Intelligent operation and maintenance management and alarm system based on large model agent

Abstract

The invention discloses an intelligent operation and maintenance management and alarm system based on a large model agent, and the system comprises a data collection and fusion module which is used for processing original data collected from an IT system to obtain an operation and maintenance data graph, and the original data at least comprise logs, indexes and link tracking data; the anomaly detection module is used for performing analysis based on the preprocessed data and the time sequence characteristics to determine abnormal data; the alarm optimization module is used for analyzing the semantic information corresponding to the abnormal data so as to determine the priority of the corresponding alarm; the root cause analysis module is used for performing fault reasoning on the abnormal data based on a pre-constructed knowledge graph and generating fault interpretation according to data corresponding to the abnormal data; and the automatic operation and maintenance decision module is used for generating an automatic repair strategy according to the abnormal data and the fault interpretation and executing the automatic repair strategy to repair the abnormal data.

Description

Technical Field

[0001] The present application relates to the field of IT operation and maintenance technology, and in particular to an intelligent operation and maintenance management and alarm system based on a large model intelligent body. Background Art

[0002] With the rapid development of information technology, enterprise IT systems are becoming increasingly complex, covering new technologies such as distributed architecture, large-scale microservices, cloud computing, and edge computing. Traditional operation and maintenance monitoring and alarm systems rely on rules and static models, and their limitations are mainly reflected in the following aspects:

[0003] 1. Single data dimension: Traditional monitoring mainly relies on log or indicator data. The single data source and fixed rules lead to limited detection effects, making it difficult to fully capture the system's operating status and potential risks.

[0004] 2. Complex rule maintenance: Operation and maintenance rules usually need to be defined manually, and cause analysis relies on manual work, making it difficult to quickly and accurately locate problems. As a result, it is difficult to adapt to dynamic and complex business scenarios, leading to false positives and false negatives.

[0005] 3. Alarms are flooding and processing is delayed: Existing alarm systems are often unable to quickly identify the root cause of alarms, resulting in high alarm noise, excessive redundant information, and increased workload for operation and maintenance personnel.

[0006] 4. Low degree of automation: The closed-loop self-healing function has a long response time. Most operation and maintenance systems are unable to adjust decisions or perform repair operations according to real-time conditions, affecting the timeliness of problem handling.

[0007] In recent years, large model technologies (such as GPT, Transformer, etc.) have provided a new development direction for intelligent operation and maintenance systems with their powerful data processing and semantic understanding capabilities. By introducing large models, in-depth analysis of operation and maintenance data, anomaly identification, root cause location, dynamic optimization, etc. can be achieved, thereby improving the automation and intelligence level of operation and maintenance. Summary of the invention

[0008] The purpose of this application is to provide an intelligent operation and maintenance management and alarm system based on a large model intelligent body, which can realize dynamic anomaly detection by deeply integrating logs, indicators and link tracking data, improve anomaly recognition by predicting and analyzing time series, realize efficient root cause location through knowledge graph and reasoning collaboration, determine the priority of alarms through semantic analysis, and form a complete closed loop by generating repair strategies and automatically executing them.

[0009] To achieve the above objectives, this application provides the following solutions:

[0010] In a first aspect, the present application provides an intelligent operation and maintenance management and alarm system based on a large model agent, the system comprising:

[0011] A data collection and fusion module is used to process the raw data collected from the IT system to obtain an operation and maintenance data map, wherein the raw data at least includes: logs, indicators, and link tracking data;

[0012] an anomaly detection module, configured to analyze the preprocessed data and the time series features to determine abnormal data;

[0013] An alarm optimization module analyzes the semantic information corresponding to the abnormal data to determine the priority of the corresponding alarm;

[0014] A root cause analysis module, used to perform fault reasoning on the abnormal data based on a pre-built knowledge graph, and generate a fault explanation according to data corresponding to the abnormal data;

[0015] The automated operation and maintenance decision module is used to generate an automatic repair strategy based on the abnormal data and the fault explanation, and execute the automatic repair strategy to repair the abnormal data.

[0016] Optionally, the data acquisition and fusion module includes:

[0017] A data collection unit, used to collect raw data from the IT system and store it in a preset standard format, and pre-process the raw data;

[0018] The semantic fusion unit is used to extract time series features from the preprocessed data and perform semantic fusion processing on the preprocessed data to obtain an operation and maintenance data map.

[0019] Optionally, the data acquisition unit includes:

[0020] Distributed log collection component, used to obtain log data of IT systems;

[0021] The indicator collection component is used to obtain indicator data from various levels of the IT system;

[0022] The link tracking component is used to collect the request flow in the IT system and analyze the performance bottleneck corresponding to the request.

[0023] Optionally, the semantic fusion unit includes:

[0024] A feature extraction component, used to extract preset features from the preprocessed data according to a preset method, and extract time series features through a preset deep learning model;

[0025] The semantic fusion component is used to perform semantic fusion processing on the pre-processed data through a unified semantic representation method.

[0026] Optionally, the anomaly detection module includes:

[0027] The time series analysis unit is used to train and model historical data through a recurrent neural network, and then make predictions, and compare the prediction results with the processed data to detect abnormal data;

[0028] The multimodal data detection unit is used to fuse the collected data into a unified time series data stream and use an adaptive neural network model to perform joint anomaly detection to determine abnormal data.

[0029] Optionally, the alarm optimization module includes:

[0030] A semantic analysis unit, used for analyzing the semantic information corresponding to the abnormal data to extract semantic features;

[0031] An alarm aggregation unit is used to calculate the similarity of abnormal data and merge the alarms of abnormal data with similarity greater than a preset threshold into high-level alarms;

[0032] A priority sorting unit, used to determine the priority of the corresponding alarm according to the semantic features of the abnormal data;

[0033] The alarm threshold adjustment unit is used to adjust the threshold of abnormal data alarm according to the current state of the IT system.

[0034] Optionally, the root cause analysis module includes:

[0035] Knowledge graph unit, used to build knowledge graphs based on IT system architecture, historical abnormal data, and problem scenarios;

[0036] A reasoning and path analysis unit, used to obtain the system state of the IT system for reasoning when abnormal data is detected, and locate the root cause of the abnormality based on the knowledge graph;

[0037] The abnormality explanation generating unit generates an abnormality explanation and a solution based on the abnormal data and the reasoning result of the reasoning and path analyzing unit, and outputs the reasoning result and the solution.

[0038] Optionally, the automated operation and maintenance decision module includes:

[0039] The strategy and solution unit generates repair measures according to the current health status of the IT system, and optimizes the repair measures to an automatic repair strategy based on the reinforcement learning model;

[0040] A repair operation unit, used to repair the IT system according to the automatic repair strategy, and adjust the automatic repair strategy according to the monitored repair results;

[0041] The repair strategy dynamic adjustment unit is used to adjust the automatic repair strategy according to the current operating status of the IT system.

[0042] Optionally, the system further includes: an interaction and knowledge management module, which is used to store abnormal data and corresponding processing procedures and repair strategies as knowledge items for query by operation and maintenance personnel.

[0043] Optionally, the interaction and knowledge management module includes:

[0044] A human-computer interaction unit, used to receive query information input by an operation and maintenance personnel, and output query results corresponding to the query information;

[0045] The knowledge management unit is used to recommend relevant knowledge items from the stored knowledge items for output according to the query information.

[0046] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0047] The present application provides an intelligent operation and maintenance management and alarm system based on a large model intelligent body. It realizes dynamic anomaly detection by deeply integrating logs, indicators and link tracking data, improves anomaly recognition by predicting and analyzing time series, realizes efficient root cause location through knowledge graph and reasoning collaboration, determines the priority of alarms through semantic analysis, and forms a complete closed loop by generating repair strategies and automatically executing them. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A structural diagram of an intelligent operation and maintenance management and alarm system based on a large model intelligent agent provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0052] refer to Figure 1 As shown, the present application provides an intelligent operation and maintenance management and alarm system based on a large model intelligent body, the system includes: a data acquisition and fusion module, an anomaly detection module, an alarm optimization module, a root cause analysis module and an automated operation and maintenance decision module. Among them, the anomaly detection module is respectively connected to the data acquisition and fusion module, the alarm optimization module and the root cause analysis module, and the automated operation and maintenance decision module is respectively connected to the alarm optimization module and the root cause analysis module.

[0053] When operating and maintaining IT systems that cover new technologies such as distributed architecture, large-scale microservices, cloud computing, and edge computing, traditional operation and maintenance monitoring and alarm systems are difficult to fully capture the operating status and potential risks of IT systems. Therefore, the intelligent operation and maintenance management and alarm system based on a large model intelligent body of the present application pre-processes the comprehensive data collected from the IT system through a data acquisition and fusion module, and extracts time series features based on the pre-processed data and finally obtains an operation and maintenance data map with semantic information based on the semantic fusion of the pre-processed data. In this embodiment, specifically through the data acquisition unit in the data acquisition and fusion module, all raw data are collected from the IT system, and the collected raw data are stored in a pre-set standard format such as JSON, ProtobufDENG, etc., and the stored raw data is further pre-processed by denoising, format conversion, and standardization. In this embodiment, the raw data information of the IT system is collected from the IT system, including: system logs, system indicators, and link tracking data of the IT system.

[0054] In this embodiment, log data is collected, transmitted and stored from various levels of the IT system, such as servers, applications, and databases, through API interfaces or agents, through distributed log collection components such as Flume and Logstash. In the scenario of one embodiment, an efficient distributed log collection and analysis system can be built by combining different distributed log collection tools, which can help enterprises and developers better manage and analyze massive log data. The logs obtained usually contain information such as timestamps, event descriptions, software status, exceptions and errors, user interactions, and security events.

[0055] In this embodiment, through indicator collection components such as Prometheus and Telegraf, various indicator information corresponding to system performance, stability, security and maintainability are obtained from various levels such as servers, applications, and databases of the IT system through API interfaces or agents, such as response time, error rate, throughput, availability, CPU usage, memory utilization, disk IO, network latency, number of concurrent connections, database response time, security event rate, log analysis time, resource utilization efficiency, scheduled task accuracy, persistence, fault recovery time, mean time between failures, security vulnerability repair time, user satisfaction, and automation adoption rate.

[0056] In this embodiment, the request flow in the IT system and the performance bottleneck analysis corresponding to the request are collected through distributed link tracking components such as Zipkin and Jaeger. By covering all related IT systems, the calling path and status of user behavior between systems can be fully recorded, which can help operation and maintenance personnel clearly see the execution path of the request between microservices, and find and repair the bottlenecks and other performance problems of the system.

[0057] For example, the collected request flow: users initiate requests through the front-end interface or application, and these requests are usually sent to the server through the HTTP protocol; the request first reaches the load balancer, which distributes the request to the back-end server according to the configured load balancing strategy (such as polling, minimum number of connections, etc.); the back-end server processes the request, which may involve database queries, business logic processing, etc.; if the request needs to access the database, the database will process it and return the result to the back-end server; in order to improve performance, a cache layer, such as Redis, is usually added between the back-end and the database to reduce direct access to the database; after processing the request, the result is returned to the user through the load balancer.

[0058] Performance analysis of the request collected: 1. Hardware performance bottleneck: CPU bottleneck: The server processing capacity reaches its limit, resulting in increased response time. Solutions include optimizing the application's computing logic, using more efficient algorithms, introducing parallel processing or multi-threading technology, upgrading the CPU, or increasing the number of servers. Memory bottleneck: Memory leaks or excessive use of memory lead to a reduction in available memory. Solutions include using memory analysis tools to find and fix memory leaks, optimizing data structures, and introducing cache mechanisms. Disk I / O bottleneck: The disk read and write speeds cannot keep up with the needs of data processing. Solutions include using faster disks (such as SSDs), optimizing disk I / O operations, and using RAID technology. 2. Network performance bottleneck: Network bandwidth bottleneck: Insufficient network bandwidth leads to limited data transmission speed. Solutions include upgrading network equipment, increasing network bandwidth, using network compression technology, and introducing CDN. Network delay and packet loss: caused by network fluctuations, routing problems, or network congestion. Solutions include optimizing network architecture, improving routing strategies, monitoring network status, and promptly resolving network problems. 3. Application performance bottleneck: Unreasonable program architecture: Improper design leads to insufficient resource utilization or inefficient processing. Solutions include redesigning the program architecture, optimizing code logic, and reducing unnecessary calculations and data processing. Synchronous lock problem: Synchronous locks cause threads to wait during high concurrency. Solutions include evaluating whether to remove synchronous locks, adopting more efficient lock mechanisms, and optimizing lock usage strategies. 4. Database performance bottleneck: Slow SQL query: Complex SQL query statements or lack of indexes lead to slow query speeds. Solutions include optimizing SQL query statements and adding necessary indexes to database tables. Database lock contention: Lock contention occurs when multiple transactions access the same data resource at the same time. Solutions include optimizing transaction processing logic and reducing lock holding time.

[0059] Further, the semantic fusion unit extracts time series features from the data preprocessed by the data acquisition unit, and performs semantic fusion processing on the preprocessed data. Specifically, the feature extraction component extracts pre-set feature data from the preprocessed data in a preset manner, and extracts time series features through the pre-set deep learning modularity. In a scenario of an embodiment, the feature extraction component uses time window sliding and statistical methods to extract important features such as mean, variance, maximum value, minimum value, etc. from the preprocessed data, and further extracts time series features through pre-trained deep learning models such as convolutional neural network CNN and long short-term memory network LSTM. The semantic fusion unit uses a unified semantic representation method to fuse the preprocessed data: logs, indicators and link tracking data through the semantic fusion component. In a scenario of an embodiment, the semantic fusion component uses a large model based on BERT or GPT to semantically understand each type of data from different sources: logs, indicators and link tracking, etc., and maps these data to the same vector space to generate a multimodal operation and maintenance data map. Since each data point is embedded in the vector space, an operation and maintenance data map with semantic information is formed. In this embodiment, the large model can be directly fine-tuned using existing ones such as GPT-3, GPT-4, BERT, etc. to adapt to specific operation and maintenance scenarios, wherein the fine-tuning process includes training a corpus containing operation and maintenance related tasks and adjusting the parameters of the model.

[0060] In an embodiment of the present application, after data collection, preprocessing, extraction of time series features, and fusion of the IT system to obtain an operation and maintenance data map with semantic information, the collected data is further analyzed by an anomaly detection module to determine whether there is abnormal data.

[0061] Specifically, the data corresponding to the future trend obtained by the time series analysis unit from the historical data prediction is compared with the above data, and standard statistical methods such as Z-score, control chart, etc. are used to determine whether it is abnormal in combination with the prediction results. The criteria for determining abnormality of time series data include the deviation of the data (the amplitude of change exceeding the threshold) and the matching degree of the historical pattern. In this embodiment, the time series analysis unit pre-trains the historical data using recurrent neural networks such as the long short-term memory network LSTM and the gated recurrent unit GRU, so as to model the time dependency of the data and predict future trends through historical data. By using regression models such as linear regression and recurrent neural networks to analyze the long-term trend of time series data, the future trend predicted by the regression model is compared with the actual data to identify abnormal fluctuations.

[0062] When performing abnormal data analysis, combined with the sliding window mechanism and the dynamic threshold adjustment method, when the data exceeds the predicted range, the data is marked as abnormal data. For each data point, the difference between it and the predicted value is calculated. If the difference exceeds the preset threshold, it is determined to be abnormal data. In this embodiment, for example, the predicted response time of a microservice in the IT system is 3 seconds, and the actual collected response time is 10 seconds. The collected response time data exceeds the predicted value by 7 seconds, and the standard deviation is 2 seconds. Therefore, the deviation between the predicted time and the collected time is 3 times the standard deviation and one second more. Therefore, the response time of the microservice is determined to be abnormal data.

[0063] In the embodiment of the present application, the adjustment of the threshold is based on the dynamic change of the data. A preferred method is to use a static threshold for detection in the initial stage, and then adjust the threshold according to the time series data stream through an adaptive learning mechanism. When false positives or false negatives are continuously detected, the detection threshold is automatically adjusted, such as increasing the threshold width to reduce false positives, or reducing the threshold to increase sensitivity.

[0064] Specifically, the above multimodal operation and maintenance data is fused into a unified time series data stream through a multimodal data detection unit, and joint anomaly detection is performed through an adaptive neural network model, which can process both numerical data and text data. In the scenario of multimodal data, the output of the fusion model (such as anomaly score, classification result) is used for comprehensive judgment. For example, when multiple data sources are abnormal at the same time, the fusion model will give a higher anomaly score.

[0065] In an embodiment of the present application, after the abnormal data is determined, the semantic information corresponding to the abnormal data is further analyzed by an alarm optimization module to determine the priority of the corresponding alarm.

[0066] Specifically, the semantic information corresponding to the abnormal data is analyzed and processed by the semantic analysis unit, such as word segmentation and stop word removal, and the corresponding semantic features are extracted by encoding using a large model such as BERT or GPT; further, the alarm aggregation unit calculates the similarity of multiple abnormal data, and merges the alarms of abnormal data with a similarity greater than a preset similarity threshold into high-level alarms to avoid triggering multiple alarms due to the same problem and reduce redundant information. Further, the priority sorting unit analyzes the acquired semantic features and prioritizes them according to the severity of the semantic expression, the scope of influence, the business priority and other factors. In this embodiment, when sorting, machine learning such as decision trees and SVMs can also be combined to determine the impact of the alarm. In an embodiment of the present application, the timestamp, historical data, alarm type and other features of the abnormal data are also used as reference factors to sort the priority. For example, if an abnormal data is triggered by multiple system components or the triggering frequency is high, the alarm priority of the abnormal data is automatically increased. In this embodiment, the triggering threshold of the alarm is automatically adjusted further according to the real-time status of the IT system. For example, when the IT system load is high, the threshold of the non-critical alarm needs to be relaxed to avoid frequent triggering of unnecessary alarms.

[0067] In an embodiment of the present application, after determining the abnormal data, the root cause analysis module is further used to perform fault reasoning on the abnormal data based on a pre-built knowledge graph, and a fault explanation is generated according to the data corresponding to the abnormal data. Specifically, a knowledge graph of relationships such as "dependency" and "influence" between entities such as services, nodes, components and abnormal data and common problem scenarios is generated in advance according to the architecture of the IT system, historical abnormal data and common problem scenarios through a knowledge graph unit. When a new fault occurs, the graph is updated according to historical data to form a dynamic knowledge base. Further, when the abnormal data is detected, the system state of the IT system is obtained by the reasoning and path analysis unit, and the root cause of the abnormality is located based on the knowledge graph. The reasoning and path analysis unit uses a graph neural network (GNN) or Transformer to perform causal reasoning. Specifically, by analyzing the state of the IT system when the abnormal data is generated, the entities and connection relationships related to the abnormal data are identified, and multi-hop reasoning is performed to trace back from the phenomenon of abnormal data generation to the possible root cause. For example, when a service is abnormal, the state of the resources such as the database, network, hardware, etc. that it depends on is traced back, and the root cause affecting the service is located through the above-mentioned knowledge graph. In this embodiment, after tracing back to the root cause, the abnormal explanation production unit generates an abnormal explanation and a solution based on the abnormal data and the reasoning results of the reasoning and path analysis unit, and outputs the reasoning results and the solution. Specifically, through the reasoning process, a detailed abnormal data explanation is generated in combination with logs and monitoring data, and an actionable solution is generated. Furthermore, through the path in the knowledge graph, the root cause reasoning results are presented to the operation and maintenance personnel, and a variety of repair solutions are provided for them to choose from.

[0068] In this embodiment, after obtaining the explanation of the abnormal data, the automated operation and maintenance decision module generates an automatic repair strategy based on the abnormal data and the fault explanation, and executes the automatic repair strategy to repair the abnormal data. In this embodiment, the strategy and solution unit generates repair measures according to the current health status of the IT system, and optimizes the repair measures based on the reinforcement learning model to the automatic repair strategy; specifically, based on historical operation and maintenance experience and the current IT system status such as CPU usage, memory occupancy, etc., reinforcement learning models such as Q-learning and deep Q network are used to generate repair measures such as restarting services, expanding resources, and traffic switching. The IT system is repaired according to the automatic repair strategy by the repair operation unit. In this embodiment, the reinforcement learning model optimizes the repair measures through continuous training and feedback. By training the model in a simulation environment, after multiple attempts and optimizations, a set of adaptive automatic repair strategies is finally formed. The repair operation unit executes the automatic repair strategy through operation and maintenance automation tools such as Ansible, Kubernetes, and SaltStack, such as automatically restarting fault services, adjusting resource allocation, triggering traffic switching, etc. In this embodiment, the automatic repair strategy is also adjusted according to the current operating status of the IT system by the repair strategy dynamic adjustment unit. For example, if the system load suddenly increases, the repair strategy may switch from expanding resources to optimizing the use of existing resources.

[0069] In an embodiment of the present application, the intelligent operation and maintenance management and alarm system based on a large model agent also includes: an interaction and knowledge management module, which is used to store abnormal data and corresponding processing procedures and repair strategies as knowledge items for query by operation and maintenance personnel. In this embodiment, the human-computer interaction unit outputs the corresponding query results by receiving the query information input by the operation and maintenance personnel. For example, the operation and maintenance personnel input "What is the current system load?", "What happened to the most recent failure?", etc. through the human-computer interaction unit, and the knowledge management unit recommends relevant knowledge items from the stored knowledge items based on the query information for output. Specifically, large models such as GPT-3 and ChatGPT are used to automatically convert questions into structured queries through natural language processing technology, access the operation and maintenance database, monitoring system or log data, and generate corresponding answers for output.

[0070] In this embodiment, the interaction and knowledge management module also automatically records the processing process, solution and experience generated through the knowledge base automatic update unit whenever a new abnormal data is processed, and converts it into knowledge items and stores it in the knowledge base. Furthermore, dynamic knowledge accumulation is formed for the analysis of abnormal data, the reasoning process of the root cause and the effect of the solution.

[0071] In summary, the intelligent operation and maintenance management and alarm system based on large model intelligent agents provided by this application realizes dynamic anomaly detection by deeply integrating logs, indicators and link tracking data, improves anomaly recognition by predicting and analyzing time series, realizes efficient root cause location through knowledge graph and reasoning collaboration, determines the priority of alarms through semantic analysis, and forms a complete closed loop by generating repair strategies and automatically executing them.

[0072] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0073] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0074] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. An intelligent operation and maintenance management and alarm system based on a large model agent, characterized in that: The system comprises: A data collection and fusion module is used to process the raw data collected from the IT system to obtain an operation and maintenance data map, wherein the raw data at least includes: logs, indicators, and link tracking data; an anomaly detection module, configured to analyze the preprocessed data and the time series features to determine abnormal data; An alarm optimization module analyzes the semantic information corresponding to the abnormal data to determine the priority of the corresponding alarm; A root cause analysis module, used to perform fault reasoning on the abnormal data based on a pre-built knowledge graph, and generate a fault explanation according to data corresponding to the abnormal data; The automated operation and maintenance decision module is used to generate an automatic repair strategy based on the abnormal data and the fault explanation, and execute the automatic repair strategy to repair the abnormal data.

2. The intelligent operation and maintenance management and alarm system based on a large model agent according to claim 1 is characterized in that: The data acquisition and fusion module includes: A data collection unit, used to collect raw data from the IT system and store it in a preset standard format, and pre-process the raw data; The semantic fusion unit is used to extract time series features from the preprocessed data and perform semantic fusion processing on the preprocessed data to obtain an operation and maintenance data map.

3. The intelligent operation and maintenance management and alarm system based on a large model agent according to claim 2 is characterized in that: The data acquisition unit comprises: Distributed log collection component, used to obtain log data of IT systems; The indicator collection component is used to obtain indicator data from various levels of the IT system; The link tracking component is used to collect the request flow of the IT system and analyze the performance bottleneck corresponding to the request.

4. The intelligent operation and maintenance management and alarm system based on a large model agent according to claim 2 is characterized in that: The semantic fusion unit comprises: A feature extraction component, used to extract preset features from the preprocessed data according to a preset method, and extract time series features through a preset deep learning model; The semantic fusion component is used to perform semantic fusion processing on the pre-processed data through a unified semantic representation method.

5. The intelligent operation and maintenance management and alarm system based on a large model agent according to claim 1 is characterized in that: The anomaly detection module comprises: The time series analysis unit is used to train and model historical data through a recurrent neural network, and then make predictions, and compare the prediction results with the processed data to detect abnormal data; The multimodal data detection unit is used to fuse the collected data into a unified time series data stream and use an adaptive neural network model to perform joint anomaly detection to determine abnormal data.

6. The intelligent operation and maintenance management and alarm system based on a large model agent according to claim 1 is characterized in that: The alarm optimization module includes: A semantic analysis unit, used for analyzing the semantic information corresponding to the abnormal data to extract semantic features; An alarm aggregation unit is used to calculate the similarity of abnormal data and merge the alarms of abnormal data with similarity greater than a preset threshold into high-level alarms; A priority sorting unit, used to determine the priority of the corresponding alarm according to the semantic features of the abnormal data; The alarm threshold adjustment unit is used to adjust the threshold of abnormal data alarm according to the current state of the IT system.

7. The intelligent operation and maintenance management and alarm system based on a large model agent according to claim 1 is characterized in that: The root cause analysis module includes: Knowledge graph unit, used to build knowledge graphs based on IT system architecture, historical abnormal data, and problem scenarios; A reasoning and path analysis unit, used to obtain the system state of the IT system for reasoning when abnormal data is detected, and locate the root cause of the abnormality based on the knowledge graph; The abnormality explanation generating unit generates an abnormality explanation and a solution based on the abnormal data and the reasoning result of the reasoning and path analyzing unit, and outputs the reasoning result and the solution.

8. The intelligent operation and maintenance management and alarm system based on a large model agent according to claim 1 is characterized in that: The automated operation and maintenance decision module includes: The strategy and solution unit generates repair measures according to the current health status of the IT system, and optimizes the repair measures to an automatic repair strategy based on the reinforcement learning model; A repair operation unit, used to repair the IT system according to the automatic repair strategy, and adjust the automatic repair strategy according to the monitored repair results; The repair strategy dynamic adjustment unit is used to adjust the automatic repair strategy according to the current operating status of the IT system.

9. The intelligent operation and maintenance management and alarm system based on a large model agent according to any one of claims 1 to 8, characterized in that: The system further comprises: The interaction and knowledge management module is used to store abnormal data and the corresponding processing procedures and repair strategies as knowledge items for query by operation and maintenance personnel.

10. The intelligent operation and maintenance management and alarm system based on large model agent according to claim 9 is characterized in that: The interaction and knowledge management module includes: A human-computer interaction unit, used to receive query information input by an operation and maintenance personnel, and output query results corresponding to the query information; The knowledge management unit is used to recommend relevant knowledge items from the stored knowledge items for output according to the query information.

Images