is sent to the user; After receiving the fault management instruction from the user, the corresponding management plan information is retrieved according to the fault root cause of the secondary event matching the fault event to be processed; The governance plan information includes the governance script; the governance script is executed; When there is no primary event fault root cause matching the fault event to be processed, determine the event description corresponding to the fault event to be processed; Determine the similarity between the fault event to be processed and each historical event according to the event description corresponding to the fault event to be processed; Determine the governance plan information corresponding to the historical event with the highest similarity; and execute the governance script contained in the governance plan information corresponding to the historical event with the highest similarity.

2. The method for locating the root cause of an event fault according to claim 1, characterized in that: According to the inspection method associated with each first-level event fault root cause in the first-level event fault root cause list, determine the first-level event fault root cause that matches the fault event to be processed, including: Sort multiple first-level event fault root sources according to the number of occurrences of each first-level event fault root source in the first-level event fault root source list; According to the sorting result, the fault event to be processed is matched with each primary event fault root cause in sequence until a match is successful, and a primary event fault root cause matching the fault event to be processed is obtained.

3. The method for locating the root cause of an event fault according to claim 2, characterized in that: According to the sorting results, the fault events to be processed are matched with the fault root causes of each first-level event in sequence until a match is successful, including: When the inspection is performed using the inspection method associated with the current first-level event fault root cause and the inspection passes, it is determined that the current first-level event fault root cause successfully matches the to-be-processed fault event.

4. The method for locating the root cause of an event fault according to claim 1, characterized in that: After determining a list of secondary event fault root sources under the primary event fault root source according to the primary event fault root source that matches the fault event to be processed, the following is also included: When the list of fault root causes of secondary events is empty, the fault root causes of primary events matching the fault events to be processed are sent to the user.

5. The method for locating the root cause of an event fault according to claim 4, characterized in that: When the list of fault root causes of secondary events is empty, after the fault root causes of the primary events matching the fault events to be processed are sent to the user, the following steps are also included: After receiving the fault management instruction from the user, the corresponding management plan information is retrieved according to the fault root cause of the first-level event matching the fault event to be processed, and the management script contained in the management plan information is executed.

6. The method for locating the root cause of an event fault according to claim 1, characterized in that: According to the event description corresponding to the fault event to be processed, determine the similarity between the fault event to be processed and each historical event, including: Determine an event description vector of the fault event to be processed according to the event description corresponding to the fault event to be processed; The similarity between the fault event to be processed and each historical event is determined according to the event description vector of the fault event to be processed.

7. The method for locating the root cause of an event fault according to claim 6, characterized in that: Determining an event description vector of the fault event to be processed according to the event description corresponding to the fault event to be processed includes: The word2vec model is used to determine the event description vector of the fault event to be processed according to the event description corresponding to the fault event to be processed.

8. A device for locating the root cause of an event fault, characterized in that: include: A matching module is used to obtain pending fault events in the process of handling banking business; according to the inspection method associated with each first-level event fault root source in the first-level event fault root source list, determine the first-level event fault root source matching the pending fault event; the inspection method associated with the first-level event fault root source is used to verify whether the corresponding first-level event fault root source occurs; According to the primary event fault root source that matches the fault event to be processed, a list of secondary event fault root sources under the primary event fault root source is determined; When there is a secondary event fault root source matching the to-be-processed fault event in the secondary event fault root source list, the secondary event fault root source matching the to-be-processed fault event is sent to the user; A management module is used to retrieve corresponding management plan information according to the secondary event fault root cause matching the fault event to be processed after receiving the fault management instruction from the user; The governance plan information includes the governance script; the governance script is executed; When there is no primary event fault root cause matching the fault event to be processed, determine the event description corresponding to the fault event to be processed; Determine the similarity between the fault event to be processed and each historical event according to the event description corresponding to the fault event to be processed; Determine the governance plan information corresponding to the historical event with the highest similarity; Execute the governance script contained in the governance plan information corresponding to the historical event with the highest similarity.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images